Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe
-
Size
454KB
-
MD5
5ad8220291f0dd0997a6ae1d67709501
-
SHA1
51514aab950a20489d7e3f00bc86fe4378decf08
-
SHA256
5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0
-
SHA512
49f0be8f18671c7a92b5eaf165a600c0705994f956841599ca41f17ce70dd046efc37f2e746a021441d4846a1c519f40dab82726d811c7561a9a5185f20a4d7d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-21-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-60-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-101-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2632-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1208-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-201-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/968-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-231-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/740-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-291-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1440-293-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/280-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/304-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-535-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-594-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2036-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-968-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1576-1053-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2232-1055-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-1062-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-1069-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1992-1134-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1644-1252-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1984 5lfllrf.exe 2508 tnthbt.exe 2992 vjdpv.exe 2680 5hbbbb.exe 2684 xrxllfl.exe 2816 htnntt.exe 2560 nbntbb.exe 2576 hbtntb.exe 2596 3fllxrr.exe 2420 1lrrrrr.exe 872 hbthnt.exe 2632 3fllflr.exe 1232 9bhbtn.exe 1000 1dvdj.exe 852 9rlflrx.exe 628 hnbbbb.exe 1980 1frxxfl.exe 1768 thnnbn.exe 2892 djpvv.exe 1208 3rfffxx.exe 2104 jvddp.exe 564 xxlrrlr.exe 2868 1frrrrr.exe 968 hbhhtn.exe 2008 3bnnbh.exe 740 btbbnh.exe 2960 9djvp.exe 3036 vpdjp.exe 2232 5lxxxxf.exe 1908 tbbhhh.exe 2916 1pjvd.exe 1440 flrfflx.exe 2128 nbnntn.exe 280 jvddp.exe 2508 5xllxff.exe 2660 ffrrrrf.exe 2792 1tbtbt.exe 2664 djvpd.exe 2692 vvpdj.exe 2852 9fllrrf.exe 2700 nhbbhh.exe 2536 vvddp.exe 2644 dvvjv.exe 2596 xrxxrrf.exe 888 9nhnbb.exe 1840 jpdjv.exe 2592 vjvvd.exe 896 9rlxlrx.exe 304 nntbtn.exe 1248 nbbbhh.exe 2784 vjppp.exe 1268 xlxflrl.exe 1164 9bnhhh.exe 1996 btbbbb.exe 2092 3rrrrrx.exe 2100 9xrxflx.exe 2160 hbhhhn.exe 2088 ntbhnn.exe 1092 7vddd.exe 2248 ffxflrf.exe 708 hthhht.exe 936 nbnntt.exe 2056 dvpvd.exe 2136 rllrflr.exe -
resource yara_rule behavioral1/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-293-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/280-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-594-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2588-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-929-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1352-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-1053-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2232-1055-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1069-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2728-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1134-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2980-1153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-1289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-1326-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1984 2016 5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe 31 PID 2016 wrote to memory of 1984 2016 5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe 31 PID 2016 wrote to memory of 1984 2016 5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe 31 PID 2016 wrote to memory of 1984 2016 5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe 31 PID 1984 wrote to memory of 2508 1984 5lfllrf.exe 32 PID 1984 wrote to memory of 2508 1984 5lfllrf.exe 32 PID 1984 wrote to memory of 2508 1984 5lfllrf.exe 32 PID 1984 wrote to memory of 2508 1984 5lfllrf.exe 32 PID 2508 wrote to memory of 2992 2508 tnthbt.exe 33 PID 2508 wrote to memory of 2992 2508 tnthbt.exe 33 PID 2508 wrote to memory of 2992 2508 tnthbt.exe 33 PID 2508 wrote to memory of 2992 2508 tnthbt.exe 33 PID 2992 wrote to memory of 2680 2992 vjdpv.exe 34 PID 2992 wrote to memory of 2680 2992 vjdpv.exe 34 PID 2992 wrote to memory of 2680 2992 vjdpv.exe 34 PID 2992 wrote to memory of 2680 2992 vjdpv.exe 34 PID 2680 wrote to memory of 2684 2680 5hbbbb.exe 35 PID 2680 wrote to memory of 2684 2680 5hbbbb.exe 35 PID 2680 wrote to memory of 2684 2680 5hbbbb.exe 35 PID 2680 wrote to memory of 2684 2680 5hbbbb.exe 35 PID 2684 wrote to memory of 2816 2684 xrxllfl.exe 36 PID 2684 wrote to memory of 2816 2684 xrxllfl.exe 36 PID 2684 wrote to memory of 2816 2684 xrxllfl.exe 36 PID 2684 wrote to memory of 2816 2684 xrxllfl.exe 36 PID 2816 wrote to memory of 2560 2816 htnntt.exe 37 PID 2816 wrote to memory of 2560 2816 htnntt.exe 37 PID 2816 wrote to memory of 2560 2816 htnntt.exe 37 PID 2816 wrote to memory of 2560 2816 htnntt.exe 37 PID 2560 wrote to memory of 2576 2560 nbntbb.exe 38 PID 2560 wrote to memory of 2576 2560 nbntbb.exe 38 PID 2560 wrote to memory of 2576 2560 nbntbb.exe 38 PID 2560 wrote to memory of 2576 2560 nbntbb.exe 38 PID 2576 wrote to memory of 2596 2576 hbtntb.exe 39 PID 2576 wrote to memory of 2596 2576 hbtntb.exe 39 PID 2576 wrote to memory of 2596 2576 hbtntb.exe 39 PID 2576 wrote to memory of 2596 2576 hbtntb.exe 39 PID 2596 wrote to memory of 2420 2596 3fllxrr.exe 40 PID 2596 wrote to memory of 2420 2596 3fllxrr.exe 40 PID 2596 wrote to memory of 2420 2596 3fllxrr.exe 40 PID 2596 wrote to memory of 2420 2596 3fllxrr.exe 40 PID 2420 wrote to memory of 872 2420 1lrrrrr.exe 41 PID 2420 wrote to memory of 872 2420 1lrrrrr.exe 41 PID 2420 wrote to memory of 872 2420 1lrrrrr.exe 41 PID 2420 wrote to memory of 872 2420 1lrrrrr.exe 41 PID 872 wrote to memory of 2632 872 hbthnt.exe 42 PID 872 wrote to memory of 2632 872 hbthnt.exe 42 PID 872 wrote to memory of 2632 872 hbthnt.exe 42 PID 872 wrote to memory of 2632 872 hbthnt.exe 42 PID 2632 wrote to memory of 1232 2632 3fllflr.exe 43 PID 2632 wrote to memory of 1232 2632 3fllflr.exe 43 PID 2632 wrote to memory of 1232 2632 3fllflr.exe 43 PID 2632 wrote to memory of 1232 2632 3fllflr.exe 43 PID 1232 wrote to memory of 1000 1232 9bhbtn.exe 44 PID 1232 wrote to memory of 1000 1232 9bhbtn.exe 44 PID 1232 wrote to memory of 1000 1232 9bhbtn.exe 44 PID 1232 wrote to memory of 1000 1232 9bhbtn.exe 44 PID 1000 wrote to memory of 852 1000 1dvdj.exe 45 PID 1000 wrote to memory of 852 1000 1dvdj.exe 45 PID 1000 wrote to memory of 852 1000 1dvdj.exe 45 PID 1000 wrote to memory of 852 1000 1dvdj.exe 45 PID 852 wrote to memory of 628 852 9rlflrx.exe 46 PID 852 wrote to memory of 628 852 9rlflrx.exe 46 PID 852 wrote to memory of 628 852 9rlflrx.exe 46 PID 852 wrote to memory of 628 852 9rlflrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe"C:\Users\Admin\AppData\Local\Temp\5d67470325ddb8eff703ff42ec0dabcd02014bd9c2739a11729b9cc3c1b3e6c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\5lfllrf.exec:\5lfllrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\tnthbt.exec:\tnthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\vjdpv.exec:\vjdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5hbbbb.exec:\5hbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xrxllfl.exec:\xrxllfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\htnntt.exec:\htnntt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nbntbb.exec:\nbntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\hbtntb.exec:\hbtntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\3fllxrr.exec:\3fllxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1lrrrrr.exec:\1lrrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\hbthnt.exec:\hbthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\3fllflr.exec:\3fllflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9bhbtn.exec:\9bhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\1dvdj.exec:\1dvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\9rlflrx.exec:\9rlflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\hnbbbb.exec:\hnbbbb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628 -
\??\c:\1frxxfl.exec:\1frxxfl.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\thnnbn.exec:\thnnbn.exe19⤵
- Executes dropped EXE
PID:1768 -
\??\c:\djpvv.exec:\djpvv.exe20⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3rfffxx.exec:\3rfffxx.exe21⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jvddp.exec:\jvddp.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xxlrrlr.exec:\xxlrrlr.exe23⤵
- Executes dropped EXE
PID:564 -
\??\c:\1frrrrr.exec:\1frrrrr.exe24⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hbhhtn.exec:\hbhhtn.exe25⤵
- Executes dropped EXE
PID:968 -
\??\c:\3bnnbh.exec:\3bnnbh.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\btbbnh.exec:\btbbnh.exe27⤵
- Executes dropped EXE
PID:740 -
\??\c:\9djvp.exec:\9djvp.exe28⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vpdjp.exec:\vpdjp.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5lxxxxf.exec:\5lxxxxf.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tbbhhh.exec:\tbbhhh.exe31⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1pjvd.exec:\1pjvd.exe32⤵
- Executes dropped EXE
PID:2916 -
\??\c:\flrfflx.exec:\flrfflx.exe33⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nbnntn.exec:\nbnntn.exe34⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jvddp.exec:\jvddp.exe35⤵
- Executes dropped EXE
PID:280 -
\??\c:\5xllxff.exec:\5xllxff.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ffrrrrf.exec:\ffrrrrf.exe37⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1tbtbt.exec:\1tbtbt.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\djvpd.exec:\djvpd.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vvpdj.exec:\vvpdj.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9fllrrf.exec:\9fllrrf.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nhbbhh.exec:\nhbbhh.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vvddp.exec:\vvddp.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dvvjv.exec:\dvvjv.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9nhnbb.exec:\9nhnbb.exe46⤵
- Executes dropped EXE
PID:888 -
\??\c:\jpdjv.exec:\jpdjv.exe47⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vjvvd.exec:\vjvvd.exe48⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9rlxlrx.exec:\9rlxlrx.exe49⤵
- Executes dropped EXE
PID:896 -
\??\c:\nntbtn.exec:\nntbtn.exe50⤵
- Executes dropped EXE
PID:304 -
\??\c:\nbbbhh.exec:\nbbbhh.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\vjppp.exec:\vjppp.exe52⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xlxflrl.exec:\xlxflrl.exe53⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9bnhhh.exec:\9bnhhh.exe54⤵
- Executes dropped EXE
PID:1164 -
\??\c:\btbbbb.exec:\btbbbb.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3rrrrrx.exec:\3rrrrrx.exe56⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9xrxflx.exec:\9xrxflx.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hbhhhn.exec:\hbhhhn.exe58⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ntbhnn.exec:\ntbhnn.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7vddd.exec:\7vddd.exe60⤵
- Executes dropped EXE
PID:1092 -
\??\c:\ffxflrf.exec:\ffxflrf.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hthhht.exec:\hthhht.exe62⤵
- Executes dropped EXE
PID:708 -
\??\c:\nbnntt.exec:\nbnntt.exe63⤵
- Executes dropped EXE
PID:936 -
\??\c:\dvpvd.exec:\dvpvd.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rllrflr.exec:\rllrflr.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\tnnhnn.exec:\tnnhnn.exe66⤵PID:568
-
\??\c:\thtthh.exec:\thtthh.exe67⤵
- System Location Discovery: System Language Discovery
PID:1260 -
\??\c:\jvdvd.exec:\jvdvd.exe68⤵PID:3068
-
\??\c:\lfrrffl.exec:\lfrrffl.exe69⤵PID:2204
-
\??\c:\tthtnh.exec:\tthtnh.exe70⤵PID:900
-
\??\c:\hhhntb.exec:\hhhntb.exe71⤵PID:1864
-
\??\c:\dvpvj.exec:\dvpvj.exe72⤵PID:1792
-
\??\c:\frxffxx.exec:\frxffxx.exe73⤵PID:1736
-
\??\c:\rrrrrrf.exec:\rrrrrrf.exe74⤵PID:800
-
\??\c:\ttnhtb.exec:\ttnhtb.exe75⤵PID:2320
-
\??\c:\1pjdv.exec:\1pjdv.exe76⤵PID:3064
-
\??\c:\ddvdj.exec:\ddvdj.exe77⤵PID:2756
-
\??\c:\9xlrxxf.exec:\9xlrxxf.exe78⤵PID:2920
-
\??\c:\btbhnn.exec:\btbhnn.exe79⤵PID:2684
-
\??\c:\5pjpd.exec:\5pjpd.exe80⤵PID:2404
-
\??\c:\9pdjj.exec:\9pdjj.exe81⤵PID:2816
-
\??\c:\rfllllf.exec:\rfllllf.exe82⤵PID:2588
-
\??\c:\bbtbnn.exec:\bbtbnn.exe83⤵PID:2548
-
\??\c:\3hbhhh.exec:\3hbhhh.exe84⤵PID:2980
-
\??\c:\vjppd.exec:\vjppd.exe85⤵
- System Location Discovery: System Language Discovery
PID:2576 -
\??\c:\rrlrllf.exec:\rrlrllf.exe86⤵PID:2996
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe87⤵PID:1960
-
\??\c:\nnbbhh.exec:\nnbbhh.exe88⤵PID:2844
-
\??\c:\pjdjp.exec:\pjdjp.exe89⤵PID:2848
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe90⤵PID:1232
-
\??\c:\xlxfflx.exec:\xlxfflx.exe91⤵PID:2520
-
\??\c:\hbhbtb.exec:\hbhbtb.exe92⤵PID:2344
-
\??\c:\1jvvd.exec:\1jvvd.exe93⤵PID:2036
-
\??\c:\jvjdd.exec:\jvjdd.exe94⤵PID:1604
-
\??\c:\9rlflrr.exec:\9rlflrr.exe95⤵PID:1160
-
\??\c:\1hbbtn.exec:\1hbbtn.exe96⤵PID:2572
-
\??\c:\1tbtnt.exec:\1tbtnt.exe97⤵PID:2884
-
\??\c:\1pvvv.exec:\1pvvv.exe98⤵PID:2892
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe99⤵PID:2124
-
\??\c:\3llllfl.exec:\3llllfl.exe100⤵
- System Location Discovery: System Language Discovery
PID:1140 -
\??\c:\htnntt.exec:\htnntt.exe101⤵PID:2088
-
\??\c:\7dpvd.exec:\7dpvd.exe102⤵
- System Location Discovery: System Language Discovery
PID:1060 -
\??\c:\vpjjv.exec:\vpjjv.exe103⤵PID:540
-
\??\c:\lxrrrrf.exec:\lxrrrrf.exe104⤵PID:1356
-
\??\c:\hthhtt.exec:\hthhtt.exe105⤵
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\3nthhh.exec:\3nthhh.exe106⤵PID:2060
-
\??\c:\jvjjp.exec:\jvjjp.exe107⤵PID:2136
-
\??\c:\rrrrrrf.exec:\rrrrrrf.exe108⤵PID:568
-
\??\c:\9llrrrf.exec:\9llrrrf.exe109⤵PID:1504
-
\??\c:\5bttbh.exec:\5bttbh.exe110⤵PID:2900
-
\??\c:\jdvpd.exec:\jdvpd.exe111⤵PID:1004
-
\??\c:\jdpvp.exec:\jdpvp.exe112⤵PID:1548
-
\??\c:\frfflfr.exec:\frfflfr.exe113⤵PID:2040
-
\??\c:\nbnntb.exec:\nbnntb.exe114⤵PID:1588
-
\??\c:\5hnhbb.exec:\5hnhbb.exe115⤵PID:1600
-
\??\c:\9vvdj.exec:\9vvdj.exe116⤵PID:2256
-
\??\c:\fxllxxf.exec:\fxllxxf.exe117⤵PID:280
-
\??\c:\xrlrllx.exec:\xrlrllx.exe118⤵PID:2508
-
\??\c:\3nhbnb.exec:\3nhbnb.exe119⤵PID:2748
-
\??\c:\dvpvp.exec:\dvpvp.exe120⤵PID:2800
-
\??\c:\jppdj.exec:\jppdj.exe121⤵PID:2812
-
\??\c:\rllxrxx.exec:\rllxrxx.exe122⤵PID:2568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-