Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe
-
Size
454KB
-
MD5
461470b4af3eecdfe0353a10b7114339
-
SHA1
f28906cfbcc6482783b7f3920f033e8127e2893c
-
SHA256
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf
-
SHA512
4cbd68100dd8cde189a3d54fc29eb5381a4df4bc99e7d02f6d00dd0cfbb5aebb7b7934e690f75302696e4493943769b2be418c90bedac2405d8c45e1b698c3e0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-53-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2908-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-436-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-525-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-558-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-640-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-806-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-805-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-850-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-883-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2752-882-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2708-898-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-916-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1568 7hhnhb.exe 2172 vvjpv.exe 2496 bbtbtt.exe 2680 3vpdj.exe 2788 xxrrfrl.exe 2744 hbtthh.exe 2888 nbttnn.exe 2908 pjvvj.exe 2792 9lflfll.exe 1860 bnhbtt.exe 2100 ppvjd.exe 1924 lxllrrf.exe 2012 bnbhtb.exe 1704 vvjdd.exe 1640 1lxrxff.exe 1816 fxllrrr.exe 1920 xrrfrxl.exe 1836 thbbnt.exe 2764 lrffrxx.exe 2268 hbnnbb.exe 2156 dpjpd.exe 944 xrffllr.exe 3020 lxxflrf.exe 828 bbthtn.exe 1448 rrrlrlf.exe 2556 bbbtbb.exe 3044 9fxlffx.exe 356 vjppv.exe 1696 rfxlxfr.exe 1932 nhthbh.exe 2344 1vppd.exe 1484 frxfrrf.exe 2996 pjpvv.exe 2172 vppjp.exe 2900 7fxrflx.exe 2696 nbnnbb.exe 2880 rxrfllx.exe 2884 7rffxxf.exe 1108 hhbhhh.exe 2776 7pvvd.exe 948 1xllflr.exe 2596 3thnbt.exe 2708 nnnnth.exe 2628 ppjvd.exe 2100 pvvdj.exe 2848 rxfrlrl.exe 2360 nhnnnb.exe 2012 nhthbt.exe 2916 jjvpv.exe 1708 llflfrx.exe 1640 7fxxxxf.exe 2484 1ttbhn.exe 1456 1jdjj.exe 1920 vdvdj.exe 2956 fllxrrl.exe 2904 1bnbnt.exe 2192 5jvdd.exe 1192 3vppp.exe 2184 llxxlll.exe 1528 hnnbhn.exe 1604 5pddp.exe 1160 pdvjd.exe 1680 lllxxxl.exe 1448 hnbhtb.exe -
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-52-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2908-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-882-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2100-916-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2572-918-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1568 2528 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 30 PID 2528 wrote to memory of 1568 2528 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 30 PID 2528 wrote to memory of 1568 2528 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 30 PID 2528 wrote to memory of 1568 2528 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 30 PID 1568 wrote to memory of 2172 1568 7hhnhb.exe 31 PID 1568 wrote to memory of 2172 1568 7hhnhb.exe 31 PID 1568 wrote to memory of 2172 1568 7hhnhb.exe 31 PID 1568 wrote to memory of 2172 1568 7hhnhb.exe 31 PID 2172 wrote to memory of 2496 2172 vvjpv.exe 32 PID 2172 wrote to memory of 2496 2172 vvjpv.exe 32 PID 2172 wrote to memory of 2496 2172 vvjpv.exe 32 PID 2172 wrote to memory of 2496 2172 vvjpv.exe 32 PID 2496 wrote to memory of 2680 2496 bbtbtt.exe 33 PID 2496 wrote to memory of 2680 2496 bbtbtt.exe 33 PID 2496 wrote to memory of 2680 2496 bbtbtt.exe 33 PID 2496 wrote to memory of 2680 2496 bbtbtt.exe 33 PID 2680 wrote to memory of 2788 2680 3vpdj.exe 34 PID 2680 wrote to memory of 2788 2680 3vpdj.exe 34 PID 2680 wrote to memory of 2788 2680 3vpdj.exe 34 PID 2680 wrote to memory of 2788 2680 3vpdj.exe 34 PID 2788 wrote to memory of 2744 2788 xxrrfrl.exe 35 PID 2788 wrote to memory of 2744 2788 xxrrfrl.exe 35 PID 2788 wrote to memory of 2744 2788 xxrrfrl.exe 35 PID 2788 wrote to memory of 2744 2788 xxrrfrl.exe 35 PID 2744 wrote to memory of 2888 2744 hbtthh.exe 37 PID 2744 wrote to memory of 2888 2744 hbtthh.exe 37 PID 2744 wrote to memory of 2888 2744 hbtthh.exe 37 PID 2744 wrote to memory of 2888 2744 hbtthh.exe 37 PID 2888 wrote to memory of 2908 2888 nbttnn.exe 38 PID 2888 wrote to memory of 2908 2888 nbttnn.exe 38 PID 2888 wrote to memory of 2908 2888 nbttnn.exe 38 PID 2888 wrote to memory of 2908 2888 nbttnn.exe 38 PID 2908 wrote to memory of 2792 2908 pjvvj.exe 39 PID 2908 wrote to memory of 2792 2908 pjvvj.exe 39 PID 2908 wrote to memory of 2792 2908 pjvvj.exe 39 PID 2908 wrote to memory of 2792 2908 pjvvj.exe 39 PID 2792 wrote to memory of 1860 2792 9lflfll.exe 40 PID 2792 wrote to memory of 1860 2792 9lflfll.exe 40 PID 2792 wrote to memory of 1860 2792 9lflfll.exe 40 PID 2792 wrote to memory of 1860 2792 9lflfll.exe 40 PID 1860 wrote to memory of 2100 1860 bnhbtt.exe 41 PID 1860 wrote to memory of 2100 1860 bnhbtt.exe 41 PID 1860 wrote to memory of 2100 1860 bnhbtt.exe 41 PID 1860 wrote to memory of 2100 1860 bnhbtt.exe 41 PID 2100 wrote to memory of 1924 2100 ppvjd.exe 42 PID 2100 wrote to memory of 1924 2100 ppvjd.exe 42 PID 2100 wrote to memory of 1924 2100 ppvjd.exe 42 PID 2100 wrote to memory of 1924 2100 ppvjd.exe 42 PID 1924 wrote to memory of 2012 1924 lxllrrf.exe 43 PID 1924 wrote to memory of 2012 1924 lxllrrf.exe 43 PID 1924 wrote to memory of 2012 1924 lxllrrf.exe 43 PID 1924 wrote to memory of 2012 1924 lxllrrf.exe 43 PID 2012 wrote to memory of 1704 2012 bnbhtb.exe 44 PID 2012 wrote to memory of 1704 2012 bnbhtb.exe 44 PID 2012 wrote to memory of 1704 2012 bnbhtb.exe 44 PID 2012 wrote to memory of 1704 2012 bnbhtb.exe 44 PID 1704 wrote to memory of 1640 1704 vvjdd.exe 45 PID 1704 wrote to memory of 1640 1704 vvjdd.exe 45 PID 1704 wrote to memory of 1640 1704 vvjdd.exe 45 PID 1704 wrote to memory of 1640 1704 vvjdd.exe 45 PID 1640 wrote to memory of 1816 1640 1lxrxff.exe 46 PID 1640 wrote to memory of 1816 1640 1lxrxff.exe 46 PID 1640 wrote to memory of 1816 1640 1lxrxff.exe 46 PID 1640 wrote to memory of 1816 1640 1lxrxff.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe"C:\Users\Admin\AppData\Local\Temp\f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\7hhnhb.exec:\7hhnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\vvjpv.exec:\vvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\bbtbtt.exec:\bbtbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\3vpdj.exec:\3vpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xxrrfrl.exec:\xxrrfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hbtthh.exec:\hbtthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\nbttnn.exec:\nbttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\pjvvj.exec:\pjvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\9lflfll.exec:\9lflfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bnhbtt.exec:\bnhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\ppvjd.exec:\ppvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\lxllrrf.exec:\lxllrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\bnbhtb.exec:\bnbhtb.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vvjdd.exec:\vvjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\1lxrxff.exec:\1lxrxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\fxllrrr.exec:\fxllrrr.exe17⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\thbbnt.exec:\thbbnt.exe19⤵
- Executes dropped EXE
PID:1836 -
\??\c:\lrffrxx.exec:\lrffrxx.exe20⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hbnnbb.exec:\hbnnbb.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dpjpd.exec:\dpjpd.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrffllr.exec:\xrffllr.exe23⤵
- Executes dropped EXE
PID:944 -
\??\c:\lxxflrf.exec:\lxxflrf.exe24⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bbthtn.exec:\bbthtn.exe25⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrrlrlf.exec:\rrrlrlf.exe26⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bbbtbb.exec:\bbbtbb.exe27⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9fxlffx.exec:\9fxlffx.exe28⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vjppv.exec:\vjppv.exe29⤵
- Executes dropped EXE
PID:356 -
\??\c:\rfxlxfr.exec:\rfxlxfr.exe30⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nhthbh.exec:\nhthbh.exe31⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1vppd.exec:\1vppd.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\frxfrrf.exec:\frxfrrf.exe33⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pjpvv.exec:\pjpvv.exe34⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vppjp.exec:\vppjp.exe35⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7fxrflx.exec:\7fxrflx.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nbnnbb.exec:\nbnnbb.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rxrfllx.exec:\rxrfllx.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7rffxxf.exec:\7rffxxf.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hhbhhh.exec:\hhbhhh.exe40⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7pvvd.exec:\7pvvd.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1xllflr.exec:\1xllflr.exe42⤵
- Executes dropped EXE
PID:948 -
\??\c:\3thnbt.exec:\3thnbt.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nnnnth.exec:\nnnnth.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ppjvd.exec:\ppjvd.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pvvdj.exec:\pvvdj.exe46⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nhnnnb.exec:\nhnnnb.exe48⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nhthbt.exec:\nhthbt.exe49⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jjvpv.exec:\jjvpv.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\llflfrx.exec:\llflfrx.exe51⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7fxxxxf.exec:\7fxxxxf.exe52⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1ttbhn.exec:\1ttbhn.exe53⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1jdjj.exec:\1jdjj.exe54⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vdvdj.exec:\vdvdj.exe55⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fllxrrl.exec:\fllxrrl.exe56⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1bnbnt.exec:\1bnbnt.exe57⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5jvdd.exec:\5jvdd.exe58⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3vppp.exec:\3vppp.exe59⤵
- Executes dropped EXE
PID:1192 -
\??\c:\llxxlll.exec:\llxxlll.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hnnbhn.exec:\hnnbhn.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5pddp.exec:\5pddp.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pdvjd.exec:\pdvjd.exe63⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lllxxxl.exec:\lllxxxl.exe64⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hnbhtb.exec:\hnbhtb.exe65⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ntnbnb.exec:\ntnbnb.exe66⤵PID:564
-
\??\c:\ppdjv.exec:\ppdjv.exe67⤵PID:2364
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe68⤵PID:3044
-
\??\c:\9nbtnt.exec:\9nbtnt.exe69⤵PID:1284
-
\??\c:\tnnbbb.exec:\tnnbbb.exe70⤵PID:324
-
\??\c:\7vjpd.exec:\7vjpd.exe71⤵PID:2296
-
\??\c:\1rllxfr.exec:\1rllxfr.exe72⤵PID:2544
-
\??\c:\5nbhhn.exec:\5nbhhn.exe73⤵PID:1628
-
\??\c:\bhthhn.exec:\bhthhn.exe74⤵PID:1928
-
\??\c:\9dvdp.exec:\9dvdp.exe75⤵PID:680
-
\??\c:\rrrxflf.exec:\rrrxflf.exe76⤵
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\nbhnnb.exec:\nbhnnb.exe77⤵PID:2504
-
\??\c:\bbbnhn.exec:\bbbnhn.exe78⤵PID:2256
-
\??\c:\1jdjp.exec:\1jdjp.exe79⤵PID:2784
-
\??\c:\5rxxflr.exec:\5rxxflr.exe80⤵PID:2692
-
\??\c:\nnnttb.exec:\nnnttb.exe81⤵PID:2892
-
\??\c:\3nbbnt.exec:\3nbbnt.exe82⤵PID:2444
-
\??\c:\9pddd.exec:\9pddd.exe83⤵PID:2836
-
\??\c:\lfrflxf.exec:\lfrflxf.exe84⤵PID:2756
-
\??\c:\llfllxl.exec:\llfllxl.exe85⤵PID:2664
-
\??\c:\nhhthn.exec:\nhhthn.exe86⤵PID:2628
-
\??\c:\9pjjv.exec:\9pjjv.exe87⤵PID:2100
-
\??\c:\fxlxffr.exec:\fxlxffr.exe88⤵PID:2932
-
\??\c:\llxxxxl.exec:\llxxxxl.exe89⤵PID:1648
-
\??\c:\hbbhnb.exec:\hbbhnb.exe90⤵PID:2016
-
\??\c:\vpjpp.exec:\vpjpp.exe91⤵PID:2164
-
\??\c:\7ddjj.exec:\7ddjj.exe92⤵PID:1388
-
\??\c:\xxxxrfr.exec:\xxxxrfr.exe93⤵PID:1892
-
\??\c:\nhtbnn.exec:\nhtbnn.exe94⤵PID:1556
-
\??\c:\hhbhnt.exec:\hhbhnt.exe95⤵PID:2928
-
\??\c:\3djjp.exec:\3djjp.exe96⤵PID:2944
-
\??\c:\rlrxllr.exec:\rlrxllr.exe97⤵PID:2964
-
\??\c:\llfrfrf.exec:\llfrfrf.exe98⤵PID:2180
-
\??\c:\3nbbnt.exec:\3nbbnt.exe99⤵PID:2152
-
\??\c:\5dvvj.exec:\5dvvj.exe100⤵PID:3064
-
\??\c:\5vjpd.exec:\5vjpd.exe101⤵PID:1224
-
\??\c:\rrllxfr.exec:\rrllxfr.exe102⤵PID:1900
-
\??\c:\nnnbtt.exec:\nnnbtt.exe103⤵PID:1604
-
\??\c:\vvvjv.exec:\vvvjv.exe104⤵PID:1160
-
\??\c:\jdvpv.exec:\jdvpv.exe105⤵PID:1652
-
\??\c:\llflxfr.exec:\llflxfr.exe106⤵PID:3028
-
\??\c:\btnbtt.exec:\btnbtt.exe107⤵PID:2952
-
\??\c:\7nhhth.exec:\7nhhth.exe108⤵PID:2308
-
\??\c:\7vppv.exec:\7vppv.exe109⤵PID:2264
-
\??\c:\rxlfrrf.exec:\rxlfrrf.exe110⤵PID:1696
-
\??\c:\1htbhn.exec:\1htbhn.exe111⤵PID:2424
-
\??\c:\ddpvj.exec:\ddpvj.exe112⤵PID:1508
-
\??\c:\vpvjd.exec:\vpvjd.exe113⤵PID:332
-
\??\c:\7ffrrfl.exec:\7ffrrfl.exe114⤵PID:1576
-
\??\c:\hhtbtt.exec:\hhtbtt.exe115⤵PID:2332
-
\??\c:\3vdjj.exec:\3vdjj.exe116⤵PID:2532
-
\??\c:\xfxfxfl.exec:\xfxfxfl.exe117⤵PID:2696
-
\??\c:\bbthtt.exec:\bbthtt.exe118⤵PID:2736
-
\??\c:\hbnnhb.exec:\hbnnhb.exe119⤵PID:2784
-
\??\c:\jdjvp.exec:\jdjvp.exe120⤵PID:2692
-
\??\c:\bbnnbh.exec:\bbnnbh.exe121⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-