Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe
-
Size
454KB
-
MD5
5d80e0916250699c9572dc276cadb2dc
-
SHA1
5e499c67c80b7081ff719d4cb18c19ad1bf20107
-
SHA256
5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124
-
SHA512
b35714c6a00da3ee68028e112c964468ac2cf5e8b7ef16ee9239f61af266dc17e1c987d17fea223712456ee10f091509cf5de53d72feb45141b035181f50d297
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-70-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-112-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2652-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1828-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-234-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2064-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-342-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1648-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-656-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2612-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-831-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-878-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-1211-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-1257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-1265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-1320-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2004-1339-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2912 nhbntt.exe 2032 nbntht.exe 2564 nbbtnt.exe 2796 jvdpd.exe 2060 3thbbb.exe 2044 dvjjv.exe 2772 djjpv.exe 3048 vpdjp.exe 2752 hbntbh.exe 2764 3fxrxlf.exe 2572 nhtbtb.exe 2652 vdppj.exe 2504 vpdjv.exe 2532 nbnnnn.exe 1876 ttnbhn.exe 1772 xflrxlx.exe 2028 nhhhtt.exe 752 jvppv.exe 1804 thbhhh.exe 1828 bbnnhn.exe 2524 bntbbb.exe 2184 7xlxxxl.exe 2716 bthhtb.exe 1840 lxxlrrx.exe 1076 htntbb.exe 1764 rlxxlrr.exe 600 3frxfff.exe 1328 5pjpv.exe 2064 3xrrfll.exe 2276 9pjpd.exe 2964 vpddp.exe 3016 9bhhnt.exe 3020 3jpjj.exe 2844 rlffxxf.exe 2868 htbhtt.exe 2000 9vjdj.exe 1588 xxrfllx.exe 2432 rrflrrx.exe 2848 hthhnn.exe 2364 jvjdj.exe 2168 pjpjv.exe 2080 rfxrrrf.exe 2356 9tnthn.exe 2044 3pdvv.exe 2896 dpvdp.exe 2688 lfrxflf.exe 2816 bbtbnn.exe 2696 pjjdd.exe 2672 dpdpv.exe 2920 fxrxxfr.exe 2720 hthtnt.exe 2484 bnhntt.exe 2604 3vpvv.exe 2504 frllrrx.exe 1380 hnhtnn.exe 1028 1tbhtt.exe 2452 pjdjv.exe 2424 fllrlxf.exe 1776 nhttnh.exe 1936 hhhnbb.exe 1812 dvpvv.exe 1804 5rffrrl.exe 2472 1btbtn.exe 2304 7pdjp.exe -
resource yara_rule behavioral1/memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-250-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2064-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-335-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2168-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-1036-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2772-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-1257-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2912 2868 5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe 28 PID 2868 wrote to memory of 2912 2868 5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe 28 PID 2868 wrote to memory of 2912 2868 5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe 28 PID 2868 wrote to memory of 2912 2868 5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe 28 PID 2912 wrote to memory of 2032 2912 nhbntt.exe 29 PID 2912 wrote to memory of 2032 2912 nhbntt.exe 29 PID 2912 wrote to memory of 2032 2912 nhbntt.exe 29 PID 2912 wrote to memory of 2032 2912 nhbntt.exe 29 PID 2032 wrote to memory of 2564 2032 nbntht.exe 30 PID 2032 wrote to memory of 2564 2032 nbntht.exe 30 PID 2032 wrote to memory of 2564 2032 nbntht.exe 30 PID 2032 wrote to memory of 2564 2032 nbntht.exe 30 PID 2564 wrote to memory of 2796 2564 nbbtnt.exe 31 PID 2564 wrote to memory of 2796 2564 nbbtnt.exe 31 PID 2564 wrote to memory of 2796 2564 nbbtnt.exe 31 PID 2564 wrote to memory of 2796 2564 nbbtnt.exe 31 PID 2796 wrote to memory of 2060 2796 jvdpd.exe 32 PID 2796 wrote to memory of 2060 2796 jvdpd.exe 32 PID 2796 wrote to memory of 2060 2796 jvdpd.exe 32 PID 2796 wrote to memory of 2060 2796 jvdpd.exe 32 PID 2060 wrote to memory of 2044 2060 3thbbb.exe 33 PID 2060 wrote to memory of 2044 2060 3thbbb.exe 33 PID 2060 wrote to memory of 2044 2060 3thbbb.exe 33 PID 2060 wrote to memory of 2044 2060 3thbbb.exe 33 PID 2044 wrote to memory of 2772 2044 dvjjv.exe 34 PID 2044 wrote to memory of 2772 2044 dvjjv.exe 34 PID 2044 wrote to memory of 2772 2044 dvjjv.exe 34 PID 2044 wrote to memory of 2772 2044 dvjjv.exe 34 PID 2772 wrote to memory of 3048 2772 djjpv.exe 35 PID 2772 wrote to memory of 3048 2772 djjpv.exe 35 PID 2772 wrote to memory of 3048 2772 djjpv.exe 35 PID 2772 wrote to memory of 3048 2772 djjpv.exe 35 PID 3048 wrote to memory of 2752 3048 vpdjp.exe 36 PID 3048 wrote to memory of 2752 3048 vpdjp.exe 36 PID 3048 wrote to memory of 2752 3048 vpdjp.exe 36 PID 3048 wrote to memory of 2752 3048 vpdjp.exe 36 PID 2752 wrote to memory of 2764 2752 hbntbh.exe 37 PID 2752 wrote to memory of 2764 2752 hbntbh.exe 37 PID 2752 wrote to memory of 2764 2752 hbntbh.exe 37 PID 2752 wrote to memory of 2764 2752 hbntbh.exe 37 PID 2764 wrote to memory of 2572 2764 3fxrxlf.exe 38 PID 2764 wrote to memory of 2572 2764 3fxrxlf.exe 38 PID 2764 wrote to memory of 2572 2764 3fxrxlf.exe 38 PID 2764 wrote to memory of 2572 2764 3fxrxlf.exe 38 PID 2572 wrote to memory of 2652 2572 nhtbtb.exe 39 PID 2572 wrote to memory of 2652 2572 nhtbtb.exe 39 PID 2572 wrote to memory of 2652 2572 nhtbtb.exe 39 PID 2572 wrote to memory of 2652 2572 nhtbtb.exe 39 PID 2652 wrote to memory of 2504 2652 vdppj.exe 40 PID 2652 wrote to memory of 2504 2652 vdppj.exe 40 PID 2652 wrote to memory of 2504 2652 vdppj.exe 40 PID 2652 wrote to memory of 2504 2652 vdppj.exe 40 PID 2504 wrote to memory of 2532 2504 vpdjv.exe 41 PID 2504 wrote to memory of 2532 2504 vpdjv.exe 41 PID 2504 wrote to memory of 2532 2504 vpdjv.exe 41 PID 2504 wrote to memory of 2532 2504 vpdjv.exe 41 PID 2532 wrote to memory of 1876 2532 nbnnnn.exe 42 PID 2532 wrote to memory of 1876 2532 nbnnnn.exe 42 PID 2532 wrote to memory of 1876 2532 nbnnnn.exe 42 PID 2532 wrote to memory of 1876 2532 nbnnnn.exe 42 PID 1876 wrote to memory of 1772 1876 ttnbhn.exe 43 PID 1876 wrote to memory of 1772 1876 ttnbhn.exe 43 PID 1876 wrote to memory of 1772 1876 ttnbhn.exe 43 PID 1876 wrote to memory of 1772 1876 ttnbhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe"C:\Users\Admin\AppData\Local\Temp\5d205650edfd504b73dc63661a74fc622102a0f20086324d9bca20406be7d124.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\nhbntt.exec:\nhbntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nbntht.exec:\nbntht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\nbbtnt.exec:\nbbtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jvdpd.exec:\jvdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3thbbb.exec:\3thbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\dvjjv.exec:\dvjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\djjpv.exec:\djjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vpdjp.exec:\vpdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hbntbh.exec:\hbntbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3fxrxlf.exec:\3fxrxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nhtbtb.exec:\nhtbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\vdppj.exec:\vdppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpdjv.exec:\vpdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\nbnnnn.exec:\nbnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ttnbhn.exec:\ttnbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\xflrxlx.exec:\xflrxlx.exe17⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nhhhtt.exec:\nhhhtt.exe18⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jvppv.exec:\jvppv.exe19⤵
- Executes dropped EXE
PID:752 -
\??\c:\thbhhh.exec:\thbhhh.exe20⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bbnnhn.exec:\bbnnhn.exe21⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bntbbb.exec:\bntbbb.exe22⤵
- Executes dropped EXE
PID:2524 -
\??\c:\7xlxxxl.exec:\7xlxxxl.exe23⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bthhtb.exec:\bthhtb.exe24⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lxxlrrx.exec:\lxxlrrx.exe25⤵
- Executes dropped EXE
PID:1840 -
\??\c:\htntbb.exec:\htntbb.exe26⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rlxxlrr.exec:\rlxxlrr.exe27⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3frxfff.exec:\3frxfff.exe28⤵
- Executes dropped EXE
PID:600 -
\??\c:\5pjpv.exec:\5pjpv.exe29⤵
- Executes dropped EXE
PID:1328 -
\??\c:\3xrrfll.exec:\3xrrfll.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9pjpd.exec:\9pjpd.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vpddp.exec:\vpddp.exe32⤵
- Executes dropped EXE
PID:2964 -
\??\c:\9bhhnt.exec:\9bhhnt.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3jpjj.exec:\3jpjj.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rlffxxf.exec:\rlffxxf.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\htbhtt.exec:\htbhtt.exe36⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9vjdj.exec:\9vjdj.exe37⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xxrfllx.exec:\xxrfllx.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rrflrrx.exec:\rrflrrx.exe39⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hthhnn.exec:\hthhnn.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jvjdj.exec:\jvjdj.exe41⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pjpjv.exec:\pjpjv.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2168 -
\??\c:\rfxrrrf.exec:\rfxrrrf.exe43⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9tnthn.exec:\9tnthn.exe44⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3pdvv.exec:\3pdvv.exe45⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dpvdp.exec:\dpvdp.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lfrxflf.exec:\lfrxflf.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bbtbnn.exec:\bbtbnn.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pjjdd.exec:\pjjdd.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dpdpv.exec:\dpdpv.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\fxrxxfr.exec:\fxrxxfr.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hthtnt.exec:\hthtnt.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bnhntt.exec:\bnhntt.exe53⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3vpvv.exec:\3vpvv.exe54⤵
- Executes dropped EXE
PID:2604 -
\??\c:\frllrrx.exec:\frllrrx.exe55⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hnhtnn.exec:\hnhtnn.exe56⤵
- Executes dropped EXE
PID:1380 -
\??\c:\1tbhtt.exec:\1tbhtt.exe57⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pjdjv.exec:\pjdjv.exe58⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fllrlxf.exec:\fllrlxf.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nhttnh.exec:\nhttnh.exe60⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hhhnbb.exec:\hhhnbb.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dvpvv.exec:\dvpvv.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812 -
\??\c:\5rffrrl.exec:\5rffrrl.exe63⤵
- Executes dropped EXE
PID:1804 -
\??\c:\1btbtn.exec:\1btbtn.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7pdjp.exec:\7pdjp.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fxrrllf.exec:\fxrrllf.exe66⤵PID:2128
-
\??\c:\rrlrrrf.exec:\rrlrrrf.exe67⤵PID:1052
-
\??\c:\tbbhtb.exec:\tbbhtb.exe68⤵PID:2716
-
\??\c:\vvvdp.exec:\vvvdp.exe69⤵PID:2456
-
\??\c:\vpdjp.exec:\vpdjp.exe70⤵PID:544
-
\??\c:\lllrlrf.exec:\lllrlrf.exe71⤵PID:1348
-
\??\c:\tbthbh.exec:\tbthbh.exe72⤵PID:2132
-
\??\c:\9hhhtb.exec:\9hhhtb.exe73⤵PID:1800
-
\??\c:\ddpvj.exec:\ddpvj.exe74⤵PID:3024
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe75⤵PID:1528
-
\??\c:\bthntt.exec:\bthntt.exe76⤵PID:2064
-
\??\c:\3tbnbb.exec:\3tbnbb.exe77⤵PID:3040
-
\??\c:\9pjvj.exec:\9pjvj.exe78⤵PID:272
-
\??\c:\lrflflr.exec:\lrflflr.exe79⤵PID:1540
-
\??\c:\tbttbb.exec:\tbttbb.exe80⤵PID:1628
-
\??\c:\ppjdj.exec:\ppjdj.exe81⤵PID:2208
-
\??\c:\9pjjj.exec:\9pjjj.exe82⤵PID:492
-
\??\c:\xxffllr.exec:\xxffllr.exe83⤵PID:1584
-
\??\c:\ttbttb.exec:\ttbttb.exe84⤵PID:1648
-
\??\c:\hbbhtt.exec:\hbbhtt.exe85⤵PID:2300
-
\??\c:\dpjjv.exec:\dpjjv.exe86⤵PID:1748
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe87⤵PID:2072
-
\??\c:\1rxrrrx.exec:\1rxrrrx.exe88⤵PID:304
-
\??\c:\btbbbh.exec:\btbbbh.exe89⤵
- System Location Discovery: System Language Discovery
PID:1752 -
\??\c:\9jvvj.exec:\9jvvj.exe90⤵PID:2060
-
\??\c:\9llxflx.exec:\9llxflx.exe91⤵PID:2612
-
\??\c:\rlfxffl.exec:\rlfxffl.exe92⤵PID:2948
-
\??\c:\hbtthh.exec:\hbtthh.exe93⤵PID:2708
-
\??\c:\9dvdj.exec:\9dvdj.exe94⤵PID:2688
-
\??\c:\jdddp.exec:\jdddp.exe95⤵
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\xrlxflx.exec:\xrlxflx.exe96⤵PID:2756
-
\??\c:\1nbtbb.exec:\1nbtbb.exe97⤵PID:2764
-
\??\c:\3tthbh.exec:\3tthbh.exe98⤵PID:2920
-
\??\c:\pdpvd.exec:\pdpvd.exe99⤵PID:2720
-
\??\c:\xfflrfr.exec:\xfflrfr.exe100⤵PID:2496
-
\??\c:\xxffllr.exec:\xxffllr.exe101⤵PID:2264
-
\??\c:\hnhbtn.exec:\hnhbtn.exe102⤵PID:2504
-
\??\c:\pjvdd.exec:\pjvdd.exe103⤵PID:1568
-
\??\c:\7fxfrfr.exec:\7fxfrfr.exe104⤵PID:776
-
\??\c:\rlxxxfr.exec:\rlxxxfr.exe105⤵PID:1940
-
\??\c:\btnnbh.exec:\btnnbh.exe106⤵PID:2396
-
\??\c:\ppjvd.exec:\ppjvd.exe107⤵PID:2416
-
\??\c:\vppvp.exec:\vppvp.exe108⤵PID:1284
-
\??\c:\fxlrflx.exec:\fxlrflx.exe109⤵PID:1844
-
\??\c:\bthbnn.exec:\bthbnn.exe110⤵PID:1852
-
\??\c:\3pjpv.exec:\3pjpv.exe111⤵PID:2780
-
\??\c:\jpjvp.exec:\jpjvp.exe112⤵PID:2212
-
\??\c:\7flrflx.exec:\7flrflx.exe113⤵PID:1220
-
\??\c:\bthnbh.exec:\bthnbh.exe114⤵PID:1632
-
\??\c:\hhhnnn.exec:\hhhnnn.exe115⤵PID:1080
-
\??\c:\vpddv.exec:\vpddv.exe116⤵PID:832
-
\??\c:\rlfflrx.exec:\rlfflrx.exe117⤵PID:944
-
\??\c:\nnhnbb.exec:\nnhnbb.exe118⤵PID:1140
-
\??\c:\nhhnbb.exec:\nhhnbb.exe119⤵PID:1348
-
\??\c:\jvvdv.exec:\jvvdv.exe120⤵PID:600
-
\??\c:\lffrlfr.exec:\lffrlfr.exe121⤵PID:1116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-