Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 02:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe
-
Size
453KB
-
MD5
4461cbcec22a2b5dc3a8c7715e8f3100
-
SHA1
63701a5c48c341a922e6c10a0527f06c291d52bd
-
SHA256
9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017
-
SHA512
d54e9f1600e3e8dbf99dad2829372341ad71def4045fd3476d2ad8abf2470aefa97aeaa9e58955ddb9e04986771f7273cf3beddb6c2456f0f90de8d3a86ad1e6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-34-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-52-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2756-66-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2756-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-133-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1668-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-187-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1120-225-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-296-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2396-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-468-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2080-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-490-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2152-509-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2144-522-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2012-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-642-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2888-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-650-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1560-702-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1300-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 nhnhhh.exe 2524 dvjjv.exe 2260 thhhtn.exe 2696 bbtbbn.exe 2820 7nttnn.exe 2756 jdvpv.exe 1736 tnbhnn.exe 2872 rxlrflx.exe 2604 bbnthn.exe 1704 rlxrrxl.exe 2068 5fxfrfr.exe 540 vpjpj.exe 2796 fxlrxxr.exe 1668 1vjjj.exe 592 dvjpd.exe 2864 hbbthb.exe 1440 ppjvj.exe 1828 ttntht.exe 2196 9jvvj.exe 2244 9rxxxlf.exe 1776 tbntbt.exe 1540 1rlfllx.exe 1120 7pdjp.exe 2424 nntnnn.exe 920 bbhthn.exe 1832 rrfxlfl.exe 1780 5thhhh.exe 1204 3vjpp.exe 1940 frrllxx.exe 796 5jpvv.exe 2396 fxrxrrx.exe 2392 nhnttt.exe 1528 vdjvv.exe 2684 xxfrfrl.exe 2956 nthnhn.exe 2228 vpdjp.exe 2896 jvdvp.exe 2420 rrlllrx.exe 2024 thhnnh.exe 2628 vpjpp.exe 2772 vpjvp.exe 2888 fxlllfr.exe 1932 hhbtnt.exe 2608 ntbhnn.exe 2004 pppdp.exe 2328 fxxxxfr.exe 2000 ttnbnb.exe 2136 5nhhhh.exe 1956 1jddv.exe 388 xfxxrxl.exe 1300 xxlfxlx.exe 592 nhntbb.exe 1964 jjjpd.exe 1980 xxrxlrx.exe 1312 nhbhht.exe 2160 hbbnhh.exe 3040 pvvjd.exe 2080 fxllrrf.exe 2252 rlxlxfl.exe 2564 hnhnnb.exe 784 vvvdv.exe 1720 rxrxlrf.exe 2152 xrllxrf.exe 272 bnnthn.exe -
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-34-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2820-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-170-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1776-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-881-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1628 2388 9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe 30 PID 2388 wrote to memory of 1628 2388 9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe 30 PID 2388 wrote to memory of 1628 2388 9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe 30 PID 2388 wrote to memory of 1628 2388 9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe 30 PID 1628 wrote to memory of 2524 1628 nhnhhh.exe 31 PID 1628 wrote to memory of 2524 1628 nhnhhh.exe 31 PID 1628 wrote to memory of 2524 1628 nhnhhh.exe 31 PID 1628 wrote to memory of 2524 1628 nhnhhh.exe 31 PID 2524 wrote to memory of 2260 2524 dvjjv.exe 32 PID 2524 wrote to memory of 2260 2524 dvjjv.exe 32 PID 2524 wrote to memory of 2260 2524 dvjjv.exe 32 PID 2524 wrote to memory of 2260 2524 dvjjv.exe 32 PID 2260 wrote to memory of 2696 2260 thhhtn.exe 33 PID 2260 wrote to memory of 2696 2260 thhhtn.exe 33 PID 2260 wrote to memory of 2696 2260 thhhtn.exe 33 PID 2260 wrote to memory of 2696 2260 thhhtn.exe 33 PID 2696 wrote to memory of 2820 2696 bbtbbn.exe 34 PID 2696 wrote to memory of 2820 2696 bbtbbn.exe 34 PID 2696 wrote to memory of 2820 2696 bbtbbn.exe 34 PID 2696 wrote to memory of 2820 2696 bbtbbn.exe 34 PID 2820 wrote to memory of 2756 2820 7nttnn.exe 35 PID 2820 wrote to memory of 2756 2820 7nttnn.exe 35 PID 2820 wrote to memory of 2756 2820 7nttnn.exe 35 PID 2820 wrote to memory of 2756 2820 7nttnn.exe 35 PID 2756 wrote to memory of 1736 2756 jdvpv.exe 36 PID 2756 wrote to memory of 1736 2756 jdvpv.exe 36 PID 2756 wrote to memory of 1736 2756 jdvpv.exe 36 PID 2756 wrote to memory of 1736 2756 jdvpv.exe 36 PID 1736 wrote to memory of 2872 1736 tnbhnn.exe 37 PID 1736 wrote to memory of 2872 1736 tnbhnn.exe 37 PID 1736 wrote to memory of 2872 1736 tnbhnn.exe 37 PID 1736 wrote to memory of 2872 1736 tnbhnn.exe 37 PID 2872 wrote to memory of 2604 2872 rxlrflx.exe 38 PID 2872 wrote to memory of 2604 2872 rxlrflx.exe 38 PID 2872 wrote to memory of 2604 2872 rxlrflx.exe 38 PID 2872 wrote to memory of 2604 2872 rxlrflx.exe 38 PID 2604 wrote to memory of 1704 2604 bbnthn.exe 39 PID 2604 wrote to memory of 1704 2604 bbnthn.exe 39 PID 2604 wrote to memory of 1704 2604 bbnthn.exe 39 PID 2604 wrote to memory of 1704 2604 bbnthn.exe 39 PID 1704 wrote to memory of 2068 1704 rlxrrxl.exe 40 PID 1704 wrote to memory of 2068 1704 rlxrrxl.exe 40 PID 1704 wrote to memory of 2068 1704 rlxrrxl.exe 40 PID 1704 wrote to memory of 2068 1704 rlxrrxl.exe 40 PID 2068 wrote to memory of 540 2068 5fxfrfr.exe 41 PID 2068 wrote to memory of 540 2068 5fxfrfr.exe 41 PID 2068 wrote to memory of 540 2068 5fxfrfr.exe 41 PID 2068 wrote to memory of 540 2068 5fxfrfr.exe 41 PID 540 wrote to memory of 2796 540 vpjpj.exe 42 PID 540 wrote to memory of 2796 540 vpjpj.exe 42 PID 540 wrote to memory of 2796 540 vpjpj.exe 42 PID 540 wrote to memory of 2796 540 vpjpj.exe 42 PID 2796 wrote to memory of 1668 2796 fxlrxxr.exe 43 PID 2796 wrote to memory of 1668 2796 fxlrxxr.exe 43 PID 2796 wrote to memory of 1668 2796 fxlrxxr.exe 43 PID 2796 wrote to memory of 1668 2796 fxlrxxr.exe 43 PID 1668 wrote to memory of 592 1668 1vjjj.exe 44 PID 1668 wrote to memory of 592 1668 1vjjj.exe 44 PID 1668 wrote to memory of 592 1668 1vjjj.exe 44 PID 1668 wrote to memory of 592 1668 1vjjj.exe 44 PID 592 wrote to memory of 2864 592 dvjpd.exe 45 PID 592 wrote to memory of 2864 592 dvjpd.exe 45 PID 592 wrote to memory of 2864 592 dvjpd.exe 45 PID 592 wrote to memory of 2864 592 dvjpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe"C:\Users\Admin\AppData\Local\Temp\9ca9f427289dc9b355b7a4f1d2a0edaf344bfc2fd4b6140fbed5c3b480aee017N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\nhnhhh.exec:\nhnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\dvjjv.exec:\dvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\thhhtn.exec:\thhhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\bbtbbn.exec:\bbtbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7nttnn.exec:\7nttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jdvpv.exec:\jdvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnbhnn.exec:\tnbhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\rxlrflx.exec:\rxlrflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\bbnthn.exec:\bbnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\rlxrrxl.exec:\rlxrrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\5fxfrfr.exec:\5fxfrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\vpjpj.exec:\vpjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\fxlrxxr.exec:\fxlrxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1vjjj.exec:\1vjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\dvjpd.exec:\dvjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\hbbthb.exec:\hbbthb.exe17⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ppjvj.exec:\ppjvj.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\ttntht.exec:\ttntht.exe19⤵
- Executes dropped EXE
PID:1828 -
\??\c:\9jvvj.exec:\9jvvj.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9rxxxlf.exec:\9rxxxlf.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tbntbt.exec:\tbntbt.exe22⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1rlfllx.exec:\1rlfllx.exe23⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7pdjp.exec:\7pdjp.exe24⤵
- Executes dropped EXE
PID:1120 -
\??\c:\nntnnn.exec:\nntnnn.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\bbhthn.exec:\bbhthn.exe26⤵
- Executes dropped EXE
PID:920 -
\??\c:\rrfxlfl.exec:\rrfxlfl.exe27⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5thhhh.exec:\5thhhh.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3vjpp.exec:\3vjpp.exe29⤵
- Executes dropped EXE
PID:1204 -
\??\c:\frrllxx.exec:\frrllxx.exe30⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5jpvv.exec:\5jpvv.exe31⤵
- Executes dropped EXE
PID:796 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nhnttt.exec:\nhnttt.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vdjvv.exec:\vdjvv.exe34⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xxfrfrl.exec:\xxfrfrl.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nthnhn.exec:\nthnhn.exe36⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vpdjp.exec:\vpdjp.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jvdvp.exec:\jvdvp.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rrlllrx.exec:\rrlllrx.exe39⤵
- Executes dropped EXE
PID:2420 -
\??\c:\thhnnh.exec:\thhnnh.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vpjpp.exec:\vpjpp.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vpjvp.exec:\vpjvp.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fxlllfr.exec:\fxlllfr.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhbtnt.exec:\hhbtnt.exe44⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ntbhnn.exec:\ntbhnn.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pppdp.exec:\pppdp.exe46⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fxxxxfr.exec:\fxxxxfr.exe47⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ttnbnb.exec:\ttnbnb.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\5nhhhh.exec:\5nhhhh.exe49⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1jddv.exec:\1jddv.exe50⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xfxxrxl.exec:\xfxxrxl.exe51⤵
- Executes dropped EXE
PID:388 -
\??\c:\xxlfxlx.exec:\xxlfxlx.exe52⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nhntbb.exec:\nhntbb.exe53⤵
- Executes dropped EXE
PID:592 -
\??\c:\jjjpd.exec:\jjjpd.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe55⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nhbhht.exec:\nhbhht.exe56⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hbbnhh.exec:\hbbnhh.exe57⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvvjd.exec:\pvvjd.exe58⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxllrrf.exec:\fxllrrf.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rlxlxfl.exec:\rlxlxfl.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hnhnnb.exec:\hnhnnb.exe61⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vvvdv.exec:\vvvdv.exe62⤵
- Executes dropped EXE
PID:784 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe63⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xrllxrf.exec:\xrllxrf.exe64⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bnnthn.exec:\bnnthn.exe65⤵
- Executes dropped EXE
PID:272 -
\??\c:\vpddv.exec:\vpddv.exe66⤵PID:2144
-
\??\c:\rrlxflf.exec:\rrlxflf.exe67⤵PID:2484
-
\??\c:\rrflrxf.exec:\rrflrxf.exe68⤵PID:3008
-
\??\c:\5hbhbt.exec:\5hbhbt.exe69⤵PID:2012
-
\??\c:\pjvvd.exec:\pjvvd.exe70⤵PID:1928
-
\??\c:\xffrlrx.exec:\xffrlrx.exe71⤵PID:3016
-
\??\c:\rlflfrx.exec:\rlflfrx.exe72⤵PID:1364
-
\??\c:\btbntb.exec:\btbntb.exe73⤵PID:2476
-
\??\c:\1ntbnn.exec:\1ntbnn.exe74⤵PID:2088
-
\??\c:\vvpvj.exec:\vvpvj.exe75⤵PID:1532
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe76⤵PID:1200
-
\??\c:\rllrflr.exec:\rllrflr.exe77⤵PID:848
-
\??\c:\htntbn.exec:\htntbn.exe78⤵PID:2708
-
\??\c:\7vvdd.exec:\7vvdd.exe79⤵PID:2008
-
\??\c:\jjpvp.exec:\jjpvp.exe80⤵PID:2748
-
\??\c:\rflxlrx.exec:\rflxlrx.exe81⤵PID:2420
-
\??\c:\hhbtnt.exec:\hhbtnt.exe82⤵PID:2716
-
\??\c:\jdvjd.exec:\jdvjd.exe83⤵PID:2628
-
\??\c:\xxxrlxx.exec:\xxxrlxx.exe84⤵PID:2640
-
\??\c:\xxxrrff.exec:\xxxrrff.exe85⤵PID:2888
-
\??\c:\bnhnhh.exec:\bnhnhh.exe86⤵PID:2324
-
\??\c:\vjdvp.exec:\vjdvp.exe87⤵PID:580
-
\??\c:\pjvjv.exec:\pjvjv.exe88⤵PID:2068
-
\??\c:\rxrfxfx.exec:\rxrfxfx.exe89⤵PID:2328
-
\??\c:\tnbnbh.exec:\tnbnbh.exe90⤵PID:2692
-
\??\c:\3ttbhh.exec:\3ttbhh.exe91⤵PID:2592
-
\??\c:\vddpv.exec:\vddpv.exe92⤵PID:692
-
\??\c:\llflxfx.exec:\llflxfx.exe93⤵
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe94⤵PID:1300
-
\??\c:\tbtbbh.exec:\tbtbbh.exe95⤵PID:1352
-
\??\c:\3pvjv.exec:\3pvjv.exe96⤵PID:1900
-
\??\c:\xxrxrxf.exec:\xxrxrxf.exe97⤵PID:1952
-
\??\c:\1lxflrx.exec:\1lxflrx.exe98⤵PID:3052
-
\??\c:\hhbhtt.exec:\hhbhtt.exe99⤵PID:2108
-
\??\c:\jpvvd.exec:\jpvvd.exe100⤵PID:2576
-
\??\c:\9xrfrrx.exec:\9xrfrrx.exe101⤵PID:2208
-
\??\c:\xflxrff.exec:\xflxrff.exe102⤵PID:2780
-
\??\c:\hnthhn.exec:\hnthhn.exe103⤵PID:2584
-
\??\c:\ppjpj.exec:\ppjpj.exe104⤵PID:2112
-
\??\c:\ppvdp.exec:\ppvdp.exe105⤵PID:1720
-
\??\c:\rllxlrl.exec:\rllxlrl.exe106⤵PID:1480
-
\??\c:\bhtnth.exec:\bhtnth.exe107⤵PID:2224
-
\??\c:\nnnttt.exec:\nnnttt.exe108⤵PID:2148
-
\??\c:\dvjjp.exec:\dvjjp.exe109⤵PID:324
-
\??\c:\dpjjp.exec:\dpjjp.exe110⤵PID:3004
-
\??\c:\llfrffr.exec:\llfrffr.exe111⤵PID:2264
-
\??\c:\tnhhtt.exec:\tnhhtt.exe112⤵PID:2468
-
\??\c:\nnnthn.exec:\nnnthn.exe113⤵PID:796
-
\??\c:\pjdpj.exec:\pjdpj.exe114⤵PID:2132
-
\??\c:\rlxxflr.exec:\rlxxflr.exe115⤵PID:1664
-
\??\c:\xrflrrf.exec:\xrflrrf.exe116⤵PID:2028
-
\??\c:\nnhhtt.exec:\nnhhtt.exe117⤵PID:2516
-
\??\c:\pjvvj.exec:\pjvvj.exe118⤵PID:2868
-
\??\c:\ppjpv.exec:\ppjpv.exe119⤵PID:2296
-
\??\c:\7rflrxr.exec:\7rflrxr.exe120⤵PID:2876
-
\??\c:\7tttbh.exec:\7tttbh.exe121⤵PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-