Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe
-
Size
454KB
-
MD5
69de2ccc40fe836f46b5fae2ae0be430
-
SHA1
8cf717c813d6fade774d81780f442da89a413215
-
SHA256
5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795
-
SHA512
873335c56886fedf0615f0add68c0499b83ba36674306494f7301ad63094bb30cf9bd21b9cf19f1e30edb20cac91065badcb7df046deacadb3538d1318e9e9b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetq:q7Tc2NYHUrAwfMp3CDtq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2280-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-546-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2728-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-603-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2892-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-1016-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2284 nhtbhn.exe 2768 dvjdj.exe 2968 lfrxlrf.exe 2808 3hbbbh.exe 2604 rrffrrf.exe 948 9lffllf.exe 2684 9hnnbn.exe 3052 dpddj.exe 2072 lfrxxrf.exe 2880 nhtthh.exe 2936 1vvpv.exe 1640 rfrfflr.exe 2312 thbnnn.exe 1440 pddjp.exe 668 xrlrxxr.exe 3044 3fxflfl.exe 1224 nnhthn.exe 1260 xxlrffl.exe 2384 tnhhnb.exe 2244 ppppd.exe 2428 5frrlfl.exe 2324 hhbbhh.exe 2372 ppjjp.exe 1676 tnbnbn.exe 316 tnbhtt.exe 588 bbbnhh.exe 2404 3ppdp.exe 568 7lxxflr.exe 352 7ppvd.exe 2032 bbbnbn.exe 1444 vjdvv.exe 1588 hbbhnn.exe 1340 vdvvp.exe 2712 nttnnt.exe 2760 vdddp.exe 2392 9lfflfl.exe 2836 nnhnhh.exe 2808 1pddj.exe 2780 dvpjj.exe 2584 lxllrlr.exe 3048 nbhbnh.exe 3064 vvjpp.exe 1372 dpddj.exe 2616 1xlffff.exe 2856 thbhhh.exe 2408 btnnbb.exe 1796 9vdjj.exe 1640 rlxfllx.exe 2920 1tbbtn.exe 1592 bnbnbb.exe 1192 djdjd.exe 2624 fxlffll.exe 1936 1bntnt.exe 1500 btttbh.exe 2660 7dpvv.exe 2444 xrfrflx.exe 2264 tnhbnt.exe 2428 dvvvj.exe 2208 5lxxxxx.exe 2192 rlxrffr.exe 2448 tnbtbn.exe 3036 5pjpp.exe 1648 1rlrflf.exe 1576 tthnnh.exe -
resource yara_rule behavioral1/memory/2280-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-992-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-1016-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2640-1136-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2284 2280 5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe 31 PID 2280 wrote to memory of 2284 2280 5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe 31 PID 2280 wrote to memory of 2284 2280 5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe 31 PID 2280 wrote to memory of 2284 2280 5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe 31 PID 2284 wrote to memory of 2768 2284 nhtbhn.exe 32 PID 2284 wrote to memory of 2768 2284 nhtbhn.exe 32 PID 2284 wrote to memory of 2768 2284 nhtbhn.exe 32 PID 2284 wrote to memory of 2768 2284 nhtbhn.exe 32 PID 2768 wrote to memory of 2968 2768 dvjdj.exe 33 PID 2768 wrote to memory of 2968 2768 dvjdj.exe 33 PID 2768 wrote to memory of 2968 2768 dvjdj.exe 33 PID 2768 wrote to memory of 2968 2768 dvjdj.exe 33 PID 2968 wrote to memory of 2808 2968 lfrxlrf.exe 34 PID 2968 wrote to memory of 2808 2968 lfrxlrf.exe 34 PID 2968 wrote to memory of 2808 2968 lfrxlrf.exe 34 PID 2968 wrote to memory of 2808 2968 lfrxlrf.exe 34 PID 2808 wrote to memory of 2604 2808 3hbbbh.exe 35 PID 2808 wrote to memory of 2604 2808 3hbbbh.exe 35 PID 2808 wrote to memory of 2604 2808 3hbbbh.exe 35 PID 2808 wrote to memory of 2604 2808 3hbbbh.exe 35 PID 2604 wrote to memory of 948 2604 rrffrrf.exe 36 PID 2604 wrote to memory of 948 2604 rrffrrf.exe 36 PID 2604 wrote to memory of 948 2604 rrffrrf.exe 36 PID 2604 wrote to memory of 948 2604 rrffrrf.exe 36 PID 948 wrote to memory of 2684 948 9lffllf.exe 37 PID 948 wrote to memory of 2684 948 9lffllf.exe 37 PID 948 wrote to memory of 2684 948 9lffllf.exe 37 PID 948 wrote to memory of 2684 948 9lffllf.exe 37 PID 2684 wrote to memory of 3052 2684 9hnnbn.exe 38 PID 2684 wrote to memory of 3052 2684 9hnnbn.exe 38 PID 2684 wrote to memory of 3052 2684 9hnnbn.exe 38 PID 2684 wrote to memory of 3052 2684 9hnnbn.exe 38 PID 3052 wrote to memory of 2072 3052 dpddj.exe 39 PID 3052 wrote to memory of 2072 3052 dpddj.exe 39 PID 3052 wrote to memory of 2072 3052 dpddj.exe 39 PID 3052 wrote to memory of 2072 3052 dpddj.exe 39 PID 2072 wrote to memory of 2880 2072 lfrxxrf.exe 40 PID 2072 wrote to memory of 2880 2072 lfrxxrf.exe 40 PID 2072 wrote to memory of 2880 2072 lfrxxrf.exe 40 PID 2072 wrote to memory of 2880 2072 lfrxxrf.exe 40 PID 2880 wrote to memory of 2936 2880 nhtthh.exe 41 PID 2880 wrote to memory of 2936 2880 nhtthh.exe 41 PID 2880 wrote to memory of 2936 2880 nhtthh.exe 41 PID 2880 wrote to memory of 2936 2880 nhtthh.exe 41 PID 2936 wrote to memory of 1640 2936 1vvpv.exe 42 PID 2936 wrote to memory of 1640 2936 1vvpv.exe 42 PID 2936 wrote to memory of 1640 2936 1vvpv.exe 42 PID 2936 wrote to memory of 1640 2936 1vvpv.exe 42 PID 1640 wrote to memory of 2312 1640 rfrfflr.exe 43 PID 1640 wrote to memory of 2312 1640 rfrfflr.exe 43 PID 1640 wrote to memory of 2312 1640 rfrfflr.exe 43 PID 1640 wrote to memory of 2312 1640 rfrfflr.exe 43 PID 2312 wrote to memory of 1440 2312 thbnnn.exe 44 PID 2312 wrote to memory of 1440 2312 thbnnn.exe 44 PID 2312 wrote to memory of 1440 2312 thbnnn.exe 44 PID 2312 wrote to memory of 1440 2312 thbnnn.exe 44 PID 1440 wrote to memory of 668 1440 pddjp.exe 45 PID 1440 wrote to memory of 668 1440 pddjp.exe 45 PID 1440 wrote to memory of 668 1440 pddjp.exe 45 PID 1440 wrote to memory of 668 1440 pddjp.exe 45 PID 668 wrote to memory of 3044 668 xrlrxxr.exe 46 PID 668 wrote to memory of 3044 668 xrlrxxr.exe 46 PID 668 wrote to memory of 3044 668 xrlrxxr.exe 46 PID 668 wrote to memory of 3044 668 xrlrxxr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe"C:\Users\Admin\AppData\Local\Temp\5f400068eec9a92ba67a2f0c221d1af1fcbb855c3fabc0b5f3cb81f8abeed795N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nhtbhn.exec:\nhtbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dvjdj.exec:\dvjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\3hbbbh.exec:\3hbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rrffrrf.exec:\rrffrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\9lffllf.exec:\9lffllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\9hnnbn.exec:\9hnnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dpddj.exec:\dpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\lfrxxrf.exec:\lfrxxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nhtthh.exec:\nhtthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\1vvpv.exec:\1vvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\rfrfflr.exec:\rfrfflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\thbnnn.exec:\thbnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\pddjp.exec:\pddjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\3fxflfl.exec:\3fxflfl.exe17⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nnhthn.exec:\nnhthn.exe18⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xxlrffl.exec:\xxlrffl.exe19⤵
- Executes dropped EXE
PID:1260 -
\??\c:\tnhhnb.exec:\tnhhnb.exe20⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ppppd.exec:\ppppd.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5frrlfl.exec:\5frrlfl.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hhbbhh.exec:\hhbbhh.exe23⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ppjjp.exec:\ppjjp.exe24⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tnbnbn.exec:\tnbnbn.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tnbhtt.exec:\tnbhtt.exe26⤵
- Executes dropped EXE
PID:316 -
\??\c:\bbbnhh.exec:\bbbnhh.exe27⤵
- Executes dropped EXE
PID:588 -
\??\c:\3ppdp.exec:\3ppdp.exe28⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7lxxflr.exec:\7lxxflr.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\7ppvd.exec:\7ppvd.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:352 -
\??\c:\bbbnbn.exec:\bbbnbn.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vjdvv.exec:\vjdvv.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hbbhnn.exec:\hbbhnn.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vdvvp.exec:\vdvvp.exe34⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nttnnt.exec:\nttnnt.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\vdddp.exec:\vdddp.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9lfflfl.exec:\9lfflfl.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nnhnhh.exec:\nnhnhh.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1pddj.exec:\1pddj.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvpjj.exec:\dvpjj.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lxllrlr.exec:\lxllrlr.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nbhbnh.exec:\nbhbnh.exe42⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vvjpp.exec:\vvjpp.exe43⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dpddj.exec:\dpddj.exe44⤵
- Executes dropped EXE
PID:1372 -
\??\c:\1xlffff.exec:\1xlffff.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\thbhhh.exec:\thbhhh.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\btnnbb.exec:\btnnbb.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9vdjj.exec:\9vdjj.exe48⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rlxfllx.exec:\rlxfllx.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1tbbtn.exec:\1tbbtn.exe50⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bnbnbb.exec:\bnbnbb.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\djdjd.exec:\djdjd.exe52⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fxlffll.exec:\fxlffll.exe53⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1bntnt.exec:\1bntnt.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\btttbh.exec:\btttbh.exe55⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7dpvv.exec:\7dpvv.exe56⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xrfrflx.exec:\xrfrflx.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tnhbnt.exec:\tnhbnt.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dvvvj.exec:\dvvvj.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5lxxxxx.exec:\5lxxxxx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208 -
\??\c:\rlxrffr.exec:\rlxrffr.exe61⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tnbtbn.exec:\tnbtbn.exe62⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5pjpp.exec:\5pjpp.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1rlrflf.exec:\1rlrflf.exe64⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tthnnh.exec:\tthnnh.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nhtbbb.exec:\nhtbbb.exe66⤵PID:3008
-
\??\c:\jddjp.exec:\jddjp.exe67⤵PID:1712
-
\??\c:\xrllxfl.exec:\xrllxfl.exe68⤵PID:1004
-
\??\c:\9btbbb.exec:\9btbbb.exe69⤵PID:1064
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:1528
-
\??\c:\rlfxffl.exec:\rlfxffl.exe71⤵PID:744
-
\??\c:\xxrxflx.exec:\xxrxflx.exe72⤵PID:2068
-
\??\c:\7tnbnn.exec:\7tnbnn.exe73⤵PID:1264
-
\??\c:\jjddp.exec:\jjddp.exe74⤵PID:2056
-
\??\c:\lfrrrxr.exec:\lfrrrxr.exe75⤵PID:2204
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe76⤵PID:2284
-
\??\c:\tnhtbt.exec:\tnhtbt.exe77⤵PID:2792
-
\??\c:\ddvvv.exec:\ddvvv.exe78⤵PID:2696
-
\??\c:\7rxfffl.exec:\7rxfffl.exe79⤵PID:1652
-
\??\c:\frrrxfl.exec:\frrrxfl.exe80⤵PID:2800
-
\??\c:\9tnnnt.exec:\9tnnnt.exe81⤵PID:2728
-
\??\c:\vpddd.exec:\vpddd.exe82⤵PID:2576
-
\??\c:\9xfxffl.exec:\9xfxffl.exe83⤵PID:2596
-
\??\c:\7bntbb.exec:\7bntbb.exe84⤵PID:3048
-
\??\c:\3vvdp.exec:\3vvdp.exe85⤵PID:3052
-
\??\c:\dpddj.exec:\dpddj.exe86⤵PID:2892
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe87⤵PID:2676
-
\??\c:\hbtntb.exec:\hbtntb.exe88⤵PID:2936
-
\??\c:\nhtbtb.exec:\nhtbtb.exe89⤵PID:2012
-
\??\c:\vjddd.exec:\vjddd.exe90⤵PID:2316
-
\??\c:\lflrlrx.exec:\lflrlrx.exe91⤵PID:1220
-
\??\c:\nhtnbb.exec:\nhtnbb.exe92⤵PID:2852
-
\??\c:\1tnntb.exec:\1tnntb.exe93⤵PID:2740
-
\??\c:\pjpvj.exec:\pjpvj.exe94⤵PID:2008
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe95⤵PID:2624
-
\??\c:\llfffxl.exec:\llfffxl.exe96⤵PID:680
-
\??\c:\nbnbbt.exec:\nbnbbt.exe97⤵PID:1584
-
\??\c:\pjpdj.exec:\pjpdj.exe98⤵PID:1996
-
\??\c:\xrfxfrf.exec:\xrfxfrf.exe99⤵PID:824
-
\??\c:\rrflrrf.exec:\rrflrrf.exe100⤵PID:2380
-
\??\c:\bthhnn.exec:\bthhnn.exe101⤵PID:2428
-
\??\c:\jvpdp.exec:\jvpdp.exe102⤵PID:2168
-
\??\c:\fxrllfl.exec:\fxrllfl.exe103⤵PID:2984
-
\??\c:\1rfllrr.exec:\1rfllrr.exe104⤵PID:2188
-
\??\c:\bbnthh.exec:\bbnthh.exe105⤵PID:1484
-
\??\c:\jdpjp.exec:\jdpjp.exe106⤵PID:1284
-
\??\c:\9rxrrll.exec:\9rxrrll.exe107⤵PID:1292
-
\??\c:\xlrxlfr.exec:\xlrxlfr.exe108⤵PID:1720
-
\??\c:\thtbhn.exec:\thtbhn.exe109⤵PID:2360
-
\??\c:\dvdvd.exec:\dvdvd.exe110⤵PID:2364
-
\??\c:\5rxflrx.exec:\5rxflrx.exe111⤵PID:2096
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe112⤵PID:2044
-
\??\c:\tnbbnt.exec:\tnbbnt.exe113⤵PID:900
-
\??\c:\9ppvd.exec:\9ppvd.exe114⤵PID:1960
-
\??\c:\9jvvv.exec:\9jvvv.exe115⤵PID:1588
-
\??\c:\llflrlr.exec:\llflrlr.exe116⤵PID:2672
-
\??\c:\hbtbhh.exec:\hbtbhh.exe117⤵PID:2772
-
\??\c:\btnhnn.exec:\btnhnn.exe118⤵PID:1544
-
\??\c:\vpjdp.exec:\vpjdp.exe119⤵PID:2288
-
\??\c:\xlllrlr.exec:\xlllrlr.exe120⤵PID:2912
-
\??\c:\7fxrrlx.exec:\7fxrrlx.exe121⤵PID:532
-
\??\c:\thhntt.exec:\thhntt.exe122⤵PID:2568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-