Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe
-
Size
454KB
-
MD5
8f2590f52d13073458724f80ab4e4aa0
-
SHA1
081776eb25b2c1226da576343f34541d2a26bd0b
-
SHA256
1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917
-
SHA512
29e77601ee1400bd1816326ea17831d6fd5db479ff972d05936e04dbdb519b885cee58456d6e06fee67d6698d8a1edff2941fd04fa0abf5e4b1ea253374c831d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2276-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-311-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1668-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-342-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2756-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-585-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2780-635-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2276 xffrllx.exe 2592 vvvvv.exe 2644 nbnthh.exe 2716 pjvvj.exe 2744 hbtbhn.exe 2960 1tbbbh.exe 2668 7xxxxff.exe 2532 1nhhnb.exe 2976 lxxxffl.exe 320 nhnttn.exe 808 1pvvj.exe 1092 1xlllfl.exe 2488 dvjpp.exe 2808 lfrlllr.exe 2864 nhthnh.exe 324 pjvvj.exe 2476 btbttt.exe 1728 5jvvd.exe 1028 fxrffll.exe 2032 thtthb.exe 1540 ffrrfrx.exe 1980 hbhhtb.exe 2992 rxrxffx.exe 2908 tnhthn.exe 2356 pvdjd.exe 1564 lxxrxxl.exe 1444 1dppv.exe 928 fxffflr.exe 2132 nbtntt.exe 1320 3pddp.exe 2244 bnthbb.exe 2928 ddvvv.exe 3020 xrrxrxl.exe 1612 dddvj.exe 2964 jvjjd.exe 1668 xrffllr.exe 2748 btnnbb.exe 2632 3btbhn.exe 3068 pddvd.exe 2840 rffxfxx.exe 2836 tnttbb.exe 2756 5dpdj.exe 1340 xffrxlx.exe 1664 nhtttt.exe 2456 9bttnt.exe 556 ffxlflf.exe 320 5rflxfl.exe 576 1hhhbh.exe 1484 pjdjd.exe 2776 fxxxlrf.exe 2832 9tnbth.exe 2588 vpjvj.exe 2864 fxrxllx.exe 2460 hnnhht.exe 1400 ttthtb.exe 640 pjvdd.exe 796 xxrlrrx.exe 2340 bntbbh.exe 2236 ddjjp.exe 2020 jjddp.exe 2076 9lflrxl.exe 2540 hhhtbh.exe 2148 pvpvp.exe 2912 9frlrrx.exe -
resource yara_rule behavioral1/memory/2276-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-599-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1156-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-1038-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/916-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-1103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-1114-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2276 2284 1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe 28 PID 2284 wrote to memory of 2276 2284 1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe 28 PID 2284 wrote to memory of 2276 2284 1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe 28 PID 2284 wrote to memory of 2276 2284 1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe 28 PID 2276 wrote to memory of 2592 2276 xffrllx.exe 29 PID 2276 wrote to memory of 2592 2276 xffrllx.exe 29 PID 2276 wrote to memory of 2592 2276 xffrllx.exe 29 PID 2276 wrote to memory of 2592 2276 xffrllx.exe 29 PID 2592 wrote to memory of 2644 2592 vvvvv.exe 30 PID 2592 wrote to memory of 2644 2592 vvvvv.exe 30 PID 2592 wrote to memory of 2644 2592 vvvvv.exe 30 PID 2592 wrote to memory of 2644 2592 vvvvv.exe 30 PID 2644 wrote to memory of 2716 2644 nbnthh.exe 31 PID 2644 wrote to memory of 2716 2644 nbnthh.exe 31 PID 2644 wrote to memory of 2716 2644 nbnthh.exe 31 PID 2644 wrote to memory of 2716 2644 nbnthh.exe 31 PID 2716 wrote to memory of 2744 2716 pjvvj.exe 32 PID 2716 wrote to memory of 2744 2716 pjvvj.exe 32 PID 2716 wrote to memory of 2744 2716 pjvvj.exe 32 PID 2716 wrote to memory of 2744 2716 pjvvj.exe 32 PID 2744 wrote to memory of 2960 2744 hbtbhn.exe 33 PID 2744 wrote to memory of 2960 2744 hbtbhn.exe 33 PID 2744 wrote to memory of 2960 2744 hbtbhn.exe 33 PID 2744 wrote to memory of 2960 2744 hbtbhn.exe 33 PID 2960 wrote to memory of 2668 2960 1tbbbh.exe 34 PID 2960 wrote to memory of 2668 2960 1tbbbh.exe 34 PID 2960 wrote to memory of 2668 2960 1tbbbh.exe 34 PID 2960 wrote to memory of 2668 2960 1tbbbh.exe 34 PID 2668 wrote to memory of 2532 2668 7xxxxff.exe 35 PID 2668 wrote to memory of 2532 2668 7xxxxff.exe 35 PID 2668 wrote to memory of 2532 2668 7xxxxff.exe 35 PID 2668 wrote to memory of 2532 2668 7xxxxff.exe 35 PID 2532 wrote to memory of 2976 2532 1nhhnb.exe 36 PID 2532 wrote to memory of 2976 2532 1nhhnb.exe 36 PID 2532 wrote to memory of 2976 2532 1nhhnb.exe 36 PID 2532 wrote to memory of 2976 2532 1nhhnb.exe 36 PID 2976 wrote to memory of 320 2976 lxxxffl.exe 37 PID 2976 wrote to memory of 320 2976 lxxxffl.exe 37 PID 2976 wrote to memory of 320 2976 lxxxffl.exe 37 PID 2976 wrote to memory of 320 2976 lxxxffl.exe 37 PID 320 wrote to memory of 808 320 nhnttn.exe 38 PID 320 wrote to memory of 808 320 nhnttn.exe 38 PID 320 wrote to memory of 808 320 nhnttn.exe 38 PID 320 wrote to memory of 808 320 nhnttn.exe 38 PID 808 wrote to memory of 1092 808 1pvvj.exe 39 PID 808 wrote to memory of 1092 808 1pvvj.exe 39 PID 808 wrote to memory of 1092 808 1pvvj.exe 39 PID 808 wrote to memory of 1092 808 1pvvj.exe 39 PID 1092 wrote to memory of 2488 1092 1xlllfl.exe 40 PID 1092 wrote to memory of 2488 1092 1xlllfl.exe 40 PID 1092 wrote to memory of 2488 1092 1xlllfl.exe 40 PID 1092 wrote to memory of 2488 1092 1xlllfl.exe 40 PID 2488 wrote to memory of 2808 2488 dvjpp.exe 41 PID 2488 wrote to memory of 2808 2488 dvjpp.exe 41 PID 2488 wrote to memory of 2808 2488 dvjpp.exe 41 PID 2488 wrote to memory of 2808 2488 dvjpp.exe 41 PID 2808 wrote to memory of 2864 2808 lfrlllr.exe 42 PID 2808 wrote to memory of 2864 2808 lfrlllr.exe 42 PID 2808 wrote to memory of 2864 2808 lfrlllr.exe 42 PID 2808 wrote to memory of 2864 2808 lfrlllr.exe 42 PID 2864 wrote to memory of 324 2864 nhthnh.exe 43 PID 2864 wrote to memory of 324 2864 nhthnh.exe 43 PID 2864 wrote to memory of 324 2864 nhthnh.exe 43 PID 2864 wrote to memory of 324 2864 nhthnh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe"C:\Users\Admin\AppData\Local\Temp\1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xffrllx.exec:\xffrllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\vvvvv.exec:\vvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\nbnthh.exec:\nbnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pjvvj.exec:\pjvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hbtbhn.exec:\hbtbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\1tbbbh.exec:\1tbbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\7xxxxff.exec:\7xxxxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1nhhnb.exec:\1nhhnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lxxxffl.exec:\lxxxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\nhnttn.exec:\nhnttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\1pvvj.exec:\1pvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\1xlllfl.exec:\1xlllfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\dvjpp.exec:\dvjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\lfrlllr.exec:\lfrlllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\nhthnh.exec:\nhthnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjvvj.exec:\pjvvj.exe17⤵
- Executes dropped EXE
PID:324 -
\??\c:\btbttt.exec:\btbttt.exe18⤵
- Executes dropped EXE
PID:2476 -
\??\c:\5jvvd.exec:\5jvvd.exe19⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxrffll.exec:\fxrffll.exe20⤵
- Executes dropped EXE
PID:1028 -
\??\c:\thtthb.exec:\thtthb.exe21⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ffrrfrx.exec:\ffrrfrx.exe22⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hbhhtb.exec:\hbhhtb.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rxrxffx.exec:\rxrxffx.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tnhthn.exec:\tnhthn.exe25⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pvdjd.exec:\pvdjd.exe26⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lxxrxxl.exec:\lxxrxxl.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1dppv.exec:\1dppv.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\fxffflr.exec:\fxffflr.exe29⤵
- Executes dropped EXE
PID:928 -
\??\c:\nbtntt.exec:\nbtntt.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3pddp.exec:\3pddp.exe31⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bnthbb.exec:\bnthbb.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ddvvv.exec:\ddvvv.exe33⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xrrxrxl.exec:\xrrxrxl.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\dddvj.exec:\dddvj.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jvjjd.exec:\jvjjd.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xrffllr.exec:\xrffllr.exe37⤵
- Executes dropped EXE
PID:1668 -
\??\c:\btnnbb.exec:\btnnbb.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3btbhn.exec:\3btbhn.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pddvd.exec:\pddvd.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rffxfxx.exec:\rffxfxx.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnttbb.exec:\tnttbb.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5dpdj.exec:\5dpdj.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xffrxlx.exec:\xffrxlx.exe44⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nhtttt.exec:\nhtttt.exe45⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9bttnt.exec:\9bttnt.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ffxlflf.exec:\ffxlflf.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\5rflxfl.exec:\5rflxfl.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\1hhhbh.exec:\1hhhbh.exe49⤵
- Executes dropped EXE
PID:576 -
\??\c:\pjdjd.exec:\pjdjd.exe50⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9tnbth.exec:\9tnbth.exe52⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vpjvj.exec:\vpjvj.exe53⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxrxllx.exec:\fxrxllx.exe54⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hnnhht.exec:\hnnhht.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ttthtb.exec:\ttthtb.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjvdd.exec:\pjvdd.exe57⤵
- Executes dropped EXE
PID:640 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe58⤵
- Executes dropped EXE
PID:796 -
\??\c:\bntbbh.exec:\bntbbh.exe59⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ddjjp.exec:\ddjjp.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jjddp.exec:\jjddp.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\9lflrxl.exec:\9lflrxl.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hhhtbh.exec:\hhhtbh.exe63⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvpvp.exec:\pvpvp.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9frlrrx.exec:\9frlrrx.exe65⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrfllrx.exec:\rrfllrx.exe66⤵PID:1828
-
\??\c:\nbnhnn.exec:\nbnhnn.exe67⤵PID:2356
-
\??\c:\7ppvv.exec:\7ppvv.exe68⤵PID:812
-
\??\c:\rfxfllr.exec:\rfxfllr.exe69⤵PID:1832
-
\??\c:\lfxlllr.exec:\lfxlllr.exe70⤵PID:2260
-
\??\c:\hnnhth.exec:\hnnhth.exe71⤵PID:1528
-
\??\c:\jdvvv.exec:\jdvvv.exe72⤵PID:2132
-
\??\c:\frllrlx.exec:\frllrlx.exe73⤵PID:2096
-
\??\c:\nhnthn.exec:\nhnthn.exe74⤵PID:1716
-
\??\c:\djvjd.exec:\djvjd.exe75⤵PID:1956
-
\??\c:\lxlxxlr.exec:\lxlxxlr.exe76⤵PID:2924
-
\??\c:\llrfrrl.exec:\llrfrrl.exe77⤵PID:1072
-
\??\c:\tbbtnt.exec:\tbbtnt.exe78⤵PID:1736
-
\??\c:\ppppv.exec:\ppppv.exe79⤵PID:2648
-
\??\c:\btnnhh.exec:\btnnhh.exe80⤵PID:2592
-
\??\c:\3nhhhn.exec:\3nhhhn.exe81⤵PID:2780
-
\??\c:\jdjpd.exec:\jdjpd.exe82⤵PID:2632
-
\??\c:\flfrlxf.exec:\flfrlxf.exe83⤵PID:2112
-
\??\c:\lfxflrx.exec:\lfxflrx.exe84⤵PID:2840
-
\??\c:\9hnnbh.exec:\9hnnbh.exe85⤵PID:2612
-
\??\c:\pvpdp.exec:\pvpdp.exe86⤵PID:2552
-
\??\c:\rrflflf.exec:\rrflflf.exe87⤵PID:2544
-
\??\c:\7rlxrxl.exec:\7rlxrxl.exe88⤵PID:596
-
\??\c:\bttbhn.exec:\bttbhn.exe89⤵PID:1824
-
\??\c:\9djjj.exec:\9djjj.exe90⤵PID:1156
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe91⤵PID:1036
-
\??\c:\tbbtnt.exec:\tbbtnt.exe92⤵PID:576
-
\??\c:\9ppjd.exec:\9ppjd.exe93⤵PID:1484
-
\??\c:\jjvjj.exec:\jjvjj.exe94⤵PID:2820
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe95⤵PID:2808
-
\??\c:\ttnbnt.exec:\ttnbnt.exe96⤵PID:1712
-
\??\c:\hbbbhn.exec:\hbbbhn.exe97⤵PID:2036
-
\??\c:\vjjjd.exec:\vjjjd.exe98⤵PID:1808
-
\??\c:\ffrlffx.exec:\ffrlffx.exe99⤵PID:1752
-
\??\c:\bhthbh.exec:\bhthbh.exe100⤵PID:1756
-
\??\c:\pdddj.exec:\pdddj.exe101⤵PID:1204
-
\??\c:\1vppp.exec:\1vppp.exe102⤵PID:2040
-
\??\c:\rxrlrff.exec:\rxrlrff.exe103⤵PID:2248
-
\??\c:\btnnnn.exec:\btnnnn.exe104⤵PID:1776
-
\??\c:\jdvdd.exec:\jdvdd.exe105⤵PID:2596
-
\??\c:\pjpvd.exec:\pjpvd.exe106⤵PID:2944
-
\??\c:\1lfxlrr.exec:\1lfxlrr.exe107⤵PID:1208
-
\??\c:\nhtbbh.exec:\nhtbbh.exe108⤵PID:2480
-
\??\c:\9djpd.exec:\9djpd.exe109⤵PID:2232
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe110⤵PID:1296
-
\??\c:\frlxffl.exec:\frlxffl.exe111⤵PID:1564
-
\??\c:\tnnnbt.exec:\tnnnbt.exe112⤵PID:1240
-
\??\c:\pjjdp.exec:\pjjdp.exe113⤵PID:2580
-
\??\c:\lfxfffr.exec:\lfxfffr.exe114⤵PID:2164
-
\??\c:\hhbbhh.exec:\hhbbhh.exe115⤵PID:2176
-
\??\c:\vjppv.exec:\vjppv.exe116⤵PID:2132
-
\??\c:\rflllff.exec:\rflllff.exe117⤵PID:2392
-
\??\c:\9tbbnn.exec:\9tbbnn.exe118⤵PID:2272
-
\??\c:\pjvpp.exec:\pjvpp.exe119⤵PID:1588
-
\??\c:\rfrrffx.exec:\rfrrffx.exe120⤵PID:2128
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe121⤵PID:3020
-
\??\c:\7bttbb.exec:\7bttbb.exe122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-