Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 00:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe
-
Size
456KB
-
MD5
e777a5bec06039749e52a2a6779eade6
-
SHA1
7e64a631b14448ca457aa571fa05b348a493442b
-
SHA256
38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6
-
SHA512
660a50a9655be3948c4d05947e52e476dcf14b27bcc88a59176c2aca3c34ccc4a6d12d35918befa9c595013b2ac93dd6a3a3088a13367a7604b486ca3cc685e7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLV:q7Tc2NYHUrAwfMp3CDLV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1016-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-67-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2884-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1120-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1120-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-143-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1616-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-162-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-181-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-199-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-220-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1536-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-238-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2552-280-0x00000000772C0000-0x00000000773BA000-memory.dmp family_blackmoon behavioral1/memory/1836-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-428-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1400-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-568-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2372-598-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-643-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/876-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-847-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1616-928-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1500-1060-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2112 rlrllll.exe 2116 btnntb.exe 2440 9lxflrf.exe 3060 thtbnn.exe 2716 dvpvj.exe 2884 3hbbnb.exe 2548 dvppv.exe 2536 rlllxxl.exe 2568 bbntnn.exe 2588 pjvvd.exe 3008 nhbbhn.exe 1120 dpjpp.exe 2488 ddvpd.exe 1616 3bbbbh.exe 1576 vjppv.exe 292 lxrrxxl.exe 1720 3httbh.exe 2572 jvjjp.exe 2828 xxflrfl.exe 2992 3bbbhb.exe 2688 rfrlrlx.exe 916 bnhthh.exe 1744 3flrrxf.exe 1212 fxffllr.exe 1536 nhttth.exe 2916 llflrxr.exe 2104 7bbthb.exe 2892 vpjpj.exe 2552 tthntt.exe 2288 nhtthb.exe 2452 vpppd.exe 2956 xxrxlfr.exe 2620 bnnnbb.exe 2728 9jjvv.exe 2184 fxllrxf.exe 2656 fxrlffx.exe 2664 hthhnn.exe 2628 pjjdv.exe 2292 7vjjd.exe 2544 rllllxl.exe 2532 thtttt.exe 768 jdddd.exe 2732 dvpvp.exe 1356 rrffxff.exe 1960 hbntbb.exe 1996 jvjjj.exe 1352 pdppv.exe 2444 5flrlrr.exe 1912 llfflfl.exe 1724 bnttbt.exe 1712 pdpjv.exe 2256 rlrxflr.exe 2572 rlxxxxf.exe 2012 tnhnnt.exe 2968 thtthh.exe 2028 7pdpv.exe 1400 9lffrxl.exe 1480 htnhtn.exe 2176 hbntbb.exe 1460 vdvvp.exe 1784 1vppp.exe 1776 5xrrxfl.exe 1536 ttnnnh.exe 3044 dpddp.exe -
resource yara_rule behavioral1/memory/1016-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-795-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/876-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-954-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-1048-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-1060-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1524-1062-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1016 wrote to memory of 2112 1016 38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe 30 PID 1016 wrote to memory of 2112 1016 38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe 30 PID 1016 wrote to memory of 2112 1016 38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe 30 PID 1016 wrote to memory of 2112 1016 38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe 30 PID 2112 wrote to memory of 2116 2112 rlrllll.exe 31 PID 2112 wrote to memory of 2116 2112 rlrllll.exe 31 PID 2112 wrote to memory of 2116 2112 rlrllll.exe 31 PID 2112 wrote to memory of 2116 2112 rlrllll.exe 31 PID 2116 wrote to memory of 2440 2116 btnntb.exe 32 PID 2116 wrote to memory of 2440 2116 btnntb.exe 32 PID 2116 wrote to memory of 2440 2116 btnntb.exe 32 PID 2116 wrote to memory of 2440 2116 btnntb.exe 32 PID 2440 wrote to memory of 3060 2440 9lxflrf.exe 33 PID 2440 wrote to memory of 3060 2440 9lxflrf.exe 33 PID 2440 wrote to memory of 3060 2440 9lxflrf.exe 33 PID 2440 wrote to memory of 3060 2440 9lxflrf.exe 33 PID 3060 wrote to memory of 2716 3060 thtbnn.exe 34 PID 3060 wrote to memory of 2716 3060 thtbnn.exe 34 PID 3060 wrote to memory of 2716 3060 thtbnn.exe 34 PID 3060 wrote to memory of 2716 3060 thtbnn.exe 34 PID 2716 wrote to memory of 2884 2716 dvpvj.exe 35 PID 2716 wrote to memory of 2884 2716 dvpvj.exe 35 PID 2716 wrote to memory of 2884 2716 dvpvj.exe 35 PID 2716 wrote to memory of 2884 2716 dvpvj.exe 35 PID 2884 wrote to memory of 2548 2884 3hbbnb.exe 36 PID 2884 wrote to memory of 2548 2884 3hbbnb.exe 36 PID 2884 wrote to memory of 2548 2884 3hbbnb.exe 36 PID 2884 wrote to memory of 2548 2884 3hbbnb.exe 36 PID 2548 wrote to memory of 2536 2548 dvppv.exe 37 PID 2548 wrote to memory of 2536 2548 dvppv.exe 37 PID 2548 wrote to memory of 2536 2548 dvppv.exe 37 PID 2548 wrote to memory of 2536 2548 dvppv.exe 37 PID 2536 wrote to memory of 2568 2536 rlllxxl.exe 38 PID 2536 wrote to memory of 2568 2536 rlllxxl.exe 38 PID 2536 wrote to memory of 2568 2536 rlllxxl.exe 38 PID 2536 wrote to memory of 2568 2536 rlllxxl.exe 38 PID 2568 wrote to memory of 2588 2568 bbntnn.exe 39 PID 2568 wrote to memory of 2588 2568 bbntnn.exe 39 PID 2568 wrote to memory of 2588 2568 bbntnn.exe 39 PID 2568 wrote to memory of 2588 2568 bbntnn.exe 39 PID 2588 wrote to memory of 3008 2588 pjvvd.exe 40 PID 2588 wrote to memory of 3008 2588 pjvvd.exe 40 PID 2588 wrote to memory of 3008 2588 pjvvd.exe 40 PID 2588 wrote to memory of 3008 2588 pjvvd.exe 40 PID 3008 wrote to memory of 1120 3008 nhbbhn.exe 41 PID 3008 wrote to memory of 1120 3008 nhbbhn.exe 41 PID 3008 wrote to memory of 1120 3008 nhbbhn.exe 41 PID 3008 wrote to memory of 1120 3008 nhbbhn.exe 41 PID 1120 wrote to memory of 2488 1120 dpjpp.exe 42 PID 1120 wrote to memory of 2488 1120 dpjpp.exe 42 PID 1120 wrote to memory of 2488 1120 dpjpp.exe 42 PID 1120 wrote to memory of 2488 1120 dpjpp.exe 42 PID 2488 wrote to memory of 1616 2488 ddvpd.exe 43 PID 2488 wrote to memory of 1616 2488 ddvpd.exe 43 PID 2488 wrote to memory of 1616 2488 ddvpd.exe 43 PID 2488 wrote to memory of 1616 2488 ddvpd.exe 43 PID 1616 wrote to memory of 1576 1616 3bbbbh.exe 44 PID 1616 wrote to memory of 1576 1616 3bbbbh.exe 44 PID 1616 wrote to memory of 1576 1616 3bbbbh.exe 44 PID 1616 wrote to memory of 1576 1616 3bbbbh.exe 44 PID 1576 wrote to memory of 292 1576 vjppv.exe 45 PID 1576 wrote to memory of 292 1576 vjppv.exe 45 PID 1576 wrote to memory of 292 1576 vjppv.exe 45 PID 1576 wrote to memory of 292 1576 vjppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe"C:\Users\Admin\AppData\Local\Temp\38585a00e12efc5c10e7490e9161bf6376ec12a511ee713de722755a81e566d6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\rlrllll.exec:\rlrllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\btnntb.exec:\btnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\9lxflrf.exec:\9lxflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\thtbnn.exec:\thtbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\dvpvj.exec:\dvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\3hbbnb.exec:\3hbbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dvppv.exec:\dvppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rlllxxl.exec:\rlllxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bbntnn.exec:\bbntnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\pjvvd.exec:\pjvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nhbbhn.exec:\nhbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\dpjpp.exec:\dpjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\ddvpd.exec:\ddvpd.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\3bbbbh.exec:\3bbbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\vjppv.exec:\vjppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe17⤵
- Executes dropped EXE
PID:292 -
\??\c:\3httbh.exec:\3httbh.exe18⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jvjjp.exec:\jvjjp.exe19⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xxflrfl.exec:\xxflrfl.exe20⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3bbbhb.exec:\3bbbhb.exe21⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rfrlrlx.exec:\rfrlrlx.exe22⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bnhthh.exec:\bnhthh.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\3flrrxf.exec:\3flrrxf.exe24⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fxffllr.exec:\fxffllr.exe25⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nhttth.exec:\nhttth.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\llflrxr.exec:\llflrxr.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7bbthb.exec:\7bbthb.exe28⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpjpj.exec:\vpjpj.exe29⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tthntt.exec:\tthntt.exe30⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7dvvd.exec:\7dvvd.exe31⤵PID:1836
-
\??\c:\nhtthb.exec:\nhtthb.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vpppd.exec:\vpppd.exe33⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxrxlfr.exec:\xxrxlfr.exe34⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bnnnbb.exec:\bnnnbb.exe35⤵
- Executes dropped EXE
PID:2620 -
\??\c:\9jjvv.exec:\9jjvv.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fxllrxf.exec:\fxllrxf.exe37⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fxrlffx.exec:\fxrlffx.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hthhnn.exec:\hthhnn.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjjdv.exec:\pjjdv.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7vjjd.exec:\7vjjd.exe41⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rllllxl.exec:\rllllxl.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\thtttt.exec:\thtttt.exe43⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdddd.exec:\jdddd.exe44⤵
- Executes dropped EXE
PID:768 -
\??\c:\dvpvp.exec:\dvpvp.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rrffxff.exec:\rrffxff.exe46⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hbntbb.exec:\hbntbb.exe47⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jvjjj.exec:\jvjjj.exe48⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pdppv.exec:\pdppv.exe49⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5flrlrr.exec:\5flrlrr.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\llfflfl.exec:\llfflfl.exe51⤵
- Executes dropped EXE
PID:1912 -
\??\c:\bnttbt.exec:\bnttbt.exe52⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pdpjv.exec:\pdpjv.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rlrxflr.exec:\rlrxflr.exe54⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe55⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tnhnnt.exec:\tnhnnt.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\thtthh.exec:\thtthh.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7pdpv.exec:\7pdpv.exe58⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9lffrxl.exec:\9lffrxl.exe59⤵
- Executes dropped EXE
PID:1400 -
\??\c:\htnhtn.exec:\htnhtn.exe60⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hbntbb.exec:\hbntbb.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vdvvp.exec:\vdvvp.exe62⤵
- Executes dropped EXE
PID:1460 -
\??\c:\1vppp.exec:\1vppp.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5xrrxfl.exec:\5xrrxfl.exe64⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ttnnnh.exec:\ttnnnh.exe65⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dpddp.exec:\dpddp.exe66⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pjvvd.exec:\pjvvd.exe67⤵PID:1428
-
\??\c:\fxfxllr.exec:\fxfxllr.exe68⤵PID:3052
-
\??\c:\bbthtn.exec:\bbthtn.exe69⤵PID:880
-
\??\c:\vpdjp.exec:\vpdjp.exe70⤵PID:1524
-
\??\c:\3pddp.exec:\3pddp.exe71⤵PID:1768
-
\??\c:\lxlrlfl.exec:\lxlrlfl.exe72⤵PID:2388
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe73⤵PID:2116
-
\??\c:\hbhntt.exec:\hbhntt.exe74⤵
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\ddvdp.exec:\ddvdp.exe75⤵PID:3064
-
\??\c:\1frlrxf.exec:\1frlrxf.exe76⤵PID:2720
-
\??\c:\9fxxlff.exec:\9fxxlff.exe77⤵PID:2716
-
\??\c:\thbhhn.exec:\thbhhn.exe78⤵PID:2372
-
\??\c:\jjvdv.exec:\jjvdv.exe79⤵PID:2668
-
\??\c:\1xfrxxf.exec:\1xfrxxf.exe80⤵PID:2744
-
\??\c:\xfrlrrf.exec:\xfrlrrf.exe81⤵PID:2840
-
\??\c:\bhhttb.exec:\bhhttb.exe82⤵PID:2508
-
\??\c:\vpddd.exec:\vpddd.exe83⤵PID:2568
-
\??\c:\7dpvv.exec:\7dpvv.exe84⤵PID:2556
-
\??\c:\xlxrxxl.exec:\xlxrxxl.exe85⤵PID:1136
-
\??\c:\rlffffl.exec:\rlffffl.exe86⤵PID:1120
-
\??\c:\nbthtb.exec:\nbthtb.exe87⤵PID:1968
-
\??\c:\9vdjd.exec:\9vdjd.exe88⤵PID:1260
-
\??\c:\pjjpv.exec:\pjjpv.exe89⤵PID:1944
-
\??\c:\rlllxxf.exec:\rlllxxf.exe90⤵PID:1664
-
\??\c:\bnbbhh.exec:\bnbbhh.exe91⤵PID:1348
-
\??\c:\ttnttt.exec:\ttnttt.exe92⤵PID:2352
-
\??\c:\pdjjv.exec:\pdjjv.exe93⤵PID:1732
-
\??\c:\3rxxxxf.exec:\3rxxxxf.exe94⤵PID:1032
-
\??\c:\lxlfrrx.exec:\lxlfrrx.exe95⤵PID:1708
-
\??\c:\thntbh.exec:\thntbh.exe96⤵PID:2812
-
\??\c:\vpddp.exec:\vpddp.exe97⤵PID:2836
-
\??\c:\9jvpp.exec:\9jvpp.exe98⤵PID:792
-
\??\c:\7fffxfl.exec:\7fffxfl.exe99⤵PID:2688
-
\??\c:\hbnntb.exec:\hbnntb.exe100⤵PID:2580
-
\??\c:\1tnhnn.exec:\1tnhnn.exe101⤵PID:2340
-
\??\c:\dvjpj.exec:\dvjpj.exe102⤵PID:408
-
\??\c:\frrlflr.exec:\frrlflr.exe103⤵PID:1292
-
\??\c:\xrflxrx.exec:\xrflxrx.exe104⤵PID:2192
-
\??\c:\bbnntb.exec:\bbnntb.exe105⤵PID:2204
-
\??\c:\5vddj.exec:\5vddj.exe106⤵PID:1456
-
\??\c:\jdpvj.exec:\jdpvj.exe107⤵PID:2264
-
\??\c:\lrlfffl.exec:\lrlfffl.exe108⤵PID:1556
-
\??\c:\xxrrffr.exec:\xxrrffr.exe109⤵PID:876
-
\??\c:\hbnthh.exec:\hbnthh.exe110⤵PID:1516
-
\??\c:\5pvdj.exec:\5pvdj.exe111⤵PID:2252
-
\??\c:\lfrrrlr.exec:\lfrrrlr.exe112⤵PID:2288
-
\??\c:\rrlrxff.exec:\rrlrxff.exe113⤵PID:1628
-
\??\c:\nhbtnh.exec:\nhbtnh.exe114⤵PID:2260
-
\??\c:\pjdjp.exec:\pjdjp.exe115⤵PID:2956
-
\??\c:\dvppd.exec:\dvppd.exe116⤵PID:2620
-
\??\c:\xrflflf.exec:\xrflflf.exe117⤵PID:2364
-
\??\c:\3ntbtb.exec:\3ntbtb.exe118⤵PID:2660
-
\??\c:\tnnnhh.exec:\tnnnhh.exe119⤵PID:2796
-
\??\c:\jdppj.exec:\jdppj.exe120⤵PID:2548
-
\??\c:\rflffll.exec:\rflffll.exe121⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-