Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe
-
Size
454KB
-
MD5
06c7390f3026daa03ab01ba70e5c8f3d
-
SHA1
3a6bd31fdbe0e0eba24d484ee42cd38f74963afc
-
SHA256
86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52
-
SHA512
b35ef62bbbcac67dc380b44b3c4b08db1a9ba8efe4ffea1f4de787f2a6540fd96ee4fc32e7f5d201f840b777a7e5ee0300ffb06250065773136281ee5b8c3701
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeDn:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2668-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-54-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1044-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-217-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2420-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-238-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1676-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-370-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-408-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-557-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-715-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1320-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-903-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-915-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2620-923-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/588-936-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-968-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2348-974-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-987-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-1041-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-1078-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 ttnbhn.exe 2704 jjdvj.exe 2928 xxrfrxf.exe 2584 7hhtbh.exe 2672 1ddpd.exe 2620 xfrfxrx.exe 1044 xrrlxfr.exe 588 7nbnhn.exe 1620 llfxlrf.exe 2200 fflxlxl.exe 2188 tbtnnt.exe 1944 jdvpd.exe 2036 7ttnhn.exe 1408 ffxfxfx.exe 1932 btnbbb.exe 1732 ffxfflx.exe 2960 tnbhtb.exe 2128 fxrfxfx.exe 304 bbbhtb.exe 672 ffrxlxr.exe 1108 hbhbhh.exe 404 ddvvd.exe 2420 rxxfrxr.exe 1744 jddpd.exe 280 xfrlxfr.exe 1676 pppvj.exe 924 lfrrxxl.exe 2140 9nthtb.exe 2360 ffrxflx.exe 704 tbtbtt.exe 2524 dppdv.exe 2080 bbbbnt.exe 2668 vpdjp.exe 2820 3fxxxfr.exe 1696 ntnbnt.exe 2676 pjjjv.exe 2312 1ddpv.exe 2580 1ffrlxl.exe 2612 nnthht.exe 2576 jdpdp.exe 1724 3jpjp.exe 3044 3frxlxr.exe 1920 hnhbnb.exe 264 3jdjp.exe 1492 7lxxflx.exe 2004 1xlrllx.exe 2392 9tbnbh.exe 2860 5vvdj.exe 1844 5xxrxfr.exe 2800 5xllrrr.exe 1792 hbbhbn.exe 2036 5ppdp.exe 1408 7xxxrfr.exe 1452 nnnhtb.exe 1788 jjjpd.exe 2180 xlrfxxf.exe 2960 bnhhnt.exe 2128 hnhhhn.exe 2404 jjdvj.exe 1516 3frrrrx.exe 1480 tthhtt.exe 840 jjpdj.exe 1860 lrlrllr.exe 1948 flxlrlx.exe -
resource yara_rule behavioral1/memory/2668-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-117-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1944-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-968-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2348-974-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2000-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2752 2668 86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe 30 PID 2668 wrote to memory of 2752 2668 86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe 30 PID 2668 wrote to memory of 2752 2668 86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe 30 PID 2668 wrote to memory of 2752 2668 86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe 30 PID 2752 wrote to memory of 2704 2752 ttnbhn.exe 31 PID 2752 wrote to memory of 2704 2752 ttnbhn.exe 31 PID 2752 wrote to memory of 2704 2752 ttnbhn.exe 31 PID 2752 wrote to memory of 2704 2752 ttnbhn.exe 31 PID 2704 wrote to memory of 2928 2704 jjdvj.exe 32 PID 2704 wrote to memory of 2928 2704 jjdvj.exe 32 PID 2704 wrote to memory of 2928 2704 jjdvj.exe 32 PID 2704 wrote to memory of 2928 2704 jjdvj.exe 32 PID 2928 wrote to memory of 2584 2928 xxrfrxf.exe 33 PID 2928 wrote to memory of 2584 2928 xxrfrxf.exe 33 PID 2928 wrote to memory of 2584 2928 xxrfrxf.exe 33 PID 2928 wrote to memory of 2584 2928 xxrfrxf.exe 33 PID 2584 wrote to memory of 2672 2584 7hhtbh.exe 34 PID 2584 wrote to memory of 2672 2584 7hhtbh.exe 34 PID 2584 wrote to memory of 2672 2584 7hhtbh.exe 34 PID 2584 wrote to memory of 2672 2584 7hhtbh.exe 34 PID 2672 wrote to memory of 2620 2672 1ddpd.exe 35 PID 2672 wrote to memory of 2620 2672 1ddpd.exe 35 PID 2672 wrote to memory of 2620 2672 1ddpd.exe 35 PID 2672 wrote to memory of 2620 2672 1ddpd.exe 35 PID 2620 wrote to memory of 1044 2620 xfrfxrx.exe 36 PID 2620 wrote to memory of 1044 2620 xfrfxrx.exe 36 PID 2620 wrote to memory of 1044 2620 xfrfxrx.exe 36 PID 2620 wrote to memory of 1044 2620 xfrfxrx.exe 36 PID 1044 wrote to memory of 588 1044 xrrlxfr.exe 37 PID 1044 wrote to memory of 588 1044 xrrlxfr.exe 37 PID 1044 wrote to memory of 588 1044 xrrlxfr.exe 37 PID 1044 wrote to memory of 588 1044 xrrlxfr.exe 37 PID 588 wrote to memory of 1620 588 7nbnhn.exe 38 PID 588 wrote to memory of 1620 588 7nbnhn.exe 38 PID 588 wrote to memory of 1620 588 7nbnhn.exe 38 PID 588 wrote to memory of 1620 588 7nbnhn.exe 38 PID 1620 wrote to memory of 2200 1620 llfxlrf.exe 39 PID 1620 wrote to memory of 2200 1620 llfxlrf.exe 39 PID 1620 wrote to memory of 2200 1620 llfxlrf.exe 39 PID 1620 wrote to memory of 2200 1620 llfxlrf.exe 39 PID 2200 wrote to memory of 2188 2200 fflxlxl.exe 40 PID 2200 wrote to memory of 2188 2200 fflxlxl.exe 40 PID 2200 wrote to memory of 2188 2200 fflxlxl.exe 40 PID 2200 wrote to memory of 2188 2200 fflxlxl.exe 40 PID 2188 wrote to memory of 1944 2188 tbtnnt.exe 41 PID 2188 wrote to memory of 1944 2188 tbtnnt.exe 41 PID 2188 wrote to memory of 1944 2188 tbtnnt.exe 41 PID 2188 wrote to memory of 1944 2188 tbtnnt.exe 41 PID 1944 wrote to memory of 2036 1944 jdvpd.exe 42 PID 1944 wrote to memory of 2036 1944 jdvpd.exe 42 PID 1944 wrote to memory of 2036 1944 jdvpd.exe 42 PID 1944 wrote to memory of 2036 1944 jdvpd.exe 42 PID 2036 wrote to memory of 1408 2036 7ttnhn.exe 43 PID 2036 wrote to memory of 1408 2036 7ttnhn.exe 43 PID 2036 wrote to memory of 1408 2036 7ttnhn.exe 43 PID 2036 wrote to memory of 1408 2036 7ttnhn.exe 43 PID 1408 wrote to memory of 1932 1408 ffxfxfx.exe 44 PID 1408 wrote to memory of 1932 1408 ffxfxfx.exe 44 PID 1408 wrote to memory of 1932 1408 ffxfxfx.exe 44 PID 1408 wrote to memory of 1932 1408 ffxfxfx.exe 44 PID 1932 wrote to memory of 1732 1932 btnbbb.exe 45 PID 1932 wrote to memory of 1732 1932 btnbbb.exe 45 PID 1932 wrote to memory of 1732 1932 btnbbb.exe 45 PID 1932 wrote to memory of 1732 1932 btnbbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe"C:\Users\Admin\AppData\Local\Temp\86b251aa2804f7828b14035ad3141368d058a54c36481b0404180349208eca52.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\ttnbhn.exec:\ttnbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jjdvj.exec:\jjdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\7hhtbh.exec:\7hhtbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\1ddpd.exec:\1ddpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xfrfxrx.exec:\xfrfxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xrrlxfr.exec:\xrrlxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\7nbnhn.exec:\7nbnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\llfxlrf.exec:\llfxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\fflxlxl.exec:\fflxlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\tbtnnt.exec:\tbtnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jdvpd.exec:\jdvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\7ttnhn.exec:\7ttnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\ffxfxfx.exec:\ffxfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\btnbbb.exec:\btnbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\ffxfflx.exec:\ffxfflx.exe17⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tnbhtb.exec:\tnbhtb.exe18⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fxrfxfx.exec:\fxrfxfx.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbbhtb.exec:\bbbhtb.exe20⤵
- Executes dropped EXE
PID:304 -
\??\c:\ffrxlxr.exec:\ffrxlxr.exe21⤵
- Executes dropped EXE
PID:672 -
\??\c:\hbhbhh.exec:\hbhbhh.exe22⤵
- Executes dropped EXE
PID:1108 -
\??\c:\ddvvd.exec:\ddvvd.exe23⤵
- Executes dropped EXE
PID:404 -
\??\c:\rxxfrxr.exec:\rxxfrxr.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jddpd.exec:\jddpd.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xfrlxfr.exec:\xfrlxfr.exe26⤵
- Executes dropped EXE
PID:280 -
\??\c:\pppvj.exec:\pppvj.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:924 -
\??\c:\9nthtb.exec:\9nthtb.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ffrxflx.exec:\ffrxflx.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tbtbtt.exec:\tbtbtt.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\dppdv.exec:\dppdv.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bbbbnt.exec:\bbbbnt.exe33⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vpdjp.exec:\vpdjp.exe34⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3fxxxfr.exec:\3fxxxfr.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ntnbnt.exec:\ntnbnt.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pjjjv.exec:\pjjjv.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1ddpv.exec:\1ddpv.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1ffrlxl.exec:\1ffrlxl.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nnthht.exec:\nnthht.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdpdp.exec:\jdpdp.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3jpjp.exec:\3jpjp.exe42⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3frxlxr.exec:\3frxlxr.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hnhbnb.exec:\hnhbnb.exe44⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3jdjp.exec:\3jdjp.exe45⤵
- Executes dropped EXE
PID:264 -
\??\c:\7lxxflx.exec:\7lxxflx.exe46⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1xlrllx.exec:\1xlrllx.exe47⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9tbnbh.exec:\9tbnbh.exe48⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5vvdj.exec:\5vvdj.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5xxrxfr.exec:\5xxrxfr.exe50⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5xllrrr.exec:\5xllrrr.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbbhbn.exec:\hbbhbn.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5ppdp.exec:\5ppdp.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7xxxrfr.exec:\7xxxrfr.exe54⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nnnhtb.exec:\nnnhtb.exe55⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jjjpd.exec:\jjjpd.exe56⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xlrfxxf.exec:\xlrfxxf.exe57⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bnhhnt.exec:\bnhhnt.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hnhhhn.exec:\hnhhhn.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jjdvj.exec:\jjdvj.exe60⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3frrrrx.exec:\3frrrrx.exe61⤵
- Executes dropped EXE
PID:1516 -
\??\c:\tthhtt.exec:\tthhtt.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jjpdj.exec:\jjpdj.exe63⤵
- Executes dropped EXE
PID:840 -
\??\c:\lrlrllr.exec:\lrlrllr.exe64⤵
- Executes dropped EXE
PID:1860 -
\??\c:\flxlrlx.exec:\flxlrlx.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hnbhhn.exec:\hnbhhn.exe66⤵PID:2420
-
\??\c:\ddvdp.exec:\ddvdp.exe67⤵PID:1340
-
\??\c:\1xrrxff.exec:\1xrrxff.exe68⤵PID:1648
-
\??\c:\rrxxffr.exec:\rrxxffr.exe69⤵PID:280
-
\??\c:\btthth.exec:\btthth.exe70⤵PID:608
-
\??\c:\9vvvp.exec:\9vvvp.exe71⤵PID:568
-
\??\c:\fxfrrrx.exec:\fxfrrrx.exe72⤵PID:2512
-
\??\c:\nntbbn.exec:\nntbbn.exe73⤵PID:584
-
\??\c:\bhbnht.exec:\bhbnht.exe74⤵PID:2352
-
\??\c:\9jjvv.exec:\9jjvv.exe75⤵PID:1560
-
\??\c:\fllxlxr.exec:\fllxlxr.exe76⤵PID:2640
-
\??\c:\hhhtht.exec:\hhhtht.exe77⤵PID:1936
-
\??\c:\7djpp.exec:\7djpp.exe78⤵PID:2776
-
\??\c:\pjvdj.exec:\pjvdj.exe79⤵PID:2432
-
\??\c:\rrlrflx.exec:\rrlrflx.exe80⤵PID:2292
-
\??\c:\5nnbhn.exec:\5nnbhn.exe81⤵PID:2796
-
\??\c:\tthtbh.exec:\tthtbh.exe82⤵PID:2884
-
\??\c:\7dddp.exec:\7dddp.exe83⤵PID:2764
-
\??\c:\lfflllx.exec:\lfflllx.exe84⤵PID:2696
-
\??\c:\lfflxrf.exec:\lfflxrf.exe85⤵PID:2628
-
\??\c:\hbtbhh.exec:\hbtbhh.exe86⤵PID:2608
-
\??\c:\jdddj.exec:\jdddj.exe87⤵PID:1724
-
\??\c:\vpddv.exec:\vpddv.exe88⤵PID:792
-
\??\c:\5fxrxxl.exec:\5fxrxxl.exe89⤵PID:2660
-
\??\c:\1hbbnn.exec:\1hbbnn.exe90⤵PID:2400
-
\??\c:\3ddpj.exec:\3ddpj.exe91⤵PID:2452
-
\??\c:\7dppv.exec:\7dppv.exe92⤵PID:1804
-
\??\c:\3rlfllr.exec:\3rlfllr.exe93⤵PID:1940
-
\??\c:\bthhnn.exec:\bthhnn.exe94⤵PID:1292
-
\??\c:\vvdjp.exec:\vvdjp.exe95⤵PID:1980
-
\??\c:\ppdjj.exec:\ppdjj.exe96⤵PID:2044
-
\??\c:\bthntb.exec:\bthntb.exe97⤵PID:2868
-
\??\c:\7bbnnt.exec:\7bbnnt.exe98⤵PID:1796
-
\??\c:\vdpdp.exec:\vdpdp.exe99⤵PID:1912
-
\??\c:\xrffrfx.exec:\xrffrfx.exe100⤵PID:2760
-
\??\c:\nnhtnt.exec:\nnhtnt.exe101⤵PID:1032
-
\??\c:\tnbhnt.exec:\tnbhnt.exe102⤵PID:1960
-
\??\c:\dvdjj.exec:\dvdjj.exe103⤵PID:2228
-
\??\c:\xffrrrf.exec:\xffrrrf.exe104⤵PID:2520
-
\??\c:\htttbh.exec:\htttbh.exe105⤵PID:672
-
\??\c:\tbtnnb.exec:\tbtnnb.exe106⤵PID:276
-
\??\c:\9dvvj.exec:\9dvvj.exe107⤵PID:1136
-
\??\c:\1rfrxfr.exec:\1rfrxfr.exe108⤵PID:2192
-
\??\c:\3bthnt.exec:\3bthnt.exe109⤵PID:1288
-
\??\c:\tntbbh.exec:\tntbbh.exe110⤵PID:1580
-
\??\c:\ddvdp.exec:\ddvdp.exe111⤵PID:1744
-
\??\c:\llflrrl.exec:\llflrrl.exe112⤵
- System Location Discovery: System Language Discovery
PID:492 -
\??\c:\nbhbtn.exec:\nbhbtn.exe113⤵PID:1596
-
\??\c:\bbtnbb.exec:\bbtnbb.exe114⤵PID:2544
-
\??\c:\5djpp.exec:\5djpp.exe115⤵PID:1320
-
\??\c:\3nbhnh.exec:\3nbhnh.exe116⤵PID:1488
-
\??\c:\9vvdp.exec:\9vvdp.exe117⤵PID:2280
-
\??\c:\rlflrxf.exec:\rlflrxf.exe118⤵PID:316
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe119⤵PID:2152
-
\??\c:\hnhthn.exec:\hnhthn.exe120⤵PID:2064
-
\??\c:\ddppd.exec:\ddppd.exe121⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-