Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe
-
Size
456KB
-
MD5
dbe348da744b30037024dd7262361b8e
-
SHA1
5e7852ab769e3bce8cd22044f22c25000fea1399
-
SHA256
a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2
-
SHA512
98d00dfa5284a8488aa8c25cb634546ed03e8e5734e99d5bfa809c7b301c99917c589d41495168ddfc1a226fb145e0d73790d1e3ee76a664a1ebf272228c7e8e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1176-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2556-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-48-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-213-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-328-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2848-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-350-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/108-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-386-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-577-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-652-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2672-684-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1176 xnblndx.exe 2776 hphvnl.exe 2556 hnxbxfn.exe 2904 xfhvfhr.exe 2796 vntrhv.exe 2144 hbtbbnh.exe 2716 lttbd.exe 2720 fbfhh.exe 2236 xpdxlx.exe 1644 lbbhthh.exe 3000 nrbnjr.exe 2120 fbbnvph.exe 2504 dvnlpb.exe 2676 xdvlddd.exe 1208 hbbntnp.exe 2500 llfpplx.exe 1988 fftjx.exe 784 pdnhvvp.exe 1720 fbvfhrh.exe 1224 hfdpj.exe 2132 rdprvxj.exe 1624 lbjtfp.exe 676 nfbdlbd.exe 2272 hhvrpnb.exe 964 frvnb.exe 1900 tpvbdtt.exe 1028 bbtlrfd.exe 1528 lxntfh.exe 2484 txnvptj.exe 2460 drtdtfv.exe 1616 nhrlrt.exe 2372 rdbhp.exe 1568 ttrhn.exe 2348 xfrfntj.exe 2548 fdjvd.exe 2408 xjfdvv.exe 2848 prvjlx.exe 2784 bttfr.exe 2888 jpttr.exe 2808 htdfpb.exe 108 xthvxx.exe 2304 htntxfj.exe 2804 rvbjv.exe 2292 xvbfj.exe 2012 vxffhxd.exe 2284 pnnhrd.exe 1524 fdlfj.exe 2780 vbhrjn.exe 1424 dpdrdhn.exe 948 tjtdjh.exe 1464 npndd.exe 980 rnxftjx.exe 1020 tjnjr.exe 580 xljndhx.exe 1832 jbfdn.exe 1988 lppfbdh.exe 2096 pdbbv.exe 2208 dnldf.exe 2252 trjdx.exe 952 ndnpr.exe 808 ndrxvlt.exe 2336 pvxbf.exe 2240 hbhrb.exe 1100 pbnbnlj.exe -
resource yara_rule behavioral1/memory/1176-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-328-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2848-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-684-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1464-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-739-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttntvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnflt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndvjbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdlhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfnvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxhlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpnhbfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrhlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvttxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtlnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhhxnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnbdtbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llhrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brbhdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brdrlhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvpffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbpvlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvrbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tltnpbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnbxjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 1176 1236 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 29 PID 1236 wrote to memory of 1176 1236 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 29 PID 1236 wrote to memory of 1176 1236 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 29 PID 1236 wrote to memory of 1176 1236 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 29 PID 1176 wrote to memory of 2776 1176 xnblndx.exe 30 PID 1176 wrote to memory of 2776 1176 xnblndx.exe 30 PID 1176 wrote to memory of 2776 1176 xnblndx.exe 30 PID 1176 wrote to memory of 2776 1176 xnblndx.exe 30 PID 2776 wrote to memory of 2556 2776 hphvnl.exe 31 PID 2776 wrote to memory of 2556 2776 hphvnl.exe 31 PID 2776 wrote to memory of 2556 2776 hphvnl.exe 31 PID 2776 wrote to memory of 2556 2776 hphvnl.exe 31 PID 2556 wrote to memory of 2904 2556 hnxbxfn.exe 32 PID 2556 wrote to memory of 2904 2556 hnxbxfn.exe 32 PID 2556 wrote to memory of 2904 2556 hnxbxfn.exe 32 PID 2556 wrote to memory of 2904 2556 hnxbxfn.exe 32 PID 2904 wrote to memory of 2796 2904 xfhvfhr.exe 33 PID 2904 wrote to memory of 2796 2904 xfhvfhr.exe 33 PID 2904 wrote to memory of 2796 2904 xfhvfhr.exe 33 PID 2904 wrote to memory of 2796 2904 xfhvfhr.exe 33 PID 2796 wrote to memory of 2144 2796 vntrhv.exe 34 PID 2796 wrote to memory of 2144 2796 vntrhv.exe 34 PID 2796 wrote to memory of 2144 2796 vntrhv.exe 34 PID 2796 wrote to memory of 2144 2796 vntrhv.exe 34 PID 2144 wrote to memory of 2716 2144 hbtbbnh.exe 35 PID 2144 wrote to memory of 2716 2144 hbtbbnh.exe 35 PID 2144 wrote to memory of 2716 2144 hbtbbnh.exe 35 PID 2144 wrote to memory of 2716 2144 hbtbbnh.exe 35 PID 2716 wrote to memory of 2720 2716 lttbd.exe 36 PID 2716 wrote to memory of 2720 2716 lttbd.exe 36 PID 2716 wrote to memory of 2720 2716 lttbd.exe 36 PID 2716 wrote to memory of 2720 2716 lttbd.exe 36 PID 2720 wrote to memory of 2236 2720 fbfhh.exe 37 PID 2720 wrote to memory of 2236 2720 fbfhh.exe 37 PID 2720 wrote to memory of 2236 2720 fbfhh.exe 37 PID 2720 wrote to memory of 2236 2720 fbfhh.exe 37 PID 2236 wrote to memory of 1644 2236 xpdxlx.exe 38 PID 2236 wrote to memory of 1644 2236 xpdxlx.exe 38 PID 2236 wrote to memory of 1644 2236 xpdxlx.exe 38 PID 2236 wrote to memory of 1644 2236 xpdxlx.exe 38 PID 1644 wrote to memory of 3000 1644 lbbhthh.exe 39 PID 1644 wrote to memory of 3000 1644 lbbhthh.exe 39 PID 1644 wrote to memory of 3000 1644 lbbhthh.exe 39 PID 1644 wrote to memory of 3000 1644 lbbhthh.exe 39 PID 3000 wrote to memory of 2120 3000 nrbnjr.exe 40 PID 3000 wrote to memory of 2120 3000 nrbnjr.exe 40 PID 3000 wrote to memory of 2120 3000 nrbnjr.exe 40 PID 3000 wrote to memory of 2120 3000 nrbnjr.exe 40 PID 2120 wrote to memory of 2504 2120 fbbnvph.exe 41 PID 2120 wrote to memory of 2504 2120 fbbnvph.exe 41 PID 2120 wrote to memory of 2504 2120 fbbnvph.exe 41 PID 2120 wrote to memory of 2504 2120 fbbnvph.exe 41 PID 2504 wrote to memory of 2676 2504 dvnlpb.exe 42 PID 2504 wrote to memory of 2676 2504 dvnlpb.exe 42 PID 2504 wrote to memory of 2676 2504 dvnlpb.exe 42 PID 2504 wrote to memory of 2676 2504 dvnlpb.exe 42 PID 2676 wrote to memory of 1208 2676 xdvlddd.exe 43 PID 2676 wrote to memory of 1208 2676 xdvlddd.exe 43 PID 2676 wrote to memory of 1208 2676 xdvlddd.exe 43 PID 2676 wrote to memory of 1208 2676 xdvlddd.exe 43 PID 1208 wrote to memory of 2500 1208 hbbntnp.exe 44 PID 1208 wrote to memory of 2500 1208 hbbntnp.exe 44 PID 1208 wrote to memory of 2500 1208 hbbntnp.exe 44 PID 1208 wrote to memory of 2500 1208 hbbntnp.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe"C:\Users\Admin\AppData\Local\Temp\a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\xnblndx.exec:\xnblndx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\hphvnl.exec:\hphvnl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\hnxbxfn.exec:\hnxbxfn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xfhvfhr.exec:\xfhvfhr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vntrhv.exec:\vntrhv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\hbtbbnh.exec:\hbtbbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\lttbd.exec:\lttbd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\fbfhh.exec:\fbfhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xpdxlx.exec:\xpdxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lbbhthh.exec:\lbbhthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\nrbnjr.exec:\nrbnjr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\fbbnvph.exec:\fbbnvph.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dvnlpb.exec:\dvnlpb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xdvlddd.exec:\xdvlddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hbbntnp.exec:\hbbntnp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\llfpplx.exec:\llfpplx.exe17⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fftjx.exec:\fftjx.exe18⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pdnhvvp.exec:\pdnhvvp.exe19⤵
- Executes dropped EXE
PID:784 -
\??\c:\fbvfhrh.exec:\fbvfhrh.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hfdpj.exec:\hfdpj.exe21⤵
- Executes dropped EXE
PID:1224 -
\??\c:\rdprvxj.exec:\rdprvxj.exe22⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lbjtfp.exec:\lbjtfp.exe23⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nfbdlbd.exec:\nfbdlbd.exe24⤵
- Executes dropped EXE
PID:676 -
\??\c:\hhvrpnb.exec:\hhvrpnb.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\frvnb.exec:\frvnb.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\tpvbdtt.exec:\tpvbdtt.exe27⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bbtlrfd.exec:\bbtlrfd.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lxntfh.exec:\lxntfh.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\txnvptj.exec:\txnvptj.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\drtdtfv.exec:\drtdtfv.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nhrlrt.exec:\nhrlrt.exe32⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rdbhp.exec:\rdbhp.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ttrhn.exec:\ttrhn.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xfrfntj.exec:\xfrfntj.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fdjvd.exec:\fdjvd.exe36⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xjfdvv.exec:\xjfdvv.exe37⤵
- Executes dropped EXE
PID:2408 -
\??\c:\prvjlx.exec:\prvjlx.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bttfr.exec:\bttfr.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jpttr.exec:\jpttr.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\htdfpb.exec:\htdfpb.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xthvxx.exec:\xthvxx.exe42⤵
- Executes dropped EXE
PID:108 -
\??\c:\htntxfj.exec:\htntxfj.exe43⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rvbjv.exec:\rvbjv.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xvbfj.exec:\xvbfj.exe45⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vxffhxd.exec:\vxffhxd.exe46⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pnnhrd.exec:\pnnhrd.exe47⤵
- Executes dropped EXE
PID:2284 -
\??\c:\fdlfj.exec:\fdlfj.exe48⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vbhrjn.exec:\vbhrjn.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dpdrdhn.exec:\dpdrdhn.exe50⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tjtdjh.exec:\tjtdjh.exe51⤵
- Executes dropped EXE
PID:948 -
\??\c:\npndd.exec:\npndd.exe52⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rnxftjx.exec:\rnxftjx.exe53⤵
- Executes dropped EXE
PID:980 -
\??\c:\tjnjr.exec:\tjnjr.exe54⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xljndhx.exec:\xljndhx.exe55⤵
- Executes dropped EXE
PID:580 -
\??\c:\jbfdn.exec:\jbfdn.exe56⤵
- Executes dropped EXE
PID:1832 -
\??\c:\lppfbdh.exec:\lppfbdh.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pdbbv.exec:\pdbbv.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dnldf.exec:\dnldf.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\trjdx.exec:\trjdx.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ndnpr.exec:\ndnpr.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\ndrxvlt.exec:\ndrxvlt.exe62⤵
- Executes dropped EXE
PID:808 -
\??\c:\pvxbf.exec:\pvxbf.exe63⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hbhrb.exec:\hbhrb.exe64⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pbnbnlj.exec:\pbnbnlj.exe65⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rnvfl.exec:\rnvfl.exe66⤵PID:960
-
\??\c:\rphphj.exec:\rphphj.exe67⤵PID:1664
-
\??\c:\rtbjp.exec:\rtbjp.exe68⤵PID:1096
-
\??\c:\nvbxhb.exec:\nvbxhb.exe69⤵PID:1084
-
\??\c:\dvlptb.exec:\dvlptb.exe70⤵PID:2220
-
\??\c:\fbvntvb.exec:\fbvntvb.exe71⤵PID:1484
-
\??\c:\rdxpdl.exec:\rdxpdl.exe72⤵PID:2040
-
\??\c:\jtltjhj.exec:\jtltjhj.exe73⤵PID:1912
-
\??\c:\bflhv.exec:\bflhv.exe74⤵PID:2444
-
\??\c:\blxjtxn.exec:\blxjtxn.exe75⤵PID:1616
-
\??\c:\rjhxrn.exec:\rjhxrn.exe76⤵PID:2280
-
\??\c:\thrfjrt.exec:\thrfjrt.exe77⤵PID:2524
-
\??\c:\fpfjp.exec:\fpfjp.exe78⤵PID:2028
-
\??\c:\hljnr.exec:\hljnr.exe79⤵PID:2776
-
\??\c:\btjrxv.exec:\btjrxv.exe80⤵PID:2880
-
\??\c:\vrpflbd.exec:\vrpflbd.exe81⤵PID:2188
-
\??\c:\hvjhfrf.exec:\hvjhfrf.exe82⤵PID:2816
-
\??\c:\brhjh.exec:\brhjh.exe83⤵PID:2968
-
\??\c:\pttdnf.exec:\pttdnf.exe84⤵PID:2884
-
\??\c:\ljbnn.exec:\ljbnn.exe85⤵PID:2864
-
\??\c:\ddfrxj.exec:\ddfrxj.exe86⤵PID:2224
-
\??\c:\hxdhph.exec:\hxdhph.exe87⤵PID:2716
-
\??\c:\tjnjhp.exec:\tjnjhp.exe88⤵PID:2736
-
\??\c:\rfjvnnj.exec:\rfjvnnj.exe89⤵PID:2672
-
\??\c:\rttdl.exec:\rttdl.exe90⤵PID:1152
-
\??\c:\bxrxp.exec:\bxrxp.exe91⤵PID:3024
-
\??\c:\lffbb.exec:\lffbb.exe92⤵PID:2760
-
\??\c:\jpjdnht.exec:\jpjdnht.exe93⤵PID:1732
-
\??\c:\pxdpdl.exec:\pxdpdl.exe94⤵PID:872
-
\??\c:\pvxjh.exec:\pvxjh.exe95⤵PID:816
-
\??\c:\fftxp.exec:\fftxp.exe96⤵PID:1464
-
\??\c:\xdjnxh.exec:\xdjnxh.exe97⤵PID:1208
-
\??\c:\hrjdvhx.exec:\hrjdvhx.exe98⤵PID:1020
-
\??\c:\hrhhf.exec:\hrhhf.exe99⤵PID:1740
-
\??\c:\trftjx.exec:\trftjx.exe100⤵PID:756
-
\??\c:\ftlltr.exec:\ftlltr.exe101⤵PID:2204
-
\??\c:\tfnpf.exec:\tfnpf.exe102⤵PID:2404
-
\??\c:\trxxbhh.exec:\trxxbhh.exe103⤵PID:2276
-
\??\c:\ffttt.exec:\ffttt.exe104⤵PID:2788
-
\??\c:\prjbv.exec:\prjbv.exe105⤵PID:2124
-
\??\c:\drfnjp.exec:\drfnjp.exe106⤵PID:1060
-
\??\c:\btfpv.exec:\btfpv.exe107⤵PID:2232
-
\??\c:\hjvdfxj.exec:\hjvdfxj.exe108⤵PID:2496
-
\??\c:\dfldldv.exec:\dfldldv.exe109⤵PID:1536
-
\??\c:\xhhtjn.exec:\xhhtjn.exe110⤵PID:960
-
\??\c:\lbrnxd.exec:\lbrnxd.exe111⤵PID:1664
-
\??\c:\prffhth.exec:\prffhth.exe112⤵PID:2044
-
\??\c:\ndhvh.exec:\ndhvh.exe113⤵PID:1160
-
\??\c:\hnttnfp.exec:\hnttnfp.exe114⤵PID:1528
-
\??\c:\nffhdhh.exec:\nffhdhh.exe115⤵PID:2476
-
\??\c:\xttjxt.exec:\xttjxt.exe116⤵PID:1904
-
\??\c:\lvdpj.exec:\lvdpj.exe117⤵PID:1512
-
\??\c:\tbfhtvb.exec:\tbfhtvb.exe118⤵PID:2444
-
\??\c:\rpvdl.exec:\rpvdl.exe119⤵PID:1604
-
\??\c:\xbhdl.exec:\xbhdl.exe120⤵PID:1608
-
\??\c:\tfnrb.exec:\tfnrb.exe121⤵PID:2532
-
\??\c:\hdlvlb.exec:\hdlvlb.exe122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-