Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe
-
Size
453KB
-
MD5
583ba20a8bdfea7b1180693c4946e417
-
SHA1
5e41004bf7b360d0acbe4814aa781192db6a1acc
-
SHA256
b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952
-
SHA512
c338b7699572062f9a84a1279f7ce03de8abdaedfb514e4f24fc8e53a5020cfdb5df93f8b647a1b166cc9d78cd862deaf5985ea4e6d2fdad234f11b965c506bb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2848-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-27-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2612-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-96-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/468-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-219-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/832-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-248-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1312-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-256-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1964-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-312-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2236-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1244-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-388-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-511-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2524-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-676-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2688-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3068 llrffxf.exe 2804 htbbbt.exe 2612 5lxxffl.exe 2644 ttntbb.exe 2640 jvdpp.exe 2892 lfrxffl.exe 320 7htbnn.exe 580 dpvdd.exe 2148 bthntn.exe 2512 5htttt.exe 3024 xrxrlff.exe 2972 5nhhhh.exe 468 pdppp.exe 2936 lxllllx.exe 2240 3hnbhh.exe 1160 fxrxxfr.exe 1444 3xxfrrr.exe 2136 5pvvd.exe 2468 xrffllr.exe 2648 7hntbb.exe 1108 pdjdp.exe 832 9xrrrxf.exe 1904 bhnhnh.exe 2552 jdpvd.exe 868 xxlfllr.exe 1312 7djjj.exe 1548 frffflr.exe 1124 bbnntt.exe 1964 dvvjj.exe 892 lfxxxxf.exe 2744 pdvdd.exe 2596 rfrrrxf.exe 2236 nnbnhh.exe 2724 vvjjp.exe 2588 rflffxx.exe 1244 7rflxrf.exe 2708 3pvpp.exe 1868 lfrllrr.exe 560 rflfllf.exe 1728 bnbbbb.exe 2916 7jddp.exe 1492 dpjjp.exe 584 lxffxxr.exe 2572 hthhhb.exe 2540 dpvpj.exe 2880 7pvpj.exe 3044 rflfffl.exe 3016 7bhtnh.exe 2976 nhtnnh.exe 2280 3djjp.exe 2276 1rrlllf.exe 2348 frllllr.exe 2244 nhnnhb.exe 1756 pvddv.exe 2792 rlxxfxr.exe 2212 1ffrrfx.exe 1508 bbhhnn.exe 308 9vjpv.exe 2356 frlrrxl.exe 1900 httbtn.exe 1940 nnthtt.exe 2400 3vvdj.exe 1912 lxffxfl.exe 1784 xrfflll.exe -
resource yara_rule behavioral1/memory/2848-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-388-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3016-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-452-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1756-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-937-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 3068 2848 b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe 30 PID 2848 wrote to memory of 3068 2848 b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe 30 PID 2848 wrote to memory of 3068 2848 b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe 30 PID 2848 wrote to memory of 3068 2848 b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe 30 PID 3068 wrote to memory of 2804 3068 llrffxf.exe 31 PID 3068 wrote to memory of 2804 3068 llrffxf.exe 31 PID 3068 wrote to memory of 2804 3068 llrffxf.exe 31 PID 3068 wrote to memory of 2804 3068 llrffxf.exe 31 PID 2804 wrote to memory of 2612 2804 htbbbt.exe 32 PID 2804 wrote to memory of 2612 2804 htbbbt.exe 32 PID 2804 wrote to memory of 2612 2804 htbbbt.exe 32 PID 2804 wrote to memory of 2612 2804 htbbbt.exe 32 PID 2612 wrote to memory of 2644 2612 5lxxffl.exe 33 PID 2612 wrote to memory of 2644 2612 5lxxffl.exe 33 PID 2612 wrote to memory of 2644 2612 5lxxffl.exe 33 PID 2612 wrote to memory of 2644 2612 5lxxffl.exe 33 PID 2644 wrote to memory of 2640 2644 ttntbb.exe 34 PID 2644 wrote to memory of 2640 2644 ttntbb.exe 34 PID 2644 wrote to memory of 2640 2644 ttntbb.exe 34 PID 2644 wrote to memory of 2640 2644 ttntbb.exe 34 PID 2640 wrote to memory of 2892 2640 jvdpp.exe 35 PID 2640 wrote to memory of 2892 2640 jvdpp.exe 35 PID 2640 wrote to memory of 2892 2640 jvdpp.exe 35 PID 2640 wrote to memory of 2892 2640 jvdpp.exe 35 PID 2892 wrote to memory of 320 2892 lfrxffl.exe 36 PID 2892 wrote to memory of 320 2892 lfrxffl.exe 36 PID 2892 wrote to memory of 320 2892 lfrxffl.exe 36 PID 2892 wrote to memory of 320 2892 lfrxffl.exe 36 PID 320 wrote to memory of 580 320 7htbnn.exe 37 PID 320 wrote to memory of 580 320 7htbnn.exe 37 PID 320 wrote to memory of 580 320 7htbnn.exe 37 PID 320 wrote to memory of 580 320 7htbnn.exe 37 PID 580 wrote to memory of 2148 580 dpvdd.exe 38 PID 580 wrote to memory of 2148 580 dpvdd.exe 38 PID 580 wrote to memory of 2148 580 dpvdd.exe 38 PID 580 wrote to memory of 2148 580 dpvdd.exe 38 PID 2148 wrote to memory of 2512 2148 bthntn.exe 39 PID 2148 wrote to memory of 2512 2148 bthntn.exe 39 PID 2148 wrote to memory of 2512 2148 bthntn.exe 39 PID 2148 wrote to memory of 2512 2148 bthntn.exe 39 PID 2512 wrote to memory of 3024 2512 5htttt.exe 40 PID 2512 wrote to memory of 3024 2512 5htttt.exe 40 PID 2512 wrote to memory of 3024 2512 5htttt.exe 40 PID 2512 wrote to memory of 3024 2512 5htttt.exe 40 PID 3024 wrote to memory of 2972 3024 xrxrlff.exe 41 PID 3024 wrote to memory of 2972 3024 xrxrlff.exe 41 PID 3024 wrote to memory of 2972 3024 xrxrlff.exe 41 PID 3024 wrote to memory of 2972 3024 xrxrlff.exe 41 PID 2972 wrote to memory of 468 2972 5nhhhh.exe 42 PID 2972 wrote to memory of 468 2972 5nhhhh.exe 42 PID 2972 wrote to memory of 468 2972 5nhhhh.exe 42 PID 2972 wrote to memory of 468 2972 5nhhhh.exe 42 PID 468 wrote to memory of 2936 468 pdppp.exe 43 PID 468 wrote to memory of 2936 468 pdppp.exe 43 PID 468 wrote to memory of 2936 468 pdppp.exe 43 PID 468 wrote to memory of 2936 468 pdppp.exe 43 PID 2936 wrote to memory of 2240 2936 lxllllx.exe 44 PID 2936 wrote to memory of 2240 2936 lxllllx.exe 44 PID 2936 wrote to memory of 2240 2936 lxllllx.exe 44 PID 2936 wrote to memory of 2240 2936 lxllllx.exe 44 PID 2240 wrote to memory of 1160 2240 3hnbhh.exe 45 PID 2240 wrote to memory of 1160 2240 3hnbhh.exe 45 PID 2240 wrote to memory of 1160 2240 3hnbhh.exe 45 PID 2240 wrote to memory of 1160 2240 3hnbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe"C:\Users\Admin\AppData\Local\Temp\b8aaad3172eeee5465da7cd25b3d6334217387034eed5be55931670dd5d5c952.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\llrffxf.exec:\llrffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\htbbbt.exec:\htbbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\5lxxffl.exec:\5lxxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ttntbb.exec:\ttntbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jvdpp.exec:\jvdpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\lfrxffl.exec:\lfrxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7htbnn.exec:\7htbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\dpvdd.exec:\dpvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\bthntn.exec:\bthntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5htttt.exec:\5htttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xrxrlff.exec:\xrxrlff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\5nhhhh.exec:\5nhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\pdppp.exec:\pdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\lxllllx.exec:\lxllllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\3hnbhh.exec:\3hnbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\fxrxxfr.exec:\fxrxxfr.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1160 -
\??\c:\3xxfrrr.exec:\3xxfrrr.exe18⤵
- Executes dropped EXE
PID:1444 -
\??\c:\5pvvd.exec:\5pvvd.exe19⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrffllr.exec:\xrffllr.exe20⤵
- Executes dropped EXE
PID:2468 -
\??\c:\7hntbb.exec:\7hntbb.exe21⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pdjdp.exec:\pdjdp.exe22⤵
- Executes dropped EXE
PID:1108 -
\??\c:\9xrrrxf.exec:\9xrrrxf.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\bhnhnh.exec:\bhnhnh.exe24⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdpvd.exec:\jdpvd.exe25⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xxlfllr.exec:\xxlfllr.exe26⤵
- Executes dropped EXE
PID:868 -
\??\c:\7djjj.exec:\7djjj.exe27⤵
- Executes dropped EXE
PID:1312 -
\??\c:\frffflr.exec:\frffflr.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bbnntt.exec:\bbnntt.exe29⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dvvjj.exec:\dvvjj.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\pdvdd.exec:\pdvdd.exe32⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe33⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nnbnhh.exec:\nnbnhh.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vvjjp.exec:\vvjjp.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rflffxx.exec:\rflffxx.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7rflxrf.exec:\7rflxrf.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244 -
\??\c:\3pvpp.exec:\3pvpp.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfrllrr.exec:\lfrllrr.exe39⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rflfllf.exec:\rflfllf.exe40⤵
- Executes dropped EXE
PID:560 -
\??\c:\bnbbbb.exec:\bnbbbb.exe41⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7jddp.exec:\7jddp.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dpjjp.exec:\dpjjp.exe43⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lxffxxr.exec:\lxffxxr.exe44⤵
- Executes dropped EXE
PID:584 -
\??\c:\hthhhb.exec:\hthhhb.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dpvpj.exec:\dpvpj.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7pvpj.exec:\7pvpj.exe47⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rflfffl.exec:\rflfffl.exe48⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7bhtnh.exec:\7bhtnh.exe49⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nhtnnh.exec:\nhtnnh.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3djjp.exec:\3djjp.exe51⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1rrlllf.exec:\1rrlllf.exe52⤵
- Executes dropped EXE
PID:2276 -
\??\c:\frllllr.exec:\frllllr.exe53⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhnnhb.exec:\nhnnhb.exe54⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pvddv.exec:\pvddv.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rlxxfxr.exec:\rlxxfxr.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1ffrrfx.exec:\1ffrrfx.exe57⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbhhnn.exec:\bbhhnn.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\9vjpv.exec:\9vjpv.exe59⤵
- Executes dropped EXE
PID:308 -
\??\c:\frlrrxl.exec:\frlrrxl.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\httbtn.exec:\httbtn.exe61⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nnthtt.exec:\nnthtt.exe62⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3vvdj.exec:\3vvdj.exe63⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lxffxfl.exec:\lxffxfl.exe64⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrfflll.exec:\xrfflll.exe65⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nthbbt.exec:\nthbbt.exe66⤵PID:2120
-
\??\c:\jvjdd.exec:\jvjdd.exe67⤵PID:1624
-
\??\c:\vpvpp.exec:\vpvpp.exe68⤵PID:2524
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe69⤵PID:1200
-
\??\c:\htnnnn.exec:\htnnnn.exe70⤵PID:1636
-
\??\c:\jdppv.exec:\jdppv.exe71⤵PID:1776
-
\??\c:\9dvdp.exec:\9dvdp.exe72⤵PID:1640
-
\??\c:\7lrxrrr.exec:\7lrxrrr.exe73⤵PID:2132
-
\??\c:\9bnhhh.exec:\9bnhhh.exe74⤵PID:2856
-
\??\c:\nhhtbb.exec:\nhhtbb.exe75⤵PID:3012
-
\??\c:\1jvvv.exec:\1jvvv.exe76⤵PID:2760
-
\??\c:\rxffrrl.exec:\rxffrrl.exe77⤵PID:2756
-
\??\c:\9rxxxrr.exec:\9rxxxrr.exe78⤵PID:2488
-
\??\c:\ttbhbt.exec:\ttbhbt.exe79⤵PID:2664
-
\??\c:\3jddp.exec:\3jddp.exe80⤵PID:1244
-
\??\c:\vjpjj.exec:\vjpjj.exe81⤵PID:2892
-
\??\c:\frxxxxl.exec:\frxxxxl.exe82⤵PID:2320
-
\??\c:\nbnntt.exec:\nbnntt.exe83⤵PID:560
-
\??\c:\vpvdd.exec:\vpvdd.exe84⤵PID:2084
-
\??\c:\vdpdd.exec:\vdpdd.exe85⤵PID:956
-
\??\c:\flxrrlr.exec:\flxrrlr.exe86⤵PID:400
-
\??\c:\nhbbtb.exec:\nhbbtb.exe87⤵PID:1860
-
\??\c:\nthbtt.exec:\nthbtt.exe88⤵PID:3000
-
\??\c:\vjpjd.exec:\vjpjd.exe89⤵PID:2500
-
\??\c:\jdjjj.exec:\jdjjj.exe90⤵PID:2932
-
\??\c:\lffxfff.exec:\lffxfff.exe91⤵PID:3040
-
\??\c:\hthhhb.exec:\hthhhb.exe92⤵PID:2912
-
\??\c:\bnbttn.exec:\bnbttn.exe93⤵PID:2092
-
\??\c:\pvpdv.exec:\pvpdv.exe94⤵PID:2688
-
\??\c:\3rxxrrl.exec:\3rxxrrl.exe95⤵PID:552
-
\??\c:\bntnhh.exec:\bntnhh.exe96⤵PID:2264
-
\??\c:\1nbttn.exec:\1nbttn.exe97⤵PID:1612
-
\??\c:\pdpdj.exec:\pdpdj.exe98⤵PID:2556
-
\??\c:\3rfxlrx.exec:\3rfxlrx.exe99⤵PID:1628
-
\??\c:\nnhbbt.exec:\nnhbbt.exe100⤵PID:2232
-
\??\c:\nhhnbt.exec:\nhhnbt.exe101⤵PID:2056
-
\??\c:\pvddd.exec:\pvddd.exe102⤵PID:1076
-
\??\c:\7rrrxxx.exec:\7rrrxxx.exe103⤵PID:2216
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe104⤵PID:832
-
\??\c:\tbttbb.exec:\tbttbb.exe105⤵PID:960
-
\??\c:\9jvvv.exec:\9jvvv.exe106⤵PID:1956
-
\??\c:\9xrllfl.exec:\9xrllfl.exe107⤵PID:924
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe108⤵PID:1292
-
\??\c:\5tnnhh.exec:\5tnnhh.exe109⤵PID:1992
-
\??\c:\3htthh.exec:\3htthh.exe110⤵PID:1616
-
\??\c:\pdppp.exec:\pdppp.exe111⤵PID:2460
-
\??\c:\5rffllr.exec:\5rffllr.exe112⤵PID:2184
-
\??\c:\9bnnhn.exec:\9bnnhn.exe113⤵PID:2452
-
\??\c:\7jvpj.exec:\7jvpj.exe114⤵PID:1428
-
\??\c:\jvjdd.exec:\jvjdd.exe115⤵PID:1584
-
\??\c:\xlxrrrf.exec:\xlxrrrf.exe116⤵PID:2744
-
\??\c:\bntntt.exec:\bntntt.exe117⤵PID:2740
-
\??\c:\5tbhtn.exec:\5tbhtn.exe118⤵PID:2896
-
\??\c:\dvjpp.exec:\dvjpp.exe119⤵PID:2812
-
\??\c:\lxrrrxf.exec:\lxrrrxf.exe120⤵PID:2584
-
\??\c:\tttttt.exec:\tttttt.exe121⤵PID:2700
-
\??\c:\jdppv.exec:\jdppv.exe122⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-