Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe
-
Size
453KB
-
MD5
7b13c325b4816296c67343bead78647f
-
SHA1
36edad457e248e5f90af82b53f9d604dcf027eef
-
SHA256
e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f
-
SHA512
c1673e203329c17c9d19a942126538ce1e3d2d78eca523ea54596099337eaaf12912a251a785db966f862c28b2849302fb7717f4c0b82e45286b39c29ee5e647
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-71-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2360-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-107-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/484-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-217-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/936-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-255-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2944-307-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2752-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-559-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/884-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-752-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1008-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 ddpvj.exe 2816 xrlxlxx.exe 2752 bnbtbh.exe 2052 pvjdj.exe 888 lffrllr.exe 2544 nhbnbn.exe 2672 3rfflrf.exe 3004 9rflrxl.exe 3052 lfxrflf.exe 2360 hhbntt.exe 2772 xrflrrx.exe 1724 tthntb.exe 984 dvpvp.exe 484 nhttbh.exe 1480 jpjvj.exe 380 tnbbhh.exe 592 ppvdj.exe 2352 5bntbh.exe 2084 ddvdp.exe 1600 hbnbnb.exe 2456 3pddp.exe 2036 7fxxllf.exe 1084 nhbnbh.exe 936 rrrxflx.exe 760 lfrrffr.exe 1440 vvjjd.exe 2092 xfxlflx.exe 2408 bnhtbb.exe 2944 5lfllrx.exe 1944 9nttnb.exe 2056 lfxlflx.exe 2644 rxllfrf.exe 2820 hnnbhn.exe 2708 ddvdj.exe 2556 lfxlxfl.exe 2752 3thntt.exe 2656 jdvvv.exe 2744 xxrrffr.exe 2916 nnbntb.exe 2616 bttbhh.exe 2624 jdvdj.exe 576 9rlflrx.exe 2976 bthhtt.exe 1996 nhbhnt.exe 2160 jjdvj.exe 1356 rlxrxxf.exe 2772 1nnhth.exe 1724 bhbnhn.exe 1684 pvppj.exe 984 xrfrfxf.exe 1688 nnnhnt.exe 496 tnnttt.exe 596 jdjpv.exe 1028 7fxxflx.exe 2404 xxxlflr.exe 3060 hnhnbb.exe 1260 7pjvd.exe 2444 ffxxffr.exe 408 rrlxlrf.exe 2472 nhbtbb.exe 1712 9vjpv.exe 2152 xrrlrxf.exe 2436 nhttnn.exe 1292 ppjpv.exe -
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-90-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2360-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-255-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2752-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-866-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2120 2644 e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe 30 PID 2644 wrote to memory of 2120 2644 e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe 30 PID 2644 wrote to memory of 2120 2644 e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe 30 PID 2644 wrote to memory of 2120 2644 e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe 30 PID 2120 wrote to memory of 2816 2120 ddpvj.exe 31 PID 2120 wrote to memory of 2816 2120 ddpvj.exe 31 PID 2120 wrote to memory of 2816 2120 ddpvj.exe 31 PID 2120 wrote to memory of 2816 2120 ddpvj.exe 31 PID 2816 wrote to memory of 2752 2816 xrlxlxx.exe 32 PID 2816 wrote to memory of 2752 2816 xrlxlxx.exe 32 PID 2816 wrote to memory of 2752 2816 xrlxlxx.exe 32 PID 2816 wrote to memory of 2752 2816 xrlxlxx.exe 32 PID 2752 wrote to memory of 2052 2752 bnbtbh.exe 33 PID 2752 wrote to memory of 2052 2752 bnbtbh.exe 33 PID 2752 wrote to memory of 2052 2752 bnbtbh.exe 33 PID 2752 wrote to memory of 2052 2752 bnbtbh.exe 33 PID 2052 wrote to memory of 888 2052 pvjdj.exe 34 PID 2052 wrote to memory of 888 2052 pvjdj.exe 34 PID 2052 wrote to memory of 888 2052 pvjdj.exe 34 PID 2052 wrote to memory of 888 2052 pvjdj.exe 34 PID 888 wrote to memory of 2544 888 lffrllr.exe 35 PID 888 wrote to memory of 2544 888 lffrllr.exe 35 PID 888 wrote to memory of 2544 888 lffrllr.exe 35 PID 888 wrote to memory of 2544 888 lffrllr.exe 35 PID 2544 wrote to memory of 2672 2544 nhbnbn.exe 36 PID 2544 wrote to memory of 2672 2544 nhbnbn.exe 36 PID 2544 wrote to memory of 2672 2544 nhbnbn.exe 36 PID 2544 wrote to memory of 2672 2544 nhbnbn.exe 36 PID 2672 wrote to memory of 3004 2672 3rfflrf.exe 37 PID 2672 wrote to memory of 3004 2672 3rfflrf.exe 37 PID 2672 wrote to memory of 3004 2672 3rfflrf.exe 37 PID 2672 wrote to memory of 3004 2672 3rfflrf.exe 37 PID 3004 wrote to memory of 3052 3004 9rflrxl.exe 38 PID 3004 wrote to memory of 3052 3004 9rflrxl.exe 38 PID 3004 wrote to memory of 3052 3004 9rflrxl.exe 38 PID 3004 wrote to memory of 3052 3004 9rflrxl.exe 38 PID 3052 wrote to memory of 2360 3052 lfxrflf.exe 39 PID 3052 wrote to memory of 2360 3052 lfxrflf.exe 39 PID 3052 wrote to memory of 2360 3052 lfxrflf.exe 39 PID 3052 wrote to memory of 2360 3052 lfxrflf.exe 39 PID 2360 wrote to memory of 2772 2360 hhbntt.exe 40 PID 2360 wrote to memory of 2772 2360 hhbntt.exe 40 PID 2360 wrote to memory of 2772 2360 hhbntt.exe 40 PID 2360 wrote to memory of 2772 2360 hhbntt.exe 40 PID 2772 wrote to memory of 1724 2772 xrflrrx.exe 41 PID 2772 wrote to memory of 1724 2772 xrflrrx.exe 41 PID 2772 wrote to memory of 1724 2772 xrflrrx.exe 41 PID 2772 wrote to memory of 1724 2772 xrflrrx.exe 41 PID 1724 wrote to memory of 984 1724 tthntb.exe 42 PID 1724 wrote to memory of 984 1724 tthntb.exe 42 PID 1724 wrote to memory of 984 1724 tthntb.exe 42 PID 1724 wrote to memory of 984 1724 tthntb.exe 42 PID 984 wrote to memory of 484 984 dvpvp.exe 43 PID 984 wrote to memory of 484 984 dvpvp.exe 43 PID 984 wrote to memory of 484 984 dvpvp.exe 43 PID 984 wrote to memory of 484 984 dvpvp.exe 43 PID 484 wrote to memory of 1480 484 nhttbh.exe 44 PID 484 wrote to memory of 1480 484 nhttbh.exe 44 PID 484 wrote to memory of 1480 484 nhttbh.exe 44 PID 484 wrote to memory of 1480 484 nhttbh.exe 44 PID 1480 wrote to memory of 380 1480 jpjvj.exe 45 PID 1480 wrote to memory of 380 1480 jpjvj.exe 45 PID 1480 wrote to memory of 380 1480 jpjvj.exe 45 PID 1480 wrote to memory of 380 1480 jpjvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe"C:\Users\Admin\AppData\Local\Temp\e03aa0e3f145fde5f069d8bcf7815924a9c508ce6ed7adecc4f5ef3ca804212f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ddpvj.exec:\ddpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xrlxlxx.exec:\xrlxlxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bnbtbh.exec:\bnbtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pvjdj.exec:\pvjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\lffrllr.exec:\lffrllr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\nhbnbn.exec:\nhbnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3rfflrf.exec:\3rfflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9rflrxl.exec:\9rflrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lfxrflf.exec:\lfxrflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\hhbntt.exec:\hhbntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xrflrrx.exec:\xrflrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tthntb.exec:\tthntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\dvpvp.exec:\dvpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\nhttbh.exec:\nhttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\jpjvj.exec:\jpjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\tnbbhh.exec:\tnbbhh.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\ppvdj.exec:\ppvdj.exe18⤵
- Executes dropped EXE
PID:592 -
\??\c:\5bntbh.exec:\5bntbh.exe19⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ddvdp.exec:\ddvdp.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbnbnb.exec:\hbnbnb.exe21⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3pddp.exec:\3pddp.exe22⤵
- Executes dropped EXE
PID:2456 -
\??\c:\7fxxllf.exec:\7fxxllf.exe23⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nhbnbh.exec:\nhbnbh.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rrrxflx.exec:\rrrxflx.exe25⤵
- Executes dropped EXE
PID:936 -
\??\c:\lfrrffr.exec:\lfrrffr.exe26⤵
- Executes dropped EXE
PID:760 -
\??\c:\vvjjd.exec:\vvjjd.exe27⤵
- Executes dropped EXE
PID:1440 -
\??\c:\xfxlflx.exec:\xfxlflx.exe28⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bnhtbb.exec:\bnhtbb.exe29⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5lfllrx.exec:\5lfllrx.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9nttnb.exec:\9nttnb.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lfxlflx.exec:\lfxlflx.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rxllfrf.exec:\rxllfrf.exe33⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hnnbhn.exec:\hnnbhn.exe34⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ddvdj.exec:\ddvdj.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe36⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3thntt.exec:\3thntt.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdvvv.exec:\jdvvv.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xxrrffr.exec:\xxrrffr.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nnbntb.exec:\nnbntb.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bttbhh.exec:\bttbhh.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jdvdj.exec:\jdvdj.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9rlflrx.exec:\9rlflrx.exe43⤵
- Executes dropped EXE
PID:576 -
\??\c:\bthhtt.exec:\bthhtt.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nhbhnt.exec:\nhbhnt.exe45⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jjdvj.exec:\jjdvj.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe47⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1nnhth.exec:\1nnhth.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bhbnhn.exec:\bhbnhn.exe49⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pvppj.exec:\pvppj.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe51⤵
- Executes dropped EXE
PID:984 -
\??\c:\nnnhnt.exec:\nnnhnt.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\tnnttt.exec:\tnnttt.exe53⤵
- Executes dropped EXE
PID:496 -
\??\c:\jdjpv.exec:\jdjpv.exe54⤵
- Executes dropped EXE
PID:596 -
\??\c:\7fxxflx.exec:\7fxxflx.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xxxlflr.exec:\xxxlflr.exe56⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hnhnbb.exec:\hnhnbb.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7pjvd.exec:\7pjvd.exe58⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ffxxffr.exec:\ffxxffr.exe59⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe60⤵
- Executes dropped EXE
PID:408 -
\??\c:\nhbtbb.exec:\nhbtbb.exe61⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9vjpv.exec:\9vjpv.exe62⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xrrlrxf.exec:\xrrlrxf.exe63⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhttnn.exec:\nhttnn.exe64⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ppjpv.exec:\ppjpv.exe65⤵
- Executes dropped EXE
PID:1292 -
\??\c:\9vjpd.exec:\9vjpd.exe66⤵PID:1036
-
\??\c:\xllfflr.exec:\xllfflr.exe67⤵PID:1360
-
\??\c:\5hbbhb.exec:\5hbbhb.exe68⤵PID:1816
-
\??\c:\jjjjv.exec:\jjjjv.exe69⤵PID:2388
-
\??\c:\7pdjv.exec:\7pdjv.exe70⤵PID:2428
-
\??\c:\rxfrxrf.exec:\rxfrxrf.exe71⤵PID:1940
-
\??\c:\bbntbt.exec:\bbntbt.exe72⤵PID:1964
-
\??\c:\ddvdp.exec:\ddvdp.exe73⤵PID:892
-
\??\c:\dvvvv.exec:\dvvvv.exe74⤵PID:884
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe75⤵PID:2644
-
\??\c:\1thttb.exec:\1thttb.exe76⤵PID:2704
-
\??\c:\vvjjv.exec:\vvjjv.exe77⤵PID:2928
-
\??\c:\rlfllrr.exec:\rlfllrr.exe78⤵PID:2832
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe79⤵PID:2584
-
\??\c:\1nbhnt.exec:\1nbhnt.exe80⤵PID:2604
-
\??\c:\pjdjv.exec:\pjdjv.exe81⤵PID:1312
-
\??\c:\rrllxll.exec:\rrllxll.exe82⤵PID:2560
-
\??\c:\5lrlrlx.exec:\5lrlrlx.exe83⤵PID:3056
-
\??\c:\tnntbb.exec:\tnntbb.exe84⤵PID:1856
-
\??\c:\ddvvd.exec:\ddvvd.exe85⤵PID:3016
-
\??\c:\llfrflx.exec:\llfrflx.exe86⤵PID:3012
-
\??\c:\tnbntt.exec:\tnbntt.exe87⤵PID:1996
-
\??\c:\pdpvd.exec:\pdpvd.exe88⤵PID:2160
-
\??\c:\vpjdj.exec:\vpjdj.exe89⤵PID:2312
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe90⤵PID:2772
-
\??\c:\1nttth.exec:\1nttth.exe91⤵PID:1580
-
\??\c:\ppjpv.exec:\ppjpv.exe92⤵PID:1376
-
\??\c:\lxllrxf.exec:\lxllrxf.exe93⤵PID:1484
-
\??\c:\xxffrlx.exec:\xxffrlx.exe94⤵PID:1688
-
\??\c:\bbbnbh.exec:\bbbnbh.exe95⤵PID:496
-
\??\c:\jdvdp.exec:\jdvdp.exe96⤵PID:1760
-
\??\c:\1rlrxfl.exec:\1rlrxfl.exe97⤵PID:1040
-
\??\c:\1fxxlxf.exec:\1fxxlxf.exe98⤵PID:332
-
\??\c:\tthntb.exec:\tthntb.exe99⤵PID:3060
-
\??\c:\ppdjp.exec:\ppdjp.exe100⤵PID:1508
-
\??\c:\pjddj.exec:\pjddj.exe101⤵PID:1600
-
\??\c:\lxlllrx.exec:\lxlllrx.exe102⤵PID:2364
-
\??\c:\tntttt.exec:\tntttt.exe103⤵PID:2168
-
\??\c:\bnbnnh.exec:\bnbnnh.exe104⤵PID:840
-
\??\c:\3dvdd.exec:\3dvdd.exe105⤵PID:1084
-
\??\c:\1lffllx.exec:\1lffllx.exe106⤵PID:1500
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe107⤵PID:2432
-
\??\c:\thtttt.exec:\thtttt.exe108⤵PID:860
-
\??\c:\ddvdj.exec:\ddvdj.exe109⤵PID:2040
-
\??\c:\pvjpv.exec:\pvjpv.exe110⤵PID:1224
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe111⤵PID:1992
-
\??\c:\bbnnbb.exec:\bbnnbb.exe112⤵PID:2288
-
\??\c:\5jdvp.exec:\5jdvp.exe113⤵PID:1008
-
\??\c:\vdvjp.exec:\vdvjp.exe114⤵PID:2944
-
\??\c:\llfxxxx.exec:\llfxxxx.exe115⤵PID:892
-
\??\c:\9bbnnn.exec:\9bbnnn.exe116⤵PID:1912
-
\??\c:\pdjdd.exec:\pdjdd.exe117⤵PID:2644
-
\??\c:\5xlrfll.exec:\5xlrfll.exe118⤵PID:1588
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe119⤵PID:2556
-
\??\c:\nnhhtt.exec:\nnhhtt.exe120⤵PID:2828
-
\??\c:\dpddv.exec:\dpddv.exe121⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-