Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe
-
Size
454KB
-
MD5
672d12771ce3a57eaf3d3efcd3cf7790
-
SHA1
24c52a09c325beea6c8ce73915dd154ac62bb644
-
SHA256
925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8
-
SHA512
b94b5c49e203604aa3ce9acfbd3a06ec395e014d1ffe8f15e86ef8d5c2122c8546ae01c16ba0de86de74d43ad057144b11e426a225fc5ce8aaf473320607c701
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeF:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/1972-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-63-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2880-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-97-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2912-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-105-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1808-111-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1316-124-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1316-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-194-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3028-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-209-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3044-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-298-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1580-310-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1580-325-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2888-330-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-381-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2572-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-445-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1948-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-602-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2288-609-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2756-659-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/272-716-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-787-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-809-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1064-816-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2652-902-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1644-911-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2868-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1884 xxfxlrr.exe 2300 pppjv.exe 2372 nnhnhn.exe 2380 xxrxxxr.exe 2120 5hnbnt.exe 2760 5tnhbh.exe 2764 jppdj.exe 2880 htbnbb.exe 2912 ppjpd.exe 2624 hbbnbh.exe 1808 xflfrfx.exe 1316 5nhbbn.exe 568 tnhtht.exe 1264 bbtthn.exe 596 ddjpj.exe 1348 nhtbnn.exe 1164 jpdjv.exe 1516 tttnhn.exe 2940 3xrrrxl.exe 3028 hbbnnb.exe 2664 vdjpd.exe 3044 rrlrlxr.exe 352 rlxflrl.exe 900 xrffrxl.exe 1692 dvpvp.exe 1652 vddvp.exe 2468 hnthtn.exe 2040 jdjdv.exe 1724 ntthth.exe 2164 jjppd.exe 2416 lfrxlrx.exe 2168 btnthn.exe 1580 pppvd.exe 1784 rrflrrf.exe 2348 5tntnb.exe 2888 pjdpd.exe 2964 rrflxfr.exe 2172 hhhtnb.exe 2792 nhbbhn.exe 2980 jjdjp.exe 2692 5xxxfxf.exe 2596 rfffrxl.exe 2728 hnbnbb.exe 2860 dvppv.exe 2572 dpdjd.exe 2688 lxlxlfl.exe 2240 7bnbtb.exe 348 hbttbb.exe 1108 vvdvp.exe 2840 ffrxlrx.exe 2388 9xrfllx.exe 1264 ntnthb.exe 704 htnnbh.exe 1548 7jddj.exe 1948 lllrxfr.exe 1804 hhthht.exe 1516 djddd.exe 2932 vvjvj.exe 2924 rllrxlx.exe 2448 hnnbtb.exe 2656 7vppj.exe 544 5ppjp.exe 1888 7xrrflx.exe 768 hhbhth.exe -
resource yara_rule behavioral1/memory/1884-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-82-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2912-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-194-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/3028-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-445-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1948-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-467-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2656-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-659-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2916-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-918-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1884 1972 925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe 30 PID 1972 wrote to memory of 1884 1972 925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe 30 PID 1972 wrote to memory of 1884 1972 925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe 30 PID 1972 wrote to memory of 1884 1972 925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe 30 PID 1884 wrote to memory of 2300 1884 xxfxlrr.exe 31 PID 1884 wrote to memory of 2300 1884 xxfxlrr.exe 31 PID 1884 wrote to memory of 2300 1884 xxfxlrr.exe 31 PID 1884 wrote to memory of 2300 1884 xxfxlrr.exe 31 PID 2300 wrote to memory of 2372 2300 pppjv.exe 32 PID 2300 wrote to memory of 2372 2300 pppjv.exe 32 PID 2300 wrote to memory of 2372 2300 pppjv.exe 32 PID 2300 wrote to memory of 2372 2300 pppjv.exe 32 PID 2372 wrote to memory of 2380 2372 nnhnhn.exe 33 PID 2372 wrote to memory of 2380 2372 nnhnhn.exe 33 PID 2372 wrote to memory of 2380 2372 nnhnhn.exe 33 PID 2372 wrote to memory of 2380 2372 nnhnhn.exe 33 PID 2380 wrote to memory of 2120 2380 xxrxxxr.exe 34 PID 2380 wrote to memory of 2120 2380 xxrxxxr.exe 34 PID 2380 wrote to memory of 2120 2380 xxrxxxr.exe 34 PID 2380 wrote to memory of 2120 2380 xxrxxxr.exe 34 PID 2120 wrote to memory of 2760 2120 5hnbnt.exe 35 PID 2120 wrote to memory of 2760 2120 5hnbnt.exe 35 PID 2120 wrote to memory of 2760 2120 5hnbnt.exe 35 PID 2120 wrote to memory of 2760 2120 5hnbnt.exe 35 PID 2760 wrote to memory of 2764 2760 5tnhbh.exe 36 PID 2760 wrote to memory of 2764 2760 5tnhbh.exe 36 PID 2760 wrote to memory of 2764 2760 5tnhbh.exe 36 PID 2760 wrote to memory of 2764 2760 5tnhbh.exe 36 PID 2764 wrote to memory of 2880 2764 jppdj.exe 37 PID 2764 wrote to memory of 2880 2764 jppdj.exe 37 PID 2764 wrote to memory of 2880 2764 jppdj.exe 37 PID 2764 wrote to memory of 2880 2764 jppdj.exe 37 PID 2880 wrote to memory of 2912 2880 htbnbb.exe 38 PID 2880 wrote to memory of 2912 2880 htbnbb.exe 38 PID 2880 wrote to memory of 2912 2880 htbnbb.exe 38 PID 2880 wrote to memory of 2912 2880 htbnbb.exe 38 PID 2912 wrote to memory of 2624 2912 ppjpd.exe 39 PID 2912 wrote to memory of 2624 2912 ppjpd.exe 39 PID 2912 wrote to memory of 2624 2912 ppjpd.exe 39 PID 2912 wrote to memory of 2624 2912 ppjpd.exe 39 PID 2624 wrote to memory of 1808 2624 hbbnbh.exe 40 PID 2624 wrote to memory of 1808 2624 hbbnbh.exe 40 PID 2624 wrote to memory of 1808 2624 hbbnbh.exe 40 PID 2624 wrote to memory of 1808 2624 hbbnbh.exe 40 PID 1808 wrote to memory of 1316 1808 xflfrfx.exe 41 PID 1808 wrote to memory of 1316 1808 xflfrfx.exe 41 PID 1808 wrote to memory of 1316 1808 xflfrfx.exe 41 PID 1808 wrote to memory of 1316 1808 xflfrfx.exe 41 PID 1316 wrote to memory of 568 1316 5nhbbn.exe 42 PID 1316 wrote to memory of 568 1316 5nhbbn.exe 42 PID 1316 wrote to memory of 568 1316 5nhbbn.exe 42 PID 1316 wrote to memory of 568 1316 5nhbbn.exe 42 PID 568 wrote to memory of 1264 568 tnhtht.exe 43 PID 568 wrote to memory of 1264 568 tnhtht.exe 43 PID 568 wrote to memory of 1264 568 tnhtht.exe 43 PID 568 wrote to memory of 1264 568 tnhtht.exe 43 PID 1264 wrote to memory of 596 1264 bbtthn.exe 44 PID 1264 wrote to memory of 596 1264 bbtthn.exe 44 PID 1264 wrote to memory of 596 1264 bbtthn.exe 44 PID 1264 wrote to memory of 596 1264 bbtthn.exe 44 PID 596 wrote to memory of 1348 596 ddjpj.exe 45 PID 596 wrote to memory of 1348 596 ddjpj.exe 45 PID 596 wrote to memory of 1348 596 ddjpj.exe 45 PID 596 wrote to memory of 1348 596 ddjpj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe"C:\Users\Admin\AppData\Local\Temp\925804bce4d20d3994a3f14a53f974ad1abcc16eee1d3970dbbd05b8925fc7f8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\xxfxlrr.exec:\xxfxlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\pppjv.exec:\pppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\nnhnhn.exec:\nnhnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xxrxxxr.exec:\xxrxxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\5hnbnt.exec:\5hnbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\5tnhbh.exec:\5tnhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jppdj.exec:\jppdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\htbnbb.exec:\htbnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ppjpd.exec:\ppjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hbbnbh.exec:\hbbnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xflfrfx.exec:\xflfrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\5nhbbn.exec:\5nhbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\tnhtht.exec:\tnhtht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\bbtthn.exec:\bbtthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\ddjpj.exec:\ddjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\nhtbnn.exec:\nhtbnn.exe17⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jpdjv.exec:\jpdjv.exe18⤵
- Executes dropped EXE
PID:1164 -
\??\c:\tttnhn.exec:\tttnhn.exe19⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3xrrrxl.exec:\3xrrrxl.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hbbnnb.exec:\hbbnnb.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vdjpd.exec:\vdjpd.exe22⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe23⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rlxflrl.exec:\rlxflrl.exe24⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrffrxl.exec:\xrffrxl.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\dvpvp.exec:\dvpvp.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vddvp.exec:\vddvp.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hnthtn.exec:\hnthtn.exe28⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jdjdv.exec:\jdjdv.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ntthth.exec:\ntthth.exe30⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jjppd.exec:\jjppd.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\btnthn.exec:\btnthn.exe33⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pppvd.exec:\pppvd.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rrflrrf.exec:\rrflrrf.exe35⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5tntnb.exec:\5tntnb.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pjdpd.exec:\pjdpd.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rrflxfr.exec:\rrflxfr.exe38⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hhhtnb.exec:\hhhtnb.exe39⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nhbbhn.exec:\nhbbhn.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jjdjp.exec:\jjdjp.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5xxxfxf.exec:\5xxxfxf.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rfffrxl.exec:\rfffrxl.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hnbnbb.exec:\hnbnbb.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvppv.exec:\dvppv.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dpdjd.exec:\dpdjd.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lxlxlfl.exec:\lxlxlfl.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7bnbtb.exec:\7bnbtb.exe48⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hbttbb.exec:\hbttbb.exe49⤵
- Executes dropped EXE
PID:348 -
\??\c:\vvdvp.exec:\vvdvp.exe50⤵
- Executes dropped EXE
PID:1108 -
\??\c:\ffrxlrx.exec:\ffrxlrx.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9xrfllx.exec:\9xrfllx.exe52⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ntnthb.exec:\ntnthb.exe53⤵
- Executes dropped EXE
PID:1264 -
\??\c:\htnnbh.exec:\htnnbh.exe54⤵
- Executes dropped EXE
PID:704 -
\??\c:\7jddj.exec:\7jddj.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lllrxfr.exec:\lllrxfr.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hhthht.exec:\hhthht.exe57⤵
- Executes dropped EXE
PID:1804 -
\??\c:\djddd.exec:\djddd.exe58⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vvjvj.exec:\vvjvj.exe59⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rllrxlx.exec:\rllrxlx.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hnnbtb.exec:\hnnbtb.exe61⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7vppj.exec:\7vppj.exe62⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5ppjp.exec:\5ppjp.exe63⤵
- Executes dropped EXE
PID:544 -
\??\c:\7xrrflx.exec:\7xrrflx.exe64⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hhbhth.exec:\hhbhth.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\ttbnhn.exec:\ttbnhn.exe66⤵PID:2548
-
\??\c:\jpdvd.exec:\jpdvd.exe67⤵PID:1376
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe68⤵PID:1384
-
\??\c:\1htbhn.exec:\1htbhn.exe69⤵PID:2460
-
\??\c:\5nntnt.exec:\5nntnt.exe70⤵PID:2200
-
\??\c:\dvjpj.exec:\dvjpj.exe71⤵PID:2212
-
\??\c:\fxrxllx.exec:\fxrxllx.exe72⤵PID:2208
-
\??\c:\1bbnht.exec:\1bbnht.exe73⤵PID:1956
-
\??\c:\pppvv.exec:\pppvv.exe74⤵PID:1964
-
\??\c:\dpjvp.exec:\dpjvp.exe75⤵PID:1576
-
\??\c:\ffflrfx.exec:\ffflrfx.exe76⤵PID:3024
-
\??\c:\bbbbtt.exec:\bbbbtt.exe77⤵PID:2292
-
\??\c:\3pvdp.exec:\3pvdp.exe78⤵PID:2360
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe79⤵PID:2652
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe80⤵PID:2288
-
\??\c:\3ttbbn.exec:\3ttbbn.exe81⤵PID:2660
-
\??\c:\7vpdd.exec:\7vpdd.exe82⤵PID:2772
-
\??\c:\djjdp.exec:\djjdp.exe83⤵PID:1644
-
\??\c:\frllffr.exec:\frllffr.exe84⤵PID:2712
-
\??\c:\9ttnbb.exec:\9ttnbb.exe85⤵PID:2868
-
\??\c:\jdvpp.exec:\jdvpp.exe86⤵PID:2864
-
\??\c:\9jpvj.exec:\9jpvj.exe87⤵PID:2704
-
\??\c:\9fflrxl.exec:\9fflrxl.exe88⤵PID:2756
-
\??\c:\7bnhnt.exec:\7bnhnt.exe89⤵PID:2788
-
\??\c:\nnnbbn.exec:\nnnbbn.exe90⤵PID:2620
-
\??\c:\jjpjj.exec:\jjpjj.exe91⤵PID:1808
-
\??\c:\9lxrrrf.exec:\9lxrrrf.exe92⤵PID:944
-
\??\c:\rfxxrrx.exec:\rfxxrrx.exe93⤵PID:2556
-
\??\c:\hbnbhn.exec:\hbnbhn.exe94⤵PID:1852
-
\??\c:\vpjpv.exec:\vpjpv.exe95⤵PID:592
-
\??\c:\dvpjd.exec:\dvpjd.exe96⤵PID:1004
-
\??\c:\xxrxrfr.exec:\xxrxrfr.exe97⤵PID:272
-
\??\c:\tnntnt.exec:\tnntnt.exe98⤵PID:1156
-
\??\c:\jdpdv.exec:\jdpdv.exe99⤵PID:1164
-
\??\c:\ddvdj.exec:\ddvdj.exe100⤵PID:2916
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe101⤵PID:2812
-
\??\c:\nnbhbb.exec:\nnbhbb.exe102⤵PID:2260
-
\??\c:\vpdjp.exec:\vpdjp.exe103⤵PID:2608
-
\??\c:\7vpdp.exec:\7vpdp.exe104⤵PID:2060
-
\??\c:\9xrfxrf.exec:\9xrfxrf.exe105⤵PID:2096
-
\??\c:\5bntth.exec:\5bntth.exe106⤵PID:1604
-
\??\c:\hbtnbh.exec:\hbtnbh.exe107⤵PID:352
-
\??\c:\jddjv.exec:\jddjv.exe108⤵PID:2152
-
\??\c:\rxlrlrx.exec:\rxlrlrx.exe109⤵PID:2080
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe110⤵PID:964
-
\??\c:\hnhnbn.exec:\hnhnbn.exe111⤵PID:2220
-
\??\c:\ddvpd.exec:\ddvpd.exe112⤵PID:1064
-
\??\c:\9rlrxfx.exec:\9rlrxfx.exe113⤵PID:2200
-
\??\c:\hhthhb.exec:\hhthhb.exe114⤵PID:2212
-
\??\c:\vjdvv.exec:\vjdvv.exe115⤵PID:896
-
\??\c:\lrlxrlx.exec:\lrlxrlx.exe116⤵PID:2196
-
\??\c:\lxlrllf.exec:\lxlrllf.exe117⤵PID:1588
-
\??\c:\3nbntt.exec:\3nbntt.exe118⤵PID:2308
-
\??\c:\9vvjp.exec:\9vvjp.exe119⤵PID:2524
-
\??\c:\llxxlrl.exec:\llxxlrl.exe120⤵PID:1252
-
\??\c:\fflxlfx.exec:\fflxlfx.exe121⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-