Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:32
Behavioral task
behavioral1
Sample
b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe
-
Size
335KB
-
MD5
68dcfb28633b2e07c6eb42f10e53c5d0
-
SHA1
7243f8edb45339bc3e8c6257068b78a8fbd46879
-
SHA256
b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85
-
SHA512
5164ae48d8239a2f7b97799741d94d6c7621bd9c5fa1cb5800b4bab9f439809b02d91fd8735752acb9f5c69258ed7111d9b7c88b69017b2a53f912419c977662
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRn:R4wFHoSHYHUrAwfMp3CDRn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2712-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-19-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1672-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-147-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/396-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-265-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2124-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-327-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-381-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-383-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-420-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1152-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-432-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2932-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-449-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2980-483-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1868-535-0x00000000002F0000-0x0000000000317000-memory.dmp family_blackmoon behavioral1/memory/2148-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-699-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1080-741-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1280-774-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2216-778-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2052-793-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2128-809-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2356-841-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1676-852-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1948 nnhnht.exe 2492 3pjjp.exe 2340 ppjvv.exe 1672 jdppd.exe 2020 486224.exe 2460 bbbnnn.exe 2588 lxrrllx.exe 3012 6462446.exe 2512 nhtbhh.exe 2904 k86466.exe 624 04008.exe 2632 08886.exe 1332 888068.exe 1684 m6400.exe 1628 046688.exe 2616 vjppp.exe 320 c288824.exe 396 pdjdp.exe 2696 q42400.exe 1964 dpjpd.exe 1812 046846.exe 2968 dvpdv.exe 3068 48208.exe 1080 62248.exe 2104 djdvp.exe 308 pdvvj.exe 940 0844488.exe 756 3pddj.exe 1720 0084440.exe 1100 602462.exe 696 ppjvp.exe 2124 888848.exe 2088 9pjvp.exe 888 c644006.exe 2404 a4202.exe 2348 3djdd.exe 2160 02200.exe 1556 044688.exe 1588 9bbnbh.exe 2044 4862002.exe 2344 1djpv.exe 1128 nbnthb.exe 2324 4866828.exe 2392 nhnnnn.exe 2424 q24860.exe 2856 jdvjv.exe 2752 488084.exe 2888 0602002.exe 2200 242200.exe 2972 84644.exe 2824 82284.exe 2640 o266280.exe 2748 862620.exe 2212 0682806.exe 2644 i428024.exe 668 60802.exe 2928 82006.exe 2892 e04684.exe 1756 0804480.exe 1152 xrflxfr.exe 2900 g4684.exe 2932 vvpdd.exe 1804 ttnnht.exe 1444 3nnttb.exe -
resource yara_rule behavioral1/memory/2712-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012244-8.dat upx behavioral1/memory/1948-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2340-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d66-25.dat upx behavioral1/files/0x0007000000016dc0-32.dat upx behavioral1/memory/2492-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d4a-16.dat upx behavioral1/files/0x0007000000016dc8-40.dat upx behavioral1/memory/1672-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ea1-49.dat upx behavioral1/memory/2460-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017021-56.dat upx behavioral1/files/0x0008000000017466-65.dat upx behavioral1/memory/2588-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019581-72.dat upx behavioral1/memory/2512-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c0-81.dat upx behavioral1/memory/2904-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195f7-89.dat upx behavioral1/files/0x00050000000195f9-98.dat upx behavioral1/memory/624-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195fb-105.dat upx behavioral1/files/0x0009000000016d3b-113.dat upx behavioral1/files/0x00050000000195fd-121.dat upx behavioral1/files/0x00050000000195fe-129.dat upx behavioral1/memory/1628-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ff-137.dat upx behavioral1/memory/320-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2616-136-0x00000000003B0000-0x00000000003D7000-memory.dmp upx behavioral1/memory/2616-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/320-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019601-148.dat upx behavioral1/memory/396-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019603-156.dat upx behavioral1/files/0x0005000000019605-164.dat upx behavioral1/files/0x0005000000019615-171.dat upx behavioral1/memory/1964-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019659-180.dat upx behavioral1/files/0x000500000001969b-187.dat upx behavioral1/memory/3068-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1080-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196ed-195.dat upx behavioral1/files/0x0005000000019999-203.dat upx behavioral1/memory/2104-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c32-211.dat upx behavioral1/files/0x0005000000019c34-218.dat upx behavioral1/memory/940-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c36-225.dat upx behavioral1/files/0x0005000000019c50-233.dat upx behavioral1/memory/1720-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d18-242.dat upx behavioral1/files/0x0005000000019d40-251.dat upx behavioral1/files/0x0005000000019da9-259.dat upx behavioral1/memory/2124-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/888-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2160-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2160-299-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rflrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 606688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0828440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8206224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 1948 2712 b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe 30 PID 2712 wrote to memory of 1948 2712 b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe 30 PID 2712 wrote to memory of 1948 2712 b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe 30 PID 2712 wrote to memory of 1948 2712 b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe 30 PID 1948 wrote to memory of 2492 1948 nnhnht.exe 31 PID 1948 wrote to memory of 2492 1948 nnhnht.exe 31 PID 1948 wrote to memory of 2492 1948 nnhnht.exe 31 PID 1948 wrote to memory of 2492 1948 nnhnht.exe 31 PID 2492 wrote to memory of 2340 2492 3pjjp.exe 32 PID 2492 wrote to memory of 2340 2492 3pjjp.exe 32 PID 2492 wrote to memory of 2340 2492 3pjjp.exe 32 PID 2492 wrote to memory of 2340 2492 3pjjp.exe 32 PID 2340 wrote to memory of 1672 2340 ppjvv.exe 33 PID 2340 wrote to memory of 1672 2340 ppjvv.exe 33 PID 2340 wrote to memory of 1672 2340 ppjvv.exe 33 PID 2340 wrote to memory of 1672 2340 ppjvv.exe 33 PID 1672 wrote to memory of 2020 1672 jdppd.exe 34 PID 1672 wrote to memory of 2020 1672 jdppd.exe 34 PID 1672 wrote to memory of 2020 1672 jdppd.exe 34 PID 1672 wrote to memory of 2020 1672 jdppd.exe 34 PID 2020 wrote to memory of 2460 2020 486224.exe 35 PID 2020 wrote to memory of 2460 2020 486224.exe 35 PID 2020 wrote to memory of 2460 2020 486224.exe 35 PID 2020 wrote to memory of 2460 2020 486224.exe 35 PID 2460 wrote to memory of 2588 2460 bbbnnn.exe 36 PID 2460 wrote to memory of 2588 2460 bbbnnn.exe 36 PID 2460 wrote to memory of 2588 2460 bbbnnn.exe 36 PID 2460 wrote to memory of 2588 2460 bbbnnn.exe 36 PID 2588 wrote to memory of 3012 2588 lxrrllx.exe 37 PID 2588 wrote to memory of 3012 2588 lxrrllx.exe 37 PID 2588 wrote to memory of 3012 2588 lxrrllx.exe 37 PID 2588 wrote to memory of 3012 2588 lxrrllx.exe 37 PID 3012 wrote to memory of 2512 3012 6462446.exe 38 PID 3012 wrote to memory of 2512 3012 6462446.exe 38 PID 3012 wrote to memory of 2512 3012 6462446.exe 38 PID 3012 wrote to memory of 2512 3012 6462446.exe 38 PID 2512 wrote to memory of 2904 2512 nhtbhh.exe 39 PID 2512 wrote to memory of 2904 2512 nhtbhh.exe 39 PID 2512 wrote to memory of 2904 2512 nhtbhh.exe 39 PID 2512 wrote to memory of 2904 2512 nhtbhh.exe 39 PID 2904 wrote to memory of 624 2904 k86466.exe 40 PID 2904 wrote to memory of 624 2904 k86466.exe 40 PID 2904 wrote to memory of 624 2904 k86466.exe 40 PID 2904 wrote to memory of 624 2904 k86466.exe 40 PID 624 wrote to memory of 2632 624 04008.exe 41 PID 624 wrote to memory of 2632 624 04008.exe 41 PID 624 wrote to memory of 2632 624 04008.exe 41 PID 624 wrote to memory of 2632 624 04008.exe 41 PID 2632 wrote to memory of 1332 2632 08886.exe 42 PID 2632 wrote to memory of 1332 2632 08886.exe 42 PID 2632 wrote to memory of 1332 2632 08886.exe 42 PID 2632 wrote to memory of 1332 2632 08886.exe 42 PID 1332 wrote to memory of 1684 1332 888068.exe 43 PID 1332 wrote to memory of 1684 1332 888068.exe 43 PID 1332 wrote to memory of 1684 1332 888068.exe 43 PID 1332 wrote to memory of 1684 1332 888068.exe 43 PID 1684 wrote to memory of 1628 1684 m6400.exe 44 PID 1684 wrote to memory of 1628 1684 m6400.exe 44 PID 1684 wrote to memory of 1628 1684 m6400.exe 44 PID 1684 wrote to memory of 1628 1684 m6400.exe 44 PID 1628 wrote to memory of 2616 1628 046688.exe 45 PID 1628 wrote to memory of 2616 1628 046688.exe 45 PID 1628 wrote to memory of 2616 1628 046688.exe 45 PID 1628 wrote to memory of 2616 1628 046688.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe"C:\Users\Admin\AppData\Local\Temp\b9e05be5be5f8e167a54ec8dad56861516f8370241dc7069899ab4c525e5ab85N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nnhnht.exec:\nnhnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\3pjjp.exec:\3pjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ppjvv.exec:\ppjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\jdppd.exec:\jdppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\486224.exec:\486224.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\bbbnnn.exec:\bbbnnn.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\lxrrllx.exec:\lxrrllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\6462446.exec:\6462446.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\nhtbhh.exec:\nhtbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\k86466.exec:\k86466.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\04008.exec:\04008.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\08886.exec:\08886.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\888068.exec:\888068.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\m6400.exec:\m6400.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\046688.exec:\046688.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vjppp.exec:\vjppp.exe17⤵
- Executes dropped EXE
PID:2616 -
\??\c:\c288824.exec:\c288824.exe18⤵
- Executes dropped EXE
PID:320 -
\??\c:\pdjdp.exec:\pdjdp.exe19⤵
- Executes dropped EXE
PID:396 -
\??\c:\q42400.exec:\q42400.exe20⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dpjpd.exec:\dpjpd.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\046846.exec:\046846.exe22⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dvpdv.exec:\dvpdv.exe23⤵
- Executes dropped EXE
PID:2968 -
\??\c:\48208.exec:\48208.exe24⤵
- Executes dropped EXE
PID:3068 -
\??\c:\62248.exec:\62248.exe25⤵
- Executes dropped EXE
PID:1080 -
\??\c:\djdvp.exec:\djdvp.exe26⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pdvvj.exec:\pdvvj.exe27⤵
- Executes dropped EXE
PID:308 -
\??\c:\0844488.exec:\0844488.exe28⤵
- Executes dropped EXE
PID:940 -
\??\c:\3pddj.exec:\3pddj.exe29⤵
- Executes dropped EXE
PID:756 -
\??\c:\0084440.exec:\0084440.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\602462.exec:\602462.exe31⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ppjvp.exec:\ppjvp.exe32⤵
- Executes dropped EXE
PID:696 -
\??\c:\888848.exec:\888848.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9pjvp.exec:\9pjvp.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\c644006.exec:\c644006.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\a4202.exec:\a4202.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3djdd.exec:\3djdd.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\02200.exec:\02200.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\044688.exec:\044688.exe39⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9bbnbh.exec:\9bbnbh.exe40⤵
- Executes dropped EXE
PID:1588 -
\??\c:\4862002.exec:\4862002.exe41⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1djpv.exec:\1djpv.exe42⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nbnthb.exec:\nbnthb.exe43⤵
- Executes dropped EXE
PID:1128 -
\??\c:\4866828.exec:\4866828.exe44⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nhnnnn.exec:\nhnnnn.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\q24860.exec:\q24860.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jdvjv.exec:\jdvjv.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\488084.exec:\488084.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\0602002.exec:\0602002.exe49⤵
- Executes dropped EXE
PID:2888 -
\??\c:\242200.exec:\242200.exe50⤵
- Executes dropped EXE
PID:2200 -
\??\c:\84644.exec:\84644.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\82284.exec:\82284.exe52⤵
- Executes dropped EXE
PID:2824 -
\??\c:\o266280.exec:\o266280.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\862620.exec:\862620.exe54⤵
- Executes dropped EXE
PID:2748 -
\??\c:\0682806.exec:\0682806.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\i428024.exec:\i428024.exe56⤵
- Executes dropped EXE
PID:2644 -
\??\c:\60802.exec:\60802.exe57⤵
- Executes dropped EXE
PID:668 -
\??\c:\82006.exec:\82006.exe58⤵
- Executes dropped EXE
PID:2928 -
\??\c:\e04684.exec:\e04684.exe59⤵
- Executes dropped EXE
PID:2892 -
\??\c:\0804480.exec:\0804480.exe60⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xrflxfr.exec:\xrflxfr.exe61⤵
- Executes dropped EXE
PID:1152 -
\??\c:\g4684.exec:\g4684.exe62⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvpdd.exec:\vvpdd.exe63⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ttnnht.exec:\ttnnht.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\3nnttb.exec:\3nnttb.exe65⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3bhhhh.exec:\3bhhhh.exe66⤵PID:2276
-
\??\c:\2448242.exec:\2448242.exe67⤵PID:2820
-
\??\c:\7rxxxxf.exec:\7rxxxxf.exe68⤵PID:2980
-
\??\c:\2602462.exec:\2602462.exe69⤵PID:448
-
\??\c:\s0266.exec:\s0266.exe70⤵PID:1304
-
\??\c:\1vpvd.exec:\1vpvd.exe71⤵PID:2536
-
\??\c:\g4224.exec:\g4224.exe72⤵PID:1368
-
\??\c:\0428440.exec:\0428440.exe73⤵PID:1692
-
\??\c:\264004.exec:\264004.exe74⤵PID:648
-
\??\c:\824022.exec:\824022.exe75⤵PID:1356
-
\??\c:\00286.exec:\00286.exe76⤵PID:1524
-
\??\c:\9dpvp.exec:\9dpvp.exe77⤵PID:1720
-
\??\c:\i240662.exec:\i240662.exe78⤵PID:1868
-
\??\c:\rrxfxrx.exec:\rrxfxrx.exe79⤵PID:2516
-
\??\c:\xrflrxr.exec:\xrflrxr.exe80⤵PID:696
-
\??\c:\pppjd.exec:\pppjd.exe81⤵PID:2440
-
\??\c:\vpjjp.exec:\vpjjp.exe82⤵PID:2228
-
\??\c:\lfxfffl.exec:\lfxfffl.exe83⤵PID:2604
-
\??\c:\7jpvp.exec:\7jpvp.exe84⤵PID:1960
-
\??\c:\2660680.exec:\2660680.exe85⤵PID:2404
-
\??\c:\220628.exec:\220628.exe86⤵PID:3056
-
\??\c:\3ththn.exec:\3ththn.exe87⤵PID:1948
-
\??\c:\42406.exec:\42406.exe88⤵PID:3060
-
\??\c:\9htbhb.exec:\9htbhb.exe89⤵PID:3000
-
\??\c:\826240.exec:\826240.exe90⤵PID:2312
-
\??\c:\g2068.exec:\g2068.exe91⤵PID:2044
-
\??\c:\xrlrffl.exec:\xrlrffl.exe92⤵PID:2568
-
\??\c:\frrlllr.exec:\frrlllr.exe93⤵PID:1128
-
\??\c:\g4606.exec:\g4606.exe94⤵PID:2720
-
\??\c:\thnhhb.exec:\thnhhb.exe95⤵PID:2392
-
\??\c:\6484668.exec:\6484668.exe96⤵PID:2424
-
\??\c:\7pvdp.exec:\7pvdp.exe97⤵PID:2868
-
\??\c:\s8066.exec:\s8066.exe98⤵PID:2760
-
\??\c:\64664.exec:\64664.exe99⤵PID:2744
-
\??\c:\c066848.exec:\c066848.exe100⤵PID:2988
-
\??\c:\jddjj.exec:\jddjj.exe101⤵PID:2652
-
\??\c:\dvddv.exec:\dvddv.exe102⤵PID:2740
-
\??\c:\w62288.exec:\w62288.exe103⤵PID:2648
-
\??\c:\0486024.exec:\0486024.exe104⤵PID:2148
-
\??\c:\llflxxf.exec:\llflxxf.exe105⤵PID:2484
-
\??\c:\9ddjv.exec:\9ddjv.exe106⤵PID:380
-
\??\c:\dvpvv.exec:\dvpvv.exe107⤵
- System Location Discovery: System Language Discovery
PID:1340 -
\??\c:\0800206.exec:\0800206.exe108⤵PID:1664
-
\??\c:\tnnhhh.exec:\tnnhhh.exe109⤵PID:1540
-
\??\c:\028400.exec:\028400.exe110⤵PID:1224
-
\??\c:\5jvvv.exec:\5jvvv.exe111⤵PID:764
-
\??\c:\xlllllr.exec:\xlllllr.exe112⤵PID:1564
-
\??\c:\1pvdd.exec:\1pvdd.exe113⤵PID:2696
-
\??\c:\u684484.exec:\u684484.exe114⤵PID:1808
-
\??\c:\htntnt.exec:\htntnt.exe115⤵PID:1408
-
\??\c:\3tnhnb.exec:\3tnhnb.exe116⤵PID:1816
-
\??\c:\22242.exec:\22242.exe117⤵PID:1812
-
\??\c:\82668.exec:\82668.exe118⤵PID:1484
-
\??\c:\66806.exec:\66806.exe119⤵PID:1028
-
\??\c:\dvppj.exec:\dvppj.exe120⤵PID:1080
-
\??\c:\hbhnnh.exec:\hbhnnh.exe121⤵PID:1304
-
\??\c:\826828.exec:\826828.exe122⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-