Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:12
Behavioral task
behavioral1
Sample
7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe
-
Size
332KB
-
MD5
3d7ba968fdad32d7c4ebf3f5d2d5df00
-
SHA1
30d35bc9b5e5589b52b09f8a2319fdaec95479bd
-
SHA256
7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cec
-
SHA512
cb14ff7f97f88a77930a30c4b7bae49f5292ab474fa63b32c198e5916f2ca8fabc448f99811adb4b971fe96c2a1b519b74556eaf97a19dcfdd39e409346f4a05
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeJ:R4wFHoSHYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2308-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-76-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2828-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1472-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-134-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-158-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2020-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-175-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2136-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2376-191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/268-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/492-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-311-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2908-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-344-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/308-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-541-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1524-801-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2732-813-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3036-898-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-929-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-947-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-7493-0x0000000076D20000-0x0000000076E3F000-memory.dmp family_blackmoon behavioral1/memory/2468-13846-0x0000000076D20000-0x0000000076E3F000-memory.dmp family_blackmoon behavioral1/memory/2468-14413-0x0000000076D20000-0x0000000076E3F000-memory.dmp family_blackmoon behavioral1/memory/2468-14980-0x0000000076D20000-0x0000000076E3F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1632 nhthbt.exe 2352 lxflrrr.exe 2300 bthhnb.exe 2764 tnbhnn.exe 2900 9xxxflr.exe 2748 xfxrlrf.exe 2912 jjdjp.exe 2828 vpjdp.exe 2792 thnhbh.exe 2652 jdpdj.exe 1868 pdvjp.exe 1472 rlfrffr.exe 1828 jdppj.exe 2832 fxllxfr.exe 2948 nhhbth.exe 1220 ppjjv.exe 2944 fxrflrf.exe 2020 btbhtb.exe 1924 lllrlfl.exe 816 tntntt.exe 2136 vjjpd.exe 2376 pjjjv.exe 268 nbtnht.exe 2808 tnntbn.exe 2000 7frxrrx.exe 1732 thtttb.exe 1780 9vvdd.exe 2424 ffxrffl.exe 2368 ppjpv.exe 1988 pjvpv.exe 2432 7tnthn.exe 916 1vpdj.exe 1040 7lllxfl.exe 2396 1nnnth.exe 1672 ttntbh.exe 2480 jjdpp.exe 492 lllrxlf.exe 2220 xrrfrxl.exe 2192 tnnbnh.exe 2904 3hnthn.exe 2896 ddvvj.exe 2908 5xlflrx.exe 2748 3xfllxf.exe 2740 bnhbnb.exe 2648 9pjpd.exe 2788 vjjvv.exe 2696 fxrfllx.exe 2516 nnhhnt.exe 2340 hntnbt.exe 2952 jvjvd.exe 1820 1ffxllf.exe 1284 3rrlrlf.exe 2968 nbbnnt.exe 2864 tnthnt.exe 2932 3pvpv.exe 2824 vpjvv.exe 3004 7xfxxll.exe 3044 xlfrxxf.exe 1640 tnhnbb.exe 1304 vvjdp.exe 480 5vjjp.exe 2328 xxxlxfl.exe 1800 fxrxrrf.exe 2116 7nbbtb.exe -
resource yara_rule behavioral1/memory/2308-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1632-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000015ceb-7.dat upx behavioral1/memory/2308-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015da1-16.dat upx behavioral1/memory/1632-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2352-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f4c-26.dat upx behavioral1/memory/2300-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015fba-32.dat upx behavioral1/files/0x0007000000016033-41.dat upx behavioral1/memory/2764-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016136-49.dat upx behavioral1/memory/2900-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c8-58.dat upx behavioral1/memory/2748-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878d-66.dat upx behavioral1/memory/2828-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190c6-74.dat upx behavioral1/files/0x00060000000190c9-85.dat upx behavioral1/memory/2792-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f3-93.dat upx behavioral1/memory/2652-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191fd-101.dat upx behavioral1/files/0x0005000000019217-111.dat upx behavioral1/memory/1472-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019220-118.dat upx behavioral1/memory/2832-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019238-126.dat upx behavioral1/memory/2948-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019240-135.dat upx behavioral1/files/0x000500000001925d-143.dat upx behavioral1/memory/2944-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019263-151.dat upx behavioral1/files/0x0005000000019278-160.dat upx behavioral1/memory/2020-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019280-168.dat upx behavioral1/memory/1924-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938b-176.dat upx behavioral1/files/0x0009000000015d68-184.dat upx behavioral1/memory/2136-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/268-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019399-194.dat upx behavioral1/files/0x00050000000193b7-201.dat upx behavioral1/memory/2808-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c1-209.dat upx behavioral1/files/0x00050000000193c8-218.dat upx behavioral1/memory/2000-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d4-225.dat upx behavioral1/memory/2424-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1780-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ec-232.dat upx behavioral1/files/0x0005000000019417-241.dat upx behavioral1/memory/1732-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941a-249.dat upx behavioral1/files/0x0005000000019436-256.dat upx behavioral1/files/0x0005000000019441-263.dat upx behavioral1/memory/916-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/492-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-312-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1632 2308 7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe 31 PID 2308 wrote to memory of 1632 2308 7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe 31 PID 2308 wrote to memory of 1632 2308 7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe 31 PID 2308 wrote to memory of 1632 2308 7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe 31 PID 1632 wrote to memory of 2352 1632 nhthbt.exe 32 PID 1632 wrote to memory of 2352 1632 nhthbt.exe 32 PID 1632 wrote to memory of 2352 1632 nhthbt.exe 32 PID 1632 wrote to memory of 2352 1632 nhthbt.exe 32 PID 2352 wrote to memory of 2300 2352 lxflrrr.exe 33 PID 2352 wrote to memory of 2300 2352 lxflrrr.exe 33 PID 2352 wrote to memory of 2300 2352 lxflrrr.exe 33 PID 2352 wrote to memory of 2300 2352 lxflrrr.exe 33 PID 2300 wrote to memory of 2764 2300 bthhnb.exe 34 PID 2300 wrote to memory of 2764 2300 bthhnb.exe 34 PID 2300 wrote to memory of 2764 2300 bthhnb.exe 34 PID 2300 wrote to memory of 2764 2300 bthhnb.exe 34 PID 2764 wrote to memory of 2900 2764 tnbhnn.exe 35 PID 2764 wrote to memory of 2900 2764 tnbhnn.exe 35 PID 2764 wrote to memory of 2900 2764 tnbhnn.exe 35 PID 2764 wrote to memory of 2900 2764 tnbhnn.exe 35 PID 2900 wrote to memory of 2748 2900 9xxxflr.exe 36 PID 2900 wrote to memory of 2748 2900 9xxxflr.exe 36 PID 2900 wrote to memory of 2748 2900 9xxxflr.exe 36 PID 2900 wrote to memory of 2748 2900 9xxxflr.exe 36 PID 2748 wrote to memory of 2912 2748 xfxrlrf.exe 37 PID 2748 wrote to memory of 2912 2748 xfxrlrf.exe 37 PID 2748 wrote to memory of 2912 2748 xfxrlrf.exe 37 PID 2748 wrote to memory of 2912 2748 xfxrlrf.exe 37 PID 2912 wrote to memory of 2828 2912 jjdjp.exe 38 PID 2912 wrote to memory of 2828 2912 jjdjp.exe 38 PID 2912 wrote to memory of 2828 2912 jjdjp.exe 38 PID 2912 wrote to memory of 2828 2912 jjdjp.exe 38 PID 2828 wrote to memory of 2792 2828 vpjdp.exe 39 PID 2828 wrote to memory of 2792 2828 vpjdp.exe 39 PID 2828 wrote to memory of 2792 2828 vpjdp.exe 39 PID 2828 wrote to memory of 2792 2828 vpjdp.exe 39 PID 2792 wrote to memory of 2652 2792 thnhbh.exe 40 PID 2792 wrote to memory of 2652 2792 thnhbh.exe 40 PID 2792 wrote to memory of 2652 2792 thnhbh.exe 40 PID 2792 wrote to memory of 2652 2792 thnhbh.exe 40 PID 2652 wrote to memory of 1868 2652 jdpdj.exe 41 PID 2652 wrote to memory of 1868 2652 jdpdj.exe 41 PID 2652 wrote to memory of 1868 2652 jdpdj.exe 41 PID 2652 wrote to memory of 1868 2652 jdpdj.exe 41 PID 1868 wrote to memory of 1472 1868 pdvjp.exe 42 PID 1868 wrote to memory of 1472 1868 pdvjp.exe 42 PID 1868 wrote to memory of 1472 1868 pdvjp.exe 42 PID 1868 wrote to memory of 1472 1868 pdvjp.exe 42 PID 1472 wrote to memory of 1828 1472 rlfrffr.exe 43 PID 1472 wrote to memory of 1828 1472 rlfrffr.exe 43 PID 1472 wrote to memory of 1828 1472 rlfrffr.exe 43 PID 1472 wrote to memory of 1828 1472 rlfrffr.exe 43 PID 1828 wrote to memory of 2832 1828 jdppj.exe 44 PID 1828 wrote to memory of 2832 1828 jdppj.exe 44 PID 1828 wrote to memory of 2832 1828 jdppj.exe 44 PID 1828 wrote to memory of 2832 1828 jdppj.exe 44 PID 2832 wrote to memory of 2948 2832 fxllxfr.exe 45 PID 2832 wrote to memory of 2948 2832 fxllxfr.exe 45 PID 2832 wrote to memory of 2948 2832 fxllxfr.exe 45 PID 2832 wrote to memory of 2948 2832 fxllxfr.exe 45 PID 2948 wrote to memory of 1220 2948 nhhbth.exe 46 PID 2948 wrote to memory of 1220 2948 nhhbth.exe 46 PID 2948 wrote to memory of 1220 2948 nhhbth.exe 46 PID 2948 wrote to memory of 1220 2948 nhhbth.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe"C:\Users\Admin\AppData\Local\Temp\7201162228735e3a8cd907800c32a8d92f626afb2763e0d32b4f7dec98120cecN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nhthbt.exec:\nhthbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\lxflrrr.exec:\lxflrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\bthhnb.exec:\bthhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\tnbhnn.exec:\tnbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\9xxxflr.exec:\9xxxflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xfxrlrf.exec:\xfxrlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jjdjp.exec:\jjdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vpjdp.exec:\vpjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\thnhbh.exec:\thnhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jdpdj.exec:\jdpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pdvjp.exec:\pdvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\rlfrffr.exec:\rlfrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\jdppj.exec:\jdppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\fxllxfr.exec:\fxllxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nhhbth.exec:\nhhbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ppjjv.exec:\ppjjv.exe17⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fxrflrf.exec:\fxrflrf.exe18⤵
- Executes dropped EXE
PID:2944 -
\??\c:\btbhtb.exec:\btbhtb.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lllrlfl.exec:\lllrlfl.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tntntt.exec:\tntntt.exe21⤵
- Executes dropped EXE
PID:816 -
\??\c:\vjjpd.exec:\vjjpd.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pjjjv.exec:\pjjjv.exe23⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nbtnht.exec:\nbtnht.exe24⤵
- Executes dropped EXE
PID:268 -
\??\c:\tnntbn.exec:\tnntbn.exe25⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7frxrrx.exec:\7frxrrx.exe26⤵
- Executes dropped EXE
PID:2000 -
\??\c:\thtttb.exec:\thtttb.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9vvdd.exec:\9vvdd.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ffxrffl.exec:\ffxrffl.exe29⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ppjpv.exec:\ppjpv.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjvpv.exec:\pjvpv.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\7tnthn.exec:\7tnthn.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1vpdj.exec:\1vpdj.exe33⤵
- Executes dropped EXE
PID:916 -
\??\c:\7lllxfl.exec:\7lllxfl.exe34⤵
- Executes dropped EXE
PID:1040 -
\??\c:\1nnnth.exec:\1nnnth.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ttntbh.exec:\ttntbh.exe36⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jjdpp.exec:\jjdpp.exe37⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lllrxlf.exec:\lllrxlf.exe38⤵
- Executes dropped EXE
PID:492 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe39⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tnnbnh.exec:\tnnbnh.exe40⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3hnthn.exec:\3hnthn.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ddvvj.exec:\ddvvj.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5xlflrx.exec:\5xlflrx.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3xfllxf.exec:\3xfllxf.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bnhbnb.exec:\bnhbnb.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9pjpd.exec:\9pjpd.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vjjvv.exec:\vjjvv.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxrfllx.exec:\fxrfllx.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nnhhnt.exec:\nnhhnt.exe49⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hntnbt.exec:\hntnbt.exe50⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jvjvd.exec:\jvjvd.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1ffxllf.exec:\1ffxllf.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\3rrlrlf.exec:\3rrlrlf.exe53⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nbbnnt.exec:\nbbnnt.exe54⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tnthnt.exec:\tnthnt.exe55⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3pvpv.exec:\3pvpv.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vpjvv.exec:\vpjvv.exe57⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7xfxxll.exec:\7xfxxll.exe58⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xlfrxxf.exec:\xlfrxxf.exe59⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tnhnbb.exec:\tnhnbb.exe60⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvjdp.exec:\vvjdp.exe61⤵
- Executes dropped EXE
PID:1304 -
\??\c:\5vjjp.exec:\5vjjp.exe62⤵
- Executes dropped EXE
PID:480 -
\??\c:\xxxlxfl.exec:\xxxlxfl.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7nbbtb.exec:\7nbbtb.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nnhhbb.exec:\nnhhbb.exe66⤵PID:1948
-
\??\c:\pjvdj.exec:\pjvdj.exe67⤵PID:2604
-
\??\c:\7dddd.exec:\7dddd.exe68⤵PID:1280
-
\??\c:\rrlfxlr.exec:\rrlfxlr.exe69⤵PID:700
-
\??\c:\bnhnnt.exec:\bnhnnt.exe70⤵PID:1684
-
\??\c:\3nbnth.exec:\3nbnth.exe71⤵PID:3020
-
\??\c:\vddvv.exec:\vddvv.exe72⤵PID:860
-
\??\c:\ppdjv.exec:\ppdjv.exe73⤵PID:1768
-
\??\c:\xrfllrx.exec:\xrfllrx.exe74⤵PID:2172
-
\??\c:\lrlrllf.exec:\lrlrllf.exe75⤵PID:1484
-
\??\c:\3bthnb.exec:\3bthnb.exe76⤵PID:2148
-
\??\c:\dvvdv.exec:\dvvdv.exe77⤵PID:2224
-
\??\c:\pjvvd.exec:\pjvvd.exe78⤵PID:1144
-
\??\c:\xxllrrx.exec:\xxllrrx.exe79⤵PID:1028
-
\??\c:\5xrxfrf.exec:\5xrxfrf.exe80⤵PID:308
-
\??\c:\bnnhtn.exec:\bnnhtn.exe81⤵PID:1976
-
\??\c:\pvdvj.exec:\pvdvj.exe82⤵PID:1156
-
\??\c:\djpdj.exec:\djpdj.exe83⤵PID:2396
-
\??\c:\xllflrx.exec:\xllflrx.exe84⤵PID:1672
-
\??\c:\ttnthn.exec:\ttnthn.exe85⤵PID:2480
-
\??\c:\hthnnn.exec:\hthnnn.exe86⤵PID:492
-
\??\c:\ddvjj.exec:\ddvjj.exe87⤵PID:2240
-
\??\c:\vdpvp.exec:\vdpvp.exe88⤵PID:2780
-
\??\c:\lllflfl.exec:\lllflfl.exe89⤵
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\nthhnh.exec:\nthhnh.exe90⤵PID:2876
-
\??\c:\bttbbh.exec:\bttbbh.exe91⤵PID:2884
-
\??\c:\dvjjp.exec:\dvjjp.exe92⤵PID:2980
-
\??\c:\lfrfflx.exec:\lfrfflx.exe93⤵PID:1740
-
\??\c:\nthbnn.exec:\nthbnn.exe94⤵PID:2736
-
\??\c:\btbbnt.exec:\btbbnt.exe95⤵PID:2680
-
\??\c:\dvvdj.exec:\dvvdj.exe96⤵PID:2788
-
\??\c:\jpddv.exec:\jpddv.exe97⤵PID:1880
-
\??\c:\xxrrllr.exec:\xxrrllr.exe98⤵PID:2664
-
\??\c:\nnbnbb.exec:\nnbnbb.exe99⤵PID:2024
-
\??\c:\5tnttn.exec:\5tnttn.exe100⤵PID:1128
-
\??\c:\5pdjp.exec:\5pdjp.exe101⤵PID:1468
-
\??\c:\jjpvj.exec:\jjpvj.exe102⤵PID:3036
-
\??\c:\3rllrxl.exec:\3rllrxl.exe103⤵PID:2968
-
\??\c:\9lfflrf.exec:\9lfflrf.exe104⤵PID:2996
-
\??\c:\hthhtt.exec:\hthhtt.exe105⤵PID:844
-
\??\c:\5vpdj.exec:\5vpdj.exe106⤵PID:3056
-
\??\c:\5vdjv.exec:\5vdjv.exe107⤵PID:3052
-
\??\c:\lxrxxfr.exec:\lxrxxfr.exe108⤵PID:1512
-
\??\c:\xrrxffr.exec:\xrrxffr.exe109⤵PID:1656
-
\??\c:\hbhbtb.exec:\hbhbtb.exe110⤵PID:2336
-
\??\c:\jdjjj.exec:\jdjjj.exe111⤵PID:1924
-
\??\c:\3rrrlrx.exec:\3rrrlrx.exe112⤵PID:2096
-
\??\c:\lxxfrxr.exec:\lxxfrxr.exe113⤵PID:2136
-
\??\c:\nhbhbn.exec:\nhbhbn.exe114⤵PID:2568
-
\??\c:\nhbhht.exec:\nhbhht.exe115⤵PID:464
-
\??\c:\pjppd.exec:\pjppd.exe116⤵PID:404
-
\??\c:\1lrfrrf.exec:\1lrfrrf.exe117⤵PID:444
-
\??\c:\7fxlrxf.exec:\7fxlrxf.exe118⤵PID:1616
-
\??\c:\pjppd.exec:\pjppd.exe119⤵PID:2108
-
\??\c:\jjpdv.exec:\jjpdv.exe120⤵PID:552
-
\??\c:\9xlllrx.exec:\9xlllrx.exe121⤵PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-