Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe
-
Size
454KB
-
MD5
0162ba193f4475d9b9a1a039efc11ef7
-
SHA1
33f480b203f23096feb996097c1033589ebbf8b7
-
SHA256
d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06
-
SHA512
0a9885636a38f43c5f93935fd18ac6e8a4be1c2f9b100086a269dfbb678effe4b8fa0df4183e0585e52f7325ec293316cf53e5c3551aab749033ab52541ab4c8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-12-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2468-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2188-34-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-219-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2216-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-408-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/320-410-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1996-413-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2360-424-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2360-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-445-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-457-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-505-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1788-508-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/328-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-557-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-565-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-614-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2556-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-659-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1868-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-751-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2416-760-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1528-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-805-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2328-840-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2552-899-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1160 3tnhhb.exe 2468 dvpvj.exe 2188 1hbbbh.exe 2640 1jvjp.exe 2732 nnbhtt.exe 2912 jjpjp.exe 2768 nnhtnt.exe 2584 9pddd.exe 2604 9lflrxr.exe 2212 btntbh.exe 1092 bhhtnt.exe 1780 xrlrffl.exe 1972 nhhhnn.exe 2592 jvppp.exe 1400 httbhb.exe 1952 rxrflff.exe 756 rlflxxf.exe 2848 5btbhh.exe 2568 pjjdp.exe 2944 5xfrxxr.exe 788 hntnnn.exe 1860 vdjdj.exe 2136 xxxxlrl.exe 560 nnnttb.exe 2132 ddjdp.exe 2216 ffxlxrf.exe 2976 tbbnbt.exe 1012 btnbhh.exe 3048 vpjdv.exe 1844 lllxlxr.exe 2256 bhhtht.exe 2904 tthtnn.exe 1592 7bhnbh.exe 2028 jddpj.exe 1988 xxxfflf.exe 2188 nhttbn.exe 2640 hhtnht.exe 2656 dvpdj.exe 2336 rrflrxl.exe 2868 3nhbtt.exe 2724 ttbhbh.exe 2752 jddjv.exe 2544 1frxrrf.exe 2548 9hbbnn.exe 2604 ttnhtn.exe 1676 jjjvj.exe 1800 xffrlxr.exe 2260 tnhnbt.exe 320 1pjdj.exe 1996 rllllxl.exe 2360 1lrxrxl.exe 1724 bbthtb.exe 1200 jvpjd.exe 2872 3lxfrrf.exe 2200 xrlrxlx.exe 2412 hnthhb.exe 2944 dddjv.exe 2052 xxxllxr.exe 956 3fxxxxl.exe 2144 bbtbhn.exe 912 pppdj.exe 1424 rlfrflx.exe 2136 ffxlxfl.exe 1788 nntnbt.exe -
resource yara_rule behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-614-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2556-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-1008-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1019-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/968-1034-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1160 2612 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 31 PID 2612 wrote to memory of 1160 2612 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 31 PID 2612 wrote to memory of 1160 2612 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 31 PID 2612 wrote to memory of 1160 2612 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 31 PID 1160 wrote to memory of 2468 1160 3tnhhb.exe 32 PID 1160 wrote to memory of 2468 1160 3tnhhb.exe 32 PID 1160 wrote to memory of 2468 1160 3tnhhb.exe 32 PID 1160 wrote to memory of 2468 1160 3tnhhb.exe 32 PID 2468 wrote to memory of 2188 2468 dvpvj.exe 33 PID 2468 wrote to memory of 2188 2468 dvpvj.exe 33 PID 2468 wrote to memory of 2188 2468 dvpvj.exe 33 PID 2468 wrote to memory of 2188 2468 dvpvj.exe 33 PID 2188 wrote to memory of 2640 2188 1hbbbh.exe 34 PID 2188 wrote to memory of 2640 2188 1hbbbh.exe 34 PID 2188 wrote to memory of 2640 2188 1hbbbh.exe 34 PID 2188 wrote to memory of 2640 2188 1hbbbh.exe 34 PID 2640 wrote to memory of 2732 2640 1jvjp.exe 35 PID 2640 wrote to memory of 2732 2640 1jvjp.exe 35 PID 2640 wrote to memory of 2732 2640 1jvjp.exe 35 PID 2640 wrote to memory of 2732 2640 1jvjp.exe 35 PID 2732 wrote to memory of 2912 2732 nnbhtt.exe 36 PID 2732 wrote to memory of 2912 2732 nnbhtt.exe 36 PID 2732 wrote to memory of 2912 2732 nnbhtt.exe 36 PID 2732 wrote to memory of 2912 2732 nnbhtt.exe 36 PID 2912 wrote to memory of 2768 2912 jjpjp.exe 37 PID 2912 wrote to memory of 2768 2912 jjpjp.exe 37 PID 2912 wrote to memory of 2768 2912 jjpjp.exe 37 PID 2912 wrote to memory of 2768 2912 jjpjp.exe 37 PID 2768 wrote to memory of 2584 2768 nnhtnt.exe 38 PID 2768 wrote to memory of 2584 2768 nnhtnt.exe 38 PID 2768 wrote to memory of 2584 2768 nnhtnt.exe 38 PID 2768 wrote to memory of 2584 2768 nnhtnt.exe 38 PID 2584 wrote to memory of 2604 2584 9pddd.exe 39 PID 2584 wrote to memory of 2604 2584 9pddd.exe 39 PID 2584 wrote to memory of 2604 2584 9pddd.exe 39 PID 2584 wrote to memory of 2604 2584 9pddd.exe 39 PID 2604 wrote to memory of 2212 2604 9lflrxr.exe 40 PID 2604 wrote to memory of 2212 2604 9lflrxr.exe 40 PID 2604 wrote to memory of 2212 2604 9lflrxr.exe 40 PID 2604 wrote to memory of 2212 2604 9lflrxr.exe 40 PID 2212 wrote to memory of 1092 2212 btntbh.exe 41 PID 2212 wrote to memory of 1092 2212 btntbh.exe 41 PID 2212 wrote to memory of 1092 2212 btntbh.exe 41 PID 2212 wrote to memory of 1092 2212 btntbh.exe 41 PID 1092 wrote to memory of 1780 1092 bhhtnt.exe 42 PID 1092 wrote to memory of 1780 1092 bhhtnt.exe 42 PID 1092 wrote to memory of 1780 1092 bhhtnt.exe 42 PID 1092 wrote to memory of 1780 1092 bhhtnt.exe 42 PID 1780 wrote to memory of 1972 1780 xrlrffl.exe 43 PID 1780 wrote to memory of 1972 1780 xrlrffl.exe 43 PID 1780 wrote to memory of 1972 1780 xrlrffl.exe 43 PID 1780 wrote to memory of 1972 1780 xrlrffl.exe 43 PID 1972 wrote to memory of 2592 1972 nhhhnn.exe 44 PID 1972 wrote to memory of 2592 1972 nhhhnn.exe 44 PID 1972 wrote to memory of 2592 1972 nhhhnn.exe 44 PID 1972 wrote to memory of 2592 1972 nhhhnn.exe 44 PID 2592 wrote to memory of 1400 2592 jvppp.exe 45 PID 2592 wrote to memory of 1400 2592 jvppp.exe 45 PID 2592 wrote to memory of 1400 2592 jvppp.exe 45 PID 2592 wrote to memory of 1400 2592 jvppp.exe 45 PID 1400 wrote to memory of 1952 1400 httbhb.exe 46 PID 1400 wrote to memory of 1952 1400 httbhb.exe 46 PID 1400 wrote to memory of 1952 1400 httbhb.exe 46 PID 1400 wrote to memory of 1952 1400 httbhb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe"C:\Users\Admin\AppData\Local\Temp\d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\3tnhhb.exec:\3tnhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\dvpvj.exec:\dvpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\1hbbbh.exec:\1hbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1jvjp.exec:\1jvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nnbhtt.exec:\nnbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jjpjp.exec:\jjpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nnhtnt.exec:\nnhtnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\9pddd.exec:\9pddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\9lflrxr.exec:\9lflrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\btntbh.exec:\btntbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bhhtnt.exec:\bhhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\xrlrffl.exec:\xrlrffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\nhhhnn.exec:\nhhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\jvppp.exec:\jvppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\httbhb.exec:\httbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\rxrflff.exec:\rxrflff.exe17⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rlflxxf.exec:\rlflxxf.exe18⤵
- Executes dropped EXE
PID:756 -
\??\c:\5btbhh.exec:\5btbhh.exe19⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjjdp.exec:\pjjdp.exe20⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5xfrxxr.exec:\5xfrxxr.exe21⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hntnnn.exec:\hntnnn.exe22⤵
- Executes dropped EXE
PID:788 -
\??\c:\vdjdj.exec:\vdjdj.exe23⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xxxxlrl.exec:\xxxxlrl.exe24⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nnnttb.exec:\nnnttb.exe25⤵
- Executes dropped EXE
PID:560 -
\??\c:\ddjdp.exec:\ddjdp.exe26⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ffxlxrf.exec:\ffxlxrf.exe27⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tbbnbt.exec:\tbbnbt.exe28⤵
- Executes dropped EXE
PID:2976 -
\??\c:\btnbhh.exec:\btnbhh.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vpjdv.exec:\vpjdv.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lllxlxr.exec:\lllxlxr.exe31⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bhhtht.exec:\bhhtht.exe32⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tthtnn.exec:\tthtnn.exe33⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7bhnbh.exec:\7bhnbh.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jddpj.exec:\jddpj.exe35⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xxxfflf.exec:\xxxfflf.exe36⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhttbn.exec:\nhttbn.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hhtnht.exec:\hhtnht.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dvpdj.exec:\dvpdj.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rrflrxl.exec:\rrflrxl.exe40⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3nhbtt.exec:\3nhbtt.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ttbhbh.exec:\ttbhbh.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jddjv.exec:\jddjv.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1frxrrf.exec:\1frxrrf.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9hbbnn.exec:\9hbbnn.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ttnhtn.exec:\ttnhtn.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjjvj.exec:\jjjvj.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xffrlxr.exec:\xffrlxr.exe48⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tnhnbt.exec:\tnhnbt.exe49⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1pjdj.exec:\1pjdj.exe50⤵
- Executes dropped EXE
PID:320 -
\??\c:\rllllxl.exec:\rllllxl.exe51⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1lrxrxl.exec:\1lrxrxl.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbthtb.exec:\bbthtb.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jvpjd.exec:\jvpjd.exe54⤵
- Executes dropped EXE
PID:1200 -
\??\c:\3lxfrrf.exec:\3lxfrrf.exe55⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe56⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hnthhb.exec:\hnthhb.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dddjv.exec:\dddjv.exe58⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxxllxr.exec:\xxxllxr.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3fxxxxl.exec:\3fxxxxl.exe60⤵
- Executes dropped EXE
PID:956 -
\??\c:\bbtbhn.exec:\bbtbhn.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pppdj.exec:\pppdj.exe62⤵
- Executes dropped EXE
PID:912 -
\??\c:\rlfrflx.exec:\rlfrflx.exe63⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ffxlxfl.exec:\ffxlxfl.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nntnbt.exec:\nntnbt.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\dpppd.exec:\dpppd.exe66⤵PID:2132
-
\??\c:\7flxrxr.exec:\7flxrxr.exe67⤵PID:3028
-
\??\c:\hhhthn.exec:\hhhthn.exe68⤵PID:1852
-
\??\c:\7bbbht.exec:\7bbbht.exe69⤵PID:3032
-
\??\c:\5dvjd.exec:\5dvjd.exe70⤵PID:328
-
\??\c:\xxlxflf.exec:\xxlxflf.exe71⤵PID:1040
-
\??\c:\9nbntb.exec:\9nbntb.exe72⤵PID:1844
-
\??\c:\5bthnb.exec:\5bthnb.exe73⤵PID:2016
-
\??\c:\7ppjp.exec:\7ppjp.exe74⤵PID:1584
-
\??\c:\tnttbb.exec:\tnttbb.exe75⤵PID:2464
-
\??\c:\vvpdj.exec:\vvpdj.exe76⤵PID:2444
-
\??\c:\ppvdv.exec:\ppvdv.exe77⤵PID:2712
-
\??\c:\rrllxxr.exec:\rrllxxr.exe78⤵PID:2728
-
\??\c:\nhthbb.exec:\nhthbb.exe79⤵PID:2760
-
\??\c:\hthbnt.exec:\hthbnt.exe80⤵PID:2692
-
\??\c:\1pdpd.exec:\1pdpd.exe81⤵PID:2820
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe82⤵PID:2816
-
\??\c:\nbnnbh.exec:\nbnnbh.exe83⤵PID:2556
-
\??\c:\1pjdv.exec:\1pjdv.exe84⤵PID:2524
-
\??\c:\dvdvp.exec:\dvdvp.exe85⤵PID:3000
-
\??\c:\xrffxfx.exec:\xrffxfx.exe86⤵PID:2996
-
\??\c:\nnbnbb.exec:\nnbnbb.exe87⤵PID:1616
-
\??\c:\3htbnb.exec:\3htbnb.exe88⤵PID:1868
-
\??\c:\3ppjj.exec:\3ppjj.exe89⤵
- System Location Discovery: System Language Discovery
PID:1668 -
\??\c:\fxfllrx.exec:\fxfllrx.exe90⤵PID:2260
-
\??\c:\tnbbbb.exec:\tnbbbb.exe91⤵PID:1912
-
\??\c:\btnttb.exec:\btnttb.exe92⤵PID:2424
-
\??\c:\dvvvj.exec:\dvvvj.exe93⤵PID:2516
-
\??\c:\9fxflrl.exec:\9fxflrl.exe94⤵PID:1564
-
\??\c:\7httbh.exec:\7httbh.exe95⤵PID:1952
-
\??\c:\3nnbbb.exec:\3nnbbb.exe96⤵PID:1200
-
\??\c:\pvvjj.exec:\pvvjj.exe97⤵PID:2872
-
\??\c:\7fxfflf.exec:\7fxfflf.exe98⤵PID:1036
-
\??\c:\tnbbhn.exec:\tnbbhn.exe99⤵PID:1060
-
\??\c:\ntnnbh.exec:\ntnnbh.exe100⤵PID:1928
-
\??\c:\7pdvd.exec:\7pdvd.exe101⤵PID:1356
-
\??\c:\9xrrfrf.exec:\9xrrfrf.exe102⤵PID:1308
-
\??\c:\nbhnht.exec:\nbhnht.exe103⤵PID:2416
-
\??\c:\pjddv.exec:\pjddv.exe104⤵PID:2620
-
\??\c:\rllxlxr.exec:\rllxlxr.exe105⤵PID:580
-
\??\c:\3lxlfll.exec:\3lxlfll.exe106⤵PID:1340
-
\??\c:\bntnnb.exec:\bntnnb.exe107⤵PID:1528
-
\??\c:\vvvjv.exec:\vvvjv.exe108⤵PID:1064
-
\??\c:\fflfrrf.exec:\fflfrrf.exe109⤵PID:2472
-
\??\c:\ntbhtb.exec:\ntbhtb.exe110⤵PID:2976
-
\??\c:\3tnhhn.exec:\3tnhhn.exe111⤵PID:2952
-
\??\c:\ppppd.exec:\ppppd.exe112⤵PID:324
-
\??\c:\llflrfr.exec:\llflrfr.exe113⤵PID:2328
-
\??\c:\bhnhnh.exec:\bhnhnh.exe114⤵PID:1696
-
\??\c:\5ppvd.exec:\5ppvd.exe115⤵PID:2256
-
\??\c:\rrrxlff.exec:\rrrxlff.exe116⤵PID:2316
-
\??\c:\fxllxxf.exec:\fxllxxf.exe117⤵PID:1584
-
\??\c:\1nhtnb.exec:\1nhtnb.exe118⤵PID:2028
-
\??\c:\jddpd.exec:\jddpd.exe119⤵PID:3068
-
\??\c:\pvdjv.exec:\pvdjv.exe120⤵PID:3008
-
\??\c:\rfxxlfr.exec:\rfxxlfr.exe121⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-