Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe
-
Size
453KB
-
MD5
d75ae541ae76388d0b22fed138fed1e0
-
SHA1
058745d3300e6b476fe7e79dd7bfe96d95616549
-
SHA256
c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4
-
SHA512
65c50c4bbd205768012ca5f2d6d28aa2c70d6497c19e0d35634b798994e1dc1a929178cdc77a998895d68c9978f503707e1abc21060804470a9fe74279d46c33
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/1984-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-47-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2500-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-88-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/588-136-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1440-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-387-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1256-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-485-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1096-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-539-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-593-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1784-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1048-631-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1232-423-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-408-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2504-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-293-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2136-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-260-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2488-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-221-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1700-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-183-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1440-164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-127-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/640-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-124-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2988-78-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-812-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-864-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1148 nbntbh.exe 2320 xrxxlrl.exe 2240 jvdpj.exe 2500 lfrfrrf.exe 2836 nnbhtb.exe 1736 ttntnb.exe 2988 xlxfllx.exe 2644 rfxxflr.exe 2352 5thntb.exe 2688 ppjpd.exe 2288 rlrrffl.exe 640 nhbhnb.exe 588 dvjpv.exe 968 lxxxrrl.exe 2916 ntnttt.exe 1440 dpjjv.exe 324 fllllrx.exe 2444 tntthh.exe 2372 9jddp.exe 1940 1lxxflr.exe 1700 nhhnbh.exe 568 jdvvj.exe 1160 9vjpd.exe 3020 5rlrrxx.exe 612 9jjjv.exe 2488 3vjpv.exe 2416 9fflffx.exe 2548 lxrrffr.exe 2136 9vpvd.exe 1204 xrlrflx.exe 2324 tnhhtb.exe 2348 vppvd.exe 888 llxlrrf.exe 2772 tnbbnn.exe 3004 btbhnt.exe 2824 5vvdj.exe 2816 rlfrflr.exe 2652 ffrllrr.exe 2768 nnbbnn.exe 2620 dvjpd.exe 2680 jdvdj.exe 2728 llfrlrf.exe 2276 nhhbnt.exe 2504 bttbhh.exe 1256 dvvvj.exe 1644 jvjpp.exe 780 xlllrxr.exe 2972 xxrfflf.exe 1232 3bnnbb.exe 2336 pjdjv.exe 556 ddvdp.exe 2216 1fllxxx.exe 2256 lfxxfxl.exe 1512 tntbnt.exe 1540 hhbhnt.exe 316 dddjv.exe 1696 vppvv.exe 2120 xrlxlfx.exe 2368 1xlrxfr.exe 2564 nnbhnh.exe 1096 5vddp.exe 1520 5xllxxl.exe 1784 lfrfrxl.exe 2496 nhhnbb.exe -
resource yara_rule behavioral1/memory/1984-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-423-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2504-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-864-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1148 1984 c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe 30 PID 1984 wrote to memory of 1148 1984 c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe 30 PID 1984 wrote to memory of 1148 1984 c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe 30 PID 1984 wrote to memory of 1148 1984 c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe 30 PID 1148 wrote to memory of 2320 1148 nbntbh.exe 31 PID 1148 wrote to memory of 2320 1148 nbntbh.exe 31 PID 1148 wrote to memory of 2320 1148 nbntbh.exe 31 PID 1148 wrote to memory of 2320 1148 nbntbh.exe 31 PID 2320 wrote to memory of 2240 2320 xrxxlrl.exe 32 PID 2320 wrote to memory of 2240 2320 xrxxlrl.exe 32 PID 2320 wrote to memory of 2240 2320 xrxxlrl.exe 32 PID 2320 wrote to memory of 2240 2320 xrxxlrl.exe 32 PID 2240 wrote to memory of 2500 2240 jvdpj.exe 102 PID 2240 wrote to memory of 2500 2240 jvdpj.exe 102 PID 2240 wrote to memory of 2500 2240 jvdpj.exe 102 PID 2240 wrote to memory of 2500 2240 jvdpj.exe 102 PID 2500 wrote to memory of 2836 2500 lfrfrrf.exe 34 PID 2500 wrote to memory of 2836 2500 lfrfrrf.exe 34 PID 2500 wrote to memory of 2836 2500 lfrfrrf.exe 34 PID 2500 wrote to memory of 2836 2500 lfrfrrf.exe 34 PID 2836 wrote to memory of 1736 2836 nnbhtb.exe 35 PID 2836 wrote to memory of 1736 2836 nnbhtb.exe 35 PID 2836 wrote to memory of 1736 2836 nnbhtb.exe 35 PID 2836 wrote to memory of 1736 2836 nnbhtb.exe 35 PID 1736 wrote to memory of 2988 1736 ttntnb.exe 36 PID 1736 wrote to memory of 2988 1736 ttntnb.exe 36 PID 1736 wrote to memory of 2988 1736 ttntnb.exe 36 PID 1736 wrote to memory of 2988 1736 ttntnb.exe 36 PID 2988 wrote to memory of 2644 2988 xlxfllx.exe 37 PID 2988 wrote to memory of 2644 2988 xlxfllx.exe 37 PID 2988 wrote to memory of 2644 2988 xlxfllx.exe 37 PID 2988 wrote to memory of 2644 2988 xlxfllx.exe 37 PID 2644 wrote to memory of 2352 2644 rfxxflr.exe 38 PID 2644 wrote to memory of 2352 2644 rfxxflr.exe 38 PID 2644 wrote to memory of 2352 2644 rfxxflr.exe 38 PID 2644 wrote to memory of 2352 2644 rfxxflr.exe 38 PID 2352 wrote to memory of 2688 2352 5thntb.exe 39 PID 2352 wrote to memory of 2688 2352 5thntb.exe 39 PID 2352 wrote to memory of 2688 2352 5thntb.exe 39 PID 2352 wrote to memory of 2688 2352 5thntb.exe 39 PID 2688 wrote to memory of 2288 2688 ppjpd.exe 40 PID 2688 wrote to memory of 2288 2688 ppjpd.exe 40 PID 2688 wrote to memory of 2288 2688 ppjpd.exe 40 PID 2688 wrote to memory of 2288 2688 ppjpd.exe 40 PID 2288 wrote to memory of 640 2288 rlrrffl.exe 41 PID 2288 wrote to memory of 640 2288 rlrrffl.exe 41 PID 2288 wrote to memory of 640 2288 rlrrffl.exe 41 PID 2288 wrote to memory of 640 2288 rlrrffl.exe 41 PID 640 wrote to memory of 588 640 nhbhnb.exe 42 PID 640 wrote to memory of 588 640 nhbhnb.exe 42 PID 640 wrote to memory of 588 640 nhbhnb.exe 42 PID 640 wrote to memory of 588 640 nhbhnb.exe 42 PID 588 wrote to memory of 968 588 dvjpv.exe 43 PID 588 wrote to memory of 968 588 dvjpv.exe 43 PID 588 wrote to memory of 968 588 dvjpv.exe 43 PID 588 wrote to memory of 968 588 dvjpv.exe 43 PID 968 wrote to memory of 2916 968 lxxxrrl.exe 44 PID 968 wrote to memory of 2916 968 lxxxrrl.exe 44 PID 968 wrote to memory of 2916 968 lxxxrrl.exe 44 PID 968 wrote to memory of 2916 968 lxxxrrl.exe 44 PID 2916 wrote to memory of 1440 2916 ntnttt.exe 45 PID 2916 wrote to memory of 1440 2916 ntnttt.exe 45 PID 2916 wrote to memory of 1440 2916 ntnttt.exe 45 PID 2916 wrote to memory of 1440 2916 ntnttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe"C:\Users\Admin\AppData\Local\Temp\c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\nbntbh.exec:\nbntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\xrxxlrl.exec:\xrxxlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jvdpj.exec:\jvdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nnbhtb.exec:\nnbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ttntnb.exec:\ttntnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\xlxfllx.exec:\xlxfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rfxxflr.exec:\rfxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\5thntb.exec:\5thntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ppjpd.exec:\ppjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rlrrffl.exec:\rlrrffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\nhbhnb.exec:\nhbhnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\dvjpv.exec:\dvjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\ntnttt.exec:\ntnttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dpjjv.exec:\dpjjv.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\fllllrx.exec:\fllllrx.exe18⤵
- Executes dropped EXE
PID:324 -
\??\c:\tntthh.exec:\tntthh.exe19⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9jddp.exec:\9jddp.exe20⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1lxxflr.exec:\1lxxflr.exe21⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhhnbh.exec:\nhhnbh.exe22⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jdvvj.exec:\jdvvj.exe23⤵
- Executes dropped EXE
PID:568 -
\??\c:\9vjpd.exec:\9vjpd.exe24⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5rlrrxx.exec:\5rlrrxx.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9jjjv.exec:\9jjjv.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:612 -
\??\c:\3vjpv.exec:\3vjpv.exe27⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9fflffx.exec:\9fflffx.exe28⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lxrrffr.exec:\lxrrffr.exe29⤵
- Executes dropped EXE
PID:2548 -
\??\c:\9vpvd.exec:\9vpvd.exe30⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrlrflx.exec:\xrlrflx.exe31⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tnhhtb.exec:\tnhhtb.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vppvd.exec:\vppvd.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\llxlrrf.exec:\llxlrrf.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\tnbbnn.exec:\tnbbnn.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\btbhnt.exec:\btbhnt.exe36⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5vvdj.exec:\5vvdj.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\rlfrflr.exec:\rlfrflr.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ffrllrr.exec:\ffrllrr.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nnbbnn.exec:\nnbbnn.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dvjpd.exec:\dvjpd.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jdvdj.exec:\jdvdj.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\llfrlrf.exec:\llfrlrf.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nhhbnt.exec:\nhhbnt.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bttbhh.exec:\bttbhh.exe45⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvvvj.exec:\dvvvj.exe46⤵
- Executes dropped EXE
PID:1256 -
\??\c:\jvjpp.exec:\jvjpp.exe47⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xlllrxr.exec:\xlllrxr.exe48⤵
- Executes dropped EXE
PID:780 -
\??\c:\xxrfflf.exec:\xxrfflf.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3bnnbb.exec:\3bnnbb.exe50⤵
- Executes dropped EXE
PID:1232 -
\??\c:\pjdjv.exec:\pjdjv.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ddvdp.exec:\ddvdp.exe52⤵
- Executes dropped EXE
PID:556 -
\??\c:\1fllxxx.exec:\1fllxxx.exe53⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lfxxfxl.exec:\lfxxfxl.exe54⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tntbnt.exec:\tntbnt.exe55⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hhbhnt.exec:\hhbhnt.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dddjv.exec:\dddjv.exe57⤵
- Executes dropped EXE
PID:316 -
\??\c:\vppvv.exec:\vppvv.exe58⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xrlxlfx.exec:\xrlxlfx.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1xlrxfr.exec:\1xlrxfr.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nnbhnh.exec:\nnbhnh.exe61⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5vddp.exec:\5vddp.exe62⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5xllxxl.exec:\5xllxxl.exe63⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nhhnbb.exec:\nhhnbb.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hnhthn.exec:\hnhthn.exe66⤵PID:2548
-
\??\c:\dvjjj.exec:\dvjjj.exe67⤵PID:1816
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe68⤵PID:1604
-
\??\c:\frlxlrl.exec:\frlxlrl.exe69⤵PID:1808
-
\??\c:\hbnbbh.exec:\hbnbbh.exe70⤵PID:2404
-
\??\c:\bhnthb.exec:\bhnthb.exe71⤵PID:2452
-
\??\c:\ddvdj.exec:\ddvdj.exe72⤵PID:2244
-
\??\c:\frxlrfl.exec:\frxlrfl.exe73⤵PID:1608
-
\??\c:\9rxfrrf.exec:\9rxfrrf.exe74⤵PID:2500
-
\??\c:\hbhhbh.exec:\hbhhbh.exe75⤵PID:2472
-
\??\c:\bnhntt.exec:\bnhntt.exe76⤵PID:2840
-
\??\c:\jjvdv.exec:\jjvdv.exe77⤵PID:1048
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe78⤵PID:2624
-
\??\c:\ffrlxxf.exec:\ffrlxxf.exe79⤵PID:2780
-
\??\c:\bbttnt.exec:\bbttnt.exe80⤵PID:2332
-
\??\c:\ddddv.exec:\ddddv.exe81⤵PID:2616
-
\??\c:\7xxrxrl.exec:\7xxrxrl.exe82⤵PID:2664
-
\??\c:\9bbhhb.exec:\9bbhhb.exe83⤵PID:3064
-
\??\c:\vpjpd.exec:\vpjpd.exe84⤵PID:596
-
\??\c:\xrxlrrr.exec:\xrxlrrr.exe85⤵PID:640
-
\??\c:\bnbbhh.exec:\bnbbhh.exe86⤵PID:792
-
\??\c:\vpdjp.exec:\vpdjp.exe87⤵PID:1376
-
\??\c:\lffxxxx.exec:\lffxxxx.exe88⤵PID:780
-
\??\c:\ttbnnt.exec:\ttbnnt.exe89⤵PID:2964
-
\??\c:\7pdvv.exec:\7pdvv.exe90⤵PID:2224
-
\??\c:\rxrfrff.exec:\rxrfrff.exe91⤵PID:1440
-
\??\c:\nhntbt.exec:\nhntbt.exe92⤵PID:2656
-
\??\c:\rfxfllr.exec:\rfxfllr.exe93⤵PID:1956
-
\??\c:\3bhnbt.exec:\3bhnbt.exe94⤵PID:1672
-
\??\c:\3jpdp.exec:\3jpdp.exe95⤵PID:1592
-
\??\c:\hhntht.exec:\hhntht.exe96⤵PID:764
-
\??\c:\btbnhb.exec:\btbnhb.exe97⤵PID:1588
-
\??\c:\fffrrrf.exec:\fffrrrf.exe98⤵PID:968
-
\??\c:\5lxxxxf.exec:\5lxxxxf.exe99⤵PID:568
-
\??\c:\btnbnt.exec:\btnbnt.exe100⤵PID:2600
-
\??\c:\9thhnt.exec:\9thhnt.exe101⤵PID:2940
-
\??\c:\flflrxf.exec:\flflrxf.exe102⤵PID:2928
-
\??\c:\btnnbb.exec:\btnnbb.exe103⤵PID:1996
-
\??\c:\djjvj.exec:\djjvj.exe104⤵PID:1716
-
\??\c:\jjdjp.exec:\jjdjp.exe105⤵PID:2408
-
\??\c:\xllxxlf.exec:\xllxxlf.exe106⤵PID:1224
-
\??\c:\bnbbbt.exec:\bnbbbt.exe107⤵PID:2116
-
\??\c:\nhtbbh.exec:\nhtbbh.exe108⤵PID:3036
-
\??\c:\9dpvv.exec:\9dpvv.exe109⤵PID:2380
-
\??\c:\xxlrffr.exec:\xxlrffr.exe110⤵PID:1148
-
\??\c:\nntbnt.exec:\nntbnt.exe111⤵PID:2872
-
\??\c:\1hbthb.exec:\1hbthb.exe112⤵PID:1400
-
\??\c:\jvjjj.exec:\jvjjj.exe113⤵PID:1568
-
\??\c:\jjdjv.exec:\jjdjv.exe114⤵PID:2828
-
\??\c:\7lrrrll.exec:\7lrrrll.exe115⤵PID:2876
-
\??\c:\1thnhn.exec:\1thnhn.exe116⤵PID:2820
-
\??\c:\7pjjj.exec:\7pjjj.exe117⤵PID:2384
-
\??\c:\vpjvd.exec:\vpjvd.exe118⤵PID:1736
-
\??\c:\xlxfrxr.exec:\xlxfrxr.exe119⤵PID:2832
-
\??\c:\9tntbt.exec:\9tntbt.exe120⤵PID:2844
-
\??\c:\dpdpv.exec:\dpdpv.exe121⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-