Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe
-
Size
455KB
-
MD5
ae8ed63179165cc2083fc1a495eaa401
-
SHA1
82061d558fc26e2b6b982c094516bf138d149e4e
-
SHA256
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959
-
SHA512
3df7919f7e4bae3fcb55ff0892eaed46d0ac337431575d83c8d8e8f3e82dac5d232c0005d7519bcf1f2e3fa096ed1f4ee09eb871b85700be6029d5ab19f37ccb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRY:q7Tc2NYHUrAwfMp3CDRY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2564-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-77-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-130-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2920-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1168-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-273-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2376-296-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/476-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/476-339-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2648-382-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1888-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-477-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-752-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/492-862-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2128-966-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-1066-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-1065-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2436-1095-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/476-1149-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1752-1241-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1600-1283-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 ttntbn.exe 792 djdvd.exe 1724 jjdpj.exe 2900 ppdvj.exe 2352 pppdv.exe 2860 rxrxffl.exe 2736 5nnnht.exe 3008 ddvjd.exe 2980 3hbnht.exe 2800 3htnbn.exe 2676 tbthtb.exe 2148 3bttnh.exe 1912 5jjvd.exe 2920 ntntnb.exe 2004 vpddp.exe 856 1btbnt.exe 1256 ffffxxr.exe 1168 hbbnht.exe 2556 jjvjd.exe 1072 1nhtht.exe 2616 vdvdj.exe 1532 1btbnt.exe 2180 5jjvj.exe 1244 llxflrx.exe 1740 9djjp.exe 1452 ttnbhn.exe 2364 rrxrrrr.exe 3048 9htnnn.exe 980 7xxxflr.exe 2392 ttbttb.exe 876 pdvvj.exe 828 xfxfxrr.exe 2376 5vjpd.exe 2120 rlrxxxl.exe 1612 tthntb.exe 2196 vjppv.exe 2172 9jjvj.exe 2216 5xllrfl.exe 476 bbnhtb.exe 2876 5jpvd.exe 2860 lrxlrxl.exe 2836 5xrxxfr.exe 2972 nnhnbn.exe 2656 1vjpj.exe 2804 ffllxxl.exe 2648 rllrrrx.exe 2708 bthntb.exe 2684 3pdjp.exe 1888 flxfrxl.exe 2720 lxrxrfr.exe 2360 hnbntb.exe 2128 pjpdp.exe 1720 lffrxlf.exe 1856 tthhnb.exe 2168 ddjpv.exe 1640 1lrflxf.exe 2572 3xrrllx.exe 2556 nthhnn.exe 348 ddjpv.exe 1748 ffxflff.exe 1864 7nhtnb.exe 1548 9nhnth.exe 2244 jjvjd.exe 3040 frrlfrf.exe -
resource yara_rule behavioral1/memory/2564-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-225-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1740-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-273-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2120-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-752-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1764-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-1066-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-1095-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2084-1116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-1176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-1253-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2564 2016 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2016 wrote to memory of 2564 2016 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2016 wrote to memory of 2564 2016 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2016 wrote to memory of 2564 2016 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2564 wrote to memory of 792 2564 ttntbn.exe 31 PID 2564 wrote to memory of 792 2564 ttntbn.exe 31 PID 2564 wrote to memory of 792 2564 ttntbn.exe 31 PID 2564 wrote to memory of 792 2564 ttntbn.exe 31 PID 792 wrote to memory of 1724 792 djdvd.exe 32 PID 792 wrote to memory of 1724 792 djdvd.exe 32 PID 792 wrote to memory of 1724 792 djdvd.exe 32 PID 792 wrote to memory of 1724 792 djdvd.exe 32 PID 1724 wrote to memory of 2900 1724 jjdpj.exe 33 PID 1724 wrote to memory of 2900 1724 jjdpj.exe 33 PID 1724 wrote to memory of 2900 1724 jjdpj.exe 33 PID 1724 wrote to memory of 2900 1724 jjdpj.exe 33 PID 2900 wrote to memory of 2352 2900 ppdvj.exe 34 PID 2900 wrote to memory of 2352 2900 ppdvj.exe 34 PID 2900 wrote to memory of 2352 2900 ppdvj.exe 34 PID 2900 wrote to memory of 2352 2900 ppdvj.exe 34 PID 2352 wrote to memory of 2860 2352 pppdv.exe 35 PID 2352 wrote to memory of 2860 2352 pppdv.exe 35 PID 2352 wrote to memory of 2860 2352 pppdv.exe 35 PID 2352 wrote to memory of 2860 2352 pppdv.exe 35 PID 2860 wrote to memory of 2736 2860 rxrxffl.exe 36 PID 2860 wrote to memory of 2736 2860 rxrxffl.exe 36 PID 2860 wrote to memory of 2736 2860 rxrxffl.exe 36 PID 2860 wrote to memory of 2736 2860 rxrxffl.exe 36 PID 2736 wrote to memory of 3008 2736 5nnnht.exe 37 PID 2736 wrote to memory of 3008 2736 5nnnht.exe 37 PID 2736 wrote to memory of 3008 2736 5nnnht.exe 37 PID 2736 wrote to memory of 3008 2736 5nnnht.exe 37 PID 3008 wrote to memory of 2980 3008 ddvjd.exe 38 PID 3008 wrote to memory of 2980 3008 ddvjd.exe 38 PID 3008 wrote to memory of 2980 3008 ddvjd.exe 38 PID 3008 wrote to memory of 2980 3008 ddvjd.exe 38 PID 2980 wrote to memory of 2800 2980 3hbnht.exe 39 PID 2980 wrote to memory of 2800 2980 3hbnht.exe 39 PID 2980 wrote to memory of 2800 2980 3hbnht.exe 39 PID 2980 wrote to memory of 2800 2980 3hbnht.exe 39 PID 2800 wrote to memory of 2676 2800 3htnbn.exe 40 PID 2800 wrote to memory of 2676 2800 3htnbn.exe 40 PID 2800 wrote to memory of 2676 2800 3htnbn.exe 40 PID 2800 wrote to memory of 2676 2800 3htnbn.exe 40 PID 2676 wrote to memory of 2148 2676 tbthtb.exe 41 PID 2676 wrote to memory of 2148 2676 tbthtb.exe 41 PID 2676 wrote to memory of 2148 2676 tbthtb.exe 41 PID 2676 wrote to memory of 2148 2676 tbthtb.exe 41 PID 2148 wrote to memory of 1912 2148 3bttnh.exe 42 PID 2148 wrote to memory of 1912 2148 3bttnh.exe 42 PID 2148 wrote to memory of 1912 2148 3bttnh.exe 42 PID 2148 wrote to memory of 1912 2148 3bttnh.exe 42 PID 1912 wrote to memory of 2920 1912 5jjvd.exe 43 PID 1912 wrote to memory of 2920 1912 5jjvd.exe 43 PID 1912 wrote to memory of 2920 1912 5jjvd.exe 43 PID 1912 wrote to memory of 2920 1912 5jjvd.exe 43 PID 2920 wrote to memory of 2004 2920 ntntnb.exe 44 PID 2920 wrote to memory of 2004 2920 ntntnb.exe 44 PID 2920 wrote to memory of 2004 2920 ntntnb.exe 44 PID 2920 wrote to memory of 2004 2920 ntntnb.exe 44 PID 2004 wrote to memory of 856 2004 vpddp.exe 45 PID 2004 wrote to memory of 856 2004 vpddp.exe 45 PID 2004 wrote to memory of 856 2004 vpddp.exe 45 PID 2004 wrote to memory of 856 2004 vpddp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe"C:\Users\Admin\AppData\Local\Temp\ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\ttntbn.exec:\ttntbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\djdvd.exec:\djdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\jjdpj.exec:\jjdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ppdvj.exec:\ppdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pppdv.exec:\pppdv.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rxrxffl.exec:\rxrxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5nnnht.exec:\5nnnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ddvjd.exec:\ddvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\3hbnht.exec:\3hbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3htnbn.exec:\3htnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tbthtb.exec:\tbthtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\3bttnh.exec:\3bttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5jjvd.exec:\5jjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ntntnb.exec:\ntntnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vpddp.exec:\vpddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\1btbnt.exec:\1btbnt.exe17⤵
- Executes dropped EXE
PID:856 -
\??\c:\ffffxxr.exec:\ffffxxr.exe18⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hbbnht.exec:\hbbnht.exe19⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jjvjd.exec:\jjvjd.exe20⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1nhtht.exec:\1nhtht.exe21⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vdvdj.exec:\vdvdj.exe22⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1btbnt.exec:\1btbnt.exe23⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5jjvj.exec:\5jjvj.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\llxflrx.exec:\llxflrx.exe25⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9djjp.exec:\9djjp.exe26⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ttnbhn.exec:\ttnbhn.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe28⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9htnnn.exec:\9htnnn.exe29⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7xxxflr.exec:\7xxxflr.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\ttbttb.exec:\ttbttb.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pdvvj.exec:\pdvvj.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\xfxfxrr.exec:\xfxfxrr.exe33⤵
- Executes dropped EXE
PID:828 -
\??\c:\5vjpd.exec:\5vjpd.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tthntb.exec:\tthntb.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vjppv.exec:\vjppv.exe37⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9jjvj.exec:\9jjvj.exe38⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5xllrfl.exec:\5xllrfl.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bbnhtb.exec:\bbnhtb.exe40⤵
- Executes dropped EXE
PID:476 -
\??\c:\5jpvd.exec:\5jpvd.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lrxlrxl.exec:\lrxlrxl.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5xrxxfr.exec:\5xrxxfr.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nnhnbn.exec:\nnhnbn.exe44⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1vjpj.exec:\1vjpj.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ffllxxl.exec:\ffllxxl.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rllrrrx.exec:\rllrrrx.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bthntb.exec:\bthntb.exe48⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3pdjp.exec:\3pdjp.exe49⤵
- Executes dropped EXE
PID:2684 -
\??\c:\flxfrxl.exec:\flxfrxl.exe50⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lxrxrfr.exec:\lxrxrfr.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hnbntb.exec:\hnbntb.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pjpdp.exec:\pjpdp.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lffrxlf.exec:\lffrxlf.exe54⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tthhnb.exec:\tthhnb.exe55⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ddjpv.exec:\ddjpv.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1lrflxf.exec:\1lrflxf.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\3xrrllx.exec:\3xrrllx.exe58⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nthhnn.exec:\nthhnn.exe59⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ddjpv.exec:\ddjpv.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\ffxflff.exec:\ffxflff.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7nhtnb.exec:\7nhtnb.exe62⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9nhnth.exec:\9nhnth.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jjvjd.exec:\jjvjd.exe64⤵
- Executes dropped EXE
PID:2244 -
\??\c:\frrlfrf.exec:\frrlfrf.exe65⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bbhntb.exec:\bbhntb.exe66⤵PID:1680
-
\??\c:\bhnntb.exec:\bhnntb.exe67⤵PID:1536
-
\??\c:\jdvdp.exec:\jdvdp.exe68⤵PID:2612
-
\??\c:\lrfrfrx.exec:\lrfrfrx.exe69⤵PID:3004
-
\??\c:\7tnbnb.exec:\7tnbnb.exe70⤵PID:572
-
\??\c:\btntht.exec:\btntht.exe71⤵PID:2232
-
\??\c:\5dvdp.exec:\5dvdp.exe72⤵PID:556
-
\??\c:\lrrlrrx.exec:\lrrlrrx.exe73⤵PID:2028
-
\??\c:\3rlrxfx.exec:\3rlrxfx.exe74⤵PID:1420
-
\??\c:\hnhntb.exec:\hnhntb.exe75⤵PID:1592
-
\??\c:\bbnbhn.exec:\bbnbhn.exe76⤵PID:828
-
\??\c:\dpvjj.exec:\dpvjj.exe77⤵PID:1884
-
\??\c:\xrfrfff.exec:\xrfrfff.exe78⤵PID:2120
-
\??\c:\fxflrfr.exec:\fxflrfr.exe79⤵PID:492
-
\??\c:\htthnb.exec:\htthnb.exe80⤵PID:2196
-
\??\c:\9vpvv.exec:\9vpvv.exe81⤵PID:2404
-
\??\c:\3vvjv.exec:\3vvjv.exe82⤵PID:2760
-
\??\c:\llflfrx.exec:\llflfrx.exe83⤵PID:2780
-
\??\c:\bnbtbb.exec:\bnbtbb.exe84⤵PID:2856
-
\??\c:\1ddpv.exec:\1ddpv.exe85⤵PID:2484
-
\??\c:\llfxffl.exec:\llfxffl.exe86⤵PID:2668
-
\??\c:\lrllxlx.exec:\lrllxlx.exe87⤵PID:2796
-
\??\c:\9ntnth.exec:\9ntnth.exe88⤵PID:2632
-
\??\c:\ddpvj.exec:\ddpvj.exe89⤵PID:2688
-
\??\c:\xxxfrxx.exec:\xxxfrxx.exe90⤵PID:2652
-
\??\c:\3nnnbh.exec:\3nnnbh.exe91⤵PID:2304
-
\??\c:\hbtnht.exec:\hbtnht.exe92⤵PID:2148
-
\??\c:\dvjjp.exec:\dvjjp.exe93⤵PID:1912
-
\??\c:\9xrxlfr.exec:\9xrxlfr.exe94⤵PID:1104
-
\??\c:\hnbnht.exec:\hnbnht.exe95⤵PID:2920
-
\??\c:\ntntht.exec:\ntntht.exe96⤵PID:2568
-
\??\c:\pvpvj.exec:\pvpvj.exe97⤵PID:1156
-
\??\c:\lrflfrf.exec:\lrflfrf.exe98⤵PID:2728
-
\??\c:\xrrfrfx.exec:\xrrfrfx.exe99⤵PID:1856
-
\??\c:\9bbbhn.exec:\9bbbhn.exe100⤵PID:2264
-
\??\c:\9djvp.exec:\9djvp.exe101⤵PID:2156
-
\??\c:\ddvpj.exec:\ddvpj.exe102⤵PID:1124
-
\??\c:\xxflflf.exec:\xxflflf.exe103⤵PID:2200
-
\??\c:\bbbbnt.exec:\bbbbnt.exe104⤵PID:796
-
\??\c:\httbnb.exec:\httbnb.exe105⤵PID:820
-
\??\c:\ppjvj.exec:\ppjvj.exe106⤵PID:1528
-
\??\c:\xlfrfrl.exec:\xlfrfrl.exe107⤵PID:1808
-
\??\c:\tbnbhn.exec:\tbnbhn.exe108⤵PID:1764
-
\??\c:\hhtthn.exec:\hhtthn.exe109⤵PID:1916
-
\??\c:\3pdpd.exec:\3pdpd.exe110⤵PID:1652
-
\??\c:\rrxxflr.exec:\rrxxflr.exe111⤵PID:304
-
\??\c:\ntntnt.exec:\ntntnt.exe112⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\hnbhbh.exec:\hnbhbh.exe113⤵PID:1540
-
\??\c:\5jdpd.exec:\5jdpd.exe114⤵PID:3048
-
\??\c:\xlfrlfx.exec:\xlfrlfx.exe115⤵PID:980
-
\??\c:\rrfrxlf.exec:\rrfrxlf.exe116⤵PID:1284
-
\??\c:\bbttbb.exec:\bbttbb.exe117⤵PID:2108
-
\??\c:\ffxxllf.exec:\ffxxllf.exe118⤵PID:1584
-
\??\c:\rlflxfl.exec:\rlflxfl.exe119⤵PID:3044
-
\??\c:\tbthbn.exec:\tbthbn.exe120⤵PID:828
-
\??\c:\jjvjp.exec:\jjvjp.exe121⤵PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-