Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 22:48
Behavioral task
behavioral1
Sample
a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe
-
Size
3.7MB
-
MD5
4062f74bf62046004298ebcb3629f2d4
-
SHA1
9f7d9c6ee3f7881ba821fb7e2ab44004cc73afe8
-
SHA256
a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5
-
SHA512
a580ea4e5491135652c054ae252638b57636fea294bd2406d5a7920a5274caeb3c03cc38ab21f29b9fa33e6469e1ae70add16a1c3abf6d7079f7922e3a4f9058
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98+:U6XLq/qPPslzKx/dJg1ErmNd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2196-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-19-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/608-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-108-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/712-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-380-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/316-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/804-656-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1148-663-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1888-715-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1372-721-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1620-726-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1888-737-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2884-738-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-757-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1260-811-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2908-851-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2508-946-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2912 jjjjd.exe 608 djjjv.exe 3056 5dvdv.exe 2652 tnhnbb.exe 2768 ppvpv.exe 2552 pvpvd.exe 2784 5rlfllx.exe 2680 hhhtht.exe 2712 1ntttb.exe 2952 hnhthn.exe 2016 ttttnt.exe 2336 5tbbnn.exe 712 ntnnht.exe 2444 tnhbhb.exe 1864 btbbtt.exe 1752 ppvjv.exe 1872 dvjjj.exe 1612 jpjjv.exe 2596 7rfflrx.exe 1520 9jvdp.exe 2356 jvjpp.exe 1112 3xxxrxx.exe 1640 llfrrxl.exe 1556 btbnbh.exe 1440 bthhnt.exe 1676 rfxxflx.exe 1572 3fxfrxl.exe 796 rlfxfxr.exe 2984 nnnbth.exe 2120 jjdpd.exe 2868 1vvvv.exe 2132 jdvdp.exe 1540 7ddpv.exe 2924 jddpj.exe 680 5dpjp.exe 272 jdpvv.exe 3004 hbnnhb.exe 2748 bnttth.exe 3068 1tnntt.exe 592 7tnntt.exe 2848 bbbhbh.exe 2568 3hnhnh.exe 2656 hhhbnt.exe 2968 lfxffrf.exe 872 dvjdd.exe 1264 ppjdv.exe 1868 bbhtnb.exe 2328 5flrxxf.exe 316 flxrfrx.exe 712 vpdvp.exe 2444 bbnbhn.exe 1780 rlxxlrf.exe 2108 7lffrxf.exe 2716 vpvjd.exe 2280 jjvvv.exe 2532 nhbntn.exe 1044 llflxrf.exe 848 lrrrlrx.exe 1108 vpvpp.exe 2308 tnntbt.exe 832 7bnnnh.exe 1640 5xrrxxf.exe 1556 vvvvj.exe 1532 vpjvd.exe -
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-11.dat upx behavioral1/memory/2912-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016644-17.dat upx behavioral1/files/0x000800000001686c-28.dat upx behavioral1/memory/608-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c73-39.dat upx behavioral1/memory/3056-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cc5-47.dat upx behavioral1/files/0x0007000000016ce7-54.dat upx behavioral1/memory/2768-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001630a-66.dat upx behavioral1/files/0x0007000000016d1d-75.dat upx behavioral1/memory/2680-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d36-83.dat upx behavioral1/files/0x0006000000017491-92.dat upx behavioral1/memory/2712-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175e7-100.dat upx behavioral1/memory/2016-108-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000018669-110.dat upx behavioral1/memory/2336-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001400000001866f-121.dat upx behavioral1/memory/2336-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0011000000018682-130.dat upx behavioral1/memory/2444-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/712-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001868b-138.dat upx behavioral1/memory/1864-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f2-148.dat upx behavioral1/files/0x00050000000186f8-158.dat upx behavioral1/memory/1752-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018731-167.dat upx behavioral1/memory/1872-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018742-175.dat upx behavioral1/files/0x0005000000018781-183.dat upx behavioral1/files/0x000500000001878c-194.dat upx behavioral1/memory/2356-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1520-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bf3-204.dat upx behavioral1/memory/2356-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019227-211.dat upx behavioral1/files/0x000500000001922c-221.dat upx behavioral1/memory/1640-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-228.dat upx behavioral1/files/0x0005000000019261-239.dat upx behavioral1/memory/1440-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926a-248.dat upx behavioral1/memory/1676-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019279-256.dat upx behavioral1/memory/1572-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019284-265.dat upx behavioral1/files/0x00050000000192a9-274.dat upx behavioral1/files/0x0005000000019379-282.dat upx behavioral1/files/0x000500000001939d-289.dat upx behavioral1/memory/1540-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-393-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxlx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2912 2196 a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe 30 PID 2196 wrote to memory of 2912 2196 a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe 30 PID 2196 wrote to memory of 2912 2196 a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe 30 PID 2196 wrote to memory of 2912 2196 a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe 30 PID 2912 wrote to memory of 608 2912 jjjjd.exe 31 PID 2912 wrote to memory of 608 2912 jjjjd.exe 31 PID 2912 wrote to memory of 608 2912 jjjjd.exe 31 PID 2912 wrote to memory of 608 2912 jjjjd.exe 31 PID 608 wrote to memory of 3056 608 djjjv.exe 33 PID 608 wrote to memory of 3056 608 djjjv.exe 33 PID 608 wrote to memory of 3056 608 djjjv.exe 33 PID 608 wrote to memory of 3056 608 djjjv.exe 33 PID 3056 wrote to memory of 2652 3056 5dvdv.exe 34 PID 3056 wrote to memory of 2652 3056 5dvdv.exe 34 PID 3056 wrote to memory of 2652 3056 5dvdv.exe 34 PID 3056 wrote to memory of 2652 3056 5dvdv.exe 34 PID 2652 wrote to memory of 2768 2652 tnhnbb.exe 35 PID 2652 wrote to memory of 2768 2652 tnhnbb.exe 35 PID 2652 wrote to memory of 2768 2652 tnhnbb.exe 35 PID 2652 wrote to memory of 2768 2652 tnhnbb.exe 35 PID 2768 wrote to memory of 2552 2768 ppvpv.exe 36 PID 2768 wrote to memory of 2552 2768 ppvpv.exe 36 PID 2768 wrote to memory of 2552 2768 ppvpv.exe 36 PID 2768 wrote to memory of 2552 2768 ppvpv.exe 36 PID 2552 wrote to memory of 2784 2552 pvpvd.exe 37 PID 2552 wrote to memory of 2784 2552 pvpvd.exe 37 PID 2552 wrote to memory of 2784 2552 pvpvd.exe 37 PID 2552 wrote to memory of 2784 2552 pvpvd.exe 37 PID 2784 wrote to memory of 2680 2784 5rlfllx.exe 38 PID 2784 wrote to memory of 2680 2784 5rlfllx.exe 38 PID 2784 wrote to memory of 2680 2784 5rlfllx.exe 38 PID 2784 wrote to memory of 2680 2784 5rlfllx.exe 38 PID 2680 wrote to memory of 2712 2680 hhhtht.exe 39 PID 2680 wrote to memory of 2712 2680 hhhtht.exe 39 PID 2680 wrote to memory of 2712 2680 hhhtht.exe 39 PID 2680 wrote to memory of 2712 2680 hhhtht.exe 39 PID 2712 wrote to memory of 2952 2712 1ntttb.exe 40 PID 2712 wrote to memory of 2952 2712 1ntttb.exe 40 PID 2712 wrote to memory of 2952 2712 1ntttb.exe 40 PID 2712 wrote to memory of 2952 2712 1ntttb.exe 40 PID 2952 wrote to memory of 2016 2952 hnhthn.exe 41 PID 2952 wrote to memory of 2016 2952 hnhthn.exe 41 PID 2952 wrote to memory of 2016 2952 hnhthn.exe 41 PID 2952 wrote to memory of 2016 2952 hnhthn.exe 41 PID 2016 wrote to memory of 2336 2016 ttttnt.exe 42 PID 2016 wrote to memory of 2336 2016 ttttnt.exe 42 PID 2016 wrote to memory of 2336 2016 ttttnt.exe 42 PID 2016 wrote to memory of 2336 2016 ttttnt.exe 42 PID 2336 wrote to memory of 712 2336 5tbbnn.exe 43 PID 2336 wrote to memory of 712 2336 5tbbnn.exe 43 PID 2336 wrote to memory of 712 2336 5tbbnn.exe 43 PID 2336 wrote to memory of 712 2336 5tbbnn.exe 43 PID 712 wrote to memory of 2444 712 ntnnht.exe 44 PID 712 wrote to memory of 2444 712 ntnnht.exe 44 PID 712 wrote to memory of 2444 712 ntnnht.exe 44 PID 712 wrote to memory of 2444 712 ntnnht.exe 44 PID 2444 wrote to memory of 1864 2444 tnhbhb.exe 45 PID 2444 wrote to memory of 1864 2444 tnhbhb.exe 45 PID 2444 wrote to memory of 1864 2444 tnhbhb.exe 45 PID 2444 wrote to memory of 1864 2444 tnhbhb.exe 45 PID 1864 wrote to memory of 1752 1864 btbbtt.exe 46 PID 1864 wrote to memory of 1752 1864 btbbtt.exe 46 PID 1864 wrote to memory of 1752 1864 btbbtt.exe 46 PID 1864 wrote to memory of 1752 1864 btbbtt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe"C:\Users\Admin\AppData\Local\Temp\a636daaddbc0143f3a01d46230662f125ccdfdce2613643fa9cdb67fa460a9b5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\jjjjd.exec:\jjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\djjjv.exec:\djjjv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\5dvdv.exec:\5dvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\tnhnbb.exec:\tnhnbb.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ppvpv.exec:\ppvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\pvpvd.exec:\pvpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5rlfllx.exec:\5rlfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hhhtht.exec:\hhhtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1ntttb.exec:\1ntttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hnhthn.exec:\hnhthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ttttnt.exec:\ttttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\5tbbnn.exec:\5tbbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\ntnnht.exec:\ntnnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\tnhbhb.exec:\tnhbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\btbbtt.exec:\btbbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\ppvjv.exec:\ppvjv.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dvjjj.exec:\dvjjj.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jpjjv.exec:\jpjjv.exe19⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7rfflrx.exec:\7rfflrx.exe20⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9jvdp.exec:\9jvdp.exe21⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jvjpp.exec:\jvjpp.exe22⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3xxxrxx.exec:\3xxxrxx.exe23⤵
- Executes dropped EXE
PID:1112 -
\??\c:\llfrrxl.exec:\llfrrxl.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\btbnbh.exec:\btbnbh.exe25⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bthhnt.exec:\bthhnt.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1440 -
\??\c:\rfxxflx.exec:\rfxxflx.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3fxfrxl.exec:\3fxfrxl.exe28⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rlfxfxr.exec:\rlfxfxr.exe29⤵
- Executes dropped EXE
PID:796 -
\??\c:\nnnbth.exec:\nnnbth.exe30⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jjdpd.exec:\jjdpd.exe31⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1vvvv.exec:\1vvvv.exe32⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jdvdp.exec:\jdvdp.exe33⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7ddpv.exec:\7ddpv.exe34⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jddpj.exec:\jddpj.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5dpjp.exec:\5dpjp.exe36⤵
- Executes dropped EXE
PID:680 -
\??\c:\jdpvv.exec:\jdpvv.exe37⤵
- Executes dropped EXE
PID:272 -
\??\c:\hbnnhb.exec:\hbnnhb.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bnttth.exec:\bnttth.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1tnntt.exec:\1tnntt.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\7tnntt.exec:\7tnntt.exe41⤵
- Executes dropped EXE
PID:592 -
\??\c:\bbbhbh.exec:\bbbhbh.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3hnhnh.exec:\3hnhnh.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hhhbnt.exec:\hhhbnt.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lfxffrf.exec:\lfxffrf.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dvjdd.exec:\dvjdd.exe46⤵
- Executes dropped EXE
PID:872 -
\??\c:\ppjdv.exec:\ppjdv.exe47⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bbhtnb.exec:\bbhtnb.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5flrxxf.exec:\5flrxxf.exe49⤵
- Executes dropped EXE
PID:2328 -
\??\c:\flxrfrx.exec:\flxrfrx.exe50⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpdvp.exec:\vpdvp.exe51⤵
- Executes dropped EXE
PID:712 -
\??\c:\bbnbhn.exec:\bbnbhn.exe52⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\7lffrxf.exec:\7lffrxf.exe54⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vpvjd.exec:\vpvjd.exe55⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jjvvv.exec:\jjvvv.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\nhbntn.exec:\nhbntn.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\llflxrf.exec:\llflxrf.exe58⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrrrlrx.exec:\lrrrlrx.exe59⤵
- Executes dropped EXE
PID:848 -
\??\c:\vpvpp.exec:\vpvpp.exe60⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tnntbt.exec:\tnntbt.exe61⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7bnnnh.exec:\7bnnnh.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:832 -
\??\c:\5xrrxxf.exec:\5xrrxxf.exe63⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvvvj.exec:\vvvvj.exe64⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vpjvd.exec:\vpjvd.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tbbttn.exec:\tbbttn.exe66⤵PID:920
-
\??\c:\ththnt.exec:\ththnt.exe67⤵PID:2584
-
\??\c:\3lflxxf.exec:\3lflxxf.exe68⤵PID:1260
-
\??\c:\1dvvd.exec:\1dvvd.exe69⤵
- System Location Discovery: System Language Discovery
PID:1428 -
\??\c:\pjdpv.exec:\pjdpv.exe70⤵PID:1792
-
\??\c:\fffrlxf.exec:\fffrlxf.exe71⤵PID:2372
-
\??\c:\dpdjp.exec:\dpdjp.exe72⤵PID:1876
-
\??\c:\7ttbnb.exec:\7ttbnb.exe73⤵PID:1288
-
\??\c:\btnntb.exec:\btnntb.exe74⤵PID:2404
-
\??\c:\rlrfflf.exec:\rlrfflf.exe75⤵PID:2396
-
\??\c:\lfxfrlr.exec:\lfxfrlr.exe76⤵
- System Location Discovery: System Language Discovery
PID:1476 -
\??\c:\vpdjp.exec:\vpdjp.exe77⤵PID:2924
-
\??\c:\jddjj.exec:\jddjj.exe78⤵PID:2736
-
\??\c:\1nnntt.exec:\1nnntt.exe79⤵PID:3032
-
\??\c:\lfrxffl.exec:\lfrxffl.exe80⤵PID:2188
-
\??\c:\jdppv.exec:\jdppv.exe81⤵PID:1516
-
\??\c:\jjpjv.exec:\jjpjv.exe82⤵PID:2700
-
\??\c:\nhbnth.exec:\nhbnth.exe83⤵PID:2780
-
\??\c:\ffxxrxf.exec:\ffxxrxf.exe84⤵PID:2824
-
\??\c:\fllfrfx.exec:\fllfrfx.exe85⤵PID:804
-
\??\c:\vdvdj.exec:\vdvdj.exe86⤵PID:2728
-
\??\c:\hbnnnb.exec:\hbnnnb.exe87⤵PID:2588
-
\??\c:\hbbhnh.exec:\hbbhnh.exe88⤵PID:2940
-
\??\c:\bbbhbh.exec:\bbbhbh.exe89⤵PID:1148
-
\??\c:\lflxllf.exec:\lflxllf.exe90⤵PID:2016
-
\??\c:\5djvd.exec:\5djvd.exe91⤵PID:1868
-
\??\c:\ppppv.exec:\ppppv.exe92⤵PID:1680
-
\??\c:\nnhbnb.exec:\nnhbnb.exe93⤵PID:316
-
\??\c:\1tthbt.exec:\1tthbt.exe94⤵PID:2008
-
\??\c:\frxfflr.exec:\frxfflr.exe95⤵PID:1864
-
\??\c:\rrfxrxl.exec:\rrfxrxl.exe96⤵PID:2000
-
\??\c:\jvdjj.exec:\jvdjj.exe97⤵PID:1888
-
\??\c:\ppjvj.exec:\ppjvj.exe98⤵PID:1372
-
\??\c:\hhnhtb.exec:\hhnhtb.exe99⤵PID:1620
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe100⤵PID:1364
-
\??\c:\lfxfflx.exec:\lfxfflx.exe101⤵PID:2884
-
\??\c:\vvpvp.exec:\vvpvp.exe102⤵PID:1520
-
\??\c:\vpjvp.exec:\vpjvp.exe103⤵PID:1272
-
\??\c:\ttnbnb.exec:\ttnbnb.exe104⤵
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\bthntb.exec:\bthntb.exe105⤵PID:1668
-
\??\c:\3lxlflx.exec:\3lxlflx.exe106⤵PID:1800
-
\??\c:\9flrlrl.exec:\9flrlrl.exe107⤵PID:1556
-
\??\c:\pjddj.exec:\pjddj.exe108⤵PID:1484
-
\??\c:\7pdjv.exec:\7pdjv.exe109⤵PID:108
-
\??\c:\bbbhbn.exec:\bbbhbn.exe110⤵PID:2240
-
\??\c:\btnbnb.exec:\btnbnb.exe111⤵PID:1260
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe112⤵PID:2224
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe113⤵PID:2040
-
\??\c:\jdvdj.exec:\jdvdj.exe114⤵PID:1436
-
\??\c:\ttntbb.exec:\ttntbb.exe115⤵PID:2868
-
\??\c:\9nhtbb.exec:\9nhtbb.exe116⤵PID:2628
-
\??\c:\rlflfff.exec:\rlflfff.exe117⤵PID:2908
-
\??\c:\7thnth.exec:\7thnth.exe118⤵PID:1736
-
\??\c:\7tnnnt.exec:\7tnnnt.exe119⤵PID:932
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe120⤵PID:2924
-
\??\c:\xxllxrx.exec:\xxllxrx.exe121⤵PID:272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-