Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe
-
Size
453KB
-
MD5
43c73cb8683a3388574134e2174927e0
-
SHA1
2f0af82b6a5836710d06ffb25c843e909007ad9d
-
SHA256
d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843f
-
SHA512
fc108952b0364ef7681f1f682f62b8d148cf3d1a128adaaf1e4516020092648e5596b71b97c0e30f757d1eed139370baa4c1d2f2cec8cb28b5f7d124457ab265
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2092-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-452-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2528-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/720-802-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-845-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/924-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-502-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2484-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/392-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-114-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1700-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-884-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2092 tnhhtb.exe 2400 lrfllll.exe 2708 hnbbnt.exe 2584 ddvvj.exe 3044 xllfxfr.exe 672 ntbhtb.exe 800 pppvd.exe 828 fflrflr.exe 1440 lfxflrf.exe 1700 hnbnhn.exe 2908 dpddp.exe 1304 rrlrffx.exe 1084 tnhhbb.exe 2888 xxxflrr.exe 1188 ttnthh.exe 1220 pjvvj.exe 1800 9jddj.exe 2284 rlxxlrx.exe 2468 vpvjd.exe 660 fxxfxxx.exe 744 bnhnbh.exe 444 vvpvj.exe 2348 7xrrxxr.exe 956 nhhthn.exe 676 7dvvj.exe 2472 lxrrlfl.exe 760 ppjvj.exe 960 9fflxxf.exe 1816 lfllrrx.exe 392 bthntt.exe 1008 3dppv.exe 2860 tbhttn.exe 2744 nhtnth.exe 2592 7xlrflx.exe 2576 xrlfllr.exe 1976 hbhttt.exe 2628 7vdjj.exe 1096 llflxfx.exe 2172 9hnhhb.exe 1628 vdjpv.exe 2248 vpdjv.exe 1708 xlffrxr.exe 2964 tbtbnh.exe 2324 hhbtnb.exe 1376 pjdjp.exe 1184 llxlrxl.exe 2668 hbbbnn.exe 300 bbbhnt.exe 1264 vpvvj.exe 1220 rlflxfr.exe 1688 nnnhtb.exe 1792 btbhtt.exe 1488 vdppv.exe 1044 rfxfxxl.exe 2108 tnbhbb.exe 1076 hbtthn.exe 2484 vpdpj.exe 2528 fxlfllx.exe 2848 frflrxx.exe 2056 nhbhtb.exe 544 jdvjp.exe 2420 1jvpv.exe 604 7rxxrxr.exe 760 tnhnht.exe -
resource yara_rule behavioral1/memory/2092-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-905-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2092 2728 d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe 30 PID 2728 wrote to memory of 2092 2728 d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe 30 PID 2728 wrote to memory of 2092 2728 d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe 30 PID 2728 wrote to memory of 2092 2728 d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe 30 PID 2092 wrote to memory of 2400 2092 tnhhtb.exe 31 PID 2092 wrote to memory of 2400 2092 tnhhtb.exe 31 PID 2092 wrote to memory of 2400 2092 tnhhtb.exe 31 PID 2092 wrote to memory of 2400 2092 tnhhtb.exe 31 PID 2400 wrote to memory of 2708 2400 lrfllll.exe 32 PID 2400 wrote to memory of 2708 2400 lrfllll.exe 32 PID 2400 wrote to memory of 2708 2400 lrfllll.exe 32 PID 2400 wrote to memory of 2708 2400 lrfllll.exe 32 PID 2708 wrote to memory of 2584 2708 hnbbnt.exe 33 PID 2708 wrote to memory of 2584 2708 hnbbnt.exe 33 PID 2708 wrote to memory of 2584 2708 hnbbnt.exe 33 PID 2708 wrote to memory of 2584 2708 hnbbnt.exe 33 PID 2584 wrote to memory of 3044 2584 ddvvj.exe 147 PID 2584 wrote to memory of 3044 2584 ddvvj.exe 147 PID 2584 wrote to memory of 3044 2584 ddvvj.exe 147 PID 2584 wrote to memory of 3044 2584 ddvvj.exe 147 PID 3044 wrote to memory of 672 3044 xllfxfr.exe 106 PID 3044 wrote to memory of 672 3044 xllfxfr.exe 106 PID 3044 wrote to memory of 672 3044 xllfxfr.exe 106 PID 3044 wrote to memory of 672 3044 xllfxfr.exe 106 PID 672 wrote to memory of 800 672 ntbhtb.exe 36 PID 672 wrote to memory of 800 672 ntbhtb.exe 36 PID 672 wrote to memory of 800 672 ntbhtb.exe 36 PID 672 wrote to memory of 800 672 ntbhtb.exe 36 PID 800 wrote to memory of 828 800 pppvd.exe 37 PID 800 wrote to memory of 828 800 pppvd.exe 37 PID 800 wrote to memory of 828 800 pppvd.exe 37 PID 800 wrote to memory of 828 800 pppvd.exe 37 PID 828 wrote to memory of 1440 828 fflrflr.exe 38 PID 828 wrote to memory of 1440 828 fflrflr.exe 38 PID 828 wrote to memory of 1440 828 fflrflr.exe 38 PID 828 wrote to memory of 1440 828 fflrflr.exe 38 PID 1440 wrote to memory of 1700 1440 lfxflrf.exe 39 PID 1440 wrote to memory of 1700 1440 lfxflrf.exe 39 PID 1440 wrote to memory of 1700 1440 lfxflrf.exe 39 PID 1440 wrote to memory of 1700 1440 lfxflrf.exe 39 PID 1700 wrote to memory of 2908 1700 hnbnhn.exe 40 PID 1700 wrote to memory of 2908 1700 hnbnhn.exe 40 PID 1700 wrote to memory of 2908 1700 hnbnhn.exe 40 PID 1700 wrote to memory of 2908 1700 hnbnhn.exe 40 PID 2908 wrote to memory of 1304 2908 dpddp.exe 41 PID 2908 wrote to memory of 1304 2908 dpddp.exe 41 PID 2908 wrote to memory of 1304 2908 dpddp.exe 41 PID 2908 wrote to memory of 1304 2908 dpddp.exe 41 PID 1304 wrote to memory of 1084 1304 rrlrffx.exe 42 PID 1304 wrote to memory of 1084 1304 rrlrffx.exe 42 PID 1304 wrote to memory of 1084 1304 rrlrffx.exe 42 PID 1304 wrote to memory of 1084 1304 rrlrffx.exe 42 PID 1084 wrote to memory of 2888 1084 tnhhbb.exe 43 PID 1084 wrote to memory of 2888 1084 tnhhbb.exe 43 PID 1084 wrote to memory of 2888 1084 tnhhbb.exe 43 PID 1084 wrote to memory of 2888 1084 tnhhbb.exe 43 PID 2888 wrote to memory of 1188 2888 xxxflrr.exe 44 PID 2888 wrote to memory of 1188 2888 xxxflrr.exe 44 PID 2888 wrote to memory of 1188 2888 xxxflrr.exe 44 PID 2888 wrote to memory of 1188 2888 xxxflrr.exe 44 PID 1188 wrote to memory of 1220 1188 ttnthh.exe 80 PID 1188 wrote to memory of 1220 1188 ttnthh.exe 80 PID 1188 wrote to memory of 1220 1188 ttnthh.exe 80 PID 1188 wrote to memory of 1220 1188 ttnthh.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe"C:\Users\Admin\AppData\Local\Temp\d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tnhhtb.exec:\tnhhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\lrfllll.exec:\lrfllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hnbbnt.exec:\hnbbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ddvvj.exec:\ddvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xllfxfr.exec:\xllfxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ntbhtb.exec:\ntbhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\pppvd.exec:\pppvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\fflrflr.exec:\fflrflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\lfxflrf.exec:\lfxflrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\hnbnhn.exec:\hnbnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\dpddp.exec:\dpddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rrlrffx.exec:\rrlrffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\tnhhbb.exec:\tnhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\xxxflrr.exec:\xxxflrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ttnthh.exec:\ttnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\pjvvj.exec:\pjvvj.exe17⤵
- Executes dropped EXE
PID:1220 -
\??\c:\9jddj.exec:\9jddj.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe19⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vpvjd.exec:\vpvjd.exe20⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fxxfxxx.exec:\fxxfxxx.exe21⤵
- Executes dropped EXE
PID:660 -
\??\c:\bnhnbh.exec:\bnhnbh.exe22⤵
- Executes dropped EXE
PID:744 -
\??\c:\vvpvj.exec:\vvpvj.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\7xrrxxr.exec:\7xrrxxr.exe24⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhhthn.exec:\nhhthn.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\7dvvj.exec:\7dvvj.exe26⤵
- Executes dropped EXE
PID:676 -
\??\c:\lxrrlfl.exec:\lxrrlfl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2472 -
\??\c:\ppjvj.exec:\ppjvj.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\9fflxxf.exec:\9fflxxf.exe29⤵
- Executes dropped EXE
PID:960 -
\??\c:\lfllrrx.exec:\lfllrrx.exe30⤵
- Executes dropped EXE
PID:1816 -
\??\c:\bthntt.exec:\bthntt.exe31⤵
- Executes dropped EXE
PID:392 -
\??\c:\3dppv.exec:\3dppv.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xllxrll.exec:\xllxrll.exe33⤵PID:1716
-
\??\c:\tbhttn.exec:\tbhttn.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nhtnth.exec:\nhtnth.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7xlrflx.exec:\7xlrflx.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrlfllr.exec:\xrlfllr.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbhttt.exec:\hbhttt.exe38⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7vdjj.exec:\7vdjj.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\llflxfx.exec:\llflxfx.exe40⤵
- Executes dropped EXE
PID:1096 -
\??\c:\9hnhhb.exec:\9hnhhb.exe41⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vdjpv.exec:\vdjpv.exe42⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vpdjv.exec:\vpdjv.exe43⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xlffrxr.exec:\xlffrxr.exe44⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tbtbnh.exec:\tbtbnh.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hhbtnb.exec:\hhbtnb.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjdjp.exec:\pjdjp.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\llxlrxl.exec:\llxlrxl.exe48⤵
- Executes dropped EXE
PID:1184 -
\??\c:\hbbbnn.exec:\hbbbnn.exe49⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bbbhnt.exec:\bbbhnt.exe50⤵
- Executes dropped EXE
PID:300 -
\??\c:\vpvvj.exec:\vpvvj.exe51⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rlflxfr.exec:\rlflxfr.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nnnhtb.exec:\nnnhtb.exe53⤵
- Executes dropped EXE
PID:1688 -
\??\c:\btbhtt.exec:\btbhtt.exe54⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vdppv.exec:\vdppv.exe55⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rfxfxxl.exec:\rfxfxxl.exe56⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tnbhbb.exec:\tnbhbb.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hbtthn.exec:\hbtthn.exe58⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vpdpj.exec:\vpdpj.exe59⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fxlfllx.exec:\fxlfllx.exe60⤵
- Executes dropped EXE
PID:2528 -
\??\c:\frflrxx.exec:\frflrxx.exe61⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nhbhtb.exec:\nhbhtb.exe62⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jdvjp.exec:\jdvjp.exe63⤵
- Executes dropped EXE
PID:544 -
\??\c:\1jvpv.exec:\1jvpv.exe64⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7rxxrxr.exec:\7rxxrxr.exe65⤵
- Executes dropped EXE
PID:604 -
\??\c:\tnhnht.exec:\tnhnht.exe66⤵
- Executes dropped EXE
PID:760 -
\??\c:\7bbtbn.exec:\7bbtbn.exe67⤵PID:832
-
\??\c:\vdvjd.exec:\vdvjd.exe68⤵PID:2164
-
\??\c:\xrfxfrx.exec:\xrfxfrx.exe69⤵PID:1984
-
\??\c:\3lfxxfr.exec:\3lfxxfr.exe70⤵PID:2844
-
\??\c:\bbbnhh.exec:\bbbnhh.exe71⤵PID:1120
-
\??\c:\3btttb.exec:\3btttb.exe72⤵PID:2840
-
\??\c:\djjvp.exec:\djjvp.exe73⤵PID:2600
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe74⤵
- System Location Discovery: System Language Discovery
PID:2736 -
\??\c:\xrllrrx.exec:\xrllrrx.exe75⤵PID:2604
-
\??\c:\7thntt.exec:\7thntt.exe76⤵PID:264
-
\??\c:\nhhnbh.exec:\nhhnbh.exe77⤵PID:532
-
\??\c:\9pvvv.exec:\9pvvv.exe78⤵PID:672
-
\??\c:\rxlflrl.exec:\rxlflrl.exe79⤵PID:924
-
\??\c:\lflxrxl.exec:\lflxrxl.exe80⤵PID:2332
-
\??\c:\7tnhbb.exec:\7tnhbb.exe81⤵PID:1260
-
\??\c:\tbntnn.exec:\tbntnn.exe82⤵PID:2052
-
\??\c:\ppdpd.exec:\ppdpd.exe83⤵PID:2552
-
\??\c:\7flrffr.exec:\7flrffr.exe84⤵PID:2248
-
\??\c:\rlflffr.exec:\rlflffr.exe85⤵PID:1248
-
\??\c:\btbhtb.exec:\btbhtb.exe86⤵PID:2824
-
\??\c:\3dddv.exec:\3dddv.exe87⤵PID:2856
-
\??\c:\5dvvd.exec:\5dvvd.exe88⤵PID:1340
-
\??\c:\5rlrfxl.exec:\5rlrfxl.exe89⤵PID:2020
-
\??\c:\rlxfxfx.exec:\rlxfxfx.exe90⤵PID:2480
-
\??\c:\nnhthh.exec:\nnhthh.exe91⤵PID:2668
-
\??\c:\vjddv.exec:\vjddv.exe92⤵PID:300
-
\??\c:\lffrflx.exec:\lffrflx.exe93⤵PID:1284
-
\??\c:\rrxrffx.exec:\rrxrffx.exe94⤵PID:308
-
\??\c:\nhnntn.exec:\nhnntn.exe95⤵PID:3064
-
\??\c:\3dpvj.exec:\3dpvj.exe96⤵PID:2464
-
\??\c:\dddjv.exec:\dddjv.exe97⤵PID:2896
-
\??\c:\rlffrxl.exec:\rlffrxl.exe98⤵PID:1148
-
\??\c:\3tnbnh.exec:\3tnbnh.exe99⤵PID:2968
-
\??\c:\nhbnhh.exec:\nhbnhh.exe100⤵PID:1280
-
\??\c:\jdpvd.exec:\jdpvd.exe101⤵PID:1076
-
\??\c:\1ddjd.exec:\1ddjd.exe102⤵PID:824
-
\??\c:\rfrrflf.exec:\rfrrflf.exe103⤵PID:1356
-
\??\c:\lfrrflx.exec:\lfrrflx.exe104⤵PID:2192
-
\??\c:\tttnnt.exec:\tttnnt.exe105⤵PID:3060
-
\??\c:\9vvjd.exec:\9vvjd.exe106⤵PID:1812
-
\??\c:\ppdjv.exec:\ppdjv.exe107⤵PID:2148
-
\??\c:\xlxxffl.exec:\xlxxffl.exe108⤵PID:1532
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe109⤵PID:720
-
\??\c:\hnnbtt.exec:\hnnbtt.exe110⤵PID:1616
-
\??\c:\pvdjv.exec:\pvdjv.exe111⤵PID:2328
-
\??\c:\dvjdp.exec:\dvjdp.exe112⤵PID:2944
-
\??\c:\llxxrrf.exec:\llxxrrf.exe113⤵PID:2688
-
\??\c:\9lxxffl.exec:\9lxxffl.exe114⤵PID:1716
-
\??\c:\bnntth.exec:\bnntth.exe115⤵PID:2084
-
\??\c:\jddpp.exec:\jddpp.exe116⤵PID:2860
-
\??\c:\jjpvv.exec:\jjpvv.exe117⤵PID:2452
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe118⤵PID:2008
-
\??\c:\3nhhbb.exec:\3nhhbb.exe119⤵PID:3044
-
\??\c:\bthnnt.exec:\bthnnt.exe120⤵PID:864
-
\??\c:\vpdvj.exec:\vpdvj.exe121⤵PID:2792
-
\??\c:\pdjpj.exec:\pdjpj.exe122⤵PID:2112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-