Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe
-
Size
337KB
-
MD5
a3192e9f1b5dd3cfd8cd7255e8b5850a
-
SHA1
07021ab656ef98a8d5d39346050c4b5084d6c217
-
SHA256
714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087
-
SHA512
54ea232b7d04840298af2c5a1543ece6355f905cfc7042d89aaabe7de05bd2f1e2a036dbdf381fbf3008188431f21c7bad8c907cb00be1bc5ed4156ed98cc4f6
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhk:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-63-0x0000000001B60000-0x0000000001B8A000-memory.dmp family_blackmoon behavioral1/memory/2688-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/448-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-230-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/780-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-325-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-352-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2568-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-461-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1896-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-669-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2828-930-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-945-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2400-1061-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/884-1137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1156 xlfflfr.exe 1268 7hhnhn.exe 3052 jpjpd.exe 1244 3vppp.exe 2676 tnbntn.exe 2688 pdddp.exe 2992 ffrxllx.exe 2568 jjdjp.exe 2280 frlrxfr.exe 2528 hbbbtt.exe 1864 3djpv.exe 2180 rlxrlfl.exe 1328 vvppv.exe 2884 lfxrrrx.exe 2504 bntbth.exe 848 pppjj.exe 2756 nhbbnn.exe 1372 dpppv.exe 1704 7lrrxxx.exe 2188 btbhtt.exe 2064 vjvdd.exe 448 xlxxxfr.exe 1932 vvdvv.exe 780 lxlllxf.exe 1580 9hnntt.exe 108 jjdpv.exe 1596 lllxrlx.exe 1496 pjddv.exe 1052 xrlrxlf.exe 2128 nthnnb.exe 2232 pdpvp.exe 1392 fxrfrxl.exe 2440 nhhnnb.exe 1548 dpjpj.exe 1268 9xlrrxx.exe 2012 xxfllrx.exe 1660 nnnnbn.exe 3040 jdpdp.exe 2740 jvjvd.exe 1852 xrlxflx.exe 2664 9nnnth.exe 2112 5tntbn.exe 2752 dvdjp.exe 2568 rrlfxfr.exe 2280 xrrfrrf.exe 2596 nhttnt.exe 2224 ddvvj.exe 2004 xrxrrfr.exe 2776 rlxlxfr.exe 1328 tnbbnb.exe 2940 vpjdv.exe 2924 ffxfllx.exe 2716 xxrxrxr.exe 2764 7hbhnb.exe 1976 pjvpd.exe 1736 rrlrlxl.exe 2956 xrxfrxl.exe 2968 nnhhhn.exe 1896 ddvjv.exe 2384 jddjd.exe 3068 7xxfrrf.exe 2056 btnbnt.exe 3060 ttnbhn.exe 288 jdvvd.exe -
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-514-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1276-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-1099-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1156 2336 714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe 30 PID 2336 wrote to memory of 1156 2336 714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe 30 PID 2336 wrote to memory of 1156 2336 714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe 30 PID 2336 wrote to memory of 1156 2336 714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe 30 PID 1156 wrote to memory of 1268 1156 xlfflfr.exe 31 PID 1156 wrote to memory of 1268 1156 xlfflfr.exe 31 PID 1156 wrote to memory of 1268 1156 xlfflfr.exe 31 PID 1156 wrote to memory of 1268 1156 xlfflfr.exe 31 PID 1268 wrote to memory of 3052 1268 7hhnhn.exe 32 PID 1268 wrote to memory of 3052 1268 7hhnhn.exe 32 PID 1268 wrote to memory of 3052 1268 7hhnhn.exe 32 PID 1268 wrote to memory of 3052 1268 7hhnhn.exe 32 PID 3052 wrote to memory of 1244 3052 jpjpd.exe 33 PID 3052 wrote to memory of 1244 3052 jpjpd.exe 33 PID 3052 wrote to memory of 1244 3052 jpjpd.exe 33 PID 3052 wrote to memory of 1244 3052 jpjpd.exe 33 PID 1244 wrote to memory of 2676 1244 3vppp.exe 34 PID 1244 wrote to memory of 2676 1244 3vppp.exe 34 PID 1244 wrote to memory of 2676 1244 3vppp.exe 34 PID 1244 wrote to memory of 2676 1244 3vppp.exe 34 PID 2676 wrote to memory of 2688 2676 tnbntn.exe 35 PID 2676 wrote to memory of 2688 2676 tnbntn.exe 35 PID 2676 wrote to memory of 2688 2676 tnbntn.exe 35 PID 2676 wrote to memory of 2688 2676 tnbntn.exe 35 PID 2688 wrote to memory of 2992 2688 pdddp.exe 36 PID 2688 wrote to memory of 2992 2688 pdddp.exe 36 PID 2688 wrote to memory of 2992 2688 pdddp.exe 36 PID 2688 wrote to memory of 2992 2688 pdddp.exe 36 PID 2992 wrote to memory of 2568 2992 ffrxllx.exe 37 PID 2992 wrote to memory of 2568 2992 ffrxllx.exe 37 PID 2992 wrote to memory of 2568 2992 ffrxllx.exe 37 PID 2992 wrote to memory of 2568 2992 ffrxllx.exe 37 PID 2568 wrote to memory of 2280 2568 jjdjp.exe 38 PID 2568 wrote to memory of 2280 2568 jjdjp.exe 38 PID 2568 wrote to memory of 2280 2568 jjdjp.exe 38 PID 2568 wrote to memory of 2280 2568 jjdjp.exe 38 PID 2280 wrote to memory of 2528 2280 frlrxfr.exe 39 PID 2280 wrote to memory of 2528 2280 frlrxfr.exe 39 PID 2280 wrote to memory of 2528 2280 frlrxfr.exe 39 PID 2280 wrote to memory of 2528 2280 frlrxfr.exe 39 PID 2528 wrote to memory of 1864 2528 hbbbtt.exe 40 PID 2528 wrote to memory of 1864 2528 hbbbtt.exe 40 PID 2528 wrote to memory of 1864 2528 hbbbtt.exe 40 PID 2528 wrote to memory of 1864 2528 hbbbtt.exe 40 PID 1864 wrote to memory of 2180 1864 3djpv.exe 41 PID 1864 wrote to memory of 2180 1864 3djpv.exe 41 PID 1864 wrote to memory of 2180 1864 3djpv.exe 41 PID 1864 wrote to memory of 2180 1864 3djpv.exe 41 PID 2180 wrote to memory of 1328 2180 rlxrlfl.exe 42 PID 2180 wrote to memory of 1328 2180 rlxrlfl.exe 42 PID 2180 wrote to memory of 1328 2180 rlxrlfl.exe 42 PID 2180 wrote to memory of 1328 2180 rlxrlfl.exe 42 PID 1328 wrote to memory of 2884 1328 vvppv.exe 43 PID 1328 wrote to memory of 2884 1328 vvppv.exe 43 PID 1328 wrote to memory of 2884 1328 vvppv.exe 43 PID 1328 wrote to memory of 2884 1328 vvppv.exe 43 PID 2884 wrote to memory of 2504 2884 lfxrrrx.exe 44 PID 2884 wrote to memory of 2504 2884 lfxrrrx.exe 44 PID 2884 wrote to memory of 2504 2884 lfxrrrx.exe 44 PID 2884 wrote to memory of 2504 2884 lfxrrrx.exe 44 PID 2504 wrote to memory of 848 2504 bntbth.exe 45 PID 2504 wrote to memory of 848 2504 bntbth.exe 45 PID 2504 wrote to memory of 848 2504 bntbth.exe 45 PID 2504 wrote to memory of 848 2504 bntbth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe"C:\Users\Admin\AppData\Local\Temp\714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\xlfflfr.exec:\xlfflfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\7hhnhn.exec:\7hhnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\jpjpd.exec:\jpjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\3vppp.exec:\3vppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\tnbntn.exec:\tnbntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pdddp.exec:\pdddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ffrxllx.exec:\ffrxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jjdjp.exec:\jjdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\frlrxfr.exec:\frlrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\hbbbtt.exec:\hbbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\3djpv.exec:\3djpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\rlxrlfl.exec:\rlxrlfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vvppv.exec:\vvppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\bntbth.exec:\bntbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pppjj.exec:\pppjj.exe17⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhbbnn.exec:\nhbbnn.exe18⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dpppv.exec:\dpppv.exe19⤵
- Executes dropped EXE
PID:1372 -
\??\c:\7lrrxxx.exec:\7lrrxxx.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\btbhtt.exec:\btbhtt.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vjvdd.exec:\vjvdd.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xlxxxfr.exec:\xlxxxfr.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\vvdvv.exec:\vvdvv.exe24⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxlllxf.exec:\lxlllxf.exe25⤵
- Executes dropped EXE
PID:780 -
\??\c:\9hnntt.exec:\9hnntt.exe26⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jjdpv.exec:\jjdpv.exe27⤵
- Executes dropped EXE
PID:108 -
\??\c:\lllxrlx.exec:\lllxrlx.exe28⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjddv.exec:\pjddv.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xrlrxlf.exec:\xrlrxlf.exe30⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nthnnb.exec:\nthnnb.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pdpvp.exec:\pdpvp.exe32⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe33⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nhhnnb.exec:\nhhnnb.exe34⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dpjpj.exec:\dpjpj.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9xlrrxx.exec:\9xlrrxx.exe36⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xxfllrx.exec:\xxfllrx.exe37⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nnnnbn.exec:\nnnnbn.exe38⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdpdp.exec:\jdpdp.exe39⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jvjvd.exec:\jvjvd.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrlxflx.exec:\xrlxflx.exe41⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9nnnth.exec:\9nnnth.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5tntbn.exec:\5tntbn.exe43⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dvdjp.exec:\dvdjp.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe46⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nhttnt.exec:\nhttnt.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ddvvj.exec:\ddvvj.exe48⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrxrrfr.exec:\xrxrrfr.exe49⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tnbbnb.exec:\tnbbnb.exe51⤵
- Executes dropped EXE
PID:1328 -
\??\c:\vpjdv.exec:\vpjdv.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ffxfllx.exec:\ffxfllx.exe53⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xxrxrxr.exec:\xxrxrxr.exe54⤵
- Executes dropped EXE
PID:2716 -
\??\c:\7hbhnb.exec:\7hbhnb.exe55⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjvpd.exec:\pjvpd.exe56⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rrlrlxl.exec:\rrlrlxl.exe57⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrxfrxl.exec:\xrxfrxl.exe58⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nnhhhn.exec:\nnhhhn.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddvjv.exec:\ddvjv.exe60⤵
- Executes dropped EXE
PID:1896 -
\??\c:\jddjd.exec:\jddjd.exe61⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7xxfrrf.exec:\7xxfrrf.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\btnbnt.exec:\btnbnt.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ttnbhn.exec:\ttnbhn.exe64⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jdvvd.exec:\jdvvd.exe65⤵
- Executes dropped EXE
PID:288 -
\??\c:\rlxflrf.exec:\rlxflrf.exe66⤵PID:1848
-
\??\c:\rlffllx.exec:\rlffllx.exe67⤵PID:1276
-
\??\c:\ntbtbt.exec:\ntbtbt.exe68⤵PID:268
-
\??\c:\hnntbh.exec:\hnntbh.exe69⤵PID:1740
-
\??\c:\jjvdv.exec:\jjvdv.exe70⤵PID:1700
-
\??\c:\rrlrfrl.exec:\rrlrfrl.exe71⤵PID:2444
-
\??\c:\frfxflr.exec:\frfxflr.exe72⤵PID:1456
-
\??\c:\bbbnht.exec:\bbbnht.exe73⤵PID:484
-
\??\c:\dvdpj.exec:\dvdpj.exe74⤵PID:2456
-
\??\c:\llflxlf.exec:\llflxlf.exe75⤵PID:2616
-
\??\c:\bnnhnb.exec:\bnnhnb.exe76⤵PID:1392
-
\??\c:\tntbbn.exec:\tntbbn.exe77⤵PID:2440
-
\??\c:\1vjvv.exec:\1vjvv.exe78⤵PID:2460
-
\??\c:\xxfxrfx.exec:\xxfxrfx.exe79⤵PID:1268
-
\??\c:\nnbhtt.exec:\nnbhtt.exe80⤵PID:2868
-
\??\c:\tbbhtb.exec:\tbbhtb.exe81⤵PID:2672
-
\??\c:\jdpvj.exec:\jdpvj.exe82⤵PID:3040
-
\??\c:\lllrxxx.exec:\lllrxxx.exe83⤵PID:2816
-
\??\c:\hnhnbb.exec:\hnhnbb.exe84⤵PID:2728
-
\??\c:\btthnn.exec:\btthnn.exe85⤵PID:536
-
\??\c:\5djpv.exec:\5djpv.exe86⤵PID:2992
-
\??\c:\lllxrxl.exec:\lllxrxl.exe87⤵PID:2656
-
\??\c:\xrxflfl.exec:\xrxflfl.exe88⤵PID:2532
-
\??\c:\5htntn.exec:\5htntn.exe89⤵PID:2604
-
\??\c:\vjddj.exec:\vjddj.exe90⤵PID:2584
-
\??\c:\jdjpv.exec:\jdjpv.exe91⤵PID:1868
-
\??\c:\3rxxfxf.exec:\3rxxfxf.exe92⤵PID:2104
-
\??\c:\tttbnh.exec:\tttbnh.exe93⤵PID:1288
-
\??\c:\thbtth.exec:\thbtth.exe94⤵PID:1884
-
\??\c:\pvdvd.exec:\pvdvd.exe95⤵PID:1528
-
\??\c:\xfxlrxr.exec:\xfxlrxr.exe96⤵PID:1452
-
\??\c:\llxxflx.exec:\llxxflx.exe97⤵PID:2924
-
\??\c:\bbbtnt.exec:\bbbtnt.exe98⤵PID:1192
-
\??\c:\3pjpd.exec:\3pjpd.exe99⤵PID:1840
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe100⤵PID:1744
-
\??\c:\rrlrflf.exec:\rrlrflf.exe101⤵PID:2896
-
\??\c:\3hbhbh.exec:\3hbhbh.exe102⤵PID:2964
-
\??\c:\jdvvv.exec:\jdvvv.exe103⤵PID:1704
-
\??\c:\7dpjv.exec:\7dpjv.exe104⤵PID:1540
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe105⤵PID:2096
-
\??\c:\hbttbt.exec:\hbttbt.exe106⤵PID:1044
-
\??\c:\ddpjv.exec:\ddpjv.exe107⤵PID:3064
-
\??\c:\jjddp.exec:\jjddp.exe108⤵PID:1692
-
\??\c:\lflrxlr.exec:\lflrxlr.exe109⤵PID:880
-
\??\c:\rlxlrrf.exec:\rlxlrrf.exe110⤵PID:1644
-
\??\c:\9nbbnt.exec:\9nbbnt.exe111⤵PID:1960
-
\??\c:\1vpdp.exec:\1vpdp.exe112⤵PID:108
-
\??\c:\pjjvj.exec:\pjjvj.exe113⤵PID:1800
-
\??\c:\xrfrlxr.exec:\xrfrlxr.exe114⤵PID:2452
-
\??\c:\5xlrrxr.exec:\5xlrrxr.exe115⤵PID:712
-
\??\c:\hthnbh.exec:\hthnbh.exe116⤵PID:2476
-
\??\c:\7ppvd.exec:\7ppvd.exe117⤵PID:1432
-
\??\c:\vddvd.exec:\vddvd.exe118⤵PID:484
-
\??\c:\xrfrlrx.exec:\xrfrlrx.exe119⤵PID:884
-
\??\c:\nhnntn.exec:\nhnntn.exe120⤵PID:1912
-
\??\c:\3hhnbh.exec:\3hhnbh.exe121⤵PID:2464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-