Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe
-
Size
453KB
-
MD5
7c4ee55372a70b6196c4e9f4e630c8f3
-
SHA1
0f74b176d10d0bf4b37aca649c3d30e4843f4324
-
SHA256
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0
-
SHA512
f69a48e34352aac3fe35d29e3c41045eddf667833d11e33803e064da38271070e5566c8edd2984c65509ff70c09175a1647b412274da7782922fe9b57622e984
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1724-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-19-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1724-17-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2688-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-169-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2932-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-190-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2732-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-293-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2780-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-329-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2676-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-511-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1320-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-528-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1524-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1724 tnhhtn.exe 2812 ppppd.exe 2688 djdpj.exe 1808 tnttbb.exe 2724 1jdjp.exe 2572 ntnbtt.exe 3068 ppjvj.exe 2540 tthhnt.exe 2220 vpjpj.exe 2652 bhntbb.exe 2284 dvjjp.exe 2768 5httbh.exe 2860 ttnbhn.exe 2864 ddpjv.exe 2952 hhtbnn.exe 532 flrrffr.exe 2932 3xxxrrl.exe 604 7ththh.exe 1816 flfrllf.exe 2748 jjjvp.exe 2732 5pvjp.exe 1256 7ddpv.exe 1320 llfxflx.exe 1708 ttnnbb.exe 632 jdvpd.exe 1040 tnhbhh.exe 792 7jddv.exe 2968 lxrrrrf.exe 2288 nnhttt.exe 2312 ffffllx.exe 1436 bhhnhn.exe 1268 rrllxfl.exe 2704 xfxllxl.exe 1724 btbbtt.exe 2684 5vppd.exe 2780 fxlllrx.exe 2092 xrllxlf.exe 2668 tnbhnh.exe 1528 vpppp.exe 2676 7lxflrx.exe 2212 hbtbtb.exe 3068 djvvd.exe 2964 pvjjv.exe 624 1rfxxxf.exe 1124 hbnthn.exe 2900 vpjjd.exe 2892 ddvdj.exe 2448 rllrxfl.exe 1088 tnhtbh.exe 2936 pvpvj.exe 2052 vvpdj.exe 784 ffrrfrr.exe 532 hhthbh.exe 1912 jjjpv.exe 2412 xxrxxfr.exe 2352 rlfrrxf.exe 2260 hhttth.exe 2132 7vppp.exe 1660 9vjvp.exe 1712 xrrrxxf.exe 592 nnbhtb.exe 1548 ddppd.exe 1320 dvppd.exe 1540 rrlxrrx.exe -
resource yara_rule behavioral1/memory/1724-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-329-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2676-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-511-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1320-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-751-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1724 2420 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 2420 wrote to memory of 1724 2420 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 2420 wrote to memory of 1724 2420 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 2420 wrote to memory of 1724 2420 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 1724 wrote to memory of 2812 1724 tnhhtn.exe 31 PID 1724 wrote to memory of 2812 1724 tnhhtn.exe 31 PID 1724 wrote to memory of 2812 1724 tnhhtn.exe 31 PID 1724 wrote to memory of 2812 1724 tnhhtn.exe 31 PID 2812 wrote to memory of 2688 2812 ppppd.exe 32 PID 2812 wrote to memory of 2688 2812 ppppd.exe 32 PID 2812 wrote to memory of 2688 2812 ppppd.exe 32 PID 2812 wrote to memory of 2688 2812 ppppd.exe 32 PID 2688 wrote to memory of 1808 2688 djdpj.exe 33 PID 2688 wrote to memory of 1808 2688 djdpj.exe 33 PID 2688 wrote to memory of 1808 2688 djdpj.exe 33 PID 2688 wrote to memory of 1808 2688 djdpj.exe 33 PID 1808 wrote to memory of 2724 1808 tnttbb.exe 34 PID 1808 wrote to memory of 2724 1808 tnttbb.exe 34 PID 1808 wrote to memory of 2724 1808 tnttbb.exe 34 PID 1808 wrote to memory of 2724 1808 tnttbb.exe 34 PID 2724 wrote to memory of 2572 2724 1jdjp.exe 35 PID 2724 wrote to memory of 2572 2724 1jdjp.exe 35 PID 2724 wrote to memory of 2572 2724 1jdjp.exe 35 PID 2724 wrote to memory of 2572 2724 1jdjp.exe 35 PID 2572 wrote to memory of 3068 2572 ntnbtt.exe 36 PID 2572 wrote to memory of 3068 2572 ntnbtt.exe 36 PID 2572 wrote to memory of 3068 2572 ntnbtt.exe 36 PID 2572 wrote to memory of 3068 2572 ntnbtt.exe 36 PID 3068 wrote to memory of 2540 3068 ppjvj.exe 37 PID 3068 wrote to memory of 2540 3068 ppjvj.exe 37 PID 3068 wrote to memory of 2540 3068 ppjvj.exe 37 PID 3068 wrote to memory of 2540 3068 ppjvj.exe 37 PID 2540 wrote to memory of 2220 2540 tthhnt.exe 38 PID 2540 wrote to memory of 2220 2540 tthhnt.exe 38 PID 2540 wrote to memory of 2220 2540 tthhnt.exe 38 PID 2540 wrote to memory of 2220 2540 tthhnt.exe 38 PID 2220 wrote to memory of 2652 2220 vpjpj.exe 39 PID 2220 wrote to memory of 2652 2220 vpjpj.exe 39 PID 2220 wrote to memory of 2652 2220 vpjpj.exe 39 PID 2220 wrote to memory of 2652 2220 vpjpj.exe 39 PID 2652 wrote to memory of 2284 2652 bhntbb.exe 40 PID 2652 wrote to memory of 2284 2652 bhntbb.exe 40 PID 2652 wrote to memory of 2284 2652 bhntbb.exe 40 PID 2652 wrote to memory of 2284 2652 bhntbb.exe 40 PID 2284 wrote to memory of 2768 2284 dvjjp.exe 41 PID 2284 wrote to memory of 2768 2284 dvjjp.exe 41 PID 2284 wrote to memory of 2768 2284 dvjjp.exe 41 PID 2284 wrote to memory of 2768 2284 dvjjp.exe 41 PID 2768 wrote to memory of 2860 2768 5httbh.exe 42 PID 2768 wrote to memory of 2860 2768 5httbh.exe 42 PID 2768 wrote to memory of 2860 2768 5httbh.exe 42 PID 2768 wrote to memory of 2860 2768 5httbh.exe 42 PID 2860 wrote to memory of 2864 2860 ttnbhn.exe 43 PID 2860 wrote to memory of 2864 2860 ttnbhn.exe 43 PID 2860 wrote to memory of 2864 2860 ttnbhn.exe 43 PID 2860 wrote to memory of 2864 2860 ttnbhn.exe 43 PID 2864 wrote to memory of 2952 2864 ddpjv.exe 44 PID 2864 wrote to memory of 2952 2864 ddpjv.exe 44 PID 2864 wrote to memory of 2952 2864 ddpjv.exe 44 PID 2864 wrote to memory of 2952 2864 ddpjv.exe 44 PID 2952 wrote to memory of 532 2952 hhtbnn.exe 45 PID 2952 wrote to memory of 532 2952 hhtbnn.exe 45 PID 2952 wrote to memory of 532 2952 hhtbnn.exe 45 PID 2952 wrote to memory of 532 2952 hhtbnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe"C:\Users\Admin\AppData\Local\Temp\4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tnhhtn.exec:\tnhhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ppppd.exec:\ppppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\djdpj.exec:\djdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\tnttbb.exec:\tnttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\1jdjp.exec:\1jdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\ntnbtt.exec:\ntnbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ppjvj.exec:\ppjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\tthhnt.exec:\tthhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vpjpj.exec:\vpjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\bhntbb.exec:\bhntbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\dvjjp.exec:\dvjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\5httbh.exec:\5httbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ttnbhn.exec:\ttnbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ddpjv.exec:\ddpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hhtbnn.exec:\hhtbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\flrrffr.exec:\flrrffr.exe17⤵
- Executes dropped EXE
PID:532 -
\??\c:\3xxxrrl.exec:\3xxxrrl.exe18⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7ththh.exec:\7ththh.exe19⤵
- Executes dropped EXE
PID:604 -
\??\c:\flfrllf.exec:\flfrllf.exe20⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jjjvp.exec:\jjjvp.exe21⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5pvjp.exec:\5pvjp.exe22⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7ddpv.exec:\7ddpv.exe23⤵
- Executes dropped EXE
PID:1256 -
\??\c:\llfxflx.exec:\llfxflx.exe24⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ttnnbb.exec:\ttnnbb.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jdvpd.exec:\jdvpd.exe26⤵
- Executes dropped EXE
PID:632 -
\??\c:\tnhbhh.exec:\tnhbhh.exe27⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7jddv.exec:\7jddv.exe28⤵
- Executes dropped EXE
PID:792 -
\??\c:\lxrrrrf.exec:\lxrrrrf.exe29⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nnhttt.exec:\nnhttt.exe30⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ffffllx.exec:\ffffllx.exe31⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bhhnhn.exec:\bhhnhn.exe32⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rrllxfl.exec:\rrllxfl.exe33⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xfxllxl.exec:\xfxllxl.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\btbbtt.exec:\btbbtt.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5vppd.exec:\5vppd.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fxlllrx.exec:\fxlllrx.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrllxlf.exec:\xrllxlf.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\tnbhnh.exec:\tnbhnh.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vpppp.exec:\vpppp.exe40⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7lxflrx.exec:\7lxflrx.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hbtbtb.exec:\hbtbtb.exe42⤵
- Executes dropped EXE
PID:2212 -
\??\c:\djvvd.exec:\djvvd.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvjjv.exec:\pvjjv.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1rfxxxf.exec:\1rfxxxf.exe45⤵
- Executes dropped EXE
PID:624 -
\??\c:\hbnthn.exec:\hbnthn.exe46⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vpjjd.exec:\vpjjd.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ddvdj.exec:\ddvdj.exe48⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rllrxfl.exec:\rllrxfl.exe49⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tnhtbh.exec:\tnhtbh.exe50⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pvpvj.exec:\pvpvj.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vvpdj.exec:\vvpdj.exe52⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ffrrfrr.exec:\ffrrfrr.exe53⤵
- Executes dropped EXE
PID:784 -
\??\c:\hhthbh.exec:\hhthbh.exe54⤵
- Executes dropped EXE
PID:532 -
\??\c:\jjjpv.exec:\jjjpv.exe55⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xxrxxfr.exec:\xxrxxfr.exe56⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe57⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hhttth.exec:\hhttth.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7vppp.exec:\7vppp.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9vjvp.exec:\9vjvp.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe61⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nnbhtb.exec:\nnbhtb.exe62⤵
- Executes dropped EXE
PID:592 -
\??\c:\ddppd.exec:\ddppd.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dvppd.exec:\dvppd.exe64⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rrlxrrx.exec:\rrlxrrx.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lflffrf.exec:\lflffrf.exe66⤵PID:844
-
\??\c:\thnnbh.exec:\thnnbh.exe67⤵PID:1524
-
\??\c:\jjdvj.exec:\jjdvj.exe68⤵PID:2488
-
\??\c:\ffxflrx.exec:\ffxflrx.exe69⤵PID:2520
-
\??\c:\thtbhb.exec:\thtbhb.exe70⤵PID:2432
-
\??\c:\9pddj.exec:\9pddj.exe71⤵
- System Location Discovery: System Language Discovery
PID:2040 -
\??\c:\vpjdp.exec:\vpjdp.exe72⤵PID:912
-
\??\c:\7rlfxxf.exec:\7rlfxxf.exe73⤵PID:2168
-
\??\c:\tnbbnt.exec:\tnbbnt.exe74⤵PID:2660
-
\??\c:\vdddj.exec:\vdddj.exe75⤵PID:1756
-
\??\c:\1dppp.exec:\1dppp.exe76⤵PID:2712
-
\??\c:\1xllllx.exec:\1xllllx.exe77⤵PID:2164
-
\??\c:\nhtbnn.exec:\nhtbnn.exe78⤵PID:2908
-
\??\c:\nnhhhn.exec:\nnhhhn.exe79⤵PID:2780
-
\??\c:\dvpvj.exec:\dvpvj.exe80⤵PID:2092
-
\??\c:\rlxxfrx.exec:\rlxxfrx.exe81⤵PID:2568
-
\??\c:\lllxxrf.exec:\lllxxrf.exe82⤵PID:1528
-
\??\c:\tthnbb.exec:\tthnbb.exe83⤵PID:2676
-
\??\c:\3vppv.exec:\3vppv.exe84⤵PID:2824
-
\??\c:\7xlflrf.exec:\7xlflrf.exe85⤵PID:1824
-
\??\c:\nhbbbt.exec:\nhbbbt.exe86⤵PID:3060
-
\??\c:\nhbbbh.exec:\nhbbbh.exe87⤵PID:1636
-
\??\c:\ddpvp.exec:\ddpvp.exe88⤵PID:2876
-
\??\c:\llllrxf.exec:\llllrxf.exe89⤵PID:2656
-
\??\c:\hhbbhb.exec:\hhbbhb.exe90⤵PID:2884
-
\??\c:\bhbbnn.exec:\bhbbnn.exe91⤵PID:2868
-
\??\c:\jvpdp.exec:\jvpdp.exe92⤵PID:1100
-
\??\c:\ffllrrr.exec:\ffllrrr.exe93⤵PID:2880
-
\??\c:\fxrxxlx.exec:\fxrxxlx.exe94⤵PID:1684
-
\??\c:\ntntnn.exec:\ntntnn.exe95⤵PID:332
-
\??\c:\1pddj.exec:\1pddj.exe96⤵PID:1104
-
\??\c:\1lflrxl.exec:\1lflrxl.exe97⤵PID:2920
-
\??\c:\frllrrf.exec:\frllrrf.exe98⤵PID:2404
-
\??\c:\bbtbhh.exec:\bbtbhh.exe99⤵PID:1848
-
\??\c:\pjjvp.exec:\pjjvp.exe100⤵PID:2388
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe101⤵PID:2132
-
\??\c:\bthntb.exec:\bthntb.exe102⤵PID:2240
-
\??\c:\pdpvp.exec:\pdpvp.exe103⤵PID:2360
-
\??\c:\7dddv.exec:\7dddv.exe104⤵PID:1532
-
\??\c:\lrxfrrx.exec:\lrxfrrx.exe105⤵PID:2060
-
\??\c:\9bhhnb.exec:\9bhhnb.exe106⤵PID:2068
-
\??\c:\9hbnnt.exec:\9hbnnt.exe107⤵PID:632
-
\??\c:\pjvdd.exec:\pjvdd.exe108⤵PID:2280
-
\??\c:\5lffflr.exec:\5lffflr.exe109⤵PID:2484
-
\??\c:\nntnbt.exec:\nntnbt.exe110⤵PID:2488
-
\??\c:\tnbnhh.exec:\tnbnhh.exe111⤵PID:3024
-
\??\c:\pvjpv.exec:\pvjpv.exe112⤵PID:2456
-
\??\c:\llfllrx.exec:\llfllrx.exe113⤵PID:1980
-
\??\c:\xrffflx.exec:\xrffflx.exe114⤵PID:1608
-
\??\c:\tbhntn.exec:\tbhntn.exe115⤵PID:2700
-
\??\c:\1jppv.exec:\1jppv.exe116⤵PID:1364
-
\??\c:\pjvvj.exec:\pjvvj.exe117⤵PID:1724
-
\??\c:\lfllffl.exec:\lfllffl.exe118⤵PID:2684
-
\??\c:\tthhnn.exec:\tthhnn.exe119⤵PID:2916
-
\??\c:\ntbhnn.exec:\ntbhnn.exe120⤵PID:2576
-
\??\c:\rlrxffr.exec:\rlrxffr.exe121⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-