Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe
-
Size
454KB
-
MD5
1d41f0323c5e9114efb45416420fe200
-
SHA1
7fd2b646aea5a298a503044a23a7964f68a56084
-
SHA256
b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832
-
SHA512
e8304f7dffb9c10ce3c5f7f0512079f0893ae5ba715ca3f30d743331b1ff732d055b0a102cab4567c44798b4c05b8060417228f5e7cb9ad2707d5e7abaa2c377
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetd:q7Tc2NYHUrAwfMp3CDtd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2124-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-91-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2384-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-317-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-343-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2560-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-561-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/528-628-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2924-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-839-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2584-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2124 flfxlrf.exe 2804 ttntnh.exe 2968 fffrfrl.exe 2920 nntbtb.exe 2588 btbhnb.exe 2560 djjdv.exe 3060 rfrrfrr.exe 408 jpvvp.exe 2020 7fxxffr.exe 2384 3nnbth.exe 2340 7rrxrfx.exe 2796 llflxxr.exe 2856 1htnth.exe 3040 llxlxlx.exe 2888 ttbnbh.exe 1236 jpppj.exe 1148 lllfffx.exe 2964 vvpdj.exe 2456 thttbt.exe 3036 pppdv.exe 2024 lxfxrrf.exe 1164 djjpv.exe 876 7fxlxrl.exe 1524 ddjvj.exe 268 rrlxlrr.exe 2516 httnnh.exe 2028 ffxlffr.exe 992 nthhnn.exe 2280 ddvpv.exe 2268 nnhhnb.exe 3044 fxrxllf.exe 2180 nhhnbb.exe 1576 llfrfrf.exe 2740 htthtt.exe 2984 dvjpp.exe 2548 1lxlxfr.exe 2832 hbtbnb.exe 2596 7pjpj.exe 2556 7xfxxfl.exe 2560 rrllffl.exe 1708 hbbhht.exe 1332 9pjvp.exe 2640 fllxxlx.exe 804 bhhthb.exe 2520 jjjpj.exe 672 lflrflx.exe 2320 3hhtbn.exe 2788 vvpdv.exe 2916 lrlxxxr.exe 2808 tthnnt.exe 3068 dvvjj.exe 2812 vdpvd.exe 1348 xxrxrxl.exe 2348 bhtnbh.exe 2272 3pjpv.exe 3008 3xxlxlx.exe 2200 lrxfrfl.exe 1592 bbthbh.exe 772 dvjdv.exe 856 xxxrrxl.exe 2220 hbnthh.exe 2036 jjdpd.exe 1748 pjjvp.exe 2004 ffrfrfr.exe -
resource yara_rule behavioral1/memory/2400-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-936-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-943-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-956-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2124 2400 b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe 30 PID 2400 wrote to memory of 2124 2400 b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe 30 PID 2400 wrote to memory of 2124 2400 b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe 30 PID 2400 wrote to memory of 2124 2400 b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe 30 PID 2124 wrote to memory of 2804 2124 flfxlrf.exe 31 PID 2124 wrote to memory of 2804 2124 flfxlrf.exe 31 PID 2124 wrote to memory of 2804 2124 flfxlrf.exe 31 PID 2124 wrote to memory of 2804 2124 flfxlrf.exe 31 PID 2804 wrote to memory of 2968 2804 ttntnh.exe 32 PID 2804 wrote to memory of 2968 2804 ttntnh.exe 32 PID 2804 wrote to memory of 2968 2804 ttntnh.exe 32 PID 2804 wrote to memory of 2968 2804 ttntnh.exe 32 PID 2968 wrote to memory of 2920 2968 fffrfrl.exe 33 PID 2968 wrote to memory of 2920 2968 fffrfrl.exe 33 PID 2968 wrote to memory of 2920 2968 fffrfrl.exe 33 PID 2968 wrote to memory of 2920 2968 fffrfrl.exe 33 PID 2920 wrote to memory of 2588 2920 nntbtb.exe 34 PID 2920 wrote to memory of 2588 2920 nntbtb.exe 34 PID 2920 wrote to memory of 2588 2920 nntbtb.exe 34 PID 2920 wrote to memory of 2588 2920 nntbtb.exe 34 PID 2588 wrote to memory of 2560 2588 btbhnb.exe 35 PID 2588 wrote to memory of 2560 2588 btbhnb.exe 35 PID 2588 wrote to memory of 2560 2588 btbhnb.exe 35 PID 2588 wrote to memory of 2560 2588 btbhnb.exe 35 PID 2560 wrote to memory of 3060 2560 djjdv.exe 36 PID 2560 wrote to memory of 3060 2560 djjdv.exe 36 PID 2560 wrote to memory of 3060 2560 djjdv.exe 36 PID 2560 wrote to memory of 3060 2560 djjdv.exe 36 PID 3060 wrote to memory of 408 3060 rfrrfrr.exe 37 PID 3060 wrote to memory of 408 3060 rfrrfrr.exe 37 PID 3060 wrote to memory of 408 3060 rfrrfrr.exe 37 PID 3060 wrote to memory of 408 3060 rfrrfrr.exe 37 PID 408 wrote to memory of 2020 408 jpvvp.exe 38 PID 408 wrote to memory of 2020 408 jpvvp.exe 38 PID 408 wrote to memory of 2020 408 jpvvp.exe 38 PID 408 wrote to memory of 2020 408 jpvvp.exe 38 PID 2020 wrote to memory of 2384 2020 7fxxffr.exe 39 PID 2020 wrote to memory of 2384 2020 7fxxffr.exe 39 PID 2020 wrote to memory of 2384 2020 7fxxffr.exe 39 PID 2020 wrote to memory of 2384 2020 7fxxffr.exe 39 PID 2384 wrote to memory of 2340 2384 3nnbth.exe 40 PID 2384 wrote to memory of 2340 2384 3nnbth.exe 40 PID 2384 wrote to memory of 2340 2384 3nnbth.exe 40 PID 2384 wrote to memory of 2340 2384 3nnbth.exe 40 PID 2340 wrote to memory of 2796 2340 7rrxrfx.exe 41 PID 2340 wrote to memory of 2796 2340 7rrxrfx.exe 41 PID 2340 wrote to memory of 2796 2340 7rrxrfx.exe 41 PID 2340 wrote to memory of 2796 2340 7rrxrfx.exe 41 PID 2796 wrote to memory of 2856 2796 llflxxr.exe 42 PID 2796 wrote to memory of 2856 2796 llflxxr.exe 42 PID 2796 wrote to memory of 2856 2796 llflxxr.exe 42 PID 2796 wrote to memory of 2856 2796 llflxxr.exe 42 PID 2856 wrote to memory of 3040 2856 1htnth.exe 43 PID 2856 wrote to memory of 3040 2856 1htnth.exe 43 PID 2856 wrote to memory of 3040 2856 1htnth.exe 43 PID 2856 wrote to memory of 3040 2856 1htnth.exe 43 PID 3040 wrote to memory of 2888 3040 llxlxlx.exe 44 PID 3040 wrote to memory of 2888 3040 llxlxlx.exe 44 PID 3040 wrote to memory of 2888 3040 llxlxlx.exe 44 PID 3040 wrote to memory of 2888 3040 llxlxlx.exe 44 PID 2888 wrote to memory of 1236 2888 ttbnbh.exe 45 PID 2888 wrote to memory of 1236 2888 ttbnbh.exe 45 PID 2888 wrote to memory of 1236 2888 ttbnbh.exe 45 PID 2888 wrote to memory of 1236 2888 ttbnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe"C:\Users\Admin\AppData\Local\Temp\b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\flfxlrf.exec:\flfxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ttntnh.exec:\ttntnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\fffrfrl.exec:\fffrfrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\nntbtb.exec:\nntbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\btbhnb.exec:\btbhnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\djjdv.exec:\djjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rfrrfrr.exec:\rfrrfrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jpvvp.exec:\jpvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\7fxxffr.exec:\7fxxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3nnbth.exec:\3nnbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\7rrxrfx.exec:\7rrxrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\llflxxr.exec:\llflxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1htnth.exec:\1htnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\llxlxlx.exec:\llxlxlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\ttbnbh.exec:\ttbnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jpppj.exec:\jpppj.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\lllfffx.exec:\lllfffx.exe18⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vvpdj.exec:\vvpdj.exe19⤵
- Executes dropped EXE
PID:2964 -
\??\c:\thttbt.exec:\thttbt.exe20⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pppdv.exec:\pppdv.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lxfxrrf.exec:\lxfxrrf.exe22⤵
- Executes dropped EXE
PID:2024 -
\??\c:\djjpv.exec:\djjpv.exe23⤵
- Executes dropped EXE
PID:1164 -
\??\c:\7fxlxrl.exec:\7fxlxrl.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\ddjvj.exec:\ddjvj.exe25⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rrlxlrr.exec:\rrlxlrr.exe26⤵
- Executes dropped EXE
PID:268 -
\??\c:\httnnh.exec:\httnnh.exe27⤵
- Executes dropped EXE
PID:2516 -
\??\c:\ffxlffr.exec:\ffxlffr.exe28⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nthhnn.exec:\nthhnn.exe29⤵
- Executes dropped EXE
PID:992 -
\??\c:\ddvpv.exec:\ddvpv.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nnhhnb.exec:\nnhhnb.exe31⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxrxllf.exec:\fxrxllf.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nhhnbb.exec:\nhhnbb.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\llfrfrf.exec:\llfrfrf.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\htthtt.exec:\htthtt.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvjpp.exec:\dvjpp.exe36⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1lxlxfr.exec:\1lxlxfr.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hbtbnb.exec:\hbtbnb.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7pjpj.exec:\7pjpj.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\7xfxxfl.exec:\7xfxxfl.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rrllffl.exec:\rrllffl.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hbbhht.exec:\hbbhht.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9pjvp.exec:\9pjvp.exe43⤵
- Executes dropped EXE
PID:1332 -
\??\c:\fllxxlx.exec:\fllxxlx.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bhhthb.exec:\bhhthb.exe45⤵
- Executes dropped EXE
PID:804 -
\??\c:\jjjpj.exec:\jjjpj.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lflrflx.exec:\lflrflx.exe47⤵
- Executes dropped EXE
PID:672 -
\??\c:\3hhtbn.exec:\3hhtbn.exe48⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vvpdv.exec:\vvpdv.exe49⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lrlxxxr.exec:\lrlxxxr.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tthnnt.exec:\tthnnt.exe51⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvvjj.exec:\dvvjj.exe52⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vdpvd.exec:\vdpvd.exe53⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe54⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bhtnbh.exec:\bhtnbh.exe55⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3pjpv.exec:\3pjpv.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3xxlxlx.exec:\3xxlxlx.exe57⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lrxfrfl.exec:\lrxfrfl.exe58⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bbthbh.exec:\bbthbh.exe59⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dvjdv.exec:\dvjdv.exe60⤵
- Executes dropped EXE
PID:772 -
\??\c:\xxxrrxl.exec:\xxxrrxl.exe61⤵
- Executes dropped EXE
PID:856 -
\??\c:\hbnthh.exec:\hbnthh.exe62⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jjdpd.exec:\jjdpd.exe63⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pjjvp.exec:\pjjvp.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9bnntb.exec:\9bnntb.exe66⤵PID:2296
-
\??\c:\3dvpd.exec:\3dvpd.exe67⤵PID:2436
-
\??\c:\xrllxfl.exec:\xrllxfl.exe68⤵PID:764
-
\??\c:\bttbnt.exec:\bttbnt.exe69⤵PID:1808
-
\??\c:\7tnthb.exec:\7tnthb.exe70⤵PID:2960
-
\??\c:\djvjp.exec:\djvjp.exe71⤵PID:2288
-
\??\c:\flfrlrr.exec:\flfrlrr.exe72⤵PID:2724
-
\??\c:\tnbbth.exec:\tnbbth.exe73⤵PID:2444
-
\??\c:\pvddd.exec:\pvddd.exe74⤵PID:2668
-
\??\c:\ffxrfll.exec:\ffxrfll.exe75⤵PID:1432
-
\??\c:\flflffr.exec:\flflffr.exe76⤵PID:2748
-
\??\c:\bhnttb.exec:\bhnttb.exe77⤵PID:2732
-
\??\c:\jddjj.exec:\jddjj.exe78⤵PID:888
-
\??\c:\3flfxlx.exec:\3flfxlx.exe79⤵PID:2720
-
\??\c:\hhnttb.exec:\hhnttb.exe80⤵PID:2836
-
\??\c:\pppdd.exec:\pppdd.exe81⤵PID:1804
-
\??\c:\jddjp.exec:\jddjp.exe82⤵PID:2660
-
\??\c:\llllxlr.exec:\llllxlr.exe83⤵PID:528
-
\??\c:\hhhtnb.exec:\hhhtnb.exe84⤵PID:3060
-
\??\c:\pjjdd.exec:\pjjdd.exe85⤵PID:2120
-
\??\c:\3rfrrrf.exec:\3rfrrrf.exe86⤵PID:940
-
\??\c:\vvppj.exec:\vvppj.exe87⤵PID:2928
-
\??\c:\xxfxfll.exec:\xxfxfll.exe88⤵PID:2792
-
\??\c:\nttnbh.exec:\nttnbh.exe89⤵PID:2156
-
\??\c:\jjpvd.exec:\jjpvd.exe90⤵PID:2896
-
\??\c:\1xrxlrf.exec:\1xrxlrf.exe91⤵PID:2924
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe92⤵PID:2948
-
\??\c:\5hthnh.exec:\5hthnh.exe93⤵PID:2528
-
\??\c:\7dvjp.exec:\7dvjp.exe94⤵PID:2828
-
\??\c:\3rlrlxx.exec:\3rlrlxx.exe95⤵PID:2888
-
\??\c:\btntnb.exec:\btntnb.exe96⤵PID:592
-
\??\c:\pppdv.exec:\pppdv.exe97⤵PID:1972
-
\??\c:\7xlfffr.exec:\7xlfffr.exe98⤵PID:1280
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe99⤵PID:3020
-
\??\c:\tthbth.exec:\tthbth.exe100⤵PID:2456
-
\??\c:\jppjd.exec:\jppjd.exe101⤵PID:1860
-
\??\c:\5ddpd.exec:\5ddpd.exe102⤵PID:1716
-
\??\c:\nhhntb.exec:\nhhntb.exe103⤵PID:1936
-
\??\c:\jjpdd.exec:\jjpdd.exe104⤵PID:1508
-
\??\c:\xrlfrxl.exec:\xrlfrxl.exe105⤵PID:2452
-
\??\c:\rrrflxx.exec:\rrrflxx.exe106⤵
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\tbbnht.exec:\tbbnht.exe107⤵PID:2008
-
\??\c:\9vpdv.exec:\9vpdv.exe108⤵PID:2276
-
\??\c:\llfxlfr.exec:\llfxlfr.exe109⤵PID:1156
-
\??\c:\9lxlffr.exec:\9lxlffr.exe110⤵PID:2516
-
\??\c:\nnntnb.exec:\nnntnb.exe111⤵PID:2040
-
\??\c:\vdjvp.exec:\vdjvp.exe112⤵PID:2016
-
\??\c:\rllrflf.exec:\rllrflf.exe113⤵PID:768
-
\??\c:\nhttbh.exec:\nhttbh.exe114⤵PID:2288
-
\??\c:\vpjpj.exec:\vpjpj.exe115⤵PID:2648
-
\??\c:\dpvvd.exec:\dpvvd.exe116⤵PID:280
-
\??\c:\5rrxflx.exec:\5rrxflx.exe117⤵PID:1548
-
\??\c:\ttnbht.exec:\ttnbht.exe118⤵PID:2672
-
\??\c:\jvvdv.exec:\jvvdv.exe119⤵PID:2700
-
\??\c:\vdjjd.exec:\vdjjd.exe120⤵PID:2984
-
\??\c:\xllrrfx.exec:\xllrrfx.exe121⤵PID:2548
-
\??\c:\1ntnhn.exec:\1ntnhn.exe122⤵PID:2568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-