Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20/12/2024, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe
-
Size
454KB
-
MD5
b4b627c160bfb57646740daae4494bb0
-
SHA1
5af789697b565bb2fc769958986d7696cdd6c9f8
-
SHA256
bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0
-
SHA512
a7d142360ed0d0c8f0ebd28a214aba94bd12530241b3fbebe11aaeae7de607abcf613f348397856328fa1196b4815bc8a104e5e5909278aa440fa6f8863a0f5a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2088-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1352-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-181-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1388-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-241-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-259-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2996-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-290-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2092-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-297-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1376-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-443-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/112-492-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/112-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-533-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/632-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-568-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2656-645-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2248-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-766-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-814-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1700-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1804 dpdpv.exe 2116 djvjv.exe 2304 nbhbbn.exe 2852 rflxrlx.exe 2104 vjdjj.exe 2724 nnnbnn.exe 824 rlfrlrf.exe 2864 pvvjv.exe 2684 bhthth.exe 2768 7vpdv.exe 2564 bnbnhh.exe 2308 5jdpj.exe 2248 5dvdj.exe 764 nttthn.exe 1388 lrlrlxl.exe 2004 djjvj.exe 1352 bbbhtb.exe 2820 pddpv.exe 2844 htthtt.exe 2380 frxfrlr.exe 1092 hnthth.exe 1340 fxxrxrl.exe 908 lrllxfx.exe 1532 vvvdj.exe 3016 bhnnnh.exe 1812 dpvvp.exe 2904 bhnnbh.exe 2996 djpdj.exe 2268 pvjvv.exe 2420 1rrfxlf.exe 2092 djdjd.exe 1376 llflxxx.exe 2100 xllfrxr.exe 2116 bhhntt.exe 2568 dpjjv.exe 2580 lllfxfl.exe 2592 bhttnb.exe 2104 1tbbtb.exe 2596 3dvdp.exe 2620 llllrlr.exe 2776 hnnbhb.exe 2604 jjvjv.exe 2600 7rlxxlf.exe 2652 1nnhhh.exe 2936 xxrfxfr.exe 2236 7frxllr.exe 1824 ththhn.exe 1668 7dpdp.exe 1564 9nhbhb.exe 1796 tthttb.exe 536 dpdpv.exe 1908 1frflxl.exe 1956 bbhnbb.exe 1952 pvjvd.exe 2476 xlllfll.exe 2576 fflrxfl.exe 1972 1hbhht.exe 2352 3vddd.exe 1260 llfrrfr.exe 112 ntbhht.exe 924 9vjvp.exe 2344 1jdjv.exe 2184 nhntbn.exe 1532 ddvdp.exe -
resource yara_rule behavioral1/memory/2088-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-379-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2652-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-443-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2476-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-645-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2504-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-766-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2344-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-873-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1804 2088 bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe 31 PID 2088 wrote to memory of 1804 2088 bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe 31 PID 2088 wrote to memory of 1804 2088 bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe 31 PID 2088 wrote to memory of 1804 2088 bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe 31 PID 1804 wrote to memory of 2116 1804 dpdpv.exe 32 PID 1804 wrote to memory of 2116 1804 dpdpv.exe 32 PID 1804 wrote to memory of 2116 1804 dpdpv.exe 32 PID 1804 wrote to memory of 2116 1804 dpdpv.exe 32 PID 2116 wrote to memory of 2304 2116 djvjv.exe 33 PID 2116 wrote to memory of 2304 2116 djvjv.exe 33 PID 2116 wrote to memory of 2304 2116 djvjv.exe 33 PID 2116 wrote to memory of 2304 2116 djvjv.exe 33 PID 2304 wrote to memory of 2852 2304 nbhbbn.exe 34 PID 2304 wrote to memory of 2852 2304 nbhbbn.exe 34 PID 2304 wrote to memory of 2852 2304 nbhbbn.exe 34 PID 2304 wrote to memory of 2852 2304 nbhbbn.exe 34 PID 2852 wrote to memory of 2104 2852 rflxrlx.exe 35 PID 2852 wrote to memory of 2104 2852 rflxrlx.exe 35 PID 2852 wrote to memory of 2104 2852 rflxrlx.exe 35 PID 2852 wrote to memory of 2104 2852 rflxrlx.exe 35 PID 2104 wrote to memory of 2724 2104 vjdjj.exe 36 PID 2104 wrote to memory of 2724 2104 vjdjj.exe 36 PID 2104 wrote to memory of 2724 2104 vjdjj.exe 36 PID 2104 wrote to memory of 2724 2104 vjdjj.exe 36 PID 2724 wrote to memory of 824 2724 nnnbnn.exe 37 PID 2724 wrote to memory of 824 2724 nnnbnn.exe 37 PID 2724 wrote to memory of 824 2724 nnnbnn.exe 37 PID 2724 wrote to memory of 824 2724 nnnbnn.exe 37 PID 824 wrote to memory of 2864 824 rlfrlrf.exe 38 PID 824 wrote to memory of 2864 824 rlfrlrf.exe 38 PID 824 wrote to memory of 2864 824 rlfrlrf.exe 38 PID 824 wrote to memory of 2864 824 rlfrlrf.exe 38 PID 2864 wrote to memory of 2684 2864 pvvjv.exe 39 PID 2864 wrote to memory of 2684 2864 pvvjv.exe 39 PID 2864 wrote to memory of 2684 2864 pvvjv.exe 39 PID 2864 wrote to memory of 2684 2864 pvvjv.exe 39 PID 2684 wrote to memory of 2768 2684 bhthth.exe 40 PID 2684 wrote to memory of 2768 2684 bhthth.exe 40 PID 2684 wrote to memory of 2768 2684 bhthth.exe 40 PID 2684 wrote to memory of 2768 2684 bhthth.exe 40 PID 2768 wrote to memory of 2564 2768 7vpdv.exe 41 PID 2768 wrote to memory of 2564 2768 7vpdv.exe 41 PID 2768 wrote to memory of 2564 2768 7vpdv.exe 41 PID 2768 wrote to memory of 2564 2768 7vpdv.exe 41 PID 2564 wrote to memory of 2308 2564 bnbnhh.exe 42 PID 2564 wrote to memory of 2308 2564 bnbnhh.exe 42 PID 2564 wrote to memory of 2308 2564 bnbnhh.exe 42 PID 2564 wrote to memory of 2308 2564 bnbnhh.exe 42 PID 2308 wrote to memory of 2248 2308 5jdpj.exe 43 PID 2308 wrote to memory of 2248 2308 5jdpj.exe 43 PID 2308 wrote to memory of 2248 2308 5jdpj.exe 43 PID 2308 wrote to memory of 2248 2308 5jdpj.exe 43 PID 2248 wrote to memory of 764 2248 5dvdj.exe 44 PID 2248 wrote to memory of 764 2248 5dvdj.exe 44 PID 2248 wrote to memory of 764 2248 5dvdj.exe 44 PID 2248 wrote to memory of 764 2248 5dvdj.exe 44 PID 764 wrote to memory of 1388 764 nttthn.exe 45 PID 764 wrote to memory of 1388 764 nttthn.exe 45 PID 764 wrote to memory of 1388 764 nttthn.exe 45 PID 764 wrote to memory of 1388 764 nttthn.exe 45 PID 1388 wrote to memory of 2004 1388 lrlrlxl.exe 46 PID 1388 wrote to memory of 2004 1388 lrlrlxl.exe 46 PID 1388 wrote to memory of 2004 1388 lrlrlxl.exe 46 PID 1388 wrote to memory of 2004 1388 lrlrlxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe"C:\Users\Admin\AppData\Local\Temp\bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\dpdpv.exec:\dpdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\djvjv.exec:\djvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nbhbbn.exec:\nbhbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\rflxrlx.exec:\rflxrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vjdjj.exec:\vjdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\nnnbnn.exec:\nnnbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\pvvjv.exec:\pvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bhthth.exec:\bhthth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7vpdv.exec:\7vpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bnbnhh.exec:\bnbnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5jdpj.exec:\5jdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\5dvdj.exec:\5dvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nttthn.exec:\nttthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\lrlrlxl.exec:\lrlrlxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\djjvj.exec:\djjvj.exe17⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bbbhtb.exec:\bbbhtb.exe18⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pddpv.exec:\pddpv.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\htthtt.exec:\htthtt.exe20⤵
- Executes dropped EXE
PID:2844 -
\??\c:\frxfrlr.exec:\frxfrlr.exe21⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hnthth.exec:\hnthth.exe22⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxxrxrl.exec:\fxxrxrl.exe23⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lrllxfx.exec:\lrllxfx.exe24⤵
- Executes dropped EXE
PID:908 -
\??\c:\vvvdj.exec:\vvvdj.exe25⤵
- Executes dropped EXE
PID:1532 -
\??\c:\bhnnnh.exec:\bhnnnh.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dpvvp.exec:\dpvvp.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bhnnbh.exec:\bhnnbh.exe28⤵
- Executes dropped EXE
PID:2904 -
\??\c:\djpdj.exec:\djpdj.exe29⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pvjvv.exec:\pvjvv.exe30⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1rrfxlf.exec:\1rrfxlf.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\djdjd.exec:\djdjd.exe32⤵
- Executes dropped EXE
PID:2092 -
\??\c:\llflxxx.exec:\llflxxx.exe33⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xllfrxr.exec:\xllfrxr.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bhhntt.exec:\bhhntt.exe35⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dpjjv.exec:\dpjjv.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lllfxfl.exec:\lllfxfl.exe37⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bhttnb.exec:\bhttnb.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1tbbtb.exec:\1tbbtb.exe39⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3dvdp.exec:\3dvdp.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llllrlr.exec:\llllrlr.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hnnbhb.exec:\hnnbhb.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jjvjv.exec:\jjvjv.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7rlxxlf.exec:\7rlxxlf.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1nnhhh.exec:\1nnhhh.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xxrfxfr.exec:\xxrfxfr.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7frxllr.exec:\7frxllr.exe47⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ththhn.exec:\ththhn.exe48⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7dpdp.exec:\7dpdp.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1668 -
\??\c:\9nhbhb.exec:\9nhbhb.exe50⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tthttb.exec:\tthttb.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dpdpv.exec:\dpdpv.exe52⤵
- Executes dropped EXE
PID:536 -
\??\c:\1frflxl.exec:\1frflxl.exe53⤵
- Executes dropped EXE
PID:1908 -
\??\c:\bbhnbb.exec:\bbhnbb.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\pvjvd.exec:\pvjvd.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xlllfll.exec:\xlllfll.exe56⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fflrxfl.exec:\fflrxfl.exe57⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1hbhht.exec:\1hbhht.exe58⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3vddd.exec:\3vddd.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\llfrrfr.exec:\llfrrfr.exe60⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ntbhht.exec:\ntbhht.exe61⤵
- Executes dropped EXE
PID:112 -
\??\c:\9vjvp.exec:\9vjvp.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\1jdjv.exec:\1jdjv.exe63⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhntbn.exec:\nhntbn.exe64⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ddvdp.exec:\ddvdp.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9lrxxfr.exec:\9lrxxfr.exe66⤵PID:3016
-
\??\c:\bntbnn.exec:\bntbnn.exe67⤵PID:2984
-
\??\c:\vpppp.exec:\vpppp.exe68⤵PID:632
-
\??\c:\rflrlxf.exec:\rflrlxf.exe69⤵PID:984
-
\??\c:\nbnnbn.exec:\nbnnbn.exe70⤵PID:2996
-
\??\c:\pjdjv.exec:\pjdjv.exe71⤵PID:868
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe72⤵PID:2340
-
\??\c:\lllfxff.exec:\lllfxff.exe73⤵PID:1996
-
\??\c:\hhbhth.exec:\hhbhth.exe74⤵PID:1800
-
\??\c:\xrlffxl.exec:\xrlffxl.exe75⤵PID:2060
-
\??\c:\nbnbhh.exec:\nbnbhh.exe76⤵PID:1688
-
\??\c:\httbnb.exec:\httbnb.exe77⤵PID:1196
-
\??\c:\vdvvd.exec:\vdvvd.exe78⤵PID:2256
-
\??\c:\flxlrfx.exec:\flxlrfx.exe79⤵PID:2852
-
\??\c:\hhtbtt.exec:\hhtbtt.exe80⤵PID:2708
-
\??\c:\7dpdv.exec:\7dpdv.exe81⤵PID:2772
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe82⤵PID:2496
-
\??\c:\bhhnnt.exec:\bhhnnt.exe83⤵PID:2760
-
\??\c:\rrfffrf.exec:\rrfffrf.exe84⤵PID:2656
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe85⤵PID:2288
-
\??\c:\bttbbt.exec:\bttbbt.exe86⤵PID:2504
-
\??\c:\frrxflf.exec:\frrxflf.exe87⤵PID:2560
-
\??\c:\ttnbth.exec:\ttnbth.exe88⤵PID:2532
-
\??\c:\vjvpp.exec:\vjvpp.exe89⤵PID:2608
-
\??\c:\5rrrflx.exec:\5rrrflx.exe90⤵PID:1028
-
\??\c:\nnntnt.exec:\nnntnt.exe91⤵PID:1728
-
\??\c:\pvjvp.exec:\pvjvp.exe92⤵PID:1668
-
\??\c:\7dpdp.exec:\7dpdp.exe93⤵PID:2248
-
\??\c:\xxrflxf.exec:\xxrflxf.exe94⤵PID:1796
-
\??\c:\tththt.exec:\tththt.exe95⤵PID:2416
-
\??\c:\jjppd.exec:\jjppd.exe96⤵PID:1908
-
\??\c:\lxlllfl.exec:\lxlllfl.exe97⤵PID:2252
-
\??\c:\bnthhn.exec:\bnthhn.exe98⤵
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\3dvdv.exec:\3dvdv.exe99⤵PID:2476
-
\??\c:\flrrxfl.exec:\flrrxfl.exe100⤵PID:2576
-
\??\c:\bnbbbh.exec:\bnbbbh.exe101⤵PID:1172
-
\??\c:\dpvjv.exec:\dpvjv.exe102⤵PID:988
-
\??\c:\llrlfxr.exec:\llrlfxr.exe103⤵PID:896
-
\??\c:\btnhht.exec:\btnhht.exe104⤵PID:1396
-
\??\c:\ttntht.exec:\ttntht.exe105⤵PID:924
-
\??\c:\llxlxlf.exec:\llxlxlf.exe106⤵PID:2344
-
\??\c:\tthhtb.exec:\tthhtb.exe107⤵PID:1284
-
\??\c:\vjjdd.exec:\vjjdd.exe108⤵PID:684
-
\??\c:\7vddj.exec:\7vddj.exe109⤵PID:832
-
\??\c:\7rrrfrf.exec:\7rrrfrf.exe110⤵PID:2904
-
\??\c:\nbnnbn.exec:\nbnnbn.exe111⤵PID:632
-
\??\c:\pvppv.exec:\pvppv.exe112⤵PID:984
-
\??\c:\lrfrfxr.exec:\lrfrfxr.exe113⤵PID:1752
-
\??\c:\lffxrlf.exec:\lffxrlf.exe114⤵PID:1748
-
\??\c:\pvvdd.exec:\pvvdd.exe115⤵PID:1700
-
\??\c:\5xxlrlr.exec:\5xxlrlr.exe116⤵PID:1996
-
\??\c:\lfflflx.exec:\lfflflx.exe117⤵PID:1800
-
\??\c:\hhbtht.exec:\hhbtht.exe118⤵PID:2060
-
\??\c:\pjpjd.exec:\pjpjd.exe119⤵PID:2668
-
\??\c:\xlflffl.exec:\xlflffl.exe120⤵PID:1196
-
\??\c:\5bnnhn.exec:\5bnnhn.exe121⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-