Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe
-
Size
348KB
-
MD5
cfe37d94b619b82303018cdcf2568d42
-
SHA1
7cb5917f0bae5492d442140e769b832ad7c3030b
-
SHA256
c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6
-
SHA512
c066c3290c16a1d0ba43bf53a88b834a40a97bed7d7f8c4b5574af798699e4e294a31760fdfe96692f80517232b84df88c9d47d110f4df05d23c7331a9e52e59
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAa0:l7TcbWXZshJX2VGdb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/548-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2612-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2836-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2672-45-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2800-53-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2540-63-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2568-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-82-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2988-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1720-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1724-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1920-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1508-143-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2600-154-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1268-162-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2572-179-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/844-223-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2292-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2964-250-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2952-263-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2832-294-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2256-301-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2144-320-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2144-322-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2980-372-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2776-399-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/896-406-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1780-437-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2132-438-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/964-463-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3032-515-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2288-643-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/652-645-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/896-669-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2152-719-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2152-718-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/444-759-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2140-772-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2744-859-0x00000000003B0000-0x00000000003D8000-memory.dmp family_blackmoon behavioral1/memory/2676-873-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1508-954-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2024-1076-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2636-1133-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/2336-1205-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1208-1241-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2340-1251-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/444-1278-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2612 1hbhnb.exe 2320 3dpjj.exe 2836 nhhnbb.exe 2672 fxfxflx.exe 2800 tnhntt.exe 2540 3pjjj.exe 2568 ffflxlf.exe 2704 5ntntb.exe 2528 5flxxxf.exe 2988 bnttbb.exe 1720 vpjdj.exe 1724 3fllrxf.exe 2064 vjdjj.exe 1920 frfrxff.exe 1508 7bhbbh.exe 2600 vpvvp.exe 1268 rflrxfl.exe 1160 7thnbb.exe 2572 9ffrflr.exe 2220 btnbtn.exe 2500 3pjjp.exe 2368 jvjpp.exe 1672 7bhhhh.exe 844 ddvjd.exe 936 frlxxrf.exe 2292 bntnnn.exe 2964 9dddp.exe 2372 nhthnt.exe 2952 pvjvj.exe 1908 xrlxrfr.exe 2904 tntthb.exe 2832 dvdjp.exe 2256 5ntttt.exe 1440 ppddp.exe 2320 5xrrrrf.exe 2144 llxxrfr.exe 2756 tnhnbb.exe 2636 bbtnht.exe 2812 pddpd.exe 2076 ffxlxfr.exe 2568 rlxrxrf.exe 2668 nhtbhh.exe 2596 5pjpd.exe 2980 ppddp.exe 2996 3rlrflx.exe 888 9btbhn.exe 768 hbnntt.exe 2776 pdjdd.exe 896 fxfxffl.exe 304 rlfxrrx.exe 852 1nbhtt.exe 1508 5pjjd.exe 2876 fflxxll.exe 1780 frfxfxf.exe 2132 nhtbnt.exe 1160 3bhntb.exe 2892 pjvdj.exe 964 lffxlll.exe 2216 1frxlrx.exe 288 3nhhnn.exe 2940 7dpdd.exe 540 dpdvd.exe 1452 1rrlfxf.exe 2512 fxlfllx.exe -
resource yara_rule behavioral1/memory/548-8-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2612-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2836-27-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2836-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-45-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2800-53-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2540-63-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2568-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-82-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2988-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1720-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1724-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1920-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-154-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1268-162-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2572-179-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/844-223-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2292-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2964-250-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2952-263-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2904-278-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2832-294-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2256-301-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2144-322-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2980-372-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/768-385-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2996-397-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2776-399-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/896-406-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1780-437-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2132-438-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1452-488-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2512-496-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2940-495-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2736-590-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2820-603-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2576-616-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2288-643-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/652-645-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/896-669-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-719-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2140-772-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2204-811-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2692-874-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2596-899-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2596-906-0x00000000002A0000-0x00000000002C8000-memory.dmp upx behavioral1/memory/696-941-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1508-954-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3028-1039-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2024-1076-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2468-1085-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2992-1114-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2636-1133-0x0000000000250000-0x0000000000278000-memory.dmp upx behavioral1/memory/2340-1251-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/444-1278-0x0000000000220000-0x0000000000248000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 2612 548 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 31 PID 548 wrote to memory of 2612 548 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 31 PID 548 wrote to memory of 2612 548 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 31 PID 548 wrote to memory of 2612 548 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 31 PID 2612 wrote to memory of 2320 2612 1hbhnb.exe 32 PID 2612 wrote to memory of 2320 2612 1hbhnb.exe 32 PID 2612 wrote to memory of 2320 2612 1hbhnb.exe 32 PID 2612 wrote to memory of 2320 2612 1hbhnb.exe 32 PID 2320 wrote to memory of 2836 2320 3dpjj.exe 33 PID 2320 wrote to memory of 2836 2320 3dpjj.exe 33 PID 2320 wrote to memory of 2836 2320 3dpjj.exe 33 PID 2320 wrote to memory of 2836 2320 3dpjj.exe 33 PID 2836 wrote to memory of 2672 2836 nhhnbb.exe 34 PID 2836 wrote to memory of 2672 2836 nhhnbb.exe 34 PID 2836 wrote to memory of 2672 2836 nhhnbb.exe 34 PID 2836 wrote to memory of 2672 2836 nhhnbb.exe 34 PID 2672 wrote to memory of 2800 2672 fxfxflx.exe 35 PID 2672 wrote to memory of 2800 2672 fxfxflx.exe 35 PID 2672 wrote to memory of 2800 2672 fxfxflx.exe 35 PID 2672 wrote to memory of 2800 2672 fxfxflx.exe 35 PID 2800 wrote to memory of 2540 2800 tnhntt.exe 36 PID 2800 wrote to memory of 2540 2800 tnhntt.exe 36 PID 2800 wrote to memory of 2540 2800 tnhntt.exe 36 PID 2800 wrote to memory of 2540 2800 tnhntt.exe 36 PID 2540 wrote to memory of 2568 2540 3pjjj.exe 37 PID 2540 wrote to memory of 2568 2540 3pjjj.exe 37 PID 2540 wrote to memory of 2568 2540 3pjjj.exe 37 PID 2540 wrote to memory of 2568 2540 3pjjj.exe 37 PID 2568 wrote to memory of 2704 2568 ffflxlf.exe 38 PID 2568 wrote to memory of 2704 2568 ffflxlf.exe 38 PID 2568 wrote to memory of 2704 2568 ffflxlf.exe 38 PID 2568 wrote to memory of 2704 2568 ffflxlf.exe 38 PID 2704 wrote to memory of 2528 2704 5ntntb.exe 39 PID 2704 wrote to memory of 2528 2704 5ntntb.exe 39 PID 2704 wrote to memory of 2528 2704 5ntntb.exe 39 PID 2704 wrote to memory of 2528 2704 5ntntb.exe 39 PID 2528 wrote to memory of 2988 2528 5flxxxf.exe 40 PID 2528 wrote to memory of 2988 2528 5flxxxf.exe 40 PID 2528 wrote to memory of 2988 2528 5flxxxf.exe 40 PID 2528 wrote to memory of 2988 2528 5flxxxf.exe 40 PID 2988 wrote to memory of 1720 2988 bnttbb.exe 41 PID 2988 wrote to memory of 1720 2988 bnttbb.exe 41 PID 2988 wrote to memory of 1720 2988 bnttbb.exe 41 PID 2988 wrote to memory of 1720 2988 bnttbb.exe 41 PID 1720 wrote to memory of 1724 1720 vpjdj.exe 42 PID 1720 wrote to memory of 1724 1720 vpjdj.exe 42 PID 1720 wrote to memory of 1724 1720 vpjdj.exe 42 PID 1720 wrote to memory of 1724 1720 vpjdj.exe 42 PID 1724 wrote to memory of 2064 1724 3fllrxf.exe 43 PID 1724 wrote to memory of 2064 1724 3fllrxf.exe 43 PID 1724 wrote to memory of 2064 1724 3fllrxf.exe 43 PID 1724 wrote to memory of 2064 1724 3fllrxf.exe 43 PID 2064 wrote to memory of 1920 2064 vjdjj.exe 44 PID 2064 wrote to memory of 1920 2064 vjdjj.exe 44 PID 2064 wrote to memory of 1920 2064 vjdjj.exe 44 PID 2064 wrote to memory of 1920 2064 vjdjj.exe 44 PID 1920 wrote to memory of 1508 1920 frfrxff.exe 45 PID 1920 wrote to memory of 1508 1920 frfrxff.exe 45 PID 1920 wrote to memory of 1508 1920 frfrxff.exe 45 PID 1920 wrote to memory of 1508 1920 frfrxff.exe 45 PID 1508 wrote to memory of 2600 1508 7bhbbh.exe 46 PID 1508 wrote to memory of 2600 1508 7bhbbh.exe 46 PID 1508 wrote to memory of 2600 1508 7bhbbh.exe 46 PID 1508 wrote to memory of 2600 1508 7bhbbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe"C:\Users\Admin\AppData\Local\Temp\c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\1hbhnb.exec:\1hbhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\3dpjj.exec:\3dpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\nhhnbb.exec:\nhhnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\fxfxflx.exec:\fxfxflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tnhntt.exec:\tnhntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3pjjj.exec:\3pjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\ffflxlf.exec:\ffflxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\5ntntb.exec:\5ntntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5flxxxf.exec:\5flxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bnttbb.exec:\bnttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vpjdj.exec:\vpjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\3fllrxf.exec:\3fllrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\vjdjj.exec:\vjdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\frfrxff.exec:\frfrxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\7bhbbh.exec:\7bhbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\vpvvp.exec:\vpvvp.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rflrxfl.exec:\rflrxfl.exe18⤵
- Executes dropped EXE
PID:1268 -
\??\c:\7thnbb.exec:\7thnbb.exe19⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9ffrflr.exec:\9ffrflr.exe20⤵
- Executes dropped EXE
PID:2572 -
\??\c:\btnbtn.exec:\btnbtn.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3pjjp.exec:\3pjjp.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jvjpp.exec:\jvjpp.exe23⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7bhhhh.exec:\7bhhhh.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ddvjd.exec:\ddvjd.exe25⤵
- Executes dropped EXE
PID:844 -
\??\c:\frlxxrf.exec:\frlxxrf.exe26⤵
- Executes dropped EXE
PID:936 -
\??\c:\bntnnn.exec:\bntnnn.exe27⤵
- Executes dropped EXE
PID:2292 -
\??\c:\9dddp.exec:\9dddp.exe28⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhthnt.exec:\nhthnt.exe29⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pvjvj.exec:\pvjvj.exe30⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xrlxrfr.exec:\xrlxrfr.exe31⤵
- Executes dropped EXE
PID:1908 -
\??\c:\tntthb.exec:\tntthb.exe32⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dvdjp.exec:\dvdjp.exe33⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5ntttt.exec:\5ntttt.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ppddp.exec:\ppddp.exe35⤵
- Executes dropped EXE
PID:1440 -
\??\c:\5xrrrrf.exec:\5xrrrrf.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llxxrfr.exec:\llxxrfr.exe37⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tnhnbb.exec:\tnhnbb.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bbtnht.exec:\bbtnht.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pddpd.exec:\pddpd.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe41⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhtbhh.exec:\nhtbhh.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5pjpd.exec:\5pjpd.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ppddp.exec:\ppddp.exe45⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3rlrflx.exec:\3rlrflx.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9btbhn.exec:\9btbhn.exe47⤵
- Executes dropped EXE
PID:888 -
\??\c:\hbnntt.exec:\hbnntt.exe48⤵
- Executes dropped EXE
PID:768 -
\??\c:\pdjdd.exec:\pdjdd.exe49⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxfxffl.exec:\fxfxffl.exe50⤵
- Executes dropped EXE
PID:896 -
\??\c:\rlfxrrx.exec:\rlfxrrx.exe51⤵
- Executes dropped EXE
PID:304 -
\??\c:\1nbhtt.exec:\1nbhtt.exe52⤵
- Executes dropped EXE
PID:852 -
\??\c:\5pjjd.exec:\5pjjd.exe53⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fflxxll.exec:\fflxxll.exe54⤵
- Executes dropped EXE
PID:2876 -
\??\c:\frfxfxf.exec:\frfxfxf.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nhtbnt.exec:\nhtbnt.exe56⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3bhntb.exec:\3bhntb.exe57⤵
- Executes dropped EXE
PID:1160 -
\??\c:\pjvdj.exec:\pjvdj.exe58⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lffxlll.exec:\lffxlll.exe59⤵
- Executes dropped EXE
PID:964 -
\??\c:\1frxlrx.exec:\1frxlrx.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3nhhnn.exec:\3nhhnn.exe61⤵
- Executes dropped EXE
PID:288 -
\??\c:\7dpdd.exec:\7dpdd.exe62⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dpdvd.exec:\dpdvd.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\1rrlfxf.exec:\1rrlfxf.exe64⤵
- Executes dropped EXE
PID:1452 -
\??\c:\fxlfllx.exec:\fxlfllx.exe65⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hbhntt.exec:\hbhntt.exe66⤵PID:2960
-
\??\c:\jdjjv.exec:\jdjjv.exe67⤵PID:3032
-
\??\c:\jdvpp.exec:\jdvpp.exe68⤵PID:1784
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe69⤵PID:2080
-
\??\c:\bbtthh.exec:\bbtthh.exe70⤵PID:876
-
\??\c:\nhbnht.exec:\nhbnht.exe71⤵PID:2444
-
\??\c:\5vvdj.exec:\5vvdj.exe72⤵PID:880
-
\??\c:\xlfffxl.exec:\xlfffxl.exe73⤵PID:2616
-
\??\c:\lfllrrx.exec:\lfllrrx.exe74⤵PID:1792
-
\??\c:\hhbtnn.exec:\hhbtnn.exe75⤵PID:2316
-
\??\c:\dvddj.exec:\dvddj.exe76⤵PID:1596
-
\??\c:\jdpdd.exec:\jdpdd.exe77⤵PID:1944
-
\??\c:\9xrlrxx.exec:\9xrlrxx.exe78⤵
- System Location Discovery: System Language Discovery
PID:1808 -
\??\c:\bnnntn.exec:\bnnntn.exe79⤵PID:2748
-
\??\c:\3hbttt.exec:\3hbttt.exe80⤵PID:2736
-
\??\c:\jdpvd.exec:\jdpvd.exe81⤵PID:2664
-
\??\c:\rfllrfl.exec:\rfllrfl.exe82⤵PID:2820
-
\??\c:\rflllfr.exec:\rflllfr.exe83⤵PID:2852
-
\??\c:\ttntbh.exec:\ttntbh.exe84⤵PID:2576
-
\??\c:\dpppd.exec:\dpppd.exe85⤵PID:2724
-
\??\c:\pdppd.exec:\pdppd.exe86⤵PID:2604
-
\??\c:\xrllrxf.exec:\xrllrxf.exe87⤵PID:2288
-
\??\c:\1thtbh.exec:\1thtbh.exe88⤵PID:652
-
\??\c:\nntthh.exec:\nntthh.exe89⤵PID:1392
-
\??\c:\9pddj.exec:\9pddj.exe90⤵PID:1720
-
\??\c:\frfllrx.exec:\frfllrx.exe91⤵PID:1840
-
\??\c:\9frlllr.exec:\9frlllr.exe92⤵PID:896
-
\??\c:\bhhthn.exec:\bhhthn.exe93⤵PID:2020
-
\??\c:\btbbnh.exec:\btbbnh.exe94⤵PID:1524
-
\??\c:\pjpdp.exec:\pjpdp.exe95⤵PID:2768
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe96⤵PID:2864
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe97⤵PID:2092
-
\??\c:\nhbbnn.exec:\nhbbnn.exe98⤵PID:2348
-
\??\c:\5nbbbh.exec:\5nbbbh.exe99⤵PID:2152
-
\??\c:\jdppp.exec:\jdppp.exe100⤵PID:2124
-
\??\c:\1rrxxrl.exec:\1rrxxrl.exe101⤵PID:2160
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe102⤵PID:444
-
\??\c:\ttbhnt.exec:\ttbhnt.exe103⤵PID:2376
-
\??\c:\7jdvd.exec:\7jdvd.exe104⤵PID:1236
-
\??\c:\3vpvp.exec:\3vpvp.exe105⤵PID:316
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe106⤵PID:1732
-
\??\c:\rrlxfrf.exec:\rrlxfrf.exe107⤵PID:2140
-
\??\c:\3ntnbb.exec:\3ntnbb.exe108⤵PID:1500
-
\??\c:\1pvpp.exec:\1pvpp.exe109⤵PID:2956
-
\??\c:\rllrxlr.exec:\rllrxlr.exe110⤵PID:2924
-
\??\c:\lfrlffl.exec:\lfrlffl.exe111⤵PID:2392
-
\??\c:\tnbbhh.exec:\tnbbhh.exe112⤵PID:900
-
\??\c:\hnnbtb.exec:\hnnbtb.exe113⤵PID:2944
-
\??\c:\5dpvj.exec:\5dpvj.exe114⤵PID:2204
-
\??\c:\pdddd.exec:\pdddd.exe115⤵PID:1956
-
\??\c:\lfxxflr.exec:\lfxxflr.exe116⤵PID:2128
-
\??\c:\nnhnht.exec:\nnhnht.exe117⤵PID:2040
-
\??\c:\nbbthh.exec:\nbbthh.exe118⤵PID:2256
-
\??\c:\vjvdd.exec:\vjvdd.exe119⤵PID:1944
-
\??\c:\pdjjv.exec:\pdjjv.exe120⤵PID:1964
-
\??\c:\xllxrxl.exec:\xllxrxl.exe121⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-