Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe
-
Size
452KB
-
MD5
25f55d23a782a51ea429791c3a2964e0
-
SHA1
a8ec6e093f718f78db0cc8b9ba32618a3664da01
-
SHA256
958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390
-
SHA512
e28772ae9c415ced18555845f0169bc12f9e0befa074899b82f601148dfa87f47e436b3e4e7e4f2d44ee415ecc10732f1a6448cfb1dd88eac51e1f9236616047
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2696-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-146-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1512-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-200-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1844-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-329-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2348-331-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2912-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-360-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2640-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-648-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-671-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1520-677-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1540-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-737-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2392-791-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2108-854-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1796-922-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/484-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-975-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-989-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-1112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 1lfxffr.exe 2220 7nhhtb.exe 1376 frxfrxl.exe 2348 jjpvj.exe 2856 5jvvv.exe 2260 rfrrflx.exe 2336 ppjvv.exe 2720 flllxfl.exe 2732 vvjpd.exe 1732 1nhntb.exe 3052 3pdvd.exe 1740 jjdjd.exe 320 nhhhbb.exe 1220 llffllr.exe 2076 bttthn.exe 2436 7vdjv.exe 1512 xrflrrx.exe 1908 hnhnbh.exe 2604 fxllxfr.exe 1224 vpvvd.exe 2524 1rllrxf.exe 1940 9tnhtb.exe 444 dddpj.exe 856 7pjpp.exe 108 rlrxfxl.exe 1576 jdvjv.exe 2080 dpjpd.exe 2004 rrflrfr.exe 1844 7htnnt.exe 1636 xxxflll.exe 2396 tttnnt.exe 3044 jjjvd.exe 2968 1htnht.exe 1244 jdpvj.exe 2060 1lllxlx.exe 1376 frlrxfl.exe 2348 5hbhht.exe 1968 dvppj.exe 2980 9jvdd.exe 2912 fxllxxf.exe 2504 hbnnbb.exe 2640 dvvdj.exe 2628 pjjjp.exe 2688 3xlflrl.exe 3060 tttbnt.exe 704 btntbb.exe 784 9pjjv.exe 1648 5rrfflf.exe 1724 lfxflrf.exe 2032 7nhhtb.exe 1976 5jdpp.exe 2052 vvvjv.exe 1652 9lxxffl.exe 1880 nhtntt.exe 1080 nnhnhn.exe 1176 jjvdp.exe 2496 rllrfff.exe 2928 1btttt.exe 1916 hbbtbb.exe 3004 vjdvd.exe 348 rrllxxx.exe 1428 rfrrffr.exe 2816 htbbbt.exe 896 dvjdj.exe -
resource yara_rule behavioral1/memory/2696-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-329-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2912-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-791-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2108-854-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1524-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-1313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1332-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2916 2696 958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe 30 PID 2696 wrote to memory of 2916 2696 958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe 30 PID 2696 wrote to memory of 2916 2696 958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe 30 PID 2696 wrote to memory of 2916 2696 958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe 30 PID 2916 wrote to memory of 2220 2916 1lfxffr.exe 31 PID 2916 wrote to memory of 2220 2916 1lfxffr.exe 31 PID 2916 wrote to memory of 2220 2916 1lfxffr.exe 31 PID 2916 wrote to memory of 2220 2916 1lfxffr.exe 31 PID 2220 wrote to memory of 1376 2220 7nhhtb.exe 32 PID 2220 wrote to memory of 1376 2220 7nhhtb.exe 32 PID 2220 wrote to memory of 1376 2220 7nhhtb.exe 32 PID 2220 wrote to memory of 1376 2220 7nhhtb.exe 32 PID 1376 wrote to memory of 2348 1376 frxfrxl.exe 33 PID 1376 wrote to memory of 2348 1376 frxfrxl.exe 33 PID 1376 wrote to memory of 2348 1376 frxfrxl.exe 33 PID 1376 wrote to memory of 2348 1376 frxfrxl.exe 33 PID 2348 wrote to memory of 2856 2348 jjpvj.exe 34 PID 2348 wrote to memory of 2856 2348 jjpvj.exe 34 PID 2348 wrote to memory of 2856 2348 jjpvj.exe 34 PID 2348 wrote to memory of 2856 2348 jjpvj.exe 34 PID 2856 wrote to memory of 2260 2856 5jvvv.exe 35 PID 2856 wrote to memory of 2260 2856 5jvvv.exe 35 PID 2856 wrote to memory of 2260 2856 5jvvv.exe 35 PID 2856 wrote to memory of 2260 2856 5jvvv.exe 35 PID 2260 wrote to memory of 2336 2260 rfrrflx.exe 36 PID 2260 wrote to memory of 2336 2260 rfrrflx.exe 36 PID 2260 wrote to memory of 2336 2260 rfrrflx.exe 36 PID 2260 wrote to memory of 2336 2260 rfrrflx.exe 36 PID 2336 wrote to memory of 2720 2336 ppjvv.exe 37 PID 2336 wrote to memory of 2720 2336 ppjvv.exe 37 PID 2336 wrote to memory of 2720 2336 ppjvv.exe 37 PID 2336 wrote to memory of 2720 2336 ppjvv.exe 37 PID 2720 wrote to memory of 2732 2720 flllxfl.exe 38 PID 2720 wrote to memory of 2732 2720 flllxfl.exe 38 PID 2720 wrote to memory of 2732 2720 flllxfl.exe 38 PID 2720 wrote to memory of 2732 2720 flllxfl.exe 38 PID 2732 wrote to memory of 1732 2732 vvjpd.exe 39 PID 2732 wrote to memory of 1732 2732 vvjpd.exe 39 PID 2732 wrote to memory of 1732 2732 vvjpd.exe 39 PID 2732 wrote to memory of 1732 2732 vvjpd.exe 39 PID 1732 wrote to memory of 3052 1732 1nhntb.exe 40 PID 1732 wrote to memory of 3052 1732 1nhntb.exe 40 PID 1732 wrote to memory of 3052 1732 1nhntb.exe 40 PID 1732 wrote to memory of 3052 1732 1nhntb.exe 40 PID 3052 wrote to memory of 1740 3052 3pdvd.exe 41 PID 3052 wrote to memory of 1740 3052 3pdvd.exe 41 PID 3052 wrote to memory of 1740 3052 3pdvd.exe 41 PID 3052 wrote to memory of 1740 3052 3pdvd.exe 41 PID 1740 wrote to memory of 320 1740 jjdjd.exe 42 PID 1740 wrote to memory of 320 1740 jjdjd.exe 42 PID 1740 wrote to memory of 320 1740 jjdjd.exe 42 PID 1740 wrote to memory of 320 1740 jjdjd.exe 42 PID 320 wrote to memory of 1220 320 nhhhbb.exe 43 PID 320 wrote to memory of 1220 320 nhhhbb.exe 43 PID 320 wrote to memory of 1220 320 nhhhbb.exe 43 PID 320 wrote to memory of 1220 320 nhhhbb.exe 43 PID 1220 wrote to memory of 2076 1220 llffllr.exe 44 PID 1220 wrote to memory of 2076 1220 llffllr.exe 44 PID 1220 wrote to memory of 2076 1220 llffllr.exe 44 PID 1220 wrote to memory of 2076 1220 llffllr.exe 44 PID 2076 wrote to memory of 2436 2076 bttthn.exe 45 PID 2076 wrote to memory of 2436 2076 bttthn.exe 45 PID 2076 wrote to memory of 2436 2076 bttthn.exe 45 PID 2076 wrote to memory of 2436 2076 bttthn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe"C:\Users\Admin\AppData\Local\Temp\958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1lfxffr.exec:\1lfxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\7nhhtb.exec:\7nhhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\frxfrxl.exec:\frxfrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\jjpvj.exec:\jjpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\5jvvv.exec:\5jvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rfrrflx.exec:\rfrrflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\ppjvv.exec:\ppjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\flllxfl.exec:\flllxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vvjpd.exec:\vvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\1nhntb.exec:\1nhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\3pdvd.exec:\3pdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jjdjd.exec:\jjdjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\nhhhbb.exec:\nhhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\llffllr.exec:\llffllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\bttthn.exec:\bttthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\7vdjv.exec:\7vdjv.exe17⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xrflrrx.exec:\xrflrrx.exe18⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hnhnbh.exec:\hnhnbh.exe19⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxllxfr.exec:\fxllxfr.exe20⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vpvvd.exec:\vpvvd.exe21⤵
- Executes dropped EXE
PID:1224 -
\??\c:\1rllrxf.exec:\1rllrxf.exe22⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9tnhtb.exec:\9tnhtb.exe23⤵
- Executes dropped EXE
PID:1940 -
\??\c:\dddpj.exec:\dddpj.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\7pjpp.exec:\7pjpp.exe25⤵
- Executes dropped EXE
PID:856 -
\??\c:\rlrxfxl.exec:\rlrxfxl.exe26⤵
- Executes dropped EXE
PID:108 -
\??\c:\jdvjv.exec:\jdvjv.exe27⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dpjpd.exec:\dpjpd.exe28⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rrflrfr.exec:\rrflrfr.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7htnnt.exec:\7htnnt.exe30⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xxxflll.exec:\xxxflll.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tttnnt.exec:\tttnnt.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jjjvd.exec:\jjjvd.exe33⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1htnht.exec:\1htnht.exe34⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jdpvj.exec:\jdpvj.exe35⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1lllxlx.exec:\1lllxlx.exe36⤵
- Executes dropped EXE
PID:2060 -
\??\c:\frlrxfl.exec:\frlrxfl.exe37⤵
- Executes dropped EXE
PID:1376 -
\??\c:\5hbhht.exec:\5hbhht.exe38⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dvppj.exec:\dvppj.exe39⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9jvdd.exec:\9jvdd.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fxllxxf.exec:\fxllxxf.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hbnnbb.exec:\hbnnbb.exe42⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvvdj.exec:\dvvdj.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjjjp.exec:\pjjjp.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3xlflrl.exec:\3xlflrl.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tttbnt.exec:\tttbnt.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\btntbb.exec:\btntbb.exe47⤵
- Executes dropped EXE
PID:704 -
\??\c:\9pjjv.exec:\9pjjv.exe48⤵
- Executes dropped EXE
PID:784 -
\??\c:\5rrfflf.exec:\5rrfflf.exe49⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfxflrf.exec:\lfxflrf.exe50⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7nhhtb.exec:\7nhhtb.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5jdpp.exec:\5jdpp.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vvvjv.exec:\vvvjv.exe53⤵
- Executes dropped EXE
PID:2052 -
\??\c:\9lxxffl.exec:\9lxxffl.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nhtntt.exec:\nhtntt.exe55⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nnhnhn.exec:\nnhnhn.exe56⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jjvdp.exec:\jjvdp.exe57⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rllrfff.exec:\rllrfff.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1btttt.exec:\1btttt.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hbbtbb.exec:\hbbtbb.exe60⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vjdvd.exec:\vjdvd.exe61⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrllxxx.exec:\rrllxxx.exe62⤵
- Executes dropped EXE
PID:348 -
\??\c:\rfrrffr.exec:\rfrrffr.exe63⤵
- Executes dropped EXE
PID:1428 -
\??\c:\htbbbt.exec:\htbbbt.exe64⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dvjdj.exec:\dvjdj.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\vpjpj.exec:\vpjpj.exe66⤵PID:2528
-
\??\c:\9frrrrf.exec:\9frrrrf.exe67⤵PID:2532
-
\??\c:\5nbbhh.exec:\5nbbhh.exe68⤵PID:1012
-
\??\c:\5bhhhh.exec:\5bhhhh.exe69⤵PID:904
-
\??\c:\7jddp.exec:\7jddp.exe70⤵PID:1844
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe71⤵PID:1636
-
\??\c:\lxllxfr.exec:\lxllxfr.exe72⤵PID:2056
-
\??\c:\1btttt.exec:\1btttt.exe73⤵PID:1508
-
\??\c:\ttbntt.exec:\ttbntt.exe74⤵PID:3024
-
\??\c:\dvjjj.exec:\dvjjj.exe75⤵PID:2372
-
\??\c:\rlflrrr.exec:\rlflrrr.exe76⤵PID:1244
-
\??\c:\5xfxxfl.exec:\5xfxxfl.exe77⤵PID:2964
-
\??\c:\hbbhbn.exec:\hbbhbn.exe78⤵PID:1376
-
\??\c:\3ddjp.exec:\3ddjp.exe79⤵PID:2860
-
\??\c:\9xrlxfx.exec:\9xrlxfx.exe80⤵PID:2724
-
\??\c:\rllrxfr.exec:\rllrxfr.exe81⤵PID:2892
-
\??\c:\nbbhtb.exec:\nbbhtb.exe82⤵PID:2912
-
\??\c:\dvppd.exec:\dvppd.exe83⤵PID:2756
-
\??\c:\pvdjp.exec:\pvdjp.exe84⤵PID:288
-
\??\c:\rxffxfr.exec:\rxffxfr.exe85⤵PID:2668
-
\??\c:\nnhtnt.exec:\nnhtnt.exe86⤵PID:2200
-
\??\c:\btnnbb.exec:\btnnbb.exe87⤵PID:2660
-
\??\c:\jdvpj.exec:\jdvpj.exe88⤵PID:2072
-
\??\c:\xrrxflx.exec:\xrrxflx.exe89⤵PID:1584
-
\??\c:\7lllxfl.exec:\7lllxfl.exe90⤵PID:320
-
\??\c:\ttntht.exec:\ttntht.exe91⤵PID:1520
-
\??\c:\pdpvv.exec:\pdpvv.exe92⤵PID:1708
-
\??\c:\ppjpv.exec:\ppjpv.exe93⤵PID:1540
-
\??\c:\5rxflxf.exec:\5rxflxf.exe94⤵PID:1572
-
\??\c:\nhttbh.exec:\nhttbh.exe95⤵PID:1512
-
\??\c:\nhtttb.exec:\nhtttb.exe96⤵PID:1040
-
\??\c:\vppdd.exec:\vppdd.exe97⤵PID:2832
-
\??\c:\xrxxrrf.exec:\xrxxrrf.exe98⤵PID:1612
-
\??\c:\lfrrffl.exec:\lfrrffl.exe99⤵PID:1460
-
\??\c:\5tbntt.exec:\5tbntt.exe100⤵PID:2944
-
\??\c:\vpddp.exec:\vpddp.exe101⤵PID:2952
-
\??\c:\vpjpp.exec:\vpjpp.exe102⤵PID:2996
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe103⤵PID:2840
-
\??\c:\nbntbh.exec:\nbntbh.exe104⤵PID:2144
-
\??\c:\nhbbbb.exec:\nhbbbb.exe105⤵PID:352
-
\??\c:\jdvpv.exec:\jdvpv.exe106⤵PID:2344
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe107⤵PID:1072
-
\??\c:\rrffrxf.exec:\rrffrxf.exe108⤵PID:372
-
\??\c:\nhbnth.exec:\nhbnth.exe109⤵PID:2392
-
\??\c:\pvvjv.exec:\pvvjv.exe110⤵PID:2440
-
\??\c:\xxrxllr.exec:\xxrxllr.exe111⤵PID:1848
-
\??\c:\xxflflx.exec:\xxflflx.exe112⤵PID:900
-
\??\c:\bbtbnb.exec:\bbtbnb.exe113⤵PID:3020
-
\??\c:\tthhth.exec:\tthhth.exe114⤵PID:3068
-
\??\c:\7jdvp.exec:\7jdvp.exe115⤵PID:3044
-
\??\c:\vdvjp.exec:\vdvjp.exe116⤵PID:2564
-
\??\c:\rlrxllr.exec:\rlrxllr.exe117⤵PID:3024
-
\??\c:\9bhhnh.exec:\9bhhnh.exe118⤵PID:1924
-
\??\c:\5nnthn.exec:\5nnthn.exe119⤵PID:2108
-
\??\c:\jjdpd.exec:\jjdpd.exe120⤵PID:2060
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe121⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-