Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 03:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe
-
Size
454KB
-
MD5
46e37d94f1789887b56abf9fc6a48840
-
SHA1
6615dce57af1ad5fdc11c51b32a3c31d843c4c9b
-
SHA256
dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986
-
SHA512
724ce5cc87840f10048f114d7c1c2a3ccf92d187cdb8735e8c12e9a3fdf5722bf95279593426ea57eb929ab2b4a10c7b3e56826d465957658497d557d0a459eb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2596-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-77-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-91-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2508-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-101-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2508-99-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1672-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-119-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1928-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-135-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1884-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-158-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2876-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1308-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-228-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1136-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-264-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2976-286-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1532-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-369-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-688-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-692-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2908-731-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-766-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/484-834-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-903-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2568-929-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-1008-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1080-1063-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-1186-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-1199-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1956 ddpdp.exe 2300 1vjjd.exe 2476 lfflflf.exe 1940 ttnbnn.exe 2704 7xllrxf.exe 2672 nhnbth.exe 2648 7xlrffl.exe 2796 nbnbbn.exe 2780 nnnbnb.exe 2508 bthbhb.exe 1672 dpjvd.exe 1928 hhhthn.exe 2744 lfflfrr.exe 1884 5lxrlrl.exe 1904 nthhhn.exe 2584 1ffrlrf.exe 1728 lfxlfrx.exe 2876 hnhtht.exe 3016 djvdp.exe 2104 rllxfrf.exe 2376 bhthbn.exe 2884 5fflrlx.exe 1308 tthhtt.exe 1136 5llrlxr.exe 3068 7vpvj.exe 920 5pvdp.exe 1016 vjvpv.exe 2112 jjdpj.exe 2340 ffxlxxl.exe 2976 3vvpd.exe 2288 1llrfrx.exe 1532 5jdjv.exe 2272 jjddj.exe 2428 rlflxlx.exe 2328 bhbtnt.exe 1920 ppvvp.exe 2664 3ppjv.exe 2764 fflfrrf.exe 2640 hbbhtn.exe 2800 vppvj.exe 2784 lffxlrl.exe 2248 llflflf.exe 2796 nbbntn.exe 2544 dddpd.exe 2588 9lrlxlx.exe 2196 xffxlrl.exe 1084 nhbhbh.exe 1936 jvvdv.exe 1220 9fxfllx.exe 1552 3rrxxxf.exe 1268 hhnnbh.exe 560 1jvpv.exe 1328 rrlrflf.exe 1252 btnbth.exe 2844 5htbnt.exe 2856 jdpjv.exe 3056 nhhntt.exe 3048 tnhbhn.exe 804 jdvdp.exe 2376 xxxxlrr.exe 1060 bbttth.exe 2192 9bbbtb.exe 1656 jvvjv.exe 1976 rrrlffl.exe -
resource yara_rule behavioral1/memory/1956-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-119-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1928-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-178-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2876-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-284-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1532-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-367-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2544-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-903-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1080-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-1143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-1186-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1848-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-1317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-1366-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1956 2596 dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe 30 PID 2596 wrote to memory of 1956 2596 dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe 30 PID 2596 wrote to memory of 1956 2596 dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe 30 PID 2596 wrote to memory of 1956 2596 dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe 30 PID 1956 wrote to memory of 2300 1956 ddpdp.exe 31 PID 1956 wrote to memory of 2300 1956 ddpdp.exe 31 PID 1956 wrote to memory of 2300 1956 ddpdp.exe 31 PID 1956 wrote to memory of 2300 1956 ddpdp.exe 31 PID 2300 wrote to memory of 2476 2300 1vjjd.exe 32 PID 2300 wrote to memory of 2476 2300 1vjjd.exe 32 PID 2300 wrote to memory of 2476 2300 1vjjd.exe 32 PID 2300 wrote to memory of 2476 2300 1vjjd.exe 32 PID 2476 wrote to memory of 1940 2476 lfflflf.exe 33 PID 2476 wrote to memory of 1940 2476 lfflflf.exe 33 PID 2476 wrote to memory of 1940 2476 lfflflf.exe 33 PID 2476 wrote to memory of 1940 2476 lfflflf.exe 33 PID 1940 wrote to memory of 2704 1940 ttnbnn.exe 34 PID 1940 wrote to memory of 2704 1940 ttnbnn.exe 34 PID 1940 wrote to memory of 2704 1940 ttnbnn.exe 34 PID 1940 wrote to memory of 2704 1940 ttnbnn.exe 34 PID 2704 wrote to memory of 2672 2704 7xllrxf.exe 35 PID 2704 wrote to memory of 2672 2704 7xllrxf.exe 35 PID 2704 wrote to memory of 2672 2704 7xllrxf.exe 35 PID 2704 wrote to memory of 2672 2704 7xllrxf.exe 35 PID 2672 wrote to memory of 2648 2672 nhnbth.exe 36 PID 2672 wrote to memory of 2648 2672 nhnbth.exe 36 PID 2672 wrote to memory of 2648 2672 nhnbth.exe 36 PID 2672 wrote to memory of 2648 2672 nhnbth.exe 36 PID 2648 wrote to memory of 2796 2648 7xlrffl.exe 37 PID 2648 wrote to memory of 2796 2648 7xlrffl.exe 37 PID 2648 wrote to memory of 2796 2648 7xlrffl.exe 37 PID 2648 wrote to memory of 2796 2648 7xlrffl.exe 37 PID 2796 wrote to memory of 2780 2796 nbnbbn.exe 38 PID 2796 wrote to memory of 2780 2796 nbnbbn.exe 38 PID 2796 wrote to memory of 2780 2796 nbnbbn.exe 38 PID 2796 wrote to memory of 2780 2796 nbnbbn.exe 38 PID 2780 wrote to memory of 2508 2780 nnnbnb.exe 39 PID 2780 wrote to memory of 2508 2780 nnnbnb.exe 39 PID 2780 wrote to memory of 2508 2780 nnnbnb.exe 39 PID 2780 wrote to memory of 2508 2780 nnnbnb.exe 39 PID 2508 wrote to memory of 1672 2508 bthbhb.exe 40 PID 2508 wrote to memory of 1672 2508 bthbhb.exe 40 PID 2508 wrote to memory of 1672 2508 bthbhb.exe 40 PID 2508 wrote to memory of 1672 2508 bthbhb.exe 40 PID 1672 wrote to memory of 1928 1672 dpjvd.exe 41 PID 1672 wrote to memory of 1928 1672 dpjvd.exe 41 PID 1672 wrote to memory of 1928 1672 dpjvd.exe 41 PID 1672 wrote to memory of 1928 1672 dpjvd.exe 41 PID 1928 wrote to memory of 2744 1928 hhhthn.exe 42 PID 1928 wrote to memory of 2744 1928 hhhthn.exe 42 PID 1928 wrote to memory of 2744 1928 hhhthn.exe 42 PID 1928 wrote to memory of 2744 1928 hhhthn.exe 42 PID 2744 wrote to memory of 1884 2744 lfflfrr.exe 43 PID 2744 wrote to memory of 1884 2744 lfflfrr.exe 43 PID 2744 wrote to memory of 1884 2744 lfflfrr.exe 43 PID 2744 wrote to memory of 1884 2744 lfflfrr.exe 43 PID 1884 wrote to memory of 1904 1884 5lxrlrl.exe 44 PID 1884 wrote to memory of 1904 1884 5lxrlrl.exe 44 PID 1884 wrote to memory of 1904 1884 5lxrlrl.exe 44 PID 1884 wrote to memory of 1904 1884 5lxrlrl.exe 44 PID 1904 wrote to memory of 2584 1904 nthhhn.exe 45 PID 1904 wrote to memory of 2584 1904 nthhhn.exe 45 PID 1904 wrote to memory of 2584 1904 nthhhn.exe 45 PID 1904 wrote to memory of 2584 1904 nthhhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe"C:\Users\Admin\AppData\Local\Temp\dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ddpdp.exec:\ddpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\1vjjd.exec:\1vjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\lfflflf.exec:\lfflflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\ttnbnn.exec:\ttnbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\7xllrxf.exec:\7xllrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhnbth.exec:\nhnbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\7xlrffl.exec:\7xlrffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\nbnbbn.exec:\nbnbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nnnbnb.exec:\nnnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bthbhb.exec:\bthbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\dpjvd.exec:\dpjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\hhhthn.exec:\hhhthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\lfflfrr.exec:\lfflfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\5lxrlrl.exec:\5lxrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\nthhhn.exec:\nthhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1ffrlrf.exec:\1ffrlrf.exe17⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lfxlfrx.exec:\lfxlfrx.exe18⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hnhtht.exec:\hnhtht.exe19⤵
- Executes dropped EXE
PID:2876 -
\??\c:\djvdp.exec:\djvdp.exe20⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rllxfrf.exec:\rllxfrf.exe21⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bhthbn.exec:\bhthbn.exe22⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5fflrlx.exec:\5fflrlx.exe23⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tthhtt.exec:\tthhtt.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5llrlxr.exec:\5llrlxr.exe25⤵
- Executes dropped EXE
PID:1136 -
\??\c:\7vpvj.exec:\7vpvj.exe26⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5pvdp.exec:\5pvdp.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\vjvpv.exec:\vjvpv.exe28⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jjdpj.exec:\jjdpj.exe29⤵
- Executes dropped EXE
PID:2112 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe30⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3vvpd.exec:\3vvpd.exe31⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1llrfrx.exec:\1llrfrx.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5jdjv.exec:\5jdjv.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jjddj.exec:\jjddj.exe34⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rlflxlx.exec:\rlflxlx.exe35⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bhbtnt.exec:\bhbtnt.exe36⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ppvvp.exec:\ppvvp.exe37⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3ppjv.exec:\3ppjv.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fflfrrf.exec:\fflfrrf.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hbbhtn.exec:\hbbhtn.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vppvj.exec:\vppvj.exe41⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lffxlrl.exec:\lffxlrl.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\llflflf.exec:\llflflf.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\nbbntn.exec:\nbbntn.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\dddpd.exec:\dddpd.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9lrlxlx.exec:\9lrlxlx.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xffxlrl.exec:\xffxlrl.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nhbhbh.exec:\nhbhbh.exe48⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvvdv.exec:\jvvdv.exe49⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9fxfllx.exec:\9fxfllx.exe50⤵
- Executes dropped EXE
PID:1220 -
\??\c:\3rrxxxf.exec:\3rrxxxf.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hhnnbh.exec:\hhnnbh.exe52⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1jvpv.exec:\1jvpv.exe53⤵
- Executes dropped EXE
PID:560 -
\??\c:\rrlrflf.exec:\rrlrflf.exe54⤵
- Executes dropped EXE
PID:1328 -
\??\c:\btnbth.exec:\btnbth.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1252 -
\??\c:\5htbnt.exec:\5htbnt.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jdpjv.exec:\jdpjv.exe57⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhhntt.exec:\nhhntt.exe58⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tnhbhn.exec:\tnhbhn.exe59⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jdvdp.exec:\jdvdp.exe60⤵
- Executes dropped EXE
PID:804 -
\??\c:\xxxxlrr.exec:\xxxxlrr.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bbttth.exec:\bbttth.exe62⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9bbbtb.exec:\9bbbtb.exe63⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jvvjv.exec:\jvvjv.exe64⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rrrlffl.exec:\rrrlffl.exe65⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hnnhtt.exec:\hnnhtt.exe66⤵PID:1644
-
\??\c:\ppjvj.exec:\ppjvj.exe67⤵PID:1472
-
\??\c:\pjdjd.exec:\pjdjd.exe68⤵PID:2204
-
\??\c:\7lrfllr.exec:\7lrfllr.exe69⤵PID:1640
-
\??\c:\5tntbh.exec:\5tntbh.exe70⤵PID:2224
-
\??\c:\3dppp.exec:\3dppp.exe71⤵PID:1256
-
\??\c:\1ddvj.exec:\1ddvj.exe72⤵PID:1688
-
\??\c:\3fxxxfl.exec:\3fxxxfl.exe73⤵PID:2976
-
\??\c:\9bnhhn.exec:\9bnhhn.exe74⤵PID:2464
-
\??\c:\pvjvd.exec:\pvjvd.exe75⤵PID:1524
-
\??\c:\xrllrxl.exec:\xrllrxl.exe76⤵PID:2308
-
\??\c:\hhtbhb.exec:\hhtbhb.exe77⤵PID:1564
-
\??\c:\nhnbhb.exec:\nhnbhb.exe78⤵PID:2428
-
\??\c:\3dvdd.exec:\3dvdd.exe79⤵PID:2608
-
\??\c:\9lrxlrf.exec:\9lrxlrf.exe80⤵PID:2080
-
\??\c:\5tnbhh.exec:\5tnbhh.exe81⤵PID:2664
-
\??\c:\hbttbb.exec:\hbttbb.exe82⤵PID:2716
-
\??\c:\jjpjp.exec:\jjpjp.exe83⤵PID:1948
-
\??\c:\lflxllf.exec:\lflxllf.exe84⤵PID:2548
-
\??\c:\tthntt.exec:\tthntt.exe85⤵PID:2648
-
\??\c:\1nhhhn.exec:\1nhhhn.exe86⤵PID:2936
-
\??\c:\jjjpd.exec:\jjjpd.exe87⤵
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe88⤵PID:868
-
\??\c:\nhbnth.exec:\nhbnth.exe89⤵PID:3036
-
\??\c:\9bbntb.exec:\9bbntb.exe90⤵PID:2636
-
\??\c:\dvjpp.exec:\dvjpp.exe91⤵PID:1840
-
\??\c:\1lrxflf.exec:\1lrxflf.exe92⤵PID:1900
-
\??\c:\rrllxxr.exec:\rrllxxr.exe93⤵PID:1424
-
\??\c:\nntbbh.exec:\nntbbh.exe94⤵PID:1508
-
\??\c:\dvjvd.exec:\dvjvd.exe95⤵PID:1228
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe96⤵PID:2820
-
\??\c:\rfffxfl.exec:\rfffxfl.exe97⤵PID:1452
-
\??\c:\bhbbth.exec:\bhbbth.exe98⤵PID:1708
-
\??\c:\ddvdp.exec:\ddvdp.exe99⤵PID:2860
-
\??\c:\rfxrrlx.exec:\rfxrrlx.exe100⤵PID:2908
-
\??\c:\5bntbb.exec:\5bntbb.exe101⤵PID:2824
-
\??\c:\djpdd.exec:\djpdd.exe102⤵PID:2612
-
\??\c:\jvpvj.exec:\jvpvj.exe103⤵PID:3012
-
\??\c:\xffxfrf.exec:\xffxfrf.exe104⤵PID:2916
-
\??\c:\nntthn.exec:\nntthn.exe105⤵PID:2000
-
\??\c:\vppdp.exec:\vppdp.exe106⤵PID:2492
-
\??\c:\rxrlrfr.exec:\rxrlrfr.exe107⤵PID:684
-
\??\c:\fxxxlrx.exec:\fxxxlrx.exe108⤵PID:1656
-
\??\c:\bhhhtn.exec:\bhhhtn.exe109⤵PID:924
-
\??\c:\ddjpd.exec:\ddjpd.exe110⤵PID:1628
-
\??\c:\nhbnhh.exec:\nhbnhh.exe111⤵PID:876
-
\??\c:\hhntth.exec:\hhntth.exe112⤵PID:376
-
\??\c:\jvpjp.exec:\jvpjp.exe113⤵PID:484
-
\??\c:\rrrfxlf.exec:\rrrfxlf.exe114⤵PID:1156
-
\??\c:\ttntth.exec:\ttntth.exe115⤵PID:900
-
\??\c:\pjdjp.exec:\pjdjp.exe116⤵PID:880
-
\??\c:\3jddp.exec:\3jddp.exe117⤵PID:2132
-
\??\c:\5llxlxr.exec:\5llxlxr.exe118⤵PID:2596
-
\??\c:\tbbnht.exec:\tbbnht.exe119⤵PID:1000
-
\??\c:\ppddj.exec:\ppddj.exe120⤵PID:2316
-
\??\c:\9ddvj.exec:\9ddvj.exe121⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-