Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe
-
Size
453KB
-
MD5
8412b701ec62b69b1bd5ab870bd412c0
-
SHA1
5866a4d50052bcf4577f6777322e35e6cdfae73d
-
SHA256
98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136
-
SHA512
e14dd0b933b09f31f8fabcd8bb7879e11c1406cdc4c5093c9a379a39d3fb1fdfedac02963c6bde90bb73401e55c61ef42e2e8331fe0b3635604f0d8797ce6bd4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2460-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-135-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-144-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1412-153-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1412-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1312-225-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1556-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-270-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2128-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-375-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2160-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-412-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2084-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-453-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2516-490-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2348-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-560-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2200-574-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-652-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2440-666-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-723-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/620-736-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1192-758-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2224-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-863-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1944-1016-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2336 dvddd.exe 1020 llxlffx.exe 2260 hbnbnt.exe 2432 frflxxr.exe 2772 btbhnt.exe 2156 ppjvd.exe 2584 lfflrrf.exe 2576 tnthhb.exe 2548 lrlxflr.exe 1636 hbbbnt.exe 2196 dvjvj.exe 1728 fxfxxfr.exe 236 hbttbh.exe 1448 vpvpp.exe 2812 nbthbt.exe 1412 vjvjj.exe 1796 rxrlffl.exe 2940 dpddp.exe 1208 9lfxllx.exe 1952 1rfxlrf.exe 1704 vdpvp.exe 1108 tthntb.exe 2516 dpddj.exe 1312 lflffxl.exe 1556 htbhht.exe 1056 tntnnn.exe 1896 lfxfrlx.exe 580 bbbhtt.exe 2448 dvdjv.exe 2844 rrlrxfl.exe 2128 1bntbb.exe 1492 thtbhh.exe 2424 ffrlxfx.exe 2832 hhtbtt.exe 1884 hthnth.exe 2708 dvjpj.exe 2756 7rffffl.exe 3000 7rffffl.exe 2704 frllfxl.exe 2920 7bhhtb.exe 2688 3vppv.exe 2904 jpvpd.exe 2564 flrxffr.exe 2160 llxrrlr.exe 2104 5dppp.exe 2196 pvvjv.exe 640 1thhtb.exe 596 dpdjv.exe 1456 5xrxxxf.exe 2620 7tbntb.exe 2848 vddjj.exe 1592 1xlrxlr.exe 2084 xrlxffr.exe 2956 7bnntt.exe 2096 ddvjp.exe 2648 lllrffx.exe 2136 frrxllx.exe 1604 bntnnn.exe 1548 pjdvj.exe 1408 9rfflfl.exe 2868 hnhbnb.exe 2516 nhtnnn.exe 1672 dpvdj.exe 1660 fxrxrrl.exe -
resource yara_rule behavioral1/memory/2460-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-203-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1312-225-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1556-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-279-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2128-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-412-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2084-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-461-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2868-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-572-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2752-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-758-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2224-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-882-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2352-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-1016-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2076-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2336 2460 98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe 31 PID 2460 wrote to memory of 2336 2460 98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe 31 PID 2460 wrote to memory of 2336 2460 98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe 31 PID 2460 wrote to memory of 2336 2460 98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe 31 PID 2336 wrote to memory of 1020 2336 dvddd.exe 32 PID 2336 wrote to memory of 1020 2336 dvddd.exe 32 PID 2336 wrote to memory of 1020 2336 dvddd.exe 32 PID 2336 wrote to memory of 1020 2336 dvddd.exe 32 PID 1020 wrote to memory of 2260 1020 llxlffx.exe 33 PID 1020 wrote to memory of 2260 1020 llxlffx.exe 33 PID 1020 wrote to memory of 2260 1020 llxlffx.exe 33 PID 1020 wrote to memory of 2260 1020 llxlffx.exe 33 PID 2260 wrote to memory of 2432 2260 hbnbnt.exe 34 PID 2260 wrote to memory of 2432 2260 hbnbnt.exe 34 PID 2260 wrote to memory of 2432 2260 hbnbnt.exe 34 PID 2260 wrote to memory of 2432 2260 hbnbnt.exe 34 PID 2432 wrote to memory of 2772 2432 frflxxr.exe 35 PID 2432 wrote to memory of 2772 2432 frflxxr.exe 35 PID 2432 wrote to memory of 2772 2432 frflxxr.exe 35 PID 2432 wrote to memory of 2772 2432 frflxxr.exe 35 PID 2772 wrote to memory of 2156 2772 btbhnt.exe 36 PID 2772 wrote to memory of 2156 2772 btbhnt.exe 36 PID 2772 wrote to memory of 2156 2772 btbhnt.exe 36 PID 2772 wrote to memory of 2156 2772 btbhnt.exe 36 PID 2156 wrote to memory of 2584 2156 ppjvd.exe 37 PID 2156 wrote to memory of 2584 2156 ppjvd.exe 37 PID 2156 wrote to memory of 2584 2156 ppjvd.exe 37 PID 2156 wrote to memory of 2584 2156 ppjvd.exe 37 PID 2584 wrote to memory of 2576 2584 lfflrrf.exe 38 PID 2584 wrote to memory of 2576 2584 lfflrrf.exe 38 PID 2584 wrote to memory of 2576 2584 lfflrrf.exe 38 PID 2584 wrote to memory of 2576 2584 lfflrrf.exe 38 PID 2576 wrote to memory of 2548 2576 tnthhb.exe 39 PID 2576 wrote to memory of 2548 2576 tnthhb.exe 39 PID 2576 wrote to memory of 2548 2576 tnthhb.exe 39 PID 2576 wrote to memory of 2548 2576 tnthhb.exe 39 PID 2548 wrote to memory of 1636 2548 lrlxflr.exe 40 PID 2548 wrote to memory of 1636 2548 lrlxflr.exe 40 PID 2548 wrote to memory of 1636 2548 lrlxflr.exe 40 PID 2548 wrote to memory of 1636 2548 lrlxflr.exe 40 PID 1636 wrote to memory of 2196 1636 hbbbnt.exe 41 PID 1636 wrote to memory of 2196 1636 hbbbnt.exe 41 PID 1636 wrote to memory of 2196 1636 hbbbnt.exe 41 PID 1636 wrote to memory of 2196 1636 hbbbnt.exe 41 PID 2196 wrote to memory of 1728 2196 dvjvj.exe 42 PID 2196 wrote to memory of 1728 2196 dvjvj.exe 42 PID 2196 wrote to memory of 1728 2196 dvjvj.exe 42 PID 2196 wrote to memory of 1728 2196 dvjvj.exe 42 PID 1728 wrote to memory of 236 1728 fxfxxfr.exe 43 PID 1728 wrote to memory of 236 1728 fxfxxfr.exe 43 PID 1728 wrote to memory of 236 1728 fxfxxfr.exe 43 PID 1728 wrote to memory of 236 1728 fxfxxfr.exe 43 PID 236 wrote to memory of 1448 236 hbttbh.exe 44 PID 236 wrote to memory of 1448 236 hbttbh.exe 44 PID 236 wrote to memory of 1448 236 hbttbh.exe 44 PID 236 wrote to memory of 1448 236 hbttbh.exe 44 PID 1448 wrote to memory of 2812 1448 vpvpp.exe 45 PID 1448 wrote to memory of 2812 1448 vpvpp.exe 45 PID 1448 wrote to memory of 2812 1448 vpvpp.exe 45 PID 1448 wrote to memory of 2812 1448 vpvpp.exe 45 PID 2812 wrote to memory of 1412 2812 nbthbt.exe 46 PID 2812 wrote to memory of 1412 2812 nbthbt.exe 46 PID 2812 wrote to memory of 1412 2812 nbthbt.exe 46 PID 2812 wrote to memory of 1412 2812 nbthbt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe"C:\Users\Admin\AppData\Local\Temp\98f9ec6c2bc41b1876c15f05c7a04e682c734c432b3d5dece9d40315d232f136N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\dvddd.exec:\dvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\llxlffx.exec:\llxlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\hbnbnt.exec:\hbnbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\frflxxr.exec:\frflxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\btbhnt.exec:\btbhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ppjvd.exec:\ppjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\lfflrrf.exec:\lfflrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tnthhb.exec:\tnthhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lrlxflr.exec:\lrlxflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hbbbnt.exec:\hbbbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\dvjvj.exec:\dvjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\fxfxxfr.exec:\fxfxxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\hbttbh.exec:\hbttbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\vpvpp.exec:\vpvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\nbthbt.exec:\nbthbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vjvjj.exec:\vjvjj.exe17⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rxrlffl.exec:\rxrlffl.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dpddp.exec:\dpddp.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\9lfxllx.exec:\9lfxllx.exe20⤵
- Executes dropped EXE
PID:1208 -
\??\c:\1rfxlrf.exec:\1rfxlrf.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\vdpvp.exec:\vdpvp.exe22⤵
- Executes dropped EXE
PID:1704 -
\??\c:\tthntb.exec:\tthntb.exe23⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dpddj.exec:\dpddj.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lflffxl.exec:\lflffxl.exe25⤵
- Executes dropped EXE
PID:1312 -
\??\c:\htbhht.exec:\htbhht.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tntnnn.exec:\tntnnn.exe27⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe28⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bbbhtt.exec:\bbbhtt.exe29⤵
- Executes dropped EXE
PID:580 -
\??\c:\dvdjv.exec:\dvdjv.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe31⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1bntbb.exec:\1bntbb.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thtbhh.exec:\thtbhh.exe33⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ffrlxfx.exec:\ffrlxfx.exe34⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hhtbtt.exec:\hhtbtt.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hthnth.exec:\hthnth.exe36⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dvjpj.exec:\dvjpj.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7rffffl.exec:\7rffffl.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7rffffl.exec:\7rffffl.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\frllfxl.exec:\frllfxl.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7bhhtb.exec:\7bhhtb.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3vppv.exec:\3vppv.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jpvpd.exec:\jpvpd.exe43⤵
- Executes dropped EXE
PID:2904 -
\??\c:\flrxffr.exec:\flrxffr.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\llxrrlr.exec:\llxrrlr.exe45⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5dppp.exec:\5dppp.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pvvjv.exec:\pvvjv.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1thhtb.exec:\1thhtb.exe48⤵
- Executes dropped EXE
PID:640 -
\??\c:\dpdjv.exec:\dpdjv.exe49⤵
- Executes dropped EXE
PID:596 -
\??\c:\5xrxxxf.exec:\5xrxxxf.exe50⤵
- Executes dropped EXE
PID:1456 -
\??\c:\7tbntb.exec:\7tbntb.exe51⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vddjj.exec:\vddjj.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1xlrxlr.exec:\1xlrxlr.exe53⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xrlxffr.exec:\xrlxffr.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\7bnntt.exec:\7bnntt.exe55⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ddvjp.exec:\ddvjp.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\lllrffx.exec:\lllrffx.exe57⤵
- Executes dropped EXE
PID:2648 -
\??\c:\frrxllx.exec:\frrxllx.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bntnnn.exec:\bntnnn.exe59⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pjdvj.exec:\pjdvj.exe60⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9rfflfl.exec:\9rfflfl.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\hnhbnb.exec:\hnhbnb.exe62⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhtnnn.exec:\nhtnnn.exe63⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dpvdj.exec:\dpvdj.exe64⤵
- Executes dropped EXE
PID:1672 -
\??\c:\fxrxrrl.exec:\fxrxrrl.exe65⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nnbnbb.exec:\nnbnbb.exe66⤵PID:532
-
\??\c:\tnntnt.exec:\tnntnt.exe67⤵PID:2476
-
\??\c:\dvjjp.exec:\dvjjp.exe68⤵PID:3040
-
\??\c:\5lffffr.exec:\5lffffr.exe69⤵PID:1740
-
\??\c:\tnbbhb.exec:\tnbbhb.exe70⤵PID:580
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe71⤵PID:2348
-
\??\c:\rlrflrf.exec:\rlrflrf.exe72⤵PID:2844
-
\??\c:\bhtbhn.exec:\bhtbhn.exe73⤵PID:1248
-
\??\c:\vdpvj.exec:\vdpvj.exe74⤵PID:2128
-
\??\c:\pjdjd.exec:\pjdjd.exe75⤵PID:2200
-
\??\c:\1xrfrxf.exec:\1xrfrxf.exe76⤵PID:2424
-
\??\c:\1tnbhn.exec:\1tnbhn.exe77⤵PID:2660
-
\??\c:\tnhnbb.exec:\tnhnbb.exe78⤵PID:2752
-
\??\c:\3dpjj.exec:\3dpjj.exe79⤵PID:2772
-
\??\c:\vpjjv.exec:\vpjjv.exe80⤵PID:2668
-
\??\c:\frfxffx.exec:\frfxffx.exe81⤵PID:2684
-
\??\c:\3hntbb.exec:\3hntbb.exe82⤵PID:2588
-
\??\c:\nttthh.exec:\nttthh.exe83⤵PID:2836
-
\??\c:\vpddj.exec:\vpddj.exe84⤵PID:1372
-
\??\c:\vjddj.exec:\vjddj.exe85⤵PID:2060
-
\??\c:\3lrxfff.exec:\3lrxfff.exe86⤵PID:2616
-
\??\c:\7tnthn.exec:\7tnthn.exe87⤵PID:1636
-
\??\c:\bnbbhh.exec:\bnbbhh.exe88⤵PID:2952
-
\??\c:\vpjpj.exec:\vpjpj.exe89⤵PID:2440
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe90⤵PID:1852
-
\??\c:\xxrrllr.exec:\xxrrllr.exe91⤵PID:2512
-
\??\c:\1tnthh.exec:\1tnthh.exe92⤵PID:2892
-
\??\c:\nnbhtt.exec:\nnbhtt.exe93⤵PID:2884
-
\??\c:\1pdjj.exec:\1pdjj.exe94⤵PID:276
-
\??\c:\frffffl.exec:\frffffl.exe95⤵PID:2912
-
\??\c:\bbnthn.exec:\bbnthn.exe96⤵PID:2908
-
\??\c:\jdvvj.exec:\jdvvj.exe97⤵PID:2948
-
\??\c:\vvpjp.exec:\vvpjp.exe98⤵PID:1376
-
\??\c:\xrffxxf.exec:\xrffxxf.exe99⤵PID:2176
-
\??\c:\tthtbb.exec:\tthtbb.exe100⤵PID:620
-
\??\c:\btnhhn.exec:\btnhhn.exe101⤵PID:448
-
\??\c:\vpdjv.exec:\vpdjv.exe102⤵PID:2528
-
\??\c:\pjvvp.exec:\pjvvp.exe103⤵PID:1500
-
\??\c:\lflfllr.exec:\lflfllr.exe104⤵PID:1192
-
\??\c:\nhbbbb.exec:\nhbbbb.exe105⤵PID:1648
-
\??\c:\vpvvp.exec:\vpvvp.exe106⤵PID:1620
-
\??\c:\rlffrxf.exec:\rlffrxf.exe107⤵PID:1660
-
\??\c:\1lxffff.exec:\1lxffff.exe108⤵PID:1296
-
\??\c:\bnbhnn.exec:\bnbhnn.exe109⤵PID:2224
-
\??\c:\9bhhnn.exec:\9bhhnn.exe110⤵PID:2300
-
\??\c:\dpjdj.exec:\dpjdj.exe111⤵PID:344
-
\??\c:\9fllllr.exec:\9fllllr.exe112⤵PID:1420
-
\??\c:\7rrrffr.exec:\7rrrffr.exe113⤵PID:2348
-
\??\c:\hbbbnn.exec:\hbbbnn.exe114⤵PID:1428
-
\??\c:\jpdvv.exec:\jpdvv.exe115⤵PID:2408
-
\??\c:\vvvjj.exec:\vvvjj.exe116⤵PID:2128
-
\??\c:\xfffrxx.exec:\xfffrxx.exe117⤵PID:1020
-
\??\c:\hbtbtn.exec:\hbtbtn.exe118⤵PID:2692
-
\??\c:\nntthn.exec:\nntthn.exe119⤵PID:2152
-
\??\c:\dvvpv.exec:\dvvpv.exe120⤵PID:2748
-
\??\c:\llxlrrf.exec:\llxlrrf.exe121⤵PID:2708
-
\??\c:\tnbtbt.exec:\tnbtbt.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-