Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:51
Behavioral task
behavioral1
Sample
a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe
-
Size
79KB
-
MD5
8ea95fca637773558f2e3d4360a02ed0
-
SHA1
7ca368a7397acf854d954f326d381118530ac5b9
-
SHA256
a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806
-
SHA512
203b0c42d48ae823b5ee657d709b0fd0d9ac966208318d0f1fe2371ad5bdbd8c852b83a3791cc51f98a92740e36a7a0e0dfd7a731b33865e9994983888738095
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2f:xhOmTsF93UYfwC6GIout03LzGFK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/1204-2-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-32-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3056-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/664-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-175-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/824-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-338-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2308-341-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2252-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-367-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/776-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-390-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3036-392-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2356-423-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1800-436-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1020-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-463-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2152-496-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2152-494-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2440-515-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2264-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-555-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2260-563-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2284-575-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2636-626-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1952-637-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-743-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-830-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2616-880-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1716-908-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-934-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1088-972-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1568-993-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2404-1007-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1476-1021-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1980-1041-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1912 bnbttn.exe 2304 7pvvv.exe 3056 042480.exe 2212 040680.exe 2872 xlllxrr.exe 2748 3dpvv.exe 2308 20280.exe 2660 bntbtt.exe 2736 9jdjj.exe 2696 rrxrlxx.exe 2252 tbntnn.exe 664 xlfllff.exe 868 e46800.exe 2608 48288.exe 2692 bnbnhn.exe 2996 5tnnbb.exe 332 lfrrxfr.exe 2248 1frrxxf.exe 1308 6628022.exe 1408 frrflll.exe 1784 ttnthh.exe 2176 9jvjj.exe 2008 nbnbbh.exe 824 dvdpd.exe 2600 pjvjp.exe 2576 04262.exe 2528 lfxrxfl.exe 976 42466.exe 1120 8640884.exe 1428 o606684.exe 1728 64662.exe 2392 jdvdv.exe 2476 tnhbhb.exe 2932 0862880.exe 1168 206804.exe 2752 7rfrxrx.exe 2872 82684.exe 2844 9nhnbb.exe 2852 bnhbhb.exe 2308 pdpvd.exe 2976 862806.exe 2384 k64622.exe 2728 7jvvd.exe 2252 0888446.exe 776 nbnnnn.exe 664 jdpvj.exe 3036 660644.exe 2608 xlffrlr.exe 2892 vpppv.exe 3024 s4284.exe 2988 hthtbh.exe 2356 640002.exe 2980 nbnbbh.exe 1800 2022662.exe 2220 82062.exe 1308 9rllxxl.exe 1020 5bttbb.exe 1568 jddjp.exe 2428 9fxxlrr.exe 1572 tnthbh.exe 2008 1vpvd.exe 2604 422888.exe 2152 0882888.exe 2600 68662.exe -
resource yara_rule behavioral1/memory/1204-2-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-8.dat upx behavioral1/memory/1912-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1204-7-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000900000001707f-18.dat upx behavioral1/memory/2304-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1912-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000174b4-27.dat upx behavioral1/files/0x0007000000017570-38.dat upx behavioral1/memory/3056-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939f-142.dat upx behavioral1/files/0x000500000001938e-135.dat upx behavioral1/files/0x00050000000193cc-151.dat upx behavioral1/files/0x0005000000019358-127.dat upx behavioral1/files/0x0005000000019354-119.dat upx behavioral1/memory/664-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a1-110.dat upx behavioral1/memory/2252-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019299-101.dat upx behavioral1/memory/2696-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-92.dat upx behavioral1/memory/2736-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019274-83.dat upx behavioral1/memory/2660-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018697-74.dat upx behavioral1/memory/2308-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000018683-65.dat upx behavioral1/memory/2748-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000175f7-56.dat upx behavioral1/memory/2872-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000175f1-46.dat upx behavioral1/files/0x00050000000193d0-159.dat upx behavioral1/files/0x00050000000193dc-166.dat upx behavioral1/memory/2176-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019428-194.dat upx behavioral1/files/0x0005000000019426-186.dat upx behavioral1/files/0x00050000000194ad-203.dat upx behavioral1/files/0x00050000000193f9-178.dat upx behavioral1/memory/1308-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/824-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d5-222.dat upx behavioral1/files/0x00050000000194c3-213.dat upx behavioral1/memory/2008-209-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2576-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e1-231.dat upx behavioral1/memory/2528-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019502-239.dat upx behavioral1/files/0x0005000000019508-249.dat upx behavioral1/memory/1120-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019510-256.dat upx behavioral1/files/0x0005000000019518-268.dat upx behavioral1/files/0x0005000000019520-276.dat upx behavioral1/memory/1120-264-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2392-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001952b-284.dat upx behavioral1/memory/2932-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/776-378-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-436-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/1020-455-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8268680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0428480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2022662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1912 1204 a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe 30 PID 1204 wrote to memory of 1912 1204 a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe 30 PID 1204 wrote to memory of 1912 1204 a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe 30 PID 1204 wrote to memory of 1912 1204 a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe 30 PID 1912 wrote to memory of 2304 1912 bnbttn.exe 31 PID 1912 wrote to memory of 2304 1912 bnbttn.exe 31 PID 1912 wrote to memory of 2304 1912 bnbttn.exe 31 PID 1912 wrote to memory of 2304 1912 bnbttn.exe 31 PID 2304 wrote to memory of 3056 2304 7pvvv.exe 32 PID 2304 wrote to memory of 3056 2304 7pvvv.exe 32 PID 2304 wrote to memory of 3056 2304 7pvvv.exe 32 PID 2304 wrote to memory of 3056 2304 7pvvv.exe 32 PID 3056 wrote to memory of 2212 3056 042480.exe 33 PID 3056 wrote to memory of 2212 3056 042480.exe 33 PID 3056 wrote to memory of 2212 3056 042480.exe 33 PID 3056 wrote to memory of 2212 3056 042480.exe 33 PID 2212 wrote to memory of 2872 2212 040680.exe 34 PID 2212 wrote to memory of 2872 2212 040680.exe 34 PID 2212 wrote to memory of 2872 2212 040680.exe 34 PID 2212 wrote to memory of 2872 2212 040680.exe 34 PID 2872 wrote to memory of 2748 2872 xlllxrr.exe 35 PID 2872 wrote to memory of 2748 2872 xlllxrr.exe 35 PID 2872 wrote to memory of 2748 2872 xlllxrr.exe 35 PID 2872 wrote to memory of 2748 2872 xlllxrr.exe 35 PID 2748 wrote to memory of 2308 2748 3dpvv.exe 36 PID 2748 wrote to memory of 2308 2748 3dpvv.exe 36 PID 2748 wrote to memory of 2308 2748 3dpvv.exe 36 PID 2748 wrote to memory of 2308 2748 3dpvv.exe 36 PID 2308 wrote to memory of 2660 2308 20280.exe 37 PID 2308 wrote to memory of 2660 2308 20280.exe 37 PID 2308 wrote to memory of 2660 2308 20280.exe 37 PID 2308 wrote to memory of 2660 2308 20280.exe 37 PID 2660 wrote to memory of 2736 2660 bntbtt.exe 38 PID 2660 wrote to memory of 2736 2660 bntbtt.exe 38 PID 2660 wrote to memory of 2736 2660 bntbtt.exe 38 PID 2660 wrote to memory of 2736 2660 bntbtt.exe 38 PID 2736 wrote to memory of 2696 2736 9jdjj.exe 39 PID 2736 wrote to memory of 2696 2736 9jdjj.exe 39 PID 2736 wrote to memory of 2696 2736 9jdjj.exe 39 PID 2736 wrote to memory of 2696 2736 9jdjj.exe 39 PID 2696 wrote to memory of 2252 2696 rrxrlxx.exe 40 PID 2696 wrote to memory of 2252 2696 rrxrlxx.exe 40 PID 2696 wrote to memory of 2252 2696 rrxrlxx.exe 40 PID 2696 wrote to memory of 2252 2696 rrxrlxx.exe 40 PID 2252 wrote to memory of 664 2252 tbntnn.exe 41 PID 2252 wrote to memory of 664 2252 tbntnn.exe 41 PID 2252 wrote to memory of 664 2252 tbntnn.exe 41 PID 2252 wrote to memory of 664 2252 tbntnn.exe 41 PID 664 wrote to memory of 868 664 xlfllff.exe 42 PID 664 wrote to memory of 868 664 xlfllff.exe 42 PID 664 wrote to memory of 868 664 xlfllff.exe 42 PID 664 wrote to memory of 868 664 xlfllff.exe 42 PID 868 wrote to memory of 2608 868 e46800.exe 43 PID 868 wrote to memory of 2608 868 e46800.exe 43 PID 868 wrote to memory of 2608 868 e46800.exe 43 PID 868 wrote to memory of 2608 868 e46800.exe 43 PID 2608 wrote to memory of 2692 2608 48288.exe 44 PID 2608 wrote to memory of 2692 2608 48288.exe 44 PID 2608 wrote to memory of 2692 2608 48288.exe 44 PID 2608 wrote to memory of 2692 2608 48288.exe 44 PID 2692 wrote to memory of 2996 2692 bnbnhn.exe 45 PID 2692 wrote to memory of 2996 2692 bnbnhn.exe 45 PID 2692 wrote to memory of 2996 2692 bnbnhn.exe 45 PID 2692 wrote to memory of 2996 2692 bnbnhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe"C:\Users\Admin\AppData\Local\Temp\a357d1cf9a73373b436220c52a127800fca57127b6479653db3a90e08b894806N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\bnbttn.exec:\bnbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\7pvvv.exec:\7pvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\042480.exec:\042480.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\040680.exec:\040680.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xlllxrr.exec:\xlllxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\3dpvv.exec:\3dpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\20280.exec:\20280.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\bntbtt.exec:\bntbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\9jdjj.exec:\9jdjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\rrxrlxx.exec:\rrxrlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tbntnn.exec:\tbntnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\xlfllff.exec:\xlfllff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\e46800.exec:\e46800.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\48288.exec:\48288.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\bnbnhn.exec:\bnbnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\5tnnbb.exec:\5tnnbb.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\1frrxxf.exec:\1frrxxf.exe19⤵
- Executes dropped EXE
PID:2248 -
\??\c:\6628022.exec:\6628022.exe20⤵
- Executes dropped EXE
PID:1308 -
\??\c:\frrflll.exec:\frrflll.exe21⤵
- Executes dropped EXE
PID:1408 -
\??\c:\ttnthh.exec:\ttnthh.exe22⤵
- Executes dropped EXE
PID:1784 -
\??\c:\9jvjj.exec:\9jvjj.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nbnbbh.exec:\nbnbbh.exe24⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dvdpd.exec:\dvdpd.exe25⤵
- Executes dropped EXE
PID:824 -
\??\c:\pjvjp.exec:\pjvjp.exe26⤵
- Executes dropped EXE
PID:2600 -
\??\c:\04262.exec:\04262.exe27⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lfxrxfl.exec:\lfxrxfl.exe28⤵
- Executes dropped EXE
PID:2528 -
\??\c:\42466.exec:\42466.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\8640884.exec:\8640884.exe30⤵
- Executes dropped EXE
PID:1120 -
\??\c:\o606684.exec:\o606684.exe31⤵
- Executes dropped EXE
PID:1428 -
\??\c:\64662.exec:\64662.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdvdv.exec:\jdvdv.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnhbhb.exec:\tnhbhb.exe34⤵
- Executes dropped EXE
PID:2476 -
\??\c:\0862880.exec:\0862880.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\206804.exec:\206804.exe36⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7rfrxrx.exec:\7rfrxrx.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\82684.exec:\82684.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9nhnbb.exec:\9nhnbb.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bnhbhb.exec:\bnhbhb.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pdpvd.exec:\pdpvd.exe41⤵
- Executes dropped EXE
PID:2308 -
\??\c:\862806.exec:\862806.exe42⤵
- Executes dropped EXE
PID:2976 -
\??\c:\k64622.exec:\k64622.exe43⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7jvvd.exec:\7jvvd.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\0888446.exec:\0888446.exe45⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nbnnnn.exec:\nbnnnn.exe46⤵
- Executes dropped EXE
PID:776 -
\??\c:\jdpvj.exec:\jdpvj.exe47⤵
- Executes dropped EXE
PID:664 -
\??\c:\660644.exec:\660644.exe48⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xlffrlr.exec:\xlffrlr.exe49⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpppv.exec:\vpppv.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\s4284.exec:\s4284.exe51⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hthtbh.exec:\hthtbh.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\640002.exec:\640002.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nbnbbh.exec:\nbnbbh.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\2022662.exec:\2022662.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\82062.exec:\82062.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9rllxxl.exec:\9rllxxl.exe57⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5bttbb.exec:\5bttbb.exe58⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jddjp.exec:\jddjp.exe59⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9fxxlrr.exec:\9fxxlrr.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tnthbh.exec:\tnthbh.exe61⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1vpvd.exec:\1vpvd.exe62⤵
- Executes dropped EXE
PID:2008 -
\??\c:\422888.exec:\422888.exe63⤵
- Executes dropped EXE
PID:2604 -
\??\c:\0882888.exec:\0882888.exe64⤵
- Executes dropped EXE
PID:2152 -
\??\c:\68662.exec:\68662.exe65⤵
- Executes dropped EXE
PID:2600 -
\??\c:\20844.exec:\20844.exe66⤵PID:2096
-
\??\c:\1lffllr.exec:\1lffllr.exe67⤵PID:2440
-
\??\c:\htntbh.exec:\htntbh.exe68⤵PID:2264
-
\??\c:\1hhbbt.exec:\1hhbbt.exe69⤵PID:1744
-
\??\c:\6020846.exec:\6020846.exe70⤵PID:1120
-
\??\c:\pvvdv.exec:\pvvdv.exe71⤵PID:2332
-
\??\c:\llfrlxl.exec:\llfrlxl.exe72⤵PID:2516
-
\??\c:\ddpvd.exec:\ddpvd.exe73⤵PID:3060
-
\??\c:\jdjdp.exec:\jdjdp.exe74⤵PID:2260
-
\??\c:\4820426.exec:\4820426.exe75⤵PID:2464
-
\??\c:\jdvjv.exec:\jdvjv.exe76⤵PID:2284
-
\??\c:\pjpvd.exec:\pjpvd.exe77⤵PID:2716
-
\??\c:\w64022.exec:\w64022.exe78⤵PID:2860
-
\??\c:\fxxxxfr.exec:\fxxxxfr.exe79⤵PID:2844
-
\??\c:\080240.exec:\080240.exe80⤵PID:3068
-
\??\c:\004202.exec:\004202.exe81⤵PID:2852
-
\??\c:\9bnnnt.exec:\9bnnnt.exe82⤵PID:2760
-
\??\c:\hhtthh.exec:\hhtthh.exe83⤵PID:1860
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe84⤵PID:2636
-
\??\c:\nbnbnb.exec:\nbnbnb.exe85⤵PID:2648
-
\??\c:\nbhntt.exec:\nbhntt.exe86⤵PID:1952
-
\??\c:\thhbnn.exec:\thhbnn.exe87⤵PID:2644
-
\??\c:\g4802.exec:\g4802.exe88⤵PID:2640
-
\??\c:\860624.exec:\860624.exe89⤵PID:3036
-
\??\c:\c468028.exec:\c468028.exe90⤵PID:2712
-
\??\c:\nhtbnn.exec:\nhtbnn.exe91⤵PID:2900
-
\??\c:\3rlllrx.exec:\3rlllrx.exe92⤵PID:2344
-
\??\c:\86002.exec:\86002.exe93⤵PID:2724
-
\??\c:\64280.exec:\64280.exe94⤵PID:3000
-
\??\c:\5vpdd.exec:\5vpdd.exe95⤵PID:2248
-
\??\c:\jvdvd.exec:\jvdvd.exe96⤵PID:1800
-
\??\c:\602404.exec:\602404.exe97⤵PID:1948
-
\??\c:\nbtbhn.exec:\nbtbhn.exe98⤵PID:2424
-
\??\c:\xrxxfxx.exec:\xrxxfxx.exe99⤵PID:236
-
\??\c:\djpvv.exec:\djpvv.exe100⤵PID:3020
-
\??\c:\9ffrflr.exec:\9ffrflr.exe101⤵PID:2088
-
\??\c:\jvpvp.exec:\jvpvp.exe102⤵PID:2092
-
\??\c:\7bnntt.exec:\7bnntt.exe103⤵PID:1760
-
\??\c:\thtnth.exec:\thtnth.exe104⤵PID:2604
-
\??\c:\hbnbbb.exec:\hbnbbb.exe105⤵PID:2152
-
\??\c:\0428480.exec:\0428480.exe106⤵
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\vpdjj.exec:\vpdjj.exe107⤵PID:1652
-
\??\c:\642628.exec:\642628.exe108⤵PID:1000
-
\??\c:\04000.exec:\04000.exe109⤵PID:1548
-
\??\c:\fflrxrx.exec:\fflrxrx.exe110⤵PID:1864
-
\??\c:\08466.exec:\08466.exe111⤵PID:2076
-
\??\c:\dvjvv.exec:\dvjvv.exe112⤵PID:2336
-
\??\c:\3bbbhn.exec:\3bbbhn.exe113⤵PID:1928
-
\??\c:\vpvdd.exec:\vpvdd.exe114⤵PID:2480
-
\??\c:\26462.exec:\26462.exe115⤵PID:2316
-
\??\c:\3tnhhn.exec:\3tnhhn.exe116⤵PID:2932
-
\??\c:\m8600.exec:\m8600.exe117⤵PID:2292
-
\??\c:\864888.exec:\864888.exe118⤵PID:2284
-
\??\c:\826022.exec:\826022.exe119⤵PID:2748
-
\??\c:\046228.exec:\046228.exe120⤵PID:2764
-
\??\c:\1bnnnn.exec:\1bnnnn.exe121⤵PID:2808
-
\??\c:\0466884.exec:\0466884.exe122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-