Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 21:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe
-
Size
454KB
-
MD5
61764303652d6a655389b0245e33b332
-
SHA1
bf4a11aa41d00830f6e295f56435ac096c08f901
-
SHA256
2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6
-
SHA512
6cfb3ddb8910e9f03aa6f0e8187759561f072a2dce35e79d5645d0c8795bc1f42eb0d1962caa357a9e927267ece1169376df72f76ba3b60fbc3d56b7b2264cd9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeto:q7Tc2NYHUrAwfMp3CDto
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2160-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-46-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2668-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-103-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2344-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-113-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2740-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1892-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1176-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-536-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1564-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-614-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1892-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-712-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1436-731-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1512-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2160 hnbttb.exe 2336 xxxrlfl.exe 2536 1nthbt.exe 2668 vpvdp.exe 2600 9frllrr.exe 2628 vjvvv.exe 2640 3lfffxf.exe 2500 bntnnh.exe 2564 9frxffl.exe 2344 nbhhhh.exe 1452 5dvdd.exe 1696 rrlllrr.exe 2740 nbtttt.exe 1660 9vdjd.exe 2248 ttbhhn.exe 1624 pjvvd.exe 840 fxrxlfl.exe 1448 thnhhb.exe 1996 jjvjd.exe 2620 tbhhhb.exe 1560 1nbhhn.exe 1580 frlrfxl.exe 2220 1vjpj.exe 2300 jjppv.exe 1308 9nntbt.exe 1348 djvpv.exe 2060 lxrxlfl.exe 3008 nhtbhb.exe 1476 lxlffxf.exe 2896 1bnnbt.exe 696 lxlfrrf.exe 1460 tnbbhh.exe 2376 vpjvv.exe 1892 flffxrx.exe 3012 nbbbbb.exe 1500 dvppv.exe 1984 lxfxxll.exe 2636 thtbbh.exe 2684 djpjp.exe 2676 ddpvp.exe 3024 7rlflfl.exe 2480 9bbbhn.exe 2628 pjjpv.exe 2964 dpvpd.exe 2476 lxfllff.exe 2924 bhbbtt.exe 2364 ddppp.exe 2272 vdvvp.exe 2040 7lxrrlx.exe 1160 3hthnn.exe 2788 htbnhh.exe 1444 3xfxlfr.exe 2752 tntbbt.exe 1208 ntbttt.exe 1176 pppvd.exe 1648 7xrxrfr.exe 840 3nhntb.exe 2004 dvjpv.exe 2688 jjddj.exe 1992 lfxxlrf.exe 2816 nbnntt.exe 2484 9pppp.exe 1404 pdvjp.exe 1580 xllllff.exe -
resource yara_rule behavioral1/memory/2160-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-536-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1564-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-606-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1892-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-705-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1452-712-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1512-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-813-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2160 1876 2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe 28 PID 1876 wrote to memory of 2160 1876 2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe 28 PID 1876 wrote to memory of 2160 1876 2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe 28 PID 1876 wrote to memory of 2160 1876 2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe 28 PID 2160 wrote to memory of 2336 2160 hnbttb.exe 29 PID 2160 wrote to memory of 2336 2160 hnbttb.exe 29 PID 2160 wrote to memory of 2336 2160 hnbttb.exe 29 PID 2160 wrote to memory of 2336 2160 hnbttb.exe 29 PID 2336 wrote to memory of 2536 2336 xxxrlfl.exe 30 PID 2336 wrote to memory of 2536 2336 xxxrlfl.exe 30 PID 2336 wrote to memory of 2536 2336 xxxrlfl.exe 30 PID 2336 wrote to memory of 2536 2336 xxxrlfl.exe 30 PID 2536 wrote to memory of 2668 2536 1nthbt.exe 31 PID 2536 wrote to memory of 2668 2536 1nthbt.exe 31 PID 2536 wrote to memory of 2668 2536 1nthbt.exe 31 PID 2536 wrote to memory of 2668 2536 1nthbt.exe 31 PID 2668 wrote to memory of 2600 2668 vpvdp.exe 32 PID 2668 wrote to memory of 2600 2668 vpvdp.exe 32 PID 2668 wrote to memory of 2600 2668 vpvdp.exe 32 PID 2668 wrote to memory of 2600 2668 vpvdp.exe 32 PID 2600 wrote to memory of 2628 2600 9frllrr.exe 33 PID 2600 wrote to memory of 2628 2600 9frllrr.exe 33 PID 2600 wrote to memory of 2628 2600 9frllrr.exe 33 PID 2600 wrote to memory of 2628 2600 9frllrr.exe 33 PID 2628 wrote to memory of 2640 2628 vjvvv.exe 34 PID 2628 wrote to memory of 2640 2628 vjvvv.exe 34 PID 2628 wrote to memory of 2640 2628 vjvvv.exe 34 PID 2628 wrote to memory of 2640 2628 vjvvv.exe 34 PID 2640 wrote to memory of 2500 2640 3lfffxf.exe 35 PID 2640 wrote to memory of 2500 2640 3lfffxf.exe 35 PID 2640 wrote to memory of 2500 2640 3lfffxf.exe 35 PID 2640 wrote to memory of 2500 2640 3lfffxf.exe 35 PID 2500 wrote to memory of 2564 2500 bntnnh.exe 36 PID 2500 wrote to memory of 2564 2500 bntnnh.exe 36 PID 2500 wrote to memory of 2564 2500 bntnnh.exe 36 PID 2500 wrote to memory of 2564 2500 bntnnh.exe 36 PID 2564 wrote to memory of 2344 2564 9frxffl.exe 37 PID 2564 wrote to memory of 2344 2564 9frxffl.exe 37 PID 2564 wrote to memory of 2344 2564 9frxffl.exe 37 PID 2564 wrote to memory of 2344 2564 9frxffl.exe 37 PID 2344 wrote to memory of 1452 2344 nbhhhh.exe 38 PID 2344 wrote to memory of 1452 2344 nbhhhh.exe 38 PID 2344 wrote to memory of 1452 2344 nbhhhh.exe 38 PID 2344 wrote to memory of 1452 2344 nbhhhh.exe 38 PID 1452 wrote to memory of 1696 1452 5dvdd.exe 39 PID 1452 wrote to memory of 1696 1452 5dvdd.exe 39 PID 1452 wrote to memory of 1696 1452 5dvdd.exe 39 PID 1452 wrote to memory of 1696 1452 5dvdd.exe 39 PID 1696 wrote to memory of 2740 1696 rrlllrr.exe 40 PID 1696 wrote to memory of 2740 1696 rrlllrr.exe 40 PID 1696 wrote to memory of 2740 1696 rrlllrr.exe 40 PID 1696 wrote to memory of 2740 1696 rrlllrr.exe 40 PID 2740 wrote to memory of 1660 2740 nbtttt.exe 41 PID 2740 wrote to memory of 1660 2740 nbtttt.exe 41 PID 2740 wrote to memory of 1660 2740 nbtttt.exe 41 PID 2740 wrote to memory of 1660 2740 nbtttt.exe 41 PID 1660 wrote to memory of 2248 1660 9vdjd.exe 42 PID 1660 wrote to memory of 2248 1660 9vdjd.exe 42 PID 1660 wrote to memory of 2248 1660 9vdjd.exe 42 PID 1660 wrote to memory of 2248 1660 9vdjd.exe 42 PID 2248 wrote to memory of 1624 2248 ttbhhn.exe 43 PID 2248 wrote to memory of 1624 2248 ttbhhn.exe 43 PID 2248 wrote to memory of 1624 2248 ttbhhn.exe 43 PID 2248 wrote to memory of 1624 2248 ttbhhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe"C:\Users\Admin\AppData\Local\Temp\2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\hnbttb.exec:\hnbttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xxxrlfl.exec:\xxxrlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\1nthbt.exec:\1nthbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vpvdp.exec:\vpvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\9frllrr.exec:\9frllrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vjvvv.exec:\vjvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3lfffxf.exec:\3lfffxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bntnnh.exec:\bntnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\9frxffl.exec:\9frxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nbhhhh.exec:\nbhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\5dvdd.exec:\5dvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\rrlllrr.exec:\rrlllrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\nbtttt.exec:\nbtttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\9vdjd.exec:\9vdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ttbhhn.exec:\ttbhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\pjvvd.exec:\pjvvd.exe17⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxrxlfl.exec:\fxrxlfl.exe18⤵
- Executes dropped EXE
PID:840 -
\??\c:\thnhhb.exec:\thnhhb.exe19⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jjvjd.exec:\jjvjd.exe20⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tbhhhb.exec:\tbhhhb.exe21⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1nbhhn.exec:\1nbhhn.exe22⤵
- Executes dropped EXE
PID:1560 -
\??\c:\frlrfxl.exec:\frlrfxl.exe23⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1vjpj.exec:\1vjpj.exe24⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jjppv.exec:\jjppv.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9nntbt.exec:\9nntbt.exe26⤵
- Executes dropped EXE
PID:1308 -
\??\c:\djvpv.exec:\djvpv.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lxrxlfl.exec:\lxrxlfl.exe28⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nhtbhb.exec:\nhtbhb.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lxlffxf.exec:\lxlffxf.exe30⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1bnnbt.exec:\1bnnbt.exe31⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lxlfrrf.exec:\lxlfrrf.exe32⤵
- Executes dropped EXE
PID:696 -
\??\c:\tnbbhh.exec:\tnbbhh.exe33⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vpjvv.exec:\vpjvv.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\flffxrx.exec:\flffxrx.exe35⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nbbbbb.exec:\nbbbbb.exe36⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dvppv.exec:\dvppv.exe37⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lxfxxll.exec:\lxfxxll.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\thtbbh.exec:\thtbbh.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\djpjp.exec:\djpjp.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ddpvp.exec:\ddpvp.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7rlflfl.exec:\7rlflfl.exe42⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9bbbhn.exec:\9bbbhn.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pjjpv.exec:\pjjpv.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dpvpd.exec:\dpvpd.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lxfllff.exec:\lxfllff.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bhbbtt.exec:\bhbbtt.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ddppp.exec:\ddppp.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vdvvp.exec:\vdvvp.exe49⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7lxrrlx.exec:\7lxrrlx.exe50⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3hthnn.exec:\3hthnn.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\htbnhh.exec:\htbnhh.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3xfxlfr.exec:\3xfxlfr.exe53⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tntbbt.exec:\tntbbt.exe54⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ntbttt.exec:\ntbttt.exe55⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pppvd.exec:\pppvd.exe56⤵
- Executes dropped EXE
PID:1176 -
\??\c:\7xrxrfr.exec:\7xrxrfr.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3nhntb.exec:\3nhntb.exe58⤵
- Executes dropped EXE
PID:840 -
\??\c:\dvjpv.exec:\dvjpv.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jjddj.exec:\jjddj.exe60⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe61⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nbnntt.exec:\nbnntt.exe62⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9pppp.exec:\9pppp.exe63⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pdvjp.exec:\pdvjp.exe64⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xllllff.exec:\xllllff.exe65⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bbtbnn.exec:\bbtbnn.exe66⤵PID:2220
-
\??\c:\jjjdv.exec:\jjjdv.exe67⤵PID:956
-
\??\c:\rlrxrll.exec:\rlrxrll.exe68⤵PID:1928
-
\??\c:\1lxrlfl.exec:\1lxrlfl.exe69⤵PID:1564
-
\??\c:\ttnttb.exec:\ttnttb.exe70⤵PID:1348
-
\??\c:\pvdvj.exec:\pvdvj.exe71⤵PID:1760
-
\??\c:\dvpjv.exec:\dvpjv.exe72⤵PID:2104
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe73⤵PID:604
-
\??\c:\hbtbbn.exec:\hbtbbn.exe74⤵PID:1640
-
\??\c:\pddvj.exec:\pddvj.exe75⤵PID:2848
-
\??\c:\vvpvj.exec:\vvpvj.exe76⤵PID:2280
-
\??\c:\fllrfxf.exec:\fllrfxf.exe77⤵PID:1460
-
\??\c:\ttthth.exec:\ttthth.exe78⤵PID:1872
-
\??\c:\jdvjp.exec:\jdvjp.exe79⤵PID:1892
-
\??\c:\lllrxlx.exec:\lllrxlx.exe80⤵PID:804
-
\??\c:\7fffrxl.exec:\7fffrxl.exe81⤵PID:3028
-
\??\c:\bbtbnt.exec:\bbtbnt.exe82⤵PID:2536
-
\??\c:\3pdpv.exec:\3pdpv.exe83⤵PID:2704
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe84⤵PID:2856
-
\??\c:\lfrlrlx.exec:\lfrlrlx.exe85⤵PID:2676
-
\??\c:\ppdvv.exec:\ppdvv.exe86⤵PID:2088
-
\??\c:\dvvjd.exec:\dvvjd.exe87⤵PID:2580
-
\??\c:\fxllrrx.exec:\fxllrrx.exe88⤵PID:2612
-
\??\c:\hbnbnt.exec:\hbnbnt.exe89⤵PID:2640
-
\??\c:\vvddp.exec:\vvddp.exe90⤵PID:2476
-
\??\c:\vdvjv.exec:\vdvjv.exe91⤵PID:2972
-
\??\c:\fffllrx.exec:\fffllrx.exe92⤵PID:3020
-
\??\c:\btnbht.exec:\btnbht.exe93⤵PID:1052
-
\??\c:\hhttbb.exec:\hhttbb.exe94⤵PID:1452
-
\??\c:\jdppj.exec:\jdppj.exe95⤵PID:2744
-
\??\c:\xrflllr.exec:\xrflllr.exe96⤵PID:2740
-
\??\c:\xrrxlxx.exec:\xrrxlxx.exe97⤵PID:1436
-
\??\c:\3bnhhn.exec:\3bnhhn.exe98⤵PID:2260
-
\??\c:\jdvvj.exec:\jdvvj.exe99⤵PID:1512
-
\??\c:\rrllrlr.exec:\rrllrlr.exe100⤵PID:1628
-
\??\c:\xrllrxl.exec:\xrllrxl.exe101⤵PID:1420
-
\??\c:\btnthh.exec:\btnthh.exe102⤵PID:2028
-
\??\c:\5dvvd.exec:\5dvvd.exe103⤵PID:2800
-
\??\c:\fffflfr.exec:\fffflfr.exe104⤵
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\3frrlrf.exec:\3frrlrf.exe105⤵PID:1572
-
\??\c:\btntbb.exec:\btntbb.exe106⤵PID:2540
-
\??\c:\nhtbhn.exec:\nhtbhn.exe107⤵PID:1088
-
\??\c:\jvjpj.exec:\jvjpj.exe108⤵PID:448
-
\??\c:\rlflrfl.exec:\rlflrfl.exe109⤵PID:2424
-
\??\c:\nhnnnn.exec:\nhnnnn.exe110⤵PID:2220
-
\??\c:\9btbbh.exec:\9btbbh.exe111⤵PID:1540
-
\??\c:\pjvdj.exec:\pjvdj.exe112⤵PID:1252
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe113⤵PID:1564
-
\??\c:\9bbbbn.exec:\9bbbbn.exe114⤵PID:908
-
\??\c:\hhnhtb.exec:\hhnhtb.exe115⤵PID:1760
-
\??\c:\vpjjp.exec:\vpjjp.exe116⤵PID:2104
-
\??\c:\jjdjd.exec:\jjdjd.exe117⤵PID:2296
-
\??\c:\lfffxfr.exec:\lfffxfr.exe118⤵PID:2156
-
\??\c:\5hhtht.exec:\5hhtht.exe119⤵PID:2848
-
\??\c:\vvjpj.exec:\vvjpj.exe120⤵PID:544
-
\??\c:\vvppj.exec:\vvppj.exe121⤵PID:1876
-
\??\c:\rfxllxf.exec:\rfxllxf.exe122⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-