Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 00:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe
-
Size
456KB
-
MD5
abc45e7e40bded452877935ebac8a4f0
-
SHA1
777244ab61d2fcb45f499325cc8e615aafe55560
-
SHA256
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15
-
SHA512
bbda582bbaff8c3fa546bebaff30223bc84b8539104c40b53bd91fd31f346c04c6f89048c4e991aa9eee9a19dd03d8766b6a775b5b52aa301d15e18cd87138c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRl:q7Tc2NYHUrAwfMp3CDRl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2968-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-27-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2856-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-211-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1420-417-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1420-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-434-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/532-436-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-555-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2796-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-792-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2596-844-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/532-974-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-1103-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2588-1129-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2852 nhnbhn.exe 2128 vpddj.exe 2856 5htnbt.exe 2704 frlffff.exe 2580 bntnhb.exe 3064 pjdjp.exe 1460 3xrrxxl.exe 2608 hthhbt.exe 2336 dvpvv.exe 1056 5fflrrx.exe 1664 vvjdd.exe 2804 xxlrffr.exe 840 tnnnht.exe 2920 thbhnn.exe 1580 fxrrxfl.exe 264 htthnb.exe 2060 jjjdv.exe 2392 xrxrfrf.exe 2408 hbthbh.exe 1012 pjddj.exe 3028 thttbn.exe 1300 vpjvj.exe 1616 9xfflfl.exe 2540 1hnntb.exe 1540 jvvvd.exe 2420 xlxfrrx.exe 2140 thttbh.exe 996 rxlllrl.exe 2908 hhnhnb.exe 2652 vvvvj.exe 1512 llffxfr.exe 2852 ntnbnn.exe 2128 5jvdd.exe 2824 fxlrflr.exe 2732 btntbh.exe 2740 jdvdp.exe 1884 ppvjp.exe 2112 ffrflfx.exe 3064 nhthbh.exe 3052 7vjdj.exe 1992 ddpvd.exe 1728 1xrrxxl.exe 2124 5tnttb.exe 2628 tnnbhn.exe 1852 ppjpd.exe 676 ddpdd.exe 1720 xlxxfrf.exe 840 nnhhhn.exe 1420 bnhbhh.exe 2796 xrflxfx.exe 532 nhtbbb.exe 2308 bbtthh.exe 2072 pvpvd.exe 1732 9frfxxl.exe 1352 ntbtnh.exe 2500 pjjjd.exe 1836 9lxxlrx.exe 956 frlflff.exe 2368 rfrlrlr.exe 952 3nbhtb.exe 900 hbhhnn.exe 2188 vpdjp.exe 2488 frfxffl.exe 1940 hhbhhn.exe -
resource yara_rule behavioral1/memory/2852-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-417-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1420-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-555-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2796-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-831-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2424-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-943-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-1029-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-1057-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2852 2968 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2968 wrote to memory of 2852 2968 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2968 wrote to memory of 2852 2968 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2968 wrote to memory of 2852 2968 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2852 wrote to memory of 2128 2852 nhnbhn.exe 31 PID 2852 wrote to memory of 2128 2852 nhnbhn.exe 31 PID 2852 wrote to memory of 2128 2852 nhnbhn.exe 31 PID 2852 wrote to memory of 2128 2852 nhnbhn.exe 31 PID 2128 wrote to memory of 2856 2128 vpddj.exe 32 PID 2128 wrote to memory of 2856 2128 vpddj.exe 32 PID 2128 wrote to memory of 2856 2128 vpddj.exe 32 PID 2128 wrote to memory of 2856 2128 vpddj.exe 32 PID 2856 wrote to memory of 2704 2856 5htnbt.exe 33 PID 2856 wrote to memory of 2704 2856 5htnbt.exe 33 PID 2856 wrote to memory of 2704 2856 5htnbt.exe 33 PID 2856 wrote to memory of 2704 2856 5htnbt.exe 33 PID 2704 wrote to memory of 2580 2704 frlffff.exe 34 PID 2704 wrote to memory of 2580 2704 frlffff.exe 34 PID 2704 wrote to memory of 2580 2704 frlffff.exe 34 PID 2704 wrote to memory of 2580 2704 frlffff.exe 34 PID 2580 wrote to memory of 3064 2580 bntnhb.exe 68 PID 2580 wrote to memory of 3064 2580 bntnhb.exe 68 PID 2580 wrote to memory of 3064 2580 bntnhb.exe 68 PID 2580 wrote to memory of 3064 2580 bntnhb.exe 68 PID 3064 wrote to memory of 1460 3064 pjdjp.exe 36 PID 3064 wrote to memory of 1460 3064 pjdjp.exe 36 PID 3064 wrote to memory of 1460 3064 pjdjp.exe 36 PID 3064 wrote to memory of 1460 3064 pjdjp.exe 36 PID 1460 wrote to memory of 2608 1460 3xrrxxl.exe 37 PID 1460 wrote to memory of 2608 1460 3xrrxxl.exe 37 PID 1460 wrote to memory of 2608 1460 3xrrxxl.exe 37 PID 1460 wrote to memory of 2608 1460 3xrrxxl.exe 37 PID 2608 wrote to memory of 2336 2608 hthhbt.exe 38 PID 2608 wrote to memory of 2336 2608 hthhbt.exe 38 PID 2608 wrote to memory of 2336 2608 hthhbt.exe 38 PID 2608 wrote to memory of 2336 2608 hthhbt.exe 38 PID 2336 wrote to memory of 1056 2336 dvpvv.exe 39 PID 2336 wrote to memory of 1056 2336 dvpvv.exe 39 PID 2336 wrote to memory of 1056 2336 dvpvv.exe 39 PID 2336 wrote to memory of 1056 2336 dvpvv.exe 39 PID 1056 wrote to memory of 1664 1056 5fflrrx.exe 40 PID 1056 wrote to memory of 1664 1056 5fflrrx.exe 40 PID 1056 wrote to memory of 1664 1056 5fflrrx.exe 40 PID 1056 wrote to memory of 1664 1056 5fflrrx.exe 40 PID 1664 wrote to memory of 2804 1664 vvjdd.exe 41 PID 1664 wrote to memory of 2804 1664 vvjdd.exe 41 PID 1664 wrote to memory of 2804 1664 vvjdd.exe 41 PID 1664 wrote to memory of 2804 1664 vvjdd.exe 41 PID 2804 wrote to memory of 840 2804 xxlrffr.exe 42 PID 2804 wrote to memory of 840 2804 xxlrffr.exe 42 PID 2804 wrote to memory of 840 2804 xxlrffr.exe 42 PID 2804 wrote to memory of 840 2804 xxlrffr.exe 42 PID 840 wrote to memory of 2920 840 tnnnht.exe 43 PID 840 wrote to memory of 2920 840 tnnnht.exe 43 PID 840 wrote to memory of 2920 840 tnnnht.exe 43 PID 840 wrote to memory of 2920 840 tnnnht.exe 43 PID 2920 wrote to memory of 1580 2920 thbhnn.exe 44 PID 2920 wrote to memory of 1580 2920 thbhnn.exe 44 PID 2920 wrote to memory of 1580 2920 thbhnn.exe 44 PID 2920 wrote to memory of 1580 2920 thbhnn.exe 44 PID 1580 wrote to memory of 264 1580 fxrrxfl.exe 45 PID 1580 wrote to memory of 264 1580 fxrrxfl.exe 45 PID 1580 wrote to memory of 264 1580 fxrrxfl.exe 45 PID 1580 wrote to memory of 264 1580 fxrrxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe"C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\nhnbhn.exec:\nhnbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vpddj.exec:\vpddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\5htnbt.exec:\5htnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\frlffff.exec:\frlffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bntnhb.exec:\bntnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pjdjp.exec:\pjdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\3xrrxxl.exec:\3xrrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\hthhbt.exec:\hthhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dvpvv.exec:\dvpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\5fflrrx.exec:\5fflrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\vvjdd.exec:\vvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\xxlrffr.exec:\xxlrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\tnnnht.exec:\tnnnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\thbhnn.exec:\thbhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\htthnb.exec:\htthnb.exe17⤵
- Executes dropped EXE
PID:264 -
\??\c:\jjjdv.exec:\jjjdv.exe18⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrxrfrf.exec:\xrxrfrf.exe19⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hbthbh.exec:\hbthbh.exe20⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pjddj.exec:\pjddj.exe21⤵
- Executes dropped EXE
PID:1012 -
\??\c:\thttbn.exec:\thttbn.exe22⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vpjvj.exec:\vpjvj.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\9xfflfl.exec:\9xfflfl.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1hnntb.exec:\1hnntb.exe25⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jvvvd.exec:\jvvvd.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xlxfrrx.exec:\xlxfrrx.exe27⤵
- Executes dropped EXE
PID:2420 -
\??\c:\thttbh.exec:\thttbh.exe28⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rxlllrl.exec:\rxlllrl.exe29⤵
- Executes dropped EXE
PID:996 -
\??\c:\hhnhnb.exec:\hhnhnb.exe30⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vvvvj.exec:\vvvvj.exe31⤵
- Executes dropped EXE
PID:2652 -
\??\c:\llffxfr.exec:\llffxfr.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ntnbnn.exec:\ntnbnn.exe33⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5jvdd.exec:\5jvdd.exe34⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fxlrflr.exec:\fxlrflr.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\btntbh.exec:\btntbh.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvdp.exec:\jdvdp.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ppvjp.exec:\ppvjp.exe38⤵
- Executes dropped EXE
PID:1884 -
\??\c:\ffrflfx.exec:\ffrflfx.exe39⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nhthbh.exec:\nhthbh.exe40⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7vjdj.exec:\7vjdj.exe41⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ddpvd.exec:\ddpvd.exe42⤵
- Executes dropped EXE
PID:1992 -
\??\c:\1xrrxxl.exec:\1xrrxxl.exe43⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5tnttb.exec:\5tnttb.exe44⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tnnbhn.exec:\tnnbhn.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ppjpd.exec:\ppjpd.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ddpdd.exec:\ddpdd.exe47⤵
- Executes dropped EXE
PID:676 -
\??\c:\xlxxfrf.exec:\xlxxfrf.exe48⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnhhhn.exec:\nnhhhn.exe49⤵
- Executes dropped EXE
PID:840 -
\??\c:\bnhbhh.exec:\bnhbhh.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xrflxfx.exec:\xrflxfx.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nhtbbb.exec:\nhtbbb.exe52⤵
- Executes dropped EXE
PID:532 -
\??\c:\bbtthh.exec:\bbtthh.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pvpvd.exec:\pvpvd.exe54⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9frfxxl.exec:\9frfxxl.exe55⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ntbtnh.exec:\ntbtnh.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pjjjd.exec:\pjjjd.exe57⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9lxxlrx.exec:\9lxxlrx.exe58⤵
- Executes dropped EXE
PID:1836 -
\??\c:\frlflff.exec:\frlflff.exe59⤵
- Executes dropped EXE
PID:956 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3nbhtb.exec:\3nbhtb.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\hbhhnn.exec:\hbhhnn.exe62⤵
- Executes dropped EXE
PID:900 -
\??\c:\vpdjp.exec:\vpdjp.exe63⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frfxffl.exec:\frfxffl.exe64⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hhbhhn.exec:\hhbhhn.exe65⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjjpd.exec:\pjjpd.exe66⤵PID:2516
-
\??\c:\dvppd.exec:\dvppd.exe67⤵PID:1468
-
\??\c:\xlxxllx.exec:\xlxxllx.exe68⤵PID:2312
-
\??\c:\1tnntn.exec:\1tnntn.exe69⤵PID:1784
-
\??\c:\tnhhnn.exec:\tnhhnn.exe70⤵PID:2648
-
\??\c:\dvddj.exec:\dvddj.exe71⤵PID:2316
-
\??\c:\3lxxffr.exec:\3lxxffr.exe72⤵PID:1552
-
\??\c:\9fflrrx.exec:\9fflrrx.exe73⤵PID:1492
-
\??\c:\ttnhbh.exec:\ttnhbh.exe74⤵PID:2860
-
\??\c:\7vddj.exec:\7vddj.exe75⤵PID:2240
-
\??\c:\5xffffl.exec:\5xffffl.exe76⤵PID:2892
-
\??\c:\3xfffxx.exec:\3xfffxx.exe77⤵PID:2824
-
\??\c:\hntnbt.exec:\hntnbt.exe78⤵PID:2564
-
\??\c:\pjpdj.exec:\pjpdj.exe79⤵PID:2980
-
\??\c:\rxfrxll.exec:\rxfrxll.exe80⤵PID:2888
-
\??\c:\htbtnn.exec:\htbtnn.exe81⤵PID:2644
-
\??\c:\pdvjv.exec:\pdvjv.exe82⤵PID:656
-
\??\c:\5dppv.exec:\5dppv.exe83⤵PID:2396
-
\??\c:\rlfffff.exec:\rlfffff.exe84⤵PID:1240
-
\??\c:\1tnhnn.exec:\1tnhnn.exe85⤵PID:2364
-
\??\c:\3pddj.exec:\3pddj.exe86⤵PID:2780
-
\??\c:\dvpvd.exec:\dvpvd.exe87⤵PID:1056
-
\??\c:\7rxxfff.exec:\7rxxfff.exe88⤵PID:1664
-
\??\c:\9xxrxxr.exec:\9xxrxxr.exe89⤵PID:2064
-
\??\c:\9bnnhn.exec:\9bnnhn.exe90⤵PID:1592
-
\??\c:\dpjpv.exec:\dpjpv.exe91⤵PID:1724
-
\??\c:\vjvdj.exec:\vjvdj.exe92⤵PID:2284
-
\??\c:\fxlfllr.exec:\fxlfllr.exe93⤵PID:1232
-
\??\c:\hbthhn.exec:\hbthhn.exe94⤵PID:2796
-
\??\c:\pjjvp.exec:\pjjvp.exe95⤵PID:1076
-
\??\c:\ppdpd.exec:\ppdpd.exe96⤵PID:2028
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe97⤵PID:3004
-
\??\c:\ntntbh.exec:\ntntbh.exe98⤵PID:2380
-
\??\c:\hnhnnt.exec:\hnhnnt.exe99⤵PID:1736
-
\??\c:\7pppj.exec:\7pppj.exe100⤵PID:1620
-
\??\c:\rrxfxff.exec:\rrxfxff.exe101⤵PID:2176
-
\??\c:\1bntnn.exec:\1bntnn.exe102⤵PID:1156
-
\??\c:\hnhbtb.exec:\hnhbtb.exe103⤵PID:1448
-
\??\c:\ppjpv.exec:\ppjpv.exe104⤵PID:2200
-
\??\c:\1rllrxx.exec:\1rllrxx.exe105⤵PID:992
-
\??\c:\frllllr.exec:\frllllr.exe106⤵PID:2528
-
\??\c:\nhhnbh.exec:\nhhnbh.exe107⤵PID:1564
-
\??\c:\3djvv.exec:\3djvv.exe108⤵PID:2488
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe109⤵PID:3012
-
\??\c:\tttbhh.exec:\tttbhh.exe110⤵PID:844
-
\??\c:\ttbttn.exec:\ttbttn.exe111⤵PID:1748
-
\??\c:\pjjjj.exec:\pjjjj.exe112⤵PID:1744
-
\??\c:\5jpvd.exec:\5jpvd.exe113⤵PID:2716
-
\??\c:\rlfffrf.exec:\rlfffrf.exe114⤵PID:2844
-
\??\c:\bthttb.exec:\bthttb.exe115⤵PID:2868
-
\??\c:\bbtthb.exec:\bbtthb.exe116⤵PID:2724
-
\??\c:\ddvpd.exec:\ddvpd.exe117⤵PID:2596
-
\??\c:\7xlrxff.exec:\7xlrxff.exe118⤵PID:2904
-
\??\c:\hntbnn.exec:\hntbnn.exe119⤵PID:2756
-
\??\c:\7ntbbb.exec:\7ntbbb.exe120⤵PID:764
-
\??\c:\dpdjj.exec:\dpdjj.exe121⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-