Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:41
Behavioral task
behavioral1
Sample
793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe
-
Size
345KB
-
MD5
12c8264dcad70c360e85b595f0eacdb0
-
SHA1
ec9f700846c98b8ff0887b51fd72f8e853733746
-
SHA256
793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12
-
SHA512
f677805ba0ee473024763331a7e075e1c0a6b0e98e08afd8a51e51210a009c26deeeb43ae4c28168a36f38d4d5ee3dbf662e3bc191cf9bbb8043e2ca1bb1046c
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYAb:R4wFHoS3WXZshJX2VGdb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2024-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/108-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-52-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2780-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-119-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1048-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-149-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1180-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-182-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2248-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-216-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/344-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/284-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-292-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1056-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-334-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2732-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-546-0x0000000076F40000-0x000000007705F000-memory.dmp family_blackmoon behavioral1/memory/2156-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-752-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2216-837-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-884-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2688-905-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2496-909-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3044-925-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1848-935-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1100-988-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2952-1134-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-1140-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3040-1176-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/532-1311-0x0000000076F40000-0x000000007705F000-memory.dmp family_blackmoon behavioral1/memory/532-7912-0x0000000076F40000-0x000000007705F000-memory.dmp family_blackmoon behavioral1/memory/532-11841-0x0000000076F40000-0x000000007705F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 04206.exe 1616 20442.exe 2032 hhbntb.exe 2300 frffffl.exe 2824 20280.exe 2776 424626.exe 2864 ddppv.exe 2780 042462.exe 2068 nhttnn.exe 2680 ppjvv.exe 2860 86880.exe 2684 a2002.exe 1048 fxrxlfl.exe 2628 082240.exe 536 tnnhtb.exe 2292 nhtbnn.exe 1180 vpvvd.exe 1804 642404.exe 1136 xlllxxx.exe 2248 86028.exe 2544 64284.exe 2444 420688.exe 1272 ntnthn.exe 2260 0862828.exe 2044 5xlrllr.exe 1564 rlffrrx.exe 344 9htntt.exe 2272 048444.exe 1328 5rlfllr.exe 284 pjvpp.exe 2148 jdjpv.exe 776 48028.exe 2028 xrffrrl.exe 2080 8680284.exe 2404 04620.exe 352 o688444.exe 2328 btnbbh.exe 1056 dvjpd.exe 1696 bhnntb.exe 2724 dvjdj.exe 2464 pjppp.exe 3068 3llrfff.exe 2732 86888.exe 2824 3thhnn.exe 2764 k06666.exe 772 7vjdj.exe 2244 664624.exe 2872 0804666.exe 2096 3xrllll.exe 2004 1vddp.exe 2704 nhbbbh.exe 2476 5tbhhb.exe 2688 nbnbnn.exe 1316 e64060.exe 2336 26446.exe 2992 3bhttt.exe 2728 9ddjd.exe 2292 dvjpv.exe 1752 m4220.exe 1320 ttnbnt.exe 2480 60826.exe 2276 bhbhnt.exe 2568 thtntn.exe 1184 9pvvd.exe -
resource yara_rule behavioral1/memory/108-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/108-3-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/files/0x0008000000016875-17.dat upx behavioral1/memory/2024-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001202c-10.dat upx behavioral1/memory/108-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1616-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c66-25.dat upx behavioral1/memory/2032-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c80-33.dat upx behavioral1/files/0x0007000000016c88-42.dat upx behavioral1/memory/2824-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2300-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cd7-53.dat upx behavioral1/files/0x0007000000016cf5-60.dat upx behavioral1/files/0x0008000000016d3a-69.dat upx behavioral1/memory/2780-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001749c-76.dat upx behavioral1/memory/2780-75-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2068-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001755b-84.dat upx behavioral1/files/0x0005000000018686-93.dat upx behavioral1/memory/2680-92-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2680-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186e7-102.dat upx behavioral1/memory/2860-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016332-109.dat upx behavioral1/memory/1048-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ed-117.dat upx behavioral1/memory/2628-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/536-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f4-135.dat upx behavioral1/files/0x00050000000186f1-128.dat upx behavioral1/files/0x0005000000018704-144.dat upx behavioral1/memory/1180-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2292-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018739-153.dat upx behavioral1/files/0x0005000000018744-160.dat upx behavioral1/memory/2248-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878e-168.dat upx behavioral1/memory/2248-176-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000187a8-179.dat upx behavioral1/files/0x0006000000018b4e-187.dat upx behavioral1/memory/2544-186-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2248-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1272-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c16-196.dat upx behavioral1/memory/2444-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019246-204.dat upx behavioral1/memory/2260-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019250-213.dat upx behavioral1/files/0x0005000000019269-220.dat upx behavioral1/files/0x0005000000019278-228.dat upx behavioral1/files/0x0005000000019284-237.dat upx behavioral1/memory/344-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019297-243.dat upx behavioral1/files/0x000500000001933f-250.dat upx behavioral1/files/0x0005000000019360-260.dat upx behavioral1/memory/284-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2148-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a6-267.dat upx behavioral1/memory/776-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-280-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0862440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 108 wrote to memory of 2024 108 793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe 30 PID 108 wrote to memory of 2024 108 793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe 30 PID 108 wrote to memory of 2024 108 793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe 30 PID 108 wrote to memory of 2024 108 793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe 30 PID 2024 wrote to memory of 1616 2024 04206.exe 31 PID 2024 wrote to memory of 1616 2024 04206.exe 31 PID 2024 wrote to memory of 1616 2024 04206.exe 31 PID 2024 wrote to memory of 1616 2024 04206.exe 31 PID 1616 wrote to memory of 2032 1616 20442.exe 32 PID 1616 wrote to memory of 2032 1616 20442.exe 32 PID 1616 wrote to memory of 2032 1616 20442.exe 32 PID 1616 wrote to memory of 2032 1616 20442.exe 32 PID 2032 wrote to memory of 2300 2032 hhbntb.exe 33 PID 2032 wrote to memory of 2300 2032 hhbntb.exe 33 PID 2032 wrote to memory of 2300 2032 hhbntb.exe 33 PID 2032 wrote to memory of 2300 2032 hhbntb.exe 33 PID 2300 wrote to memory of 2824 2300 frffffl.exe 34 PID 2300 wrote to memory of 2824 2300 frffffl.exe 34 PID 2300 wrote to memory of 2824 2300 frffffl.exe 34 PID 2300 wrote to memory of 2824 2300 frffffl.exe 34 PID 2824 wrote to memory of 2776 2824 20280.exe 35 PID 2824 wrote to memory of 2776 2824 20280.exe 35 PID 2824 wrote to memory of 2776 2824 20280.exe 35 PID 2824 wrote to memory of 2776 2824 20280.exe 35 PID 2776 wrote to memory of 2864 2776 424626.exe 36 PID 2776 wrote to memory of 2864 2776 424626.exe 36 PID 2776 wrote to memory of 2864 2776 424626.exe 36 PID 2776 wrote to memory of 2864 2776 424626.exe 36 PID 2864 wrote to memory of 2780 2864 ddppv.exe 37 PID 2864 wrote to memory of 2780 2864 ddppv.exe 37 PID 2864 wrote to memory of 2780 2864 ddppv.exe 37 PID 2864 wrote to memory of 2780 2864 ddppv.exe 37 PID 2780 wrote to memory of 2068 2780 042462.exe 38 PID 2780 wrote to memory of 2068 2780 042462.exe 38 PID 2780 wrote to memory of 2068 2780 042462.exe 38 PID 2780 wrote to memory of 2068 2780 042462.exe 38 PID 2068 wrote to memory of 2680 2068 nhttnn.exe 39 PID 2068 wrote to memory of 2680 2068 nhttnn.exe 39 PID 2068 wrote to memory of 2680 2068 nhttnn.exe 39 PID 2068 wrote to memory of 2680 2068 nhttnn.exe 39 PID 2680 wrote to memory of 2860 2680 ppjvv.exe 40 PID 2680 wrote to memory of 2860 2680 ppjvv.exe 40 PID 2680 wrote to memory of 2860 2680 ppjvv.exe 40 PID 2680 wrote to memory of 2860 2680 ppjvv.exe 40 PID 2860 wrote to memory of 2684 2860 86880.exe 41 PID 2860 wrote to memory of 2684 2860 86880.exe 41 PID 2860 wrote to memory of 2684 2860 86880.exe 41 PID 2860 wrote to memory of 2684 2860 86880.exe 41 PID 2684 wrote to memory of 1048 2684 a2002.exe 42 PID 2684 wrote to memory of 1048 2684 a2002.exe 42 PID 2684 wrote to memory of 1048 2684 a2002.exe 42 PID 2684 wrote to memory of 1048 2684 a2002.exe 42 PID 1048 wrote to memory of 2628 1048 fxrxlfl.exe 43 PID 1048 wrote to memory of 2628 1048 fxrxlfl.exe 43 PID 1048 wrote to memory of 2628 1048 fxrxlfl.exe 43 PID 1048 wrote to memory of 2628 1048 fxrxlfl.exe 43 PID 2628 wrote to memory of 536 2628 082240.exe 44 PID 2628 wrote to memory of 536 2628 082240.exe 44 PID 2628 wrote to memory of 536 2628 082240.exe 44 PID 2628 wrote to memory of 536 2628 082240.exe 44 PID 536 wrote to memory of 2292 536 tnnhtb.exe 45 PID 536 wrote to memory of 2292 536 tnnhtb.exe 45 PID 536 wrote to memory of 2292 536 tnnhtb.exe 45 PID 536 wrote to memory of 2292 536 tnnhtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe"C:\Users\Admin\AppData\Local\Temp\793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\04206.exec:\04206.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\20442.exec:\20442.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\hhbntb.exec:\hhbntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\frffffl.exec:\frffffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\20280.exec:\20280.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\424626.exec:\424626.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ddppv.exec:\ddppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\042462.exec:\042462.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhttnn.exec:\nhttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ppjvv.exec:\ppjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\86880.exec:\86880.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\a2002.exec:\a2002.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\fxrxlfl.exec:\fxrxlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\082240.exec:\082240.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\tnnhtb.exec:\tnnhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nhtbnn.exec:\nhtbnn.exe17⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vpvvd.exec:\vpvvd.exe18⤵
- Executes dropped EXE
PID:1180 -
\??\c:\642404.exec:\642404.exe19⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xlllxxx.exec:\xlllxxx.exe20⤵
- Executes dropped EXE
PID:1136 -
\??\c:\86028.exec:\86028.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\64284.exec:\64284.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\420688.exec:\420688.exe23⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ntnthn.exec:\ntnthn.exe24⤵
- Executes dropped EXE
PID:1272 -
\??\c:\0862828.exec:\0862828.exe25⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5xlrllr.exec:\5xlrllr.exe26⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlffrrx.exec:\rlffrrx.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9htntt.exec:\9htntt.exe28⤵
- Executes dropped EXE
PID:344 -
\??\c:\048444.exec:\048444.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5rlfllr.exec:\5rlfllr.exe30⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pjvpp.exec:\pjvpp.exe31⤵
- Executes dropped EXE
PID:284 -
\??\c:\jdjpv.exec:\jdjpv.exe32⤵
- Executes dropped EXE
PID:2148 -
\??\c:\48028.exec:\48028.exe33⤵
- Executes dropped EXE
PID:776 -
\??\c:\xrffrrl.exec:\xrffrrl.exe34⤵
- Executes dropped EXE
PID:2028 -
\??\c:\8680284.exec:\8680284.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\04620.exec:\04620.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\o688444.exec:\o688444.exe37⤵
- Executes dropped EXE
PID:352 -
\??\c:\btnbbh.exec:\btnbbh.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dvjpd.exec:\dvjpd.exe39⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bhnntb.exec:\bhnntb.exe40⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvjdj.exec:\dvjdj.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pjppp.exec:\pjppp.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3llrfff.exec:\3llrfff.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\86888.exec:\86888.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3thhnn.exec:\3thhnn.exe45⤵
- Executes dropped EXE
PID:2824 -
\??\c:\k06666.exec:\k06666.exe46⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7vjdj.exec:\7vjdj.exe47⤵
- Executes dropped EXE
PID:772 -
\??\c:\664624.exec:\664624.exe48⤵
- Executes dropped EXE
PID:2244 -
\??\c:\0804666.exec:\0804666.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3xrllll.exec:\3xrllll.exe50⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1vddp.exec:\1vddp.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nhbbbh.exec:\nhbbbh.exe52⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5tbhhb.exec:\5tbhhb.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nbnbnn.exec:\nbnbnn.exe54⤵
- Executes dropped EXE
PID:2688 -
\??\c:\e64060.exec:\e64060.exe55⤵
- Executes dropped EXE
PID:1316 -
\??\c:\26446.exec:\26446.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3bhttt.exec:\3bhttt.exe57⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9ddjd.exec:\9ddjd.exe58⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvjpv.exec:\dvjpv.exe59⤵
- Executes dropped EXE
PID:2292 -
\??\c:\m4220.exec:\m4220.exe60⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ttnbnt.exec:\ttnbnt.exe61⤵
- Executes dropped EXE
PID:1320 -
\??\c:\60826.exec:\60826.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bhbhnt.exec:\bhbhnt.exe63⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thtntn.exec:\thtntn.exe64⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9pvvd.exec:\9pvvd.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\m8406.exec:\m8406.exe66⤵PID:1960
-
\??\c:\684888.exec:\684888.exe67⤵PID:2572
-
\??\c:\o646228.exec:\o646228.exe68⤵PID:2200
-
\??\c:\208248.exec:\208248.exe69⤵PID:384
-
\??\c:\i206440.exec:\i206440.exe70⤵PID:1104
-
\??\c:\rrflxfl.exec:\rrflxfl.exe71⤵PID:632
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe72⤵PID:976
-
\??\c:\o828440.exec:\o828440.exe73⤵PID:2008
-
\??\c:\1jdjv.exec:\1jdjv.exe74⤵PID:832
-
\??\c:\ttnhht.exec:\ttnhht.exe75⤵PID:1548
-
\??\c:\jdvjv.exec:\jdvjv.exe76⤵PID:1576
-
\??\c:\pdvjd.exec:\pdvjd.exe77⤵PID:668
-
\??\c:\26486.exec:\26486.exe78⤵PID:1968
-
\??\c:\8262840.exec:\8262840.exe79⤵PID:2208
-
\??\c:\tnbntb.exec:\tnbntb.exe80⤵PID:800
-
\??\c:\2228888.exec:\2228888.exe81⤵PID:776
-
\??\c:\26026.exec:\26026.exe82⤵PID:880
-
\??\c:\2024006.exec:\2024006.exe83⤵PID:1632
-
\??\c:\xlffflr.exec:\xlffflr.exe84⤵PID:532
-
\??\c:\64622.exec:\64622.exe85⤵PID:2404
-
\??\c:\tnbnth.exec:\tnbnth.exe86⤵PID:2348
-
\??\c:\bthhhn.exec:\bthhhn.exe87⤵PID:1944
-
\??\c:\dppdj.exec:\dppdj.exe88⤵PID:1900
-
\??\c:\20846.exec:\20846.exe89⤵PID:2072
-
\??\c:\vjddj.exec:\vjddj.exe90⤵PID:2304
-
\??\c:\bthbbb.exec:\bthbbb.exe91⤵PID:1716
-
\??\c:\86280.exec:\86280.exe92⤵PID:2464
-
\??\c:\g4284.exec:\g4284.exe93⤵PID:2156
-
\??\c:\c228846.exec:\c228846.exe94⤵PID:2840
-
\??\c:\0800628.exec:\0800628.exe95⤵PID:2824
-
\??\c:\xrxlrrx.exec:\xrxlrrx.exe96⤵
- System Location Discovery: System Language Discovery
PID:2764 -
\??\c:\w42226.exec:\w42226.exe97⤵PID:2760
-
\??\c:\5bhbbt.exec:\5bhbbt.exe98⤵PID:2796
-
\??\c:\frflxrx.exec:\frflxrx.exe99⤵PID:2068
-
\??\c:\202884.exec:\202884.exe100⤵PID:2096
-
\??\c:\m0846.exec:\m0846.exe101⤵PID:2064
-
\??\c:\68668.exec:\68668.exe102⤵PID:2860
-
\??\c:\5pvpv.exec:\5pvpv.exe103⤵PID:1048
-
\??\c:\ddpjd.exec:\ddpjd.exe104⤵PID:1416
-
\??\c:\g6840.exec:\g6840.exe105⤵PID:2936
-
\??\c:\c600668.exec:\c600668.exe106⤵PID:3060
-
\??\c:\ffffffl.exec:\ffffffl.exe107⤵PID:3024
-
\??\c:\thtntn.exec:\thtntn.exe108⤵PID:3020
-
\??\c:\vpvvj.exec:\vpvvj.exe109⤵PID:1324
-
\??\c:\862286.exec:\862286.exe110⤵PID:2592
-
\??\c:\dvvpp.exec:\dvvpp.exe111⤵PID:2500
-
\??\c:\hnbhbb.exec:\hnbhbb.exe112⤵PID:2528
-
\??\c:\2062440.exec:\2062440.exe113⤵PID:1312
-
\??\c:\tnbhnt.exec:\tnbhnt.exe114⤵
- System Location Discovery: System Language Discovery
PID:1904 -
\??\c:\04624.exec:\04624.exe115⤵PID:1912
-
\??\c:\q02226.exec:\q02226.exe116⤵PID:564
-
\??\c:\9nbhnn.exec:\9nbhnn.exe117⤵PID:1852
-
\??\c:\7fxxlfr.exec:\7fxxlfr.exe118⤵PID:1996
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe119⤵PID:1100
-
\??\c:\tnhnbb.exec:\tnhnbb.exe120⤵PID:1728
-
\??\c:\c022828.exec:\c022828.exe121⤵PID:1348
-
\??\c:\pjvvj.exec:\pjvvj.exe122⤵PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-