Analysis
-
max time kernel
111s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe
-
Size
453KB
-
MD5
228565d822ba9ffaace66e3aedeb79b0
-
SHA1
1bbb7535a5b58afb85541a83767f0f945e0d5b2c
-
SHA256
f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2
-
SHA512
e5b330d2d936fbd2c5f01586c5019ca6a80c6bd6aff8d2ac60ad79156f06dd2a92637a57c07eda77b8cb3125750a039478627eb2ea618b023c629bbff2e17dfa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1688-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-17-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2236-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-427-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1812-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-449-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1660-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-483-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-913-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2636-874-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-873-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1096-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-534-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/900-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-352-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1348-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-197-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-1112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2236 1vjjd.exe 2356 3nhhnb.exe 2760 1xlllll.exe 2644 7rlxlrx.exe 2624 tnhnbh.exe 2984 pvjpj.exe 2628 nhbttt.exe 2512 3jvpd.exe 2544 jdddd.exe 2024 rlflxxl.exe 1340 tnnbnt.exe 1088 jjddp.exe 2700 thtbbh.exe 2724 hbhhnb.exe 2532 rxxxllx.exe 1396 ffrxxrx.exe 2480 thhnbh.exe 2728 7jvvd.exe 1792 bbthtb.exe 1936 jvppd.exe 2116 lfxfllx.exe 2668 9hhhnn.exe 2180 1vjpv.exe 2376 1rfrlxr.exe 2412 hhthtt.exe 112 jdpvd.exe 864 tnbhtb.exe 2288 tnbntb.exe 2284 rffflrr.exe 1692 rrrxrrl.exe 1348 9hhhhh.exe 2260 dpdpv.exe 1608 rlffllx.exe 3056 5vvdd.exe 1732 pjdpv.exe 2636 xfrllfx.exe 2780 hbthht.exe 2688 bnhbhh.exe 2632 7jvvp.exe 2860 llrxlrl.exe 2516 bnnnbn.exe 2548 1tntbh.exe 2612 dvpvv.exe 2524 frxlrlx.exe 264 3nbhhh.exe 528 3tntbh.exe 572 ddvjj.exe 2852 lflllrx.exe 768 hbnbhh.exe 2856 bhbnhh.exe 440 jddpj.exe 1812 ffrffxx.exe 2840 1fxfflr.exe 1300 nhbnbb.exe 2756 pdppd.exe 2728 5llxrlf.exe 1660 xrlrxfr.exe 2092 bhnntb.exe 1808 pjvvd.exe 2924 vpvjv.exe 1420 xlfflfl.exe 2180 bttbnt.exe 2200 hhhnhh.exe 1360 vjjvd.exe -
resource yara_rule behavioral1/memory/1688-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-1007-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1113-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2236 1688 f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe 28 PID 1688 wrote to memory of 2236 1688 f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe 28 PID 1688 wrote to memory of 2236 1688 f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe 28 PID 1688 wrote to memory of 2236 1688 f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe 28 PID 2236 wrote to memory of 2356 2236 1vjjd.exe 104 PID 2236 wrote to memory of 2356 2236 1vjjd.exe 104 PID 2236 wrote to memory of 2356 2236 1vjjd.exe 104 PID 2236 wrote to memory of 2356 2236 1vjjd.exe 104 PID 2356 wrote to memory of 2760 2356 3nhhnb.exe 30 PID 2356 wrote to memory of 2760 2356 3nhhnb.exe 30 PID 2356 wrote to memory of 2760 2356 3nhhnb.exe 30 PID 2356 wrote to memory of 2760 2356 3nhhnb.exe 30 PID 2760 wrote to memory of 2644 2760 1xlllll.exe 151 PID 2760 wrote to memory of 2644 2760 1xlllll.exe 151 PID 2760 wrote to memory of 2644 2760 1xlllll.exe 151 PID 2760 wrote to memory of 2644 2760 1xlllll.exe 151 PID 2644 wrote to memory of 2624 2644 7rlxlrx.exe 32 PID 2644 wrote to memory of 2624 2644 7rlxlrx.exe 32 PID 2644 wrote to memory of 2624 2644 7rlxlrx.exe 32 PID 2644 wrote to memory of 2624 2644 7rlxlrx.exe 32 PID 2624 wrote to memory of 2984 2624 tnhnbh.exe 33 PID 2624 wrote to memory of 2984 2624 tnhnbh.exe 33 PID 2624 wrote to memory of 2984 2624 tnhnbh.exe 33 PID 2624 wrote to memory of 2984 2624 tnhnbh.exe 33 PID 2984 wrote to memory of 2628 2984 pvjpj.exe 34 PID 2984 wrote to memory of 2628 2984 pvjpj.exe 34 PID 2984 wrote to memory of 2628 2984 pvjpj.exe 34 PID 2984 wrote to memory of 2628 2984 pvjpj.exe 34 PID 2628 wrote to memory of 2512 2628 nhbttt.exe 35 PID 2628 wrote to memory of 2512 2628 nhbttt.exe 35 PID 2628 wrote to memory of 2512 2628 nhbttt.exe 35 PID 2628 wrote to memory of 2512 2628 nhbttt.exe 35 PID 2512 wrote to memory of 2544 2512 3jvpd.exe 36 PID 2512 wrote to memory of 2544 2512 3jvpd.exe 36 PID 2512 wrote to memory of 2544 2512 3jvpd.exe 36 PID 2512 wrote to memory of 2544 2512 3jvpd.exe 36 PID 2544 wrote to memory of 2024 2544 jdddd.exe 37 PID 2544 wrote to memory of 2024 2544 jdddd.exe 37 PID 2544 wrote to memory of 2024 2544 jdddd.exe 37 PID 2544 wrote to memory of 2024 2544 jdddd.exe 37 PID 2024 wrote to memory of 1340 2024 rlflxxl.exe 38 PID 2024 wrote to memory of 1340 2024 rlflxxl.exe 38 PID 2024 wrote to memory of 1340 2024 rlflxxl.exe 38 PID 2024 wrote to memory of 1340 2024 rlflxxl.exe 38 PID 1340 wrote to memory of 1088 1340 tnnbnt.exe 39 PID 1340 wrote to memory of 1088 1340 tnnbnt.exe 39 PID 1340 wrote to memory of 1088 1340 tnnbnt.exe 39 PID 1340 wrote to memory of 1088 1340 tnnbnt.exe 39 PID 1088 wrote to memory of 2700 1088 jjddp.exe 40 PID 1088 wrote to memory of 2700 1088 jjddp.exe 40 PID 1088 wrote to memory of 2700 1088 jjddp.exe 40 PID 1088 wrote to memory of 2700 1088 jjddp.exe 40 PID 2700 wrote to memory of 2724 2700 thtbbh.exe 41 PID 2700 wrote to memory of 2724 2700 thtbbh.exe 41 PID 2700 wrote to memory of 2724 2700 thtbbh.exe 41 PID 2700 wrote to memory of 2724 2700 thtbbh.exe 41 PID 2724 wrote to memory of 2532 2724 hbhhnb.exe 42 PID 2724 wrote to memory of 2532 2724 hbhhnb.exe 42 PID 2724 wrote to memory of 2532 2724 hbhhnb.exe 42 PID 2724 wrote to memory of 2532 2724 hbhhnb.exe 42 PID 2532 wrote to memory of 1396 2532 rxxxllx.exe 43 PID 2532 wrote to memory of 1396 2532 rxxxllx.exe 43 PID 2532 wrote to memory of 1396 2532 rxxxllx.exe 43 PID 2532 wrote to memory of 1396 2532 rxxxllx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe"C:\Users\Admin\AppData\Local\Temp\f981c824045cb3ac8755079dba7c8759c6b2b3bf481fa943ff70a87e28be31e2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\1vjjd.exec:\1vjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\3nhhnb.exec:\3nhhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\1xlllll.exec:\1xlllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7rlxlrx.exec:\7rlxlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\tnhnbh.exec:\tnhnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pvjpj.exec:\pvjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\nhbttt.exec:\nhbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3jvpd.exec:\3jvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\jdddd.exec:\jdddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rlflxxl.exec:\rlflxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\tnnbnt.exec:\tnnbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\jjddp.exec:\jjddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\thtbbh.exec:\thtbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hbhhnb.exec:\hbhhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rxxxllx.exec:\rxxxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ffrxxrx.exec:\ffrxxrx.exe17⤵
- Executes dropped EXE
PID:1396 -
\??\c:\thhnbh.exec:\thhnbh.exe18⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7jvvd.exec:\7jvvd.exe19⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bbthtb.exec:\bbthtb.exe20⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jvppd.exec:\jvppd.exe21⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lfxfllx.exec:\lfxfllx.exe22⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9hhhnn.exec:\9hhhnn.exe23⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1vjpv.exec:\1vjpv.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1rfrlxr.exec:\1rfrlxr.exe25⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hhthtt.exec:\hhthtt.exe26⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jdpvd.exec:\jdpvd.exe27⤵
- Executes dropped EXE
PID:112 -
\??\c:\tnbhtb.exec:\tnbhtb.exe28⤵
- Executes dropped EXE
PID:864 -
\??\c:\tnbntb.exec:\tnbntb.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rffflrr.exec:\rffflrr.exe30⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rrrxrrl.exec:\rrrxrrl.exe31⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9hhhhh.exec:\9hhhhh.exe32⤵
- Executes dropped EXE
PID:1348 -
\??\c:\dpdpv.exec:\dpdpv.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlffllx.exec:\rlffllx.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5vvdd.exec:\5vvdd.exe35⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjdpv.exec:\pjdpv.exe36⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xfrllfx.exec:\xfrllfx.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hbthht.exec:\hbthht.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bnhbhh.exec:\bnhbhh.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7jvvp.exec:\7jvvp.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\llrxlrl.exec:\llrxlrl.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bnnnbn.exec:\bnnnbn.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1tntbh.exec:\1tntbh.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvpvv.exec:\dvpvv.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\frxlrlx.exec:\frxlrlx.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\3nbhhh.exec:\3nbhhh.exe46⤵
- Executes dropped EXE
PID:264 -
\??\c:\3tntbh.exec:\3tntbh.exe47⤵
- Executes dropped EXE
PID:528 -
\??\c:\ddvjj.exec:\ddvjj.exe48⤵
- Executes dropped EXE
PID:572 -
\??\c:\lflllrx.exec:\lflllrx.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hbnbhh.exec:\hbnbhh.exe50⤵
- Executes dropped EXE
PID:768 -
\??\c:\bhbnhh.exec:\bhbnhh.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\jddpj.exec:\jddpj.exe52⤵
- Executes dropped EXE
PID:440 -
\??\c:\ffrffxx.exec:\ffrffxx.exe53⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1fxfflr.exec:\1fxfflr.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhbnbb.exec:\nhbnbb.exe55⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pdppd.exec:\pdppd.exe56⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5llxrlf.exec:\5llxrlf.exe57⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe58⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bhnntb.exec:\bhnntb.exe59⤵
- Executes dropped EXE
PID:2092 -
\??\c:\pjvvd.exec:\pjvvd.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vpvjv.exec:\vpvjv.exe61⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xlfflfl.exec:\xlfflfl.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\bttbnt.exec:\bttbnt.exe63⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hhhnhh.exec:\hhhnhh.exe64⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vjjvd.exec:\vjjvd.exe65⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pdppv.exec:\pdppv.exe66⤵PID:2044
-
\??\c:\lrffrfx.exec:\lrffrfx.exe67⤵PID:900
-
\??\c:\7nnbhh.exec:\7nnbhh.exe68⤵PID:700
-
\??\c:\ppdjv.exec:\ppdjv.exe69⤵PID:2268
-
\??\c:\pjvvd.exec:\pjvvd.exe70⤵PID:2280
-
\??\c:\xllfxlr.exec:\xllfxlr.exe71⤵PID:2332
-
\??\c:\hnthtb.exec:\hnthtb.exe72⤵PID:1720
-
\??\c:\nbnnnn.exec:\nbnnnn.exe73⤵PID:2216
-
\??\c:\pvvdj.exec:\pvvdj.exe74⤵PID:2260
-
\??\c:\3xrxllx.exec:\3xrxllx.exe75⤵PID:2348
-
\??\c:\9bnnbb.exec:\9bnnbb.exe76⤵PID:2188
-
\??\c:\nnhbhh.exec:\nnhbhh.exe77⤵PID:2676
-
\??\c:\pjvpv.exec:\pjvpv.exe78⤵PID:2356
-
\??\c:\5vjpp.exec:\5vjpp.exe79⤵PID:2596
-
\??\c:\fxrxlff.exec:\fxrxlff.exe80⤵PID:2796
-
\??\c:\3nhbtt.exec:\3nhbtt.exe81⤵PID:2600
-
\??\c:\7nnhhb.exec:\7nnhhb.exe82⤵PID:2912
-
\??\c:\dppjp.exec:\dppjp.exe83⤵PID:2660
-
\??\c:\djvvv.exec:\djvvv.exe84⤵PID:2664
-
\??\c:\lflfxfx.exec:\lflfxfx.exe85⤵PID:2604
-
\??\c:\xlfrrxx.exec:\xlfrrxx.exe86⤵PID:2996
-
\??\c:\bntbnh.exec:\bntbnh.exe87⤵PID:580
-
\??\c:\vjvpd.exec:\vjvpd.exe88⤵PID:392
-
\??\c:\vvpvj.exec:\vvpvj.exe89⤵PID:3016
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe90⤵PID:2300
-
\??\c:\ntnthh.exec:\ntnthh.exe91⤵PID:2864
-
\??\c:\hnhtnb.exec:\hnhtnb.exe92⤵PID:2244
-
\??\c:\jvppd.exec:\jvppd.exe93⤵PID:1656
-
\??\c:\1dppv.exec:\1dppv.exe94⤵PID:1248
-
\??\c:\rlxllfr.exec:\rlxllfr.exe95⤵PID:1964
-
\??\c:\lxllxff.exec:\lxllxff.exe96⤵PID:2552
-
\??\c:\5nbbnn.exec:\5nbbnn.exe97⤵PID:2720
-
\??\c:\3thhtb.exec:\3thhtb.exe98⤵PID:1316
-
\??\c:\dddvd.exec:\dddvd.exe99⤵PID:844
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe100⤵PID:1032
-
\??\c:\3rfffff.exec:\3rfffff.exe101⤵PID:1936
-
\??\c:\1thnbh.exec:\1thnbh.exe102⤵PID:328
-
\??\c:\ppdjv.exec:\ppdjv.exe103⤵PID:2164
-
\??\c:\ppddp.exec:\ppddp.exe104⤵PID:2012
-
\??\c:\3xlrrxf.exec:\3xlrrxf.exe105⤵PID:1512
-
\??\c:\fxrrfrx.exec:\fxrrfrx.exe106⤵PID:1984
-
\??\c:\hhhntt.exec:\hhhntt.exe107⤵PID:1096
-
\??\c:\hhbthn.exec:\hhbthn.exe108⤵PID:2424
-
\??\c:\1jvvd.exec:\1jvvd.exe109⤵PID:2136
-
\??\c:\vvvvd.exec:\vvvvd.exe110⤵PID:2176
-
\??\c:\fxlflfl.exec:\fxlflfl.exe111⤵PID:908
-
\??\c:\5fxfrlr.exec:\5fxfrlr.exe112⤵PID:1972
-
\??\c:\3bhnnt.exec:\3bhnnt.exe113⤵PID:2032
-
\??\c:\vpddj.exec:\vpddj.exe114⤵PID:1868
-
\??\c:\vpdjp.exec:\vpdjp.exe115⤵PID:1992
-
\??\c:\5fxfxxf.exec:\5fxfxxf.exe116⤵PID:1980
-
\??\c:\bhbhth.exec:\bhbhth.exe117⤵PID:3032
-
\??\c:\tnhnbh.exec:\tnhnbh.exe118⤵
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\5djpv.exec:\5djpv.exe119⤵PID:2236
-
\??\c:\dvpvp.exec:\dvpvp.exe120⤵PID:1148
-
\??\c:\xrlrllx.exec:\xrlrllx.exe121⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-