Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe
-
Size
454KB
-
MD5
2f879bb10c1a39cb5635cba8daec8a7e
-
SHA1
4e422069cee7c15775f11d8520c21f5acfaed08b
-
SHA256
0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb
-
SHA512
7aacecc1b6f69aec89297c3898b8df19bebd88368950a822a5ee349542183f0e32212d08e8cca7c714330fbb6f89a6eb6649cffd42422b1bc9d58b160d8a34b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/328-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-19-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1792-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-57-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2800-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-95-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-113-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/2612-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-132-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2124-149-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/828-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-167-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2184-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-217-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1720-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-768-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2860-869-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-921-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2612-943-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2488-985-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/908-1024-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-1031-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 7dvdv.exe 2144 nthhnh.exe 1792 jjddj.exe 2880 ddvdp.exe 2152 bnhtbb.exe 2800 lfrlrrx.exe 2732 1nhnbb.exe 2264 jdjpd.exe 2892 llxlllx.exe 2748 hhtbhh.exe 2612 rlfllll.exe 2632 tnhntn.exe 1544 9dvpv.exe 1432 9ttbhn.exe 2124 9nbbbn.exe 1208 lfxxlrx.exe 828 hhbnbb.exe 1936 hbbhtb.exe 2840 fxrrfff.exe 2836 nnnttt.exe 2184 5dvvv.exe 2372 fxrxfrx.exe 2916 1hhhtn.exe 2960 pjvdv.exe 1720 nhbbnn.exe 904 vpjpd.exe 2272 xrfrffl.exe 876 5nhhnn.exe 2360 3vjdd.exe 108 5rlrxfl.exe 2544 7thnhh.exe 1628 3xrrffr.exe 324 bthhhh.exe 756 jdvdp.exe 2348 dvppd.exe 956 xxlrflr.exe 2248 nhhbbb.exe 2728 ddvdp.exe 2800 1vvdd.exe 2864 rxllfrl.exe 2712 bhbhnn.exe 2888 nnntbh.exe 2876 vpjjp.exe 2852 xlxxfff.exe 2656 xrrxxxf.exe 2872 ntbntb.exe 2236 7pjjj.exe 3028 rrfffxf.exe 1160 xrlfllr.exe 2488 1hbbtt.exe 1696 ddjjj.exe 1716 vdjjp.exe 1652 rrffllx.exe 840 bbnnnn.exe 1196 nthbbb.exe 1852 9jddd.exe 2680 rxrllff.exe 532 1fllxxx.exe 2200 9nnhbt.exe 952 jdjjp.exe 2172 3jpjd.exe 2916 rxllrxr.exe 1504 3nhbbt.exe 2900 7bnnnh.exe -
resource yara_rule behavioral1/memory/328-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-95-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2892-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-113-0x0000000000280000-0x00000000002AA000-memory.dmp upx behavioral1/memory/2612-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-149-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1208-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-217-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1720-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-272-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/108-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-768-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/2860-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-954-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-985-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/892-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-1031-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-1276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-1301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-1374-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 328 wrote to memory of 2552 328 0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe 30 PID 328 wrote to memory of 2552 328 0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe 30 PID 328 wrote to memory of 2552 328 0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe 30 PID 328 wrote to memory of 2552 328 0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe 30 PID 2552 wrote to memory of 2144 2552 7dvdv.exe 31 PID 2552 wrote to memory of 2144 2552 7dvdv.exe 31 PID 2552 wrote to memory of 2144 2552 7dvdv.exe 31 PID 2552 wrote to memory of 2144 2552 7dvdv.exe 31 PID 2144 wrote to memory of 1792 2144 nthhnh.exe 32 PID 2144 wrote to memory of 1792 2144 nthhnh.exe 32 PID 2144 wrote to memory of 1792 2144 nthhnh.exe 32 PID 2144 wrote to memory of 1792 2144 nthhnh.exe 32 PID 1792 wrote to memory of 2880 1792 jjddj.exe 33 PID 1792 wrote to memory of 2880 1792 jjddj.exe 33 PID 1792 wrote to memory of 2880 1792 jjddj.exe 33 PID 1792 wrote to memory of 2880 1792 jjddj.exe 33 PID 2880 wrote to memory of 2152 2880 ddvdp.exe 34 PID 2880 wrote to memory of 2152 2880 ddvdp.exe 34 PID 2880 wrote to memory of 2152 2880 ddvdp.exe 34 PID 2880 wrote to memory of 2152 2880 ddvdp.exe 34 PID 2152 wrote to memory of 2800 2152 bnhtbb.exe 35 PID 2152 wrote to memory of 2800 2152 bnhtbb.exe 35 PID 2152 wrote to memory of 2800 2152 bnhtbb.exe 35 PID 2152 wrote to memory of 2800 2152 bnhtbb.exe 35 PID 2800 wrote to memory of 2732 2800 lfrlrrx.exe 36 PID 2800 wrote to memory of 2732 2800 lfrlrrx.exe 36 PID 2800 wrote to memory of 2732 2800 lfrlrrx.exe 36 PID 2800 wrote to memory of 2732 2800 lfrlrrx.exe 36 PID 2732 wrote to memory of 2264 2732 1nhnbb.exe 37 PID 2732 wrote to memory of 2264 2732 1nhnbb.exe 37 PID 2732 wrote to memory of 2264 2732 1nhnbb.exe 37 PID 2732 wrote to memory of 2264 2732 1nhnbb.exe 37 PID 2264 wrote to memory of 2892 2264 jdjpd.exe 38 PID 2264 wrote to memory of 2892 2264 jdjpd.exe 38 PID 2264 wrote to memory of 2892 2264 jdjpd.exe 38 PID 2264 wrote to memory of 2892 2264 jdjpd.exe 38 PID 2892 wrote to memory of 2748 2892 llxlllx.exe 39 PID 2892 wrote to memory of 2748 2892 llxlllx.exe 39 PID 2892 wrote to memory of 2748 2892 llxlllx.exe 39 PID 2892 wrote to memory of 2748 2892 llxlllx.exe 39 PID 2748 wrote to memory of 2612 2748 hhtbhh.exe 40 PID 2748 wrote to memory of 2612 2748 hhtbhh.exe 40 PID 2748 wrote to memory of 2612 2748 hhtbhh.exe 40 PID 2748 wrote to memory of 2612 2748 hhtbhh.exe 40 PID 2612 wrote to memory of 2632 2612 rlfllll.exe 41 PID 2612 wrote to memory of 2632 2612 rlfllll.exe 41 PID 2612 wrote to memory of 2632 2612 rlfllll.exe 41 PID 2612 wrote to memory of 2632 2612 rlfllll.exe 41 PID 2632 wrote to memory of 1544 2632 tnhntn.exe 42 PID 2632 wrote to memory of 1544 2632 tnhntn.exe 42 PID 2632 wrote to memory of 1544 2632 tnhntn.exe 42 PID 2632 wrote to memory of 1544 2632 tnhntn.exe 42 PID 1544 wrote to memory of 1432 1544 9dvpv.exe 43 PID 1544 wrote to memory of 1432 1544 9dvpv.exe 43 PID 1544 wrote to memory of 1432 1544 9dvpv.exe 43 PID 1544 wrote to memory of 1432 1544 9dvpv.exe 43 PID 1432 wrote to memory of 2124 1432 9ttbhn.exe 44 PID 1432 wrote to memory of 2124 1432 9ttbhn.exe 44 PID 1432 wrote to memory of 2124 1432 9ttbhn.exe 44 PID 1432 wrote to memory of 2124 1432 9ttbhn.exe 44 PID 2124 wrote to memory of 1208 2124 9nbbbn.exe 45 PID 2124 wrote to memory of 1208 2124 9nbbbn.exe 45 PID 2124 wrote to memory of 1208 2124 9nbbbn.exe 45 PID 2124 wrote to memory of 1208 2124 9nbbbn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe"C:\Users\Admin\AppData\Local\Temp\0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\7dvdv.exec:\7dvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nthhnh.exec:\nthhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jjddj.exec:\jjddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\ddvdp.exec:\ddvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bnhtbb.exec:\bnhtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1nhnbb.exec:\1nhnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jdjpd.exec:\jdjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\llxlllx.exec:\llxlllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hhtbhh.exec:\hhtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rlfllll.exec:\rlfllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tnhntn.exec:\tnhntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9dvpv.exec:\9dvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\9ttbhn.exec:\9ttbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\9nbbbn.exec:\9nbbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe17⤵
- Executes dropped EXE
PID:1208 -
\??\c:\hhbnbb.exec:\hhbnbb.exe18⤵
- Executes dropped EXE
PID:828 -
\??\c:\hbbhtb.exec:\hbbhtb.exe19⤵
- Executes dropped EXE
PID:1936 -
\??\c:\fxrrfff.exec:\fxrrfff.exe20⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nnnttt.exec:\nnnttt.exe21⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5dvvv.exec:\5dvvv.exe22⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fxrxfrx.exec:\fxrxfrx.exe23⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1hhhtn.exec:\1hhhtn.exe24⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjvdv.exec:\pjvdv.exe25⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nhbbnn.exec:\nhbbnn.exe26⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vpjpd.exec:\vpjpd.exe27⤵
- Executes dropped EXE
PID:904 -
\??\c:\xrfrffl.exec:\xrfrffl.exe28⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5nhhnn.exec:\5nhhnn.exe29⤵
- Executes dropped EXE
PID:876 -
\??\c:\3vjdd.exec:\3vjdd.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5rlrxfl.exec:\5rlrxfl.exe31⤵
- Executes dropped EXE
PID:108 -
\??\c:\7thnhh.exec:\7thnhh.exe32⤵
- Executes dropped EXE
PID:2544 -
\??\c:\3xrrffr.exec:\3xrrffr.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bthhhh.exec:\bthhhh.exe34⤵
- Executes dropped EXE
PID:324 -
\??\c:\jdvdp.exec:\jdvdp.exe35⤵
- Executes dropped EXE
PID:756 -
\??\c:\dvppd.exec:\dvppd.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xxlrflr.exec:\xxlrflr.exe37⤵
- Executes dropped EXE
PID:956 -
\??\c:\nhhbbb.exec:\nhhbbb.exe38⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ddvdp.exec:\ddvdp.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1vvdd.exec:\1vvdd.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rxllfrl.exec:\rxllfrl.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bhbhnn.exec:\bhbhnn.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nnntbh.exec:\nnntbh.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vpjjp.exec:\vpjjp.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xlxxfff.exec:\xlxxfff.exe45⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ntbntb.exec:\ntbntb.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7pjjj.exec:\7pjjj.exe48⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rrfffxf.exec:\rrfffxf.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\xrlfllr.exec:\xrlfllr.exe50⤵
- Executes dropped EXE
PID:1160 -
\??\c:\1hbbtt.exec:\1hbbtt.exe51⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ddjjj.exec:\ddjjj.exe52⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vdjjp.exec:\vdjjp.exe53⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rrffllx.exec:\rrffllx.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bbnnnn.exec:\bbnnnn.exe55⤵
- Executes dropped EXE
PID:840 -
\??\c:\nthbbb.exec:\nthbbb.exe56⤵
- Executes dropped EXE
PID:1196 -
\??\c:\9jddd.exec:\9jddd.exe57⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rxrllff.exec:\rxrllff.exe58⤵
- Executes dropped EXE
PID:2680 -
\??\c:\1fllxxx.exec:\1fllxxx.exe59⤵
- Executes dropped EXE
PID:532 -
\??\c:\9nnhbt.exec:\9nnhbt.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdjjp.exec:\jdjjp.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\3jpjd.exec:\3jpjd.exe62⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rxllrxr.exec:\rxllrxr.exe63⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3nhbbt.exec:\3nhbbt.exe64⤵
- Executes dropped EXE
PID:1504 -
\??\c:\7bnnnh.exec:\7bnnnh.exe65⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jvjjj.exec:\jvjjj.exe66⤵PID:1720
-
\??\c:\ffrrlxx.exec:\ffrrlxx.exe67⤵
- System Location Discovery: System Language Discovery
PID:3068 -
\??\c:\xxxrxrr.exec:\xxxrxrr.exe68⤵PID:1420
-
\??\c:\hnbtnn.exec:\hnbtnn.exe69⤵PID:1396
-
\??\c:\dpjjd.exec:\dpjjd.exe70⤵PID:1864
-
\??\c:\pppvd.exec:\pppvd.exe71⤵PID:2360
-
\??\c:\fflrxxf.exec:\fflrxxf.exe72⤵PID:2516
-
\??\c:\5btbnt.exec:\5btbnt.exe73⤵PID:328
-
\??\c:\dvvpp.exec:\dvvpp.exe74⤵PID:1588
-
\??\c:\jdpvp.exec:\jdpvp.exe75⤵PID:2552
-
\??\c:\xlxxxrr.exec:\xlxxxrr.exe76⤵PID:2228
-
\??\c:\hthbbb.exec:\hthbbb.exe77⤵PID:2224
-
\??\c:\hbnntb.exec:\hbnntb.exe78⤵PID:2768
-
\??\c:\dpjvv.exec:\dpjvv.exe79⤵PID:2320
-
\??\c:\5flffxf.exec:\5flffxf.exe80⤵PID:2148
-
\??\c:\1tttnh.exec:\1tttnh.exe81⤵PID:2812
-
\??\c:\tntttt.exec:\tntttt.exe82⤵PID:2776
-
\??\c:\pvppp.exec:\pvppp.exe83⤵PID:2780
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2264 -
\??\c:\htbbhh.exec:\htbbhh.exe85⤵PID:3032
-
\??\c:\hhnbhh.exec:\hhnbhh.exe86⤵PID:2692
-
\??\c:\jpppv.exec:\jpppv.exe87⤵PID:2576
-
\??\c:\1xxrlff.exec:\1xxrlff.exe88⤵PID:2580
-
\??\c:\fxllxrx.exec:\fxllxrx.exe89⤵PID:2624
-
\??\c:\nhbhtt.exec:\nhbhtt.exe90⤵PID:1256
-
\??\c:\dpjdj.exec:\dpjdj.exe91⤵PID:2420
-
\??\c:\dpdpd.exec:\dpdpd.exe92⤵PID:1844
-
\??\c:\5xfffff.exec:\5xfffff.exe93⤵PID:1544
-
\??\c:\htbthh.exec:\htbthh.exe94⤵PID:1988
-
\??\c:\3ttnnn.exec:\3ttnnn.exe95⤵PID:2140
-
\??\c:\jvvvv.exec:\jvvvv.exe96⤵PID:1716
-
\??\c:\3lxflll.exec:\3lxflll.exe97⤵PID:2640
-
\??\c:\9rfxflr.exec:\9rfxflr.exe98⤵PID:1964
-
\??\c:\thbntn.exec:\thbntn.exe99⤵PID:1072
-
\??\c:\htbtbt.exec:\htbtbt.exe100⤵PID:2512
-
\??\c:\vjvvd.exec:\vjvvd.exe101⤵PID:2472
-
\??\c:\1xlfffl.exec:\1xlfffl.exe102⤵PID:1800
-
\??\c:\frrllfl.exec:\frrllfl.exe103⤵PID:960
-
\??\c:\tnhhtn.exec:\tnhhtn.exe104⤵PID:2292
-
\??\c:\btbbbt.exec:\btbbbt.exe105⤵PID:1456
-
\??\c:\9pjdp.exec:\9pjdp.exe106⤵PID:1252
-
\??\c:\lxrllff.exec:\lxrllff.exe107⤵PID:564
-
\??\c:\9fxrxrx.exec:\9fxrxrx.exe108⤵PID:2240
-
\??\c:\bhnnhh.exec:\bhnnhh.exe109⤵PID:1568
-
\??\c:\vvvjd.exec:\vvvjd.exe110⤵PID:3068
-
\??\c:\rfxflll.exec:\rfxflll.exe111⤵PID:2388
-
\??\c:\fxllfff.exec:\fxllfff.exe112⤵PID:2104
-
\??\c:\bnnntn.exec:\bnnntn.exe113⤵PID:2120
-
\??\c:\7jppv.exec:\7jppv.exe114⤵PID:2344
-
\??\c:\7llxrll.exec:\7llxrll.exe115⤵
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\7flffxf.exec:\7flffxf.exe116⤵PID:1628
-
\??\c:\nhnthb.exec:\nhnthb.exe117⤵PID:2068
-
\??\c:\hhthhb.exec:\hhthhb.exe118⤵PID:2552
-
\??\c:\pdvdd.exec:\pdvdd.exe119⤵PID:2228
-
\??\c:\9lxxlfl.exec:\9lxxlfl.exe120⤵PID:2664
-
\??\c:\xrllrlr.exec:\xrllrlr.exe121⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-