Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 11:30
Behavioral task
behavioral1
Sample
4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe
-
Size
3.7MB
-
MD5
dd046b69e8d48ebf28c12b52eb1d4d0b
-
SHA1
234697c421a46f588c2674bad6a0ce2328c2751e
-
SHA256
4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d
-
SHA512
cc910d67380e2f62fb26d702f11c05ef2f73035f85ac8a166571335dfc089234a6127ee273e07622cadabfc783312329464ff313df6e0fafeb79ad927d1c98e2
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98O:U6XLq/qPPslzKx/dJg1ErmNx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2252-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-44-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-57-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-84-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2832-90-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2620-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-123-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2620-137-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3000-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-178-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2704-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/336-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-260-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1576-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-349-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3004-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-415-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2992-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/928-527-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/968-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-588-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2292-589-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/280-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-610-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3064-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-652-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2928-698-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2916-720-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2548 ffflfxf.exe 2268 fxrlfxf.exe 2192 jjjjj.exe 2712 fxrfxlx.exe 2832 xrfflxr.exe 588 nhhtnb.exe 2876 thbbbn.exe 2772 bbtnbb.exe 2620 ntttnb.exe 264 hnnthb.exe 2860 xrrxrfx.exe 1112 hbbnnh.exe 2588 ntbtbt.exe 2996 vddpj.exe 3000 frrxrxf.exe 3012 hhhhht.exe 1824 btnnnt.exe 572 nthbbb.exe 2236 vdpvd.exe 2704 7btbhb.exe 2272 vdppp.exe 336 dpppv.exe 2128 lrxrfxl.exe 1656 vjppd.exe 2412 pjvvv.exe 1088 tbhnnb.exe 2664 nnbnnh.exe 1048 djjdd.exe 524 xxrxrrl.exe 1740 rffxfll.exe 2448 lxxxrrr.exe 1576 jpppv.exe 2252 xlfllxf.exe 2276 vpvdv.exe 2200 jpdpd.exe 2788 tbhtht.exe 2452 nnhnbh.exe 2736 bbhtnb.exe 2824 llxfrxl.exe 2832 xxrxlfr.exe 588 rlxxlrr.exe 600 xxxfrxl.exe 2720 pvddj.exe 2612 pvppv.exe 2596 ddpjv.exe 2436 pdpvv.exe 552 tthnhh.exe 2928 ttbhhb.exe 3004 lrrlrff.exe 2936 rlxrlxx.exe 2036 ddvdp.exe 2992 pvvjd.exe 1708 hhtnbb.exe 1164 7tthtb.exe 2328 llrxxlx.exe 2120 xxlxflf.exe 2360 lxfflfx.exe 2076 jddjp.exe 2136 dddpd.exe 2336 bbhbnh.exe 1356 nhthnh.exe 976 llfrfxr.exe 1636 fxlrlrf.exe 1668 jjdvj.exe -
resource yara_rule behavioral1/memory/2252-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000012117-6.dat upx behavioral1/memory/2548-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001924c-21.dat upx behavioral1/memory/2268-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019218-31.dat upx behavioral1/memory/2192-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001926b-39.dat upx behavioral1/files/0x0007000000019271-50.dat upx behavioral1/memory/2712-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-57-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000019277-58.dat upx behavioral1/memory/2832-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019382-70.dat upx behavioral1/memory/588-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019389-77.dat upx behavioral1/memory/2876-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000193c4-89.dat upx behavioral1/files/0x000500000001961f-101.dat upx behavioral1/memory/2620-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019620-109.dat upx behavioral1/memory/264-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019621-118.dat upx behavioral1/memory/1112-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1112-123-0x00000000005C0000-0x00000000005E7000-memory.dmp upx behavioral1/files/0x0005000000019623-128.dat upx behavioral1/files/0x0005000000019625-138.dat upx behavioral1/files/0x0005000000019629-146.dat upx behavioral1/memory/3000-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019639-158.dat upx behavioral1/memory/3000-154-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000500000001967d-165.dat upx behavioral1/files/0x00050000000196be-174.dat upx behavioral1/memory/1824-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/572-178-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000196f6-183.dat upx behavioral1/files/0x000500000001998a-192.dat upx behavioral1/memory/2704-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c43-203.dat upx behavioral1/files/0x0005000000019c48-212.dat upx behavioral1/files/0x0005000000019c4a-222.dat upx behavioral1/memory/336-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c63-231.dat upx behavioral1/memory/2128-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d2d-239.dat upx behavioral1/files/0x0005000000019d54-247.dat upx behavioral1/memory/2664-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019db5-256.dat upx behavioral1/files/0x0005000000019dc1-265.dat upx behavioral1/files/0x0005000000019faf-272.dat upx behavioral1/files/0x0005000000019fc9-281.dat upx behavioral1/files/0x000500000001a078-289.dat upx behavioral1/files/0x000500000001a08b-297.dat upx behavioral1/memory/2252-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1576-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-326-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2548 2252 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2252 wrote to memory of 2548 2252 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2252 wrote to memory of 2548 2252 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2252 wrote to memory of 2548 2252 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2548 wrote to memory of 2268 2548 ffflfxf.exe 31 PID 2548 wrote to memory of 2268 2548 ffflfxf.exe 31 PID 2548 wrote to memory of 2268 2548 ffflfxf.exe 31 PID 2548 wrote to memory of 2268 2548 ffflfxf.exe 31 PID 2268 wrote to memory of 2192 2268 fxrlfxf.exe 32 PID 2268 wrote to memory of 2192 2268 fxrlfxf.exe 32 PID 2268 wrote to memory of 2192 2268 fxrlfxf.exe 32 PID 2268 wrote to memory of 2192 2268 fxrlfxf.exe 32 PID 2192 wrote to memory of 2712 2192 jjjjj.exe 33 PID 2192 wrote to memory of 2712 2192 jjjjj.exe 33 PID 2192 wrote to memory of 2712 2192 jjjjj.exe 33 PID 2192 wrote to memory of 2712 2192 jjjjj.exe 33 PID 2712 wrote to memory of 2832 2712 fxrfxlx.exe 34 PID 2712 wrote to memory of 2832 2712 fxrfxlx.exe 34 PID 2712 wrote to memory of 2832 2712 fxrfxlx.exe 34 PID 2712 wrote to memory of 2832 2712 fxrfxlx.exe 34 PID 2832 wrote to memory of 588 2832 xrfflxr.exe 35 PID 2832 wrote to memory of 588 2832 xrfflxr.exe 35 PID 2832 wrote to memory of 588 2832 xrfflxr.exe 35 PID 2832 wrote to memory of 588 2832 xrfflxr.exe 35 PID 588 wrote to memory of 2876 588 nhhtnb.exe 36 PID 588 wrote to memory of 2876 588 nhhtnb.exe 36 PID 588 wrote to memory of 2876 588 nhhtnb.exe 36 PID 588 wrote to memory of 2876 588 nhhtnb.exe 36 PID 2876 wrote to memory of 2772 2876 thbbbn.exe 37 PID 2876 wrote to memory of 2772 2876 thbbbn.exe 37 PID 2876 wrote to memory of 2772 2876 thbbbn.exe 37 PID 2876 wrote to memory of 2772 2876 thbbbn.exe 37 PID 2772 wrote to memory of 2620 2772 bbtnbb.exe 38 PID 2772 wrote to memory of 2620 2772 bbtnbb.exe 38 PID 2772 wrote to memory of 2620 2772 bbtnbb.exe 38 PID 2772 wrote to memory of 2620 2772 bbtnbb.exe 38 PID 2620 wrote to memory of 264 2620 ntttnb.exe 39 PID 2620 wrote to memory of 264 2620 ntttnb.exe 39 PID 2620 wrote to memory of 264 2620 ntttnb.exe 39 PID 2620 wrote to memory of 264 2620 ntttnb.exe 39 PID 264 wrote to memory of 2860 264 hnnthb.exe 40 PID 264 wrote to memory of 2860 264 hnnthb.exe 40 PID 264 wrote to memory of 2860 264 hnnthb.exe 40 PID 264 wrote to memory of 2860 264 hnnthb.exe 40 PID 2860 wrote to memory of 1112 2860 xrrxrfx.exe 41 PID 2860 wrote to memory of 1112 2860 xrrxrfx.exe 41 PID 2860 wrote to memory of 1112 2860 xrrxrfx.exe 41 PID 2860 wrote to memory of 1112 2860 xrrxrfx.exe 41 PID 1112 wrote to memory of 2588 1112 hbbnnh.exe 43 PID 1112 wrote to memory of 2588 1112 hbbnnh.exe 43 PID 1112 wrote to memory of 2588 1112 hbbnnh.exe 43 PID 1112 wrote to memory of 2588 1112 hbbnnh.exe 43 PID 2588 wrote to memory of 2996 2588 ntbtbt.exe 44 PID 2588 wrote to memory of 2996 2588 ntbtbt.exe 44 PID 2588 wrote to memory of 2996 2588 ntbtbt.exe 44 PID 2588 wrote to memory of 2996 2588 ntbtbt.exe 44 PID 2996 wrote to memory of 3000 2996 vddpj.exe 45 PID 2996 wrote to memory of 3000 2996 vddpj.exe 45 PID 2996 wrote to memory of 3000 2996 vddpj.exe 45 PID 2996 wrote to memory of 3000 2996 vddpj.exe 45 PID 3000 wrote to memory of 3012 3000 frrxrxf.exe 46 PID 3000 wrote to memory of 3012 3000 frrxrxf.exe 46 PID 3000 wrote to memory of 3012 3000 frrxrxf.exe 46 PID 3000 wrote to memory of 3012 3000 frrxrxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe"C:\Users\Admin\AppData\Local\Temp\4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\ffflfxf.exec:\ffflfxf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\fxrlfxf.exec:\fxrlfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\jjjjj.exec:\jjjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\fxrfxlx.exec:\fxrfxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xrfflxr.exec:\xrfflxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nhhtnb.exec:\nhhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\thbbbn.exec:\thbbbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\bbtnbb.exec:\bbtnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ntttnb.exec:\ntttnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hnnthb.exec:\hnnthb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\hbbnnh.exec:\hbbnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\ntbtbt.exec:\ntbtbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vddpj.exec:\vddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\frrxrxf.exec:\frrxrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hhhhht.exec:\hhhhht.exe17⤵
- Executes dropped EXE
PID:3012 -
\??\c:\btnnnt.exec:\btnnnt.exe18⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nthbbb.exec:\nthbbb.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:572 -
\??\c:\vdpvd.exec:\vdpvd.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\7btbhb.exec:\7btbhb.exe21⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vdppp.exec:\vdppp.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dpppv.exec:\dpppv.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\lrxrfxl.exec:\lrxrfxl.exe24⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vjppd.exec:\vjppd.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pjvvv.exec:\pjvvv.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\tbhnnb.exec:\tbhnnb.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nnbnnh.exec:\nnbnnh.exe28⤵
- Executes dropped EXE
PID:2664 -
\??\c:\djjdd.exec:\djjdd.exe29⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xxrxrrl.exec:\xxrxrrl.exe30⤵
- Executes dropped EXE
PID:524 -
\??\c:\rffxfll.exec:\rffxfll.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe32⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jpppv.exec:\jpppv.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xlfllxf.exec:\xlfllxf.exe34⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vpvdv.exec:\vpvdv.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\jpdpd.exec:\jpdpd.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tbhtht.exec:\tbhtht.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nnhnbh.exec:\nnhnbh.exe38⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bbhtnb.exec:\bbhtnb.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\llxfrxl.exec:\llxfrxl.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xxrxlfr.exec:\xxrxlfr.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rlxxlrr.exec:\rlxxlrr.exe42⤵
- Executes dropped EXE
PID:588 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe43⤵
- Executes dropped EXE
PID:600 -
\??\c:\pvddj.exec:\pvddj.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pvppv.exec:\pvppv.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ddpjv.exec:\ddpjv.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pdpvv.exec:\pdpvv.exe47⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tthnhh.exec:\tthnhh.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552 -
\??\c:\ttbhhb.exec:\ttbhhb.exe49⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lrrlrff.exec:\lrrlrff.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rlxrlxx.exec:\rlxrlxx.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ddvdp.exec:\ddvdp.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pvvjd.exec:\pvvjd.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hhtnbb.exec:\hhtnbb.exe54⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7tthtb.exec:\7tthtb.exe55⤵
- Executes dropped EXE
PID:1164 -
\??\c:\llrxxlx.exec:\llrxxlx.exe56⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xxlxflf.exec:\xxlxflf.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lxfflfx.exec:\lxfflfx.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jddjp.exec:\jddjp.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dddpd.exec:\dddpd.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bbhbnh.exec:\bbhbnh.exe61⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhthnh.exec:\nhthnh.exe62⤵
- Executes dropped EXE
PID:1356 -
\??\c:\llfrfxr.exec:\llfrfxr.exe63⤵
- Executes dropped EXE
PID:976 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jjdvj.exec:\jjdvj.exe65⤵
- Executes dropped EXE
PID:1668 -
\??\c:\pvpdp.exec:\pvpdp.exe66⤵PID:928
-
\??\c:\7htthh.exec:\7htthh.exe67⤵PID:2412
-
\??\c:\tbthhb.exec:\tbthhb.exe68⤵PID:968
-
\??\c:\tthnbn.exec:\tthnbn.exe69⤵PID:2184
-
\??\c:\llrlffx.exec:\llrlffx.exe70⤵PID:1932
-
\??\c:\ffxlxff.exec:\ffxlxff.exe71⤵PID:2376
-
\??\c:\5pdpj.exec:\5pdpj.exe72⤵PID:1640
-
\??\c:\pjppv.exec:\pjppv.exe73⤵PID:2368
-
\??\c:\tntbhh.exec:\tntbhh.exe74⤵PID:1508
-
\??\c:\3xlrfrf.exec:\3xlrfrf.exe75⤵PID:2292
-
\??\c:\llfrxfr.exec:\llfrxfr.exe76⤵PID:280
-
\??\c:\1pjvd.exec:\1pjvd.exe77⤵PID:2160
-
\??\c:\1dpvj.exec:\1dpvj.exe78⤵PID:2080
-
\??\c:\9nthhn.exec:\9nthhn.exe79⤵PID:2700
-
\??\c:\hbthtt.exec:\hbthtt.exe80⤵PID:3064
-
\??\c:\5thntt.exec:\5thntt.exe81⤵PID:2892
-
\??\c:\llxlrff.exec:\llxlrff.exe82⤵PID:2764
-
\??\c:\xxxxfrl.exec:\xxxxfrl.exe83⤵PID:2800
-
\??\c:\vvpdp.exec:\vvpdp.exe84⤵PID:2912
-
\??\c:\ppdpd.exec:\ppdpd.exe85⤵PID:2776
-
\??\c:\bbnbth.exec:\bbnbth.exe86⤵
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\bbbhbn.exec:\bbbhbn.exe87⤵PID:1396
-
\??\c:\lflxxlr.exec:\lflxxlr.exe88⤵PID:2052
-
\??\c:\lrxlfxf.exec:\lrxlfxf.exe89⤵PID:844
-
\??\c:\pjpdp.exec:\pjpdp.exe90⤵PID:1652
-
\??\c:\ppvpp.exec:\ppvpp.exe91⤵PID:2928
-
\??\c:\bbbnbh.exec:\bbbnbh.exe92⤵PID:2920
-
\??\c:\hhnbnh.exec:\hhnbnh.exe93⤵PID:2792
-
\??\c:\rxrlflx.exec:\rxrlflx.exe94⤵PID:2916
-
\??\c:\xxlrlfr.exec:\xxlrlfr.exe95⤵PID:1984
-
\??\c:\pjpjd.exec:\pjpjd.exe96⤵PID:808
-
\??\c:\dvjvj.exec:\dvjvj.exe97⤵PID:2024
-
\??\c:\1httbn.exec:\1httbn.exe98⤵PID:2640
-
\??\c:\bbbnhb.exec:\bbbnhb.exe99⤵PID:572
-
\??\c:\nnnhtn.exec:\nnnhtn.exe100⤵
- System Location Discovery: System Language Discovery
PID:2236 -
\??\c:\fflrrfr.exec:\fflrrfr.exe101⤵PID:2164
-
\??\c:\5rrfflx.exec:\5rrfflx.exe102⤵PID:3016
-
\??\c:\jddpp.exec:\jddpp.exe103⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\5dvpd.exec:\5dvpd.exe104⤵PID:1344
-
\??\c:\nnnbtt.exec:\nnnbtt.exe105⤵
- System Location Discovery: System Language Discovery
PID:1040 -
\??\c:\ntbnbh.exec:\ntbnbh.exe106⤵PID:1544
-
\??\c:\xrrlxlf.exec:\xrrlxlf.exe107⤵PID:2932
-
\??\c:\llxfrlf.exec:\llxfrlf.exe108⤵PID:1664
-
\??\c:\vdjpv.exec:\vdjpv.exe109⤵PID:944
-
\??\c:\jjpdv.exec:\jjpdv.exe110⤵PID:2544
-
\??\c:\hhbnnb.exec:\hhbnnb.exe111⤵PID:592
-
\??\c:\rxlrlxx.exec:\rxlrlxx.exe112⤵PID:1532
-
\??\c:\xrrfxlx.exec:\xrrfxlx.exe113⤵PID:1048
-
\??\c:\5jvpv.exec:\5jvpv.exe114⤵PID:548
-
\??\c:\jppdv.exec:\jppdv.exe115⤵PID:2144
-
\??\c:\ddpjv.exec:\ddpjv.exe116⤵PID:1580
-
\??\c:\tnhnhh.exec:\tnhnhh.exe117⤵PID:2384
-
\??\c:\bbbnht.exec:\bbbnht.exe118⤵PID:2284
-
\??\c:\rxlxflf.exec:\rxlxflf.exe119⤵PID:2464
-
\??\c:\vddpd.exec:\vddpd.exe120⤵PID:2268
-
\??\c:\pvdvv.exec:\pvdvv.exe121⤵PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-