Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe
-
Size
454KB
-
MD5
65824015274c1b8a9a30101fb39553b0
-
SHA1
8b167b069858228508abebfe5ab46380d59b246c
-
SHA256
2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5
-
SHA512
adc3e6c9b7878e5b22ef346dad8c487b55df139313c494427d05fa86b0b16c36bc88cfca9006769537de859a908504a3b2f0a062301ff6c3dafe3487dee215be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-42-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1808-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-162-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-235-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2636-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-637-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2564-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-785-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1500-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 3rffrxr.exe 2788 dpjpj.exe 2772 lllfxxr.exe 1808 hbthbb.exe 2728 nnhtnn.exe 2572 rxrllxx.exe 3064 hbhhbh.exe 2540 xxrfxll.exe 2220 bthnhh.exe 1696 llxlflx.exe 2284 7nthtt.exe 2848 llxflrf.exe 1632 hbhntb.exe 2924 7rfxxfr.exe 2940 tnbhbh.exe 696 jjdjv.exe 1768 5fxxrxf.exe 3012 lfrrrxr.exe 908 nhbnbb.exe 1156 xxrxlrx.exe 2428 ntnnbh.exe 1868 rfrflll.exe 836 nnbbtb.exe 592 llflxfr.exe 1680 7bnhtt.exe 2500 xllrxxf.exe 2636 1hhtbh.exe 2268 jdpvj.exe 2488 9lxfxlx.exe 2288 bbnhtt.exe 2348 vvddj.exe 1988 bbntnn.exe 2700 ddjpv.exe 1756 lxrrffr.exe 2804 1tbhtb.exe 2684 jvjdj.exe 2164 5rxxxxf.exe 2756 xrrxllr.exe 2092 tnbhnb.exe 2668 jdvvj.exe 2564 xrrxfll.exe 1396 1thntb.exe 2124 vvppj.exe 2964 fxlxflx.exe 2540 3hbnnn.exe 2112 vpdjp.exe 2876 9xxlrrx.exe 2244 htntnt.exe 2284 5ddjp.exe 2448 jdvdj.exe 1752 7lrrxxl.exe 2948 5thbbt.exe 668 3dvdp.exe 2880 frllrxf.exe 3000 xrrllfx.exe 784 1htbnn.exe 2400 vjvdj.exe 2416 fxfflrf.exe 2276 xlxrrxf.exe 1592 5tnbtb.exe 1292 7vvpd.exe 2524 frllxxf.exe 348 lfrxflx.exe 992 tthhhh.exe -
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-812-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1500-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-969-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2664 2648 2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe 30 PID 2648 wrote to memory of 2664 2648 2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe 30 PID 2648 wrote to memory of 2664 2648 2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe 30 PID 2648 wrote to memory of 2664 2648 2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe 30 PID 2664 wrote to memory of 2788 2664 3rffrxr.exe 31 PID 2664 wrote to memory of 2788 2664 3rffrxr.exe 31 PID 2664 wrote to memory of 2788 2664 3rffrxr.exe 31 PID 2664 wrote to memory of 2788 2664 3rffrxr.exe 31 PID 2788 wrote to memory of 2772 2788 dpjpj.exe 32 PID 2788 wrote to memory of 2772 2788 dpjpj.exe 32 PID 2788 wrote to memory of 2772 2788 dpjpj.exe 32 PID 2788 wrote to memory of 2772 2788 dpjpj.exe 32 PID 2772 wrote to memory of 1808 2772 lllfxxr.exe 33 PID 2772 wrote to memory of 1808 2772 lllfxxr.exe 33 PID 2772 wrote to memory of 1808 2772 lllfxxr.exe 33 PID 2772 wrote to memory of 1808 2772 lllfxxr.exe 33 PID 1808 wrote to memory of 2728 1808 hbthbb.exe 34 PID 1808 wrote to memory of 2728 1808 hbthbb.exe 34 PID 1808 wrote to memory of 2728 1808 hbthbb.exe 34 PID 1808 wrote to memory of 2728 1808 hbthbb.exe 34 PID 2728 wrote to memory of 2572 2728 nnhtnn.exe 35 PID 2728 wrote to memory of 2572 2728 nnhtnn.exe 35 PID 2728 wrote to memory of 2572 2728 nnhtnn.exe 35 PID 2728 wrote to memory of 2572 2728 nnhtnn.exe 35 PID 2572 wrote to memory of 3064 2572 rxrllxx.exe 36 PID 2572 wrote to memory of 3064 2572 rxrllxx.exe 36 PID 2572 wrote to memory of 3064 2572 rxrllxx.exe 36 PID 2572 wrote to memory of 3064 2572 rxrllxx.exe 36 PID 3064 wrote to memory of 2540 3064 hbhhbh.exe 37 PID 3064 wrote to memory of 2540 3064 hbhhbh.exe 37 PID 3064 wrote to memory of 2540 3064 hbhhbh.exe 37 PID 3064 wrote to memory of 2540 3064 hbhhbh.exe 37 PID 2540 wrote to memory of 2220 2540 xxrfxll.exe 38 PID 2540 wrote to memory of 2220 2540 xxrfxll.exe 38 PID 2540 wrote to memory of 2220 2540 xxrfxll.exe 38 PID 2540 wrote to memory of 2220 2540 xxrfxll.exe 38 PID 2220 wrote to memory of 1696 2220 bthnhh.exe 39 PID 2220 wrote to memory of 1696 2220 bthnhh.exe 39 PID 2220 wrote to memory of 1696 2220 bthnhh.exe 39 PID 2220 wrote to memory of 1696 2220 bthnhh.exe 39 PID 1696 wrote to memory of 2284 1696 llxlflx.exe 40 PID 1696 wrote to memory of 2284 1696 llxlflx.exe 40 PID 1696 wrote to memory of 2284 1696 llxlflx.exe 40 PID 1696 wrote to memory of 2284 1696 llxlflx.exe 40 PID 2284 wrote to memory of 2848 2284 7nthtt.exe 41 PID 2284 wrote to memory of 2848 2284 7nthtt.exe 41 PID 2284 wrote to memory of 2848 2284 7nthtt.exe 41 PID 2284 wrote to memory of 2848 2284 7nthtt.exe 41 PID 2848 wrote to memory of 1632 2848 llxflrf.exe 42 PID 2848 wrote to memory of 1632 2848 llxflrf.exe 42 PID 2848 wrote to memory of 1632 2848 llxflrf.exe 42 PID 2848 wrote to memory of 1632 2848 llxflrf.exe 42 PID 1632 wrote to memory of 2924 1632 hbhntb.exe 43 PID 1632 wrote to memory of 2924 1632 hbhntb.exe 43 PID 1632 wrote to memory of 2924 1632 hbhntb.exe 43 PID 1632 wrote to memory of 2924 1632 hbhntb.exe 43 PID 2924 wrote to memory of 2940 2924 7rfxxfr.exe 44 PID 2924 wrote to memory of 2940 2924 7rfxxfr.exe 44 PID 2924 wrote to memory of 2940 2924 7rfxxfr.exe 44 PID 2924 wrote to memory of 2940 2924 7rfxxfr.exe 44 PID 2940 wrote to memory of 696 2940 tnbhbh.exe 45 PID 2940 wrote to memory of 696 2940 tnbhbh.exe 45 PID 2940 wrote to memory of 696 2940 tnbhbh.exe 45 PID 2940 wrote to memory of 696 2940 tnbhbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe"C:\Users\Admin\AppData\Local\Temp\2d4beaa6b5c47faa82534b76f7c012f473a95f242f7ab71023af394d1423d1b5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\3rffrxr.exec:\3rffrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dpjpj.exec:\dpjpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lllfxxr.exec:\lllfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbthbb.exec:\hbthbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nnhtnn.exec:\nnhtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rxrllxx.exec:\rxrllxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hbhhbh.exec:\hbhhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xxrfxll.exec:\xxrfxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\bthnhh.exec:\bthnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\llxlflx.exec:\llxlflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\7nthtt.exec:\7nthtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\llxflrf.exec:\llxflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hbhntb.exec:\hbhntb.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\7rfxxfr.exec:\7rfxxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\tnbhbh.exec:\tnbhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jjdjv.exec:\jjdjv.exe17⤵
- Executes dropped EXE
PID:696 -
\??\c:\5fxxrxf.exec:\5fxxrxf.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lfrrrxr.exec:\lfrrrxr.exe19⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhbnbb.exec:\nhbnbb.exe20⤵
- Executes dropped EXE
PID:908 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe21⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ntnnbh.exec:\ntnnbh.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rfrflll.exec:\rfrflll.exe23⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nnbbtb.exec:\nnbbtb.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\llflxfr.exec:\llflxfr.exe25⤵
- Executes dropped EXE
PID:592 -
\??\c:\7bnhtt.exec:\7bnhtt.exe26⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xllrxxf.exec:\xllrxxf.exe27⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1hhtbh.exec:\1hhtbh.exe28⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jdpvj.exec:\jdpvj.exe29⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9lxfxlx.exec:\9lxfxlx.exe30⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bbnhtt.exec:\bbnhtt.exe31⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vvddj.exec:\vvddj.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bbntnn.exec:\bbntnn.exe33⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ddjpv.exec:\ddjpv.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lxrrffr.exec:\lxrrffr.exe35⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1tbhtb.exec:\1tbhtb.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jvjdj.exec:\jvjdj.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5rxxxxf.exec:\5rxxxxf.exe38⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrrxllr.exec:\xrrxllr.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tnbhnb.exec:\tnbhnb.exe40⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jdvvj.exec:\jdvvj.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xrrxfll.exec:\xrrxfll.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1thntb.exec:\1thntb.exe43⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vvppj.exec:\vvppj.exe44⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxlxflx.exec:\fxlxflx.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3hbnnn.exec:\3hbnnn.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vpdjp.exec:\vpdjp.exe47⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9xxlrrx.exec:\9xxlrrx.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\htntnt.exec:\htntnt.exe49⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5ddjp.exec:\5ddjp.exe50⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jdvdj.exec:\jdvdj.exe51⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7lrrxxl.exec:\7lrrxxl.exe52⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5thbbt.exec:\5thbbt.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3dvdp.exec:\3dvdp.exe54⤵
- Executes dropped EXE
PID:668 -
\??\c:\frllrxf.exec:\frllrxf.exe55⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrrllfx.exec:\xrrllfx.exe56⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1htbnn.exec:\1htbnn.exe57⤵
- Executes dropped EXE
PID:784 -
\??\c:\vjvdj.exec:\vjvdj.exe58⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fxfflrf.exec:\fxfflrf.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xlxrrxf.exec:\xlxrrxf.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5tnbtb.exec:\5tnbtb.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7vvpd.exec:\7vvpd.exe62⤵
- Executes dropped EXE
PID:1292 -
\??\c:\frllxxf.exec:\frllxxf.exe63⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lfrxflx.exec:\lfrxflx.exe64⤵
- Executes dropped EXE
PID:348 -
\??\c:\tthhhh.exec:\tthhhh.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\vpjvj.exec:\vpjvj.exe66⤵PID:1776
-
\??\c:\xllfxff.exec:\xllfxff.exe67⤵PID:2120
-
\??\c:\xrrxffl.exec:\xrrxffl.exe68⤵PID:2060
-
\??\c:\bntnnh.exec:\bntnnh.exe69⤵PID:2308
-
\??\c:\5vpvp.exec:\5vpvp.exe70⤵PID:2068
-
\??\c:\xrffrfl.exec:\xrffrfl.exe71⤵PID:2300
-
\??\c:\xrffxxf.exec:\xrffxxf.exe72⤵PID:3020
-
\??\c:\bthbhn.exec:\bthbhn.exe73⤵PID:1664
-
\??\c:\dvpdp.exec:\dvpdp.exe74⤵PID:2432
-
\??\c:\7lxlrrx.exec:\7lxlrrx.exe75⤵PID:2020
-
\??\c:\nnhhtb.exec:\nnhhtb.exe76⤵PID:2312
-
\??\c:\5dpjv.exec:\5dpjv.exe77⤵PID:2272
-
\??\c:\jjvdp.exec:\jjvdp.exe78⤵PID:2176
-
\??\c:\1lfflfl.exec:\1lfflfl.exe79⤵PID:2816
-
\??\c:\tnhnbn.exec:\tnhnbn.exe80⤵PID:1724
-
\??\c:\7vppv.exec:\7vppv.exe81⤵PID:2804
-
\??\c:\vvppv.exec:\vvppv.exe82⤵PID:2672
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe83⤵PID:2164
-
\??\c:\hhtthh.exec:\hhtthh.exe84⤵PID:2600
-
\??\c:\dpdjp.exec:\dpdjp.exe85⤵PID:1760
-
\??\c:\vdvdj.exec:\vdvdj.exe86⤵PID:2728
-
\??\c:\1lllllr.exec:\1lllllr.exe87⤵PID:2564
-
\??\c:\5hbbnh.exec:\5hbbnh.exe88⤵PID:1488
-
\??\c:\ppdpd.exec:\ppdpd.exe89⤵PID:2124
-
\??\c:\jjdjp.exec:\jjdjp.exe90⤵PID:2208
-
\??\c:\1frrxxx.exec:\1frrxxx.exe91⤵PID:2540
-
\??\c:\5ntttt.exec:\5ntttt.exe92⤵PID:2652
-
\??\c:\1vdvj.exec:\1vdvj.exe93⤵PID:1484
-
\??\c:\vjdjj.exec:\vjdjj.exe94⤵PID:764
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe95⤵PID:2764
-
\??\c:\nnhttb.exec:\nnhttb.exe96⤵PID:1088
-
\??\c:\vvpdv.exec:\vvpdv.exe97⤵PID:2936
-
\??\c:\dddpv.exec:\dddpv.exe98⤵PID:1764
-
\??\c:\lllfxxx.exec:\lllfxxx.exe99⤵PID:476
-
\??\c:\ntnnnn.exec:\ntnnnn.exe100⤵PID:2880
-
\??\c:\pjppd.exec:\pjppd.exe101⤵PID:2536
-
\??\c:\jdvdp.exec:\jdvdp.exe102⤵PID:1768
-
\??\c:\flllxff.exec:\flllxff.exe103⤵
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\bbbhhh.exec:\bbbhhh.exe104⤵PID:2416
-
\??\c:\djvdj.exec:\djvdj.exe105⤵PID:2276
-
\??\c:\pvpdp.exec:\pvpdp.exe106⤵PID:1372
-
\??\c:\lxlffll.exec:\lxlffll.exe107⤵PID:832
-
\??\c:\bbnnbt.exec:\bbnnbt.exe108⤵PID:680
-
\??\c:\tthhbb.exec:\tthhbb.exe109⤵PID:348
-
\??\c:\jpjvj.exec:\jpjvj.exe110⤵PID:2360
-
\??\c:\xfrrffr.exec:\xfrrffr.exe111⤵PID:1556
-
\??\c:\bhhthh.exec:\bhhthh.exe112⤵PID:1728
-
\??\c:\jdvvp.exec:\jdvvp.exe113⤵PID:1500
-
\??\c:\1rlrlxl.exec:\1rlrlxl.exe114⤵PID:2004
-
\??\c:\rlxxfll.exec:\rlxxfll.exe115⤵
- System Location Discovery: System Language Discovery
PID:792 -
\??\c:\nhhhnt.exec:\nhhhnt.exe116⤵PID:1560
-
\??\c:\dvjjv.exec:\dvjjv.exe117⤵PID:2488
-
\??\c:\9bbbtt.exec:\9bbbtt.exe118⤵PID:1832
-
\??\c:\3ttbtb.exec:\3ttbtb.exe119⤵PID:2456
-
\??\c:\pjvdj.exec:\pjvdj.exe120⤵PID:2184
-
\??\c:\3frlllx.exec:\3frlllx.exe121⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-