Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 22:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe
-
Size
456KB
-
MD5
7a1ccf2ceaa62d92bbf643ef96ad2530
-
SHA1
ae97bfbb6d9d4f2aa9b127c9e6c081bbdcdd16d0
-
SHA256
ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179
-
SHA512
c1c3de82217e7637fd575a43eda9aa26674ec360dff3dfc33305f60c4282937b5cfc62c526d96b164981c5c383a5a51f39c1b3e76464fddc6d021973fbf09bf6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-91-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-139-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2712-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-235-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-359-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2364-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-604-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2892-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-626-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-672-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1292 nbttbb.exe 2280 5vpjd.exe 2920 llxflfl.exe 2720 jvjdd.exe 2896 rfrrrxl.exe 2820 nhbbhh.exe 2772 thtbhh.exe 2976 3pvpd.exe 1048 fxrxffr.exe 2732 jdjpd.exe 2168 rlrlrxf.exe 832 btnnbt.exe 1616 vpvjv.exe 2712 llfrrfx.exe 2944 thttbb.exe 2204 vdvjv.exe 1932 9tbhtb.exe 1764 pvppj.exe 388 7rlrlrf.exe 2592 dvjjd.exe 320 vpvvp.exe 848 bbnthn.exe 1140 pjvdd.exe 2160 rfrxfxf.exe 236 hnhntn.exe 1692 vpppv.exe 1028 9bnnnt.exe 2276 lfrrlll.exe 1484 thhbbb.exe 1500 xxxlxfl.exe 2440 bthtbb.exe 1748 vvjpd.exe 1600 5lxxrxx.exe 2508 5bnnnn.exe 2464 ddjpv.exe 2920 dvjvj.exe 2852 1nnthn.exe 2832 nnhtnb.exe 2728 ddpvd.exe 2956 1frrrrx.exe 2364 nbnhhb.exe 2816 dvppv.exe 2668 7jpjp.exe 2904 3lxrrlr.exe 2732 nhtttb.exe 1404 ddppp.exe 1012 dvdvv.exe 2828 lfxrxxf.exe 2292 fxrxflr.exe 2940 nnhthn.exe 2028 7jjvv.exe 2996 dpjdd.exe 2708 xlflxxx.exe 2012 tnntbh.exe 2104 hthntn.exe 2412 7dvvv.exe 2092 xrrfffl.exe 2148 xrffllr.exe 484 1bhbtt.exe 1628 tnbttn.exe 1084 3vppv.exe 2432 7xffxfl.exe 1856 tthnnh.exe 928 vjvjj.exe -
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-906-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-989-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-996-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1292 2420 ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe 30 PID 2420 wrote to memory of 1292 2420 ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe 30 PID 2420 wrote to memory of 1292 2420 ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe 30 PID 2420 wrote to memory of 1292 2420 ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe 30 PID 1292 wrote to memory of 2280 1292 nbttbb.exe 31 PID 1292 wrote to memory of 2280 1292 nbttbb.exe 31 PID 1292 wrote to memory of 2280 1292 nbttbb.exe 31 PID 1292 wrote to memory of 2280 1292 nbttbb.exe 31 PID 2280 wrote to memory of 2920 2280 5vpjd.exe 32 PID 2280 wrote to memory of 2920 2280 5vpjd.exe 32 PID 2280 wrote to memory of 2920 2280 5vpjd.exe 32 PID 2280 wrote to memory of 2920 2280 5vpjd.exe 32 PID 2920 wrote to memory of 2720 2920 llxflfl.exe 33 PID 2920 wrote to memory of 2720 2920 llxflfl.exe 33 PID 2920 wrote to memory of 2720 2920 llxflfl.exe 33 PID 2920 wrote to memory of 2720 2920 llxflfl.exe 33 PID 2720 wrote to memory of 2896 2720 jvjdd.exe 34 PID 2720 wrote to memory of 2896 2720 jvjdd.exe 34 PID 2720 wrote to memory of 2896 2720 jvjdd.exe 34 PID 2720 wrote to memory of 2896 2720 jvjdd.exe 34 PID 2896 wrote to memory of 2820 2896 rfrrrxl.exe 35 PID 2896 wrote to memory of 2820 2896 rfrrrxl.exe 35 PID 2896 wrote to memory of 2820 2896 rfrrrxl.exe 35 PID 2896 wrote to memory of 2820 2896 rfrrrxl.exe 35 PID 2820 wrote to memory of 2772 2820 nhbbhh.exe 36 PID 2820 wrote to memory of 2772 2820 nhbbhh.exe 36 PID 2820 wrote to memory of 2772 2820 nhbbhh.exe 36 PID 2820 wrote to memory of 2772 2820 nhbbhh.exe 36 PID 2772 wrote to memory of 2976 2772 thtbhh.exe 37 PID 2772 wrote to memory of 2976 2772 thtbhh.exe 37 PID 2772 wrote to memory of 2976 2772 thtbhh.exe 37 PID 2772 wrote to memory of 2976 2772 thtbhh.exe 37 PID 2976 wrote to memory of 1048 2976 3pvpd.exe 38 PID 2976 wrote to memory of 1048 2976 3pvpd.exe 38 PID 2976 wrote to memory of 1048 2976 3pvpd.exe 38 PID 2976 wrote to memory of 1048 2976 3pvpd.exe 38 PID 1048 wrote to memory of 2732 1048 fxrxffr.exe 39 PID 1048 wrote to memory of 2732 1048 fxrxffr.exe 39 PID 1048 wrote to memory of 2732 1048 fxrxffr.exe 39 PID 1048 wrote to memory of 2732 1048 fxrxffr.exe 39 PID 2732 wrote to memory of 2168 2732 jdjpd.exe 40 PID 2732 wrote to memory of 2168 2732 jdjpd.exe 40 PID 2732 wrote to memory of 2168 2732 jdjpd.exe 40 PID 2732 wrote to memory of 2168 2732 jdjpd.exe 40 PID 2168 wrote to memory of 832 2168 rlrlrxf.exe 41 PID 2168 wrote to memory of 832 2168 rlrlrxf.exe 41 PID 2168 wrote to memory of 832 2168 rlrlrxf.exe 41 PID 2168 wrote to memory of 832 2168 rlrlrxf.exe 41 PID 832 wrote to memory of 1616 832 btnnbt.exe 42 PID 832 wrote to memory of 1616 832 btnnbt.exe 42 PID 832 wrote to memory of 1616 832 btnnbt.exe 42 PID 832 wrote to memory of 1616 832 btnnbt.exe 42 PID 1616 wrote to memory of 2712 1616 vpvjv.exe 43 PID 1616 wrote to memory of 2712 1616 vpvjv.exe 43 PID 1616 wrote to memory of 2712 1616 vpvjv.exe 43 PID 1616 wrote to memory of 2712 1616 vpvjv.exe 43 PID 2712 wrote to memory of 2944 2712 llfrrfx.exe 44 PID 2712 wrote to memory of 2944 2712 llfrrfx.exe 44 PID 2712 wrote to memory of 2944 2712 llfrrfx.exe 44 PID 2712 wrote to memory of 2944 2712 llfrrfx.exe 44 PID 2944 wrote to memory of 2204 2944 thttbb.exe 45 PID 2944 wrote to memory of 2204 2944 thttbb.exe 45 PID 2944 wrote to memory of 2204 2944 thttbb.exe 45 PID 2944 wrote to memory of 2204 2944 thttbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe"C:\Users\Admin\AppData\Local\Temp\ea47db368739249a0d057c8877bb7741ec51aba04c4c085a783681468b60a179N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nbttbb.exec:\nbttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\5vpjd.exec:\5vpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\llxflfl.exec:\llxflfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jvjdd.exec:\jvjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rfrrrxl.exec:\rfrrrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\nhbbhh.exec:\nhbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\thtbhh.exec:\thtbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3pvpd.exec:\3pvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\fxrxffr.exec:\fxrxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\jdjpd.exec:\jdjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rlrlrxf.exec:\rlrlrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\btnnbt.exec:\btnnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\vpvjv.exec:\vpvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\llfrrfx.exec:\llfrrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\thttbb.exec:\thttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\vdvjv.exec:\vdvjv.exe17⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9tbhtb.exec:\9tbhtb.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pvppj.exec:\pvppj.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7rlrlrf.exec:\7rlrlrf.exe20⤵
- Executes dropped EXE
PID:388 -
\??\c:\dvjjd.exec:\dvjjd.exe21⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vpvvp.exec:\vpvvp.exe22⤵
- Executes dropped EXE
PID:320 -
\??\c:\bbnthn.exec:\bbnthn.exe23⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjvdd.exec:\pjvdd.exe24⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rfrxfxf.exec:\rfrxfxf.exe25⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hnhntn.exec:\hnhntn.exe26⤵
- Executes dropped EXE
PID:236 -
\??\c:\vpppv.exec:\vpppv.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9bnnnt.exec:\9bnnnt.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfrrlll.exec:\lfrrlll.exe29⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thhbbb.exec:\thhbbb.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xxxlxfl.exec:\xxxlxfl.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\bthtbb.exec:\bthtbb.exe32⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvjpd.exec:\vvjpd.exe33⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5lxxrxx.exec:\5lxxrxx.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5bnnnn.exec:\5bnnnn.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ddjpv.exec:\ddjpv.exe36⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dvjvj.exec:\dvjvj.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1nnthn.exec:\1nnthn.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nnhtnb.exec:\nnhtnb.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ddpvd.exec:\ddpvd.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1frrrrx.exec:\1frrrrx.exe41⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nbnhhb.exec:\nbnhhb.exe42⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dvppv.exec:\dvppv.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7jpjp.exec:\7jpjp.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3lxrrlr.exec:\3lxrrlr.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nhtttb.exec:\nhtttb.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ddppp.exec:\ddppp.exe47⤵
- Executes dropped EXE
PID:1404 -
\??\c:\dvdvv.exec:\dvdvv.exe48⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fxrxflr.exec:\fxrxflr.exe50⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nnhthn.exec:\nnhthn.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7jjvv.exec:\7jjvv.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dpjdd.exec:\dpjdd.exe53⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xlflxxx.exec:\xlflxxx.exe54⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tnntbh.exec:\tnntbh.exe55⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hthntn.exec:\hthntn.exe56⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7dvvv.exec:\7dvvv.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrrfffl.exec:\xrrfffl.exe58⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xrffllr.exec:\xrffllr.exe59⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1bhbtt.exec:\1bhbtt.exe60⤵
- Executes dropped EXE
PID:484 -
\??\c:\tnbttn.exec:\tnbttn.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3vppv.exec:\3vppv.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7xffxfl.exec:\7xffxfl.exe63⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tthnnh.exec:\tthnnh.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vjvjj.exec:\vjvjj.exe65⤵
- Executes dropped EXE
PID:928 -
\??\c:\jjdjp.exec:\jjdjp.exe66⤵PID:2068
-
\??\c:\5fxxfff.exec:\5fxxfff.exe67⤵PID:2544
-
\??\c:\ntbhhn.exec:\ntbhhn.exe68⤵PID:1700
-
\??\c:\hthbbb.exec:\hthbbb.exe69⤵PID:1752
-
\??\c:\dvpjp.exec:\dvpjp.exe70⤵PID:2380
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe71⤵PID:2424
-
\??\c:\flxflll.exec:\flxflll.exe72⤵PID:1936
-
\??\c:\hbthhn.exec:\hbthhn.exe73⤵PID:2572
-
\??\c:\dpjdd.exec:\dpjdd.exe74⤵PID:2420
-
\??\c:\frlffxf.exec:\frlffxf.exe75⤵PID:2448
-
\??\c:\5frxflr.exec:\5frxflr.exe76⤵PID:1748
-
\??\c:\btbbbt.exec:\btbbbt.exe77⤵PID:1572
-
\??\c:\vjdjj.exec:\vjdjj.exe78⤵PID:2704
-
\??\c:\djvpv.exec:\djvpv.exe79⤵PID:2800
-
\??\c:\rxlffxl.exec:\rxlffxl.exe80⤵PID:2912
-
\??\c:\btntbb.exec:\btntbb.exe81⤵PID:2892
-
\??\c:\hbthhb.exec:\hbthhb.exe82⤵PID:2744
-
\??\c:\1xrxxxl.exec:\1xrxxxl.exe83⤵PID:2736
-
\??\c:\tbhtnh.exec:\tbhtnh.exe84⤵PID:2956
-
\??\c:\nhnntt.exec:\nhnntt.exe85⤵PID:2780
-
\??\c:\7vjdj.exec:\7vjdj.exe86⤵PID:2296
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe87⤵PID:2676
-
\??\c:\xrrxrxl.exec:\xrrxrxl.exe88⤵PID:2136
-
\??\c:\thtbbh.exec:\thtbbh.exe89⤵PID:2468
-
\??\c:\vjvvv.exec:\vjvvv.exe90⤵PID:1100
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe91⤵PID:1996
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe92⤵PID:2300
-
\??\c:\htnhnh.exec:\htnhnh.exe93⤵PID:2952
-
\??\c:\1ppdd.exec:\1ppdd.exe94⤵PID:2700
-
\??\c:\lxrxffr.exec:\lxrxffr.exe95⤵PID:2052
-
\??\c:\9rllrrr.exec:\9rllrrr.exe96⤵PID:2332
-
\??\c:\ttntbb.exec:\ttntbb.exe97⤵PID:2580
-
\??\c:\jjvpd.exec:\jjvpd.exe98⤵PID:1408
-
\??\c:\vjdjj.exec:\vjdjj.exe99⤵PID:2076
-
\??\c:\ffxrlxf.exec:\ffxrlxf.exe100⤵PID:2080
-
\??\c:\bthntn.exec:\bthntn.exe101⤵PID:1880
-
\??\c:\nnhhnt.exec:\nnhhnt.exe102⤵PID:1352
-
\??\c:\dvvdv.exec:\dvvdv.exe103⤵PID:1968
-
\??\c:\rlflffx.exec:\rlflffx.exe104⤵PID:1196
-
\??\c:\3htbhh.exec:\3htbhh.exe105⤵PID:2252
-
\??\c:\bbthnt.exec:\bbthnt.exe106⤵PID:1944
-
\??\c:\9vvdp.exec:\9vvdp.exe107⤵PID:1256
-
\??\c:\ppjjp.exec:\ppjjp.exe108⤵PID:2264
-
\??\c:\1xfffrr.exec:\1xfffrr.exe109⤵PID:2176
-
\??\c:\5nhhnn.exec:\5nhhnn.exe110⤵PID:2272
-
\??\c:\ddppp.exec:\ddppp.exe111⤵PID:1740
-
\??\c:\5dvvd.exec:\5dvvd.exe112⤵PID:2512
-
\??\c:\fxlrxfx.exec:\fxlrxfx.exe113⤵PID:1820
-
\??\c:\nhtttt.exec:\nhtttt.exe114⤵PID:2120
-
\??\c:\dddpj.exec:\dddpj.exe115⤵PID:884
-
\??\c:\lxxflrl.exec:\lxxflrl.exe116⤵PID:2516
-
\??\c:\fxfxffl.exec:\fxfxffl.exe117⤵PID:2992
-
\??\c:\7nbbbh.exec:\7nbbbh.exe118⤵PID:1612
-
\??\c:\tntnbb.exec:\tntnbb.exe119⤵PID:2540
-
\??\c:\vjvpv.exec:\vjvpv.exe120⤵PID:1748
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe121⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-