Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe
-
Size
456KB
-
MD5
a0fefd8e7c11a9c2882b6d5c3e71d2b0
-
SHA1
4f0f082365e513624c3ad3ac8f85cb1cf9e8940d
-
SHA256
dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392db
-
SHA512
d19b343eff80ce98df73cd5260931791224f20f612e884fb6a1130d355dd2e16bf9f0543c83c259d6d559e2e4fda26527f72068b2f398486a2ed4db00dc32c0c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRk:q7Tc2NYHUrAwfMp3CDRk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2260-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-22-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2252-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-186-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1132-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-198-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2192-268-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1728-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-329-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2824-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-460-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1760-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-619-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2028-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-796-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3044-878-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2092-881-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2252 vvpvj.exe 2680 ffxxxlr.exe 2700 nbnbnb.exe 2688 1tnnbh.exe 2764 djjvj.exe 2916 nnthht.exe 2644 1pvdj.exe 1920 7hhnbn.exe 1992 djjjd.exe 3020 1bbhnn.exe 1692 7xrrxrx.exe 2888 nbnnbt.exe 1972 1dddj.exe 2196 fxfrfrf.exe 1320 jvpjp.exe 1284 hhthhn.exe 2808 3jdjj.exe 1812 tbbntb.exe 1760 ddvjp.exe 1680 5tbbbh.exe 1716 ntnnhn.exe 1132 1frrxrf.exe 1956 hhthth.exe 1028 nthnbn.exe 1784 dvvdp.exe 1708 tttbnt.exe 1040 ttnbtb.exe 3036 xxlrfll.exe 2192 ppjpv.exe 664 bttbhh.exe 1728 hbhtnt.exe 860 llflfrl.exe 1144 nhbhht.exe 2848 5frxxxf.exe 2676 1frxffx.exe 2860 1bhttt.exe 2712 dpdvv.exe 2824 ffxfxff.exe 2696 7tthtb.exe 2708 jjjpj.exe 1804 xxlrlfl.exe 1592 ttnthh.exe 2600 5pdpv.exe 1232 xrrrxfx.exe 1432 hnthbh.exe 2124 pppvj.exe 2356 pjdjv.exe 2556 5rllrrf.exe 1692 btnnth.exe 2888 1jppv.exe 2272 jdvvd.exe 568 xxrfxfr.exe 684 tntbtb.exe 756 pdjpv.exe 2776 lrxfxff.exe 1764 lflrxxl.exe 2232 bbthth.exe 2144 jjdjd.exe 1760 rrlxlfx.exe 1928 7thhtb.exe 1596 htnbtb.exe 2072 jjdjj.exe 1132 7xxrfrr.exe 1752 nnnbtn.exe -
resource yara_rule behavioral1/memory/2252-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-268-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1728-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-796-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2512-865-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2252 2260 dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe 30 PID 2260 wrote to memory of 2252 2260 dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe 30 PID 2260 wrote to memory of 2252 2260 dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe 30 PID 2260 wrote to memory of 2252 2260 dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe 30 PID 2252 wrote to memory of 2680 2252 vvpvj.exe 31 PID 2252 wrote to memory of 2680 2252 vvpvj.exe 31 PID 2252 wrote to memory of 2680 2252 vvpvj.exe 31 PID 2252 wrote to memory of 2680 2252 vvpvj.exe 31 PID 2680 wrote to memory of 2700 2680 ffxxxlr.exe 32 PID 2680 wrote to memory of 2700 2680 ffxxxlr.exe 32 PID 2680 wrote to memory of 2700 2680 ffxxxlr.exe 32 PID 2680 wrote to memory of 2700 2680 ffxxxlr.exe 32 PID 2700 wrote to memory of 2688 2700 nbnbnb.exe 33 PID 2700 wrote to memory of 2688 2700 nbnbnb.exe 33 PID 2700 wrote to memory of 2688 2700 nbnbnb.exe 33 PID 2700 wrote to memory of 2688 2700 nbnbnb.exe 33 PID 2688 wrote to memory of 2764 2688 1tnnbh.exe 34 PID 2688 wrote to memory of 2764 2688 1tnnbh.exe 34 PID 2688 wrote to memory of 2764 2688 1tnnbh.exe 34 PID 2688 wrote to memory of 2764 2688 1tnnbh.exe 34 PID 2764 wrote to memory of 2916 2764 djjvj.exe 35 PID 2764 wrote to memory of 2916 2764 djjvj.exe 35 PID 2764 wrote to memory of 2916 2764 djjvj.exe 35 PID 2764 wrote to memory of 2916 2764 djjvj.exe 35 PID 2916 wrote to memory of 2644 2916 nnthht.exe 36 PID 2916 wrote to memory of 2644 2916 nnthht.exe 36 PID 2916 wrote to memory of 2644 2916 nnthht.exe 36 PID 2916 wrote to memory of 2644 2916 nnthht.exe 36 PID 2644 wrote to memory of 1920 2644 1pvdj.exe 37 PID 2644 wrote to memory of 1920 2644 1pvdj.exe 37 PID 2644 wrote to memory of 1920 2644 1pvdj.exe 37 PID 2644 wrote to memory of 1920 2644 1pvdj.exe 37 PID 1920 wrote to memory of 1992 1920 7hhnbn.exe 38 PID 1920 wrote to memory of 1992 1920 7hhnbn.exe 38 PID 1920 wrote to memory of 1992 1920 7hhnbn.exe 38 PID 1920 wrote to memory of 1992 1920 7hhnbn.exe 38 PID 1992 wrote to memory of 3020 1992 djjjd.exe 39 PID 1992 wrote to memory of 3020 1992 djjjd.exe 39 PID 1992 wrote to memory of 3020 1992 djjjd.exe 39 PID 1992 wrote to memory of 3020 1992 djjjd.exe 39 PID 3020 wrote to memory of 1692 3020 1bbhnn.exe 40 PID 3020 wrote to memory of 1692 3020 1bbhnn.exe 40 PID 3020 wrote to memory of 1692 3020 1bbhnn.exe 40 PID 3020 wrote to memory of 1692 3020 1bbhnn.exe 40 PID 1692 wrote to memory of 2888 1692 7xrrxrx.exe 41 PID 1692 wrote to memory of 2888 1692 7xrrxrx.exe 41 PID 1692 wrote to memory of 2888 1692 7xrrxrx.exe 41 PID 1692 wrote to memory of 2888 1692 7xrrxrx.exe 41 PID 2888 wrote to memory of 1972 2888 nbnnbt.exe 42 PID 2888 wrote to memory of 1972 2888 nbnnbt.exe 42 PID 2888 wrote to memory of 1972 2888 nbnnbt.exe 42 PID 2888 wrote to memory of 1972 2888 nbnnbt.exe 42 PID 1972 wrote to memory of 2196 1972 1dddj.exe 43 PID 1972 wrote to memory of 2196 1972 1dddj.exe 43 PID 1972 wrote to memory of 2196 1972 1dddj.exe 43 PID 1972 wrote to memory of 2196 1972 1dddj.exe 43 PID 2196 wrote to memory of 1320 2196 fxfrfrf.exe 44 PID 2196 wrote to memory of 1320 2196 fxfrfrf.exe 44 PID 2196 wrote to memory of 1320 2196 fxfrfrf.exe 44 PID 2196 wrote to memory of 1320 2196 fxfrfrf.exe 44 PID 1320 wrote to memory of 1284 1320 jvpjp.exe 45 PID 1320 wrote to memory of 1284 1320 jvpjp.exe 45 PID 1320 wrote to memory of 1284 1320 jvpjp.exe 45 PID 1320 wrote to memory of 1284 1320 jvpjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe"C:\Users\Admin\AppData\Local\Temp\dbf9b57a3380e5d99d8c0c4247805f02052274f70d76117696cc85322b0392dbN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\vvpvj.exec:\vvpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\ffxxxlr.exec:\ffxxxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nbnbnb.exec:\nbnbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1tnnbh.exec:\1tnnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\djjvj.exec:\djjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nnthht.exec:\nnthht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\1pvdj.exec:\1pvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7hhnbn.exec:\7hhnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\djjjd.exec:\djjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\1bbhnn.exec:\1bbhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\7xrrxrx.exec:\7xrrxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\nbnnbt.exec:\nbnnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1dddj.exec:\1dddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\fxfrfrf.exec:\fxfrfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\jvpjp.exec:\jvpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\hhthhn.exec:\hhthhn.exe17⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3jdjj.exec:\3jdjj.exe18⤵
- Executes dropped EXE
PID:2808 -
\??\c:\tbbntb.exec:\tbbntb.exe19⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ddvjp.exec:\ddvjp.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\5tbbbh.exec:\5tbbbh.exe21⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ntnnhn.exec:\ntnnhn.exe22⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1frrxrf.exec:\1frrxrf.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\hhthth.exec:\hhthth.exe24⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nthnbn.exec:\nthnbn.exe25⤵
- Executes dropped EXE
PID:1028 -
\??\c:\dvvdp.exec:\dvvdp.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tttbnt.exec:\tttbnt.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ttnbtb.exec:\ttnbtb.exe28⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xxlrfll.exec:\xxlrfll.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppjpv.exec:\ppjpv.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bttbhh.exec:\bttbhh.exe31⤵
- Executes dropped EXE
PID:664 -
\??\c:\hbhtnt.exec:\hbhtnt.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\llflfrl.exec:\llflfrl.exe33⤵
- Executes dropped EXE
PID:860 -
\??\c:\nhbhht.exec:\nhbhht.exe34⤵
- Executes dropped EXE
PID:1144 -
\??\c:\5frxxxf.exec:\5frxxxf.exe35⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1frxffx.exec:\1frxffx.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1bhttt.exec:\1bhttt.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dpdvv.exec:\dpdvv.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ffxfxff.exec:\ffxfxff.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7tthtb.exec:\7tthtb.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jjjpj.exec:\jjjpj.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xxlrlfl.exec:\xxlrlfl.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ttnthh.exec:\ttnthh.exe43⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5pdpv.exec:\5pdpv.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xrrrxfx.exec:\xrrrxfx.exe45⤵
- Executes dropped EXE
PID:1232 -
\??\c:\hnthbh.exec:\hnthbh.exe46⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pppvj.exec:\pppvj.exe47⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjdjv.exec:\pjdjv.exe48⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5rllrrf.exec:\5rllrrf.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\btnnth.exec:\btnnth.exe50⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1jppv.exec:\1jppv.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdvvd.exec:\jdvvd.exe52⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xxrfxfr.exec:\xxrfxfr.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:568 -
\??\c:\tntbtb.exec:\tntbtb.exe54⤵
- Executes dropped EXE
PID:684 -
\??\c:\pdjpv.exec:\pdjpv.exe55⤵
- Executes dropped EXE
PID:756 -
\??\c:\lrxfxff.exec:\lrxfxff.exe56⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lflrxxl.exec:\lflrxxl.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bbthth.exec:\bbthth.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jjdjd.exec:\jjdjd.exe59⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rrlxlfx.exec:\rrlxlfx.exe60⤵
- Executes dropped EXE
PID:1760 -
\??\c:\7thhtb.exec:\7thhtb.exe61⤵
- Executes dropped EXE
PID:1928 -
\??\c:\htnbtb.exec:\htnbtb.exe62⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jjdjj.exec:\jjdjj.exe63⤵
- Executes dropped EXE
PID:2072 -
\??\c:\7xxrfrr.exec:\7xxrfrr.exe64⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nnnbtn.exec:\nnnbtn.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pvdpv.exec:\pvdpv.exe66⤵PID:2672
-
\??\c:\9llrlrl.exec:\9llrlrl.exe67⤵PID:2540
-
\??\c:\bhhnbn.exec:\bhhnbn.exe68⤵PID:2508
-
\??\c:\7pjjv.exec:\7pjjv.exe69⤵PID:1652
-
\??\c:\pjjpv.exec:\pjjpv.exe70⤵PID:2084
-
\??\c:\rxxlxfx.exec:\rxxlxfx.exe71⤵PID:1684
-
\??\c:\ttnbhh.exec:\ttnbhh.exe72⤵PID:1984
-
\??\c:\jdjvj.exec:\jdjvj.exe73⤵PID:2104
-
\??\c:\dddvv.exec:\dddvv.exe74⤵PID:664
-
\??\c:\lrlllxl.exec:\lrlllxl.exe75⤵PID:2512
-
\??\c:\hhhnbn.exec:\hhhnbn.exe76⤵PID:1444
-
\??\c:\ddpdp.exec:\ddpdp.exe77⤵PID:2092
-
\??\c:\ddvdv.exec:\ddvdv.exe78⤵PID:1580
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe79⤵PID:2252
-
\??\c:\bbtnht.exec:\bbtnht.exe80⤵PID:2864
-
\??\c:\dvvjv.exec:\dvvjv.exe81⤵PID:2844
-
\??\c:\vdjpd.exec:\vdjpd.exe82⤵PID:2872
-
\??\c:\fxlrlxl.exec:\fxlrlxl.exe83⤵PID:1328
-
\??\c:\bhhtht.exec:\bhhtht.exe84⤵PID:2696
-
\??\c:\5vvdp.exec:\5vvdp.exe85⤵PID:2584
-
\??\c:\7rxfflf.exec:\7rxfflf.exe86⤵PID:2636
-
\??\c:\7fxrflf.exec:\7fxrflf.exe87⤵PID:2156
-
\??\c:\hhbntn.exec:\hhbntn.exe88⤵PID:2644
-
\??\c:\jddpd.exec:\jddpd.exe89⤵PID:1052
-
\??\c:\1rlllrl.exec:\1rlllrl.exe90⤵PID:1856
-
\??\c:\llffrfr.exec:\llffrfr.exe91⤵PID:2408
-
\??\c:\1tbnbn.exec:\1tbnbn.exe92⤵PID:1868
-
\??\c:\vvpvj.exec:\vvpvj.exe93⤵PID:2284
-
\??\c:\3dppd.exec:\3dppd.exe94⤵PID:2896
-
\??\c:\xflrfrf.exec:\xflrfrf.exe95⤵PID:2020
-
\??\c:\nnbbnn.exec:\nnbbnn.exe96⤵PID:1972
-
\??\c:\9dddj.exec:\9dddj.exe97⤵
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\djdpd.exec:\djdpd.exe98⤵PID:776
-
\??\c:\xrllrxf.exec:\xrllrxf.exe99⤵PID:1624
-
\??\c:\3nhnth.exec:\3nhnth.exe100⤵PID:2376
-
\??\c:\jpppp.exec:\jpppp.exe101⤵PID:2808
-
\??\c:\xxrrflx.exec:\xxrrflx.exe102⤵PID:2132
-
\??\c:\xxrxrlx.exec:\xxrxrlx.exe103⤵PID:1388
-
\??\c:\bbhbth.exec:\bbhbth.exe104⤵PID:1792
-
\??\c:\dddvj.exec:\dddvj.exe105⤵PID:948
-
\??\c:\lrxfxfx.exec:\lrxfxfx.exe106⤵PID:2164
-
\??\c:\nnhtnt.exec:\nnhtnt.exe107⤵PID:944
-
\??\c:\pvpvj.exec:\pvpvj.exe108⤵PID:1952
-
\??\c:\rllrlrl.exec:\rllrlrl.exe109⤵PID:2532
-
\??\c:\tbbtnb.exec:\tbbtnb.exe110⤵PID:1772
-
\??\c:\7jjpp.exec:\7jjpp.exe111⤵PID:1724
-
\??\c:\9jdjd.exec:\9jdjd.exe112⤵PID:608
-
\??\c:\9fxrrfr.exec:\9fxrrfr.exe113⤵PID:1848
-
\??\c:\hbnbnb.exec:\hbnbnb.exe114⤵PID:3040
-
\??\c:\vdjpj.exec:\vdjpj.exe115⤵PID:1684
-
\??\c:\vppvj.exec:\vppvj.exe116⤵PID:2544
-
\??\c:\rrrxlxr.exec:\rrrxlxr.exe117⤵PID:3044
-
\??\c:\ntnthn.exec:\ntnthn.exe118⤵PID:2068
-
\??\c:\thnnbt.exec:\thnnbt.exe119⤵PID:2512
-
\??\c:\pjjvj.exec:\pjjvj.exe120⤵PID:1444
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe121⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-