Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:46
Behavioral task
behavioral1
Sample
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe
-
Size
332KB
-
MD5
e11cd07de57c4fad1a33b26e6963586c
-
SHA1
8fb5dc6c0e90ba0aca2efd61a605f1533e961b50
-
SHA256
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5
-
SHA512
024377bfd910583aa873f93e642525120a818ab684e4f6eb3b2cae4fa75031c2bdba03213aa49facbf784e54798189093a2fd86340dece43da75c3a256ec921e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeK:R4wFHoSHYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1300-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-86-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2792-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/684-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-177-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2204-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/968-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/812-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-302-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-441-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/960-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-516-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/572-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-649-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2268-697-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-792-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-890-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2628-902-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-978-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2356-6920-0x0000000076CF0000-0x0000000076DEA000-memory.dmp family_blackmoon behavioral1/memory/2356-15653-0x0000000076BD0000-0x0000000076CEF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1348 i822002.exe 2116 c486804.exe 2816 hnntnb.exe 2452 jdvjv.exe 2828 tthhhn.exe 2772 hbnbtt.exe 2808 i646840.exe 3044 264088.exe 2792 o468068.exe 2636 264628.exe 320 608088.exe 684 824848.exe 2980 4822668.exe 2964 nhbbtt.exe 2904 868066.exe 3024 ppjpd.exe 2000 u484668.exe 1340 2642442.exe 1616 648884.exe 2360 m2642.exe 1748 tthnth.exe 2204 5llxrrl.exe 2060 04246.exe 2180 s6004.exe 1396 048428.exe 560 0688204.exe 2332 8246280.exe 1924 60424.exe 968 q44604.exe 2152 pvpvj.exe 2384 660240.exe 1508 8246240.exe 2056 a4240.exe 2592 7thhhb.exe 812 8406202.exe 2516 hhthnt.exe 2104 5lrlxfr.exe 1600 pjdjp.exe 2320 q04648.exe 2292 044020.exe 2756 s8288.exe 2216 i266664.exe 2916 btnbbb.exe 2828 264428.exe 1692 0406886.exe 2456 c884288.exe 3052 5jvdv.exe 2672 w68400.exe 2844 2606062.exe 1932 pjvvj.exe 2640 3lxxxfl.exe 2228 9pvjd.exe 1296 lfrxlrr.exe 2044 tnhnth.exe 2980 o428000.exe 2716 8628666.exe 3068 g0464.exe 3032 0484686.exe 2804 rlflffr.exe 3056 dvjdj.exe 872 8248000.exe 2328 m4846.exe 2388 nbtnnt.exe 2408 ffffrxl.exe -
resource yara_rule behavioral1/memory/1300-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000120fb-8.dat upx behavioral1/memory/1300-6-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/files/0x0008000000016ce0-17.dat upx behavioral1/memory/1348-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ce8-23.dat upx behavioral1/files/0x0007000000016cf0-31.dat upx behavioral1/memory/2816-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d04-39.dat upx behavioral1/memory/2452-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d5a-46.dat upx behavioral1/memory/2772-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d71-55.dat upx behavioral1/files/0x0007000000016e1d-63.dat upx behavioral1/memory/2808-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017342-71.dat upx behavioral1/files/0x00050000000195c2-83.dat upx behavioral1/memory/2636-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c4-90.dat upx behavioral1/memory/684-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-99.dat upx behavioral1/files/0x00050000000195c7-107.dat upx behavioral1/files/0x00050000000195c8-116.dat upx behavioral1/memory/2980-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cc4-122.dat upx behavioral1/files/0x00050000000195ca-129.dat upx behavioral1/files/0x00050000000195cc-137.dat upx behavioral1/files/0x00050000000195ce-144.dat upx behavioral1/memory/1340-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195d0-154.dat upx behavioral1/memory/1340-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195e0-162.dat upx behavioral1/memory/1616-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019624-170.dat upx behavioral1/memory/2360-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019665-179.dat upx behavioral1/memory/2204-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196a0-187.dat upx behavioral1/files/0x0005000000019931-194.dat upx behavioral1/memory/2180-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bec-202.dat upx behavioral1/files/0x0005000000019bf0-210.dat upx behavioral1/memory/560-218-0x00000000003B0000-0x00000000003D7000-memory.dmp upx behavioral1/files/0x0005000000019bf2-219.dat upx behavioral1/memory/560-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c0b-225.dat upx behavioral1/files/0x0005000000019cd5-234.dat upx behavioral1/memory/968-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/968-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019cfc-244.dat upx behavioral1/memory/2152-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d5c-250.dat upx behavioral1/memory/2384-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d69-260.dat upx behavioral1/memory/1508-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-266-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2056-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/812-286-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k08660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44420.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8022866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q02400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8240002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262664.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2642442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 046688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k42666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q20488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1300 wrote to memory of 1348 1300 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 1300 wrote to memory of 1348 1300 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 1300 wrote to memory of 1348 1300 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 1300 wrote to memory of 1348 1300 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 1348 wrote to memory of 2116 1348 i822002.exe 31 PID 1348 wrote to memory of 2116 1348 i822002.exe 31 PID 1348 wrote to memory of 2116 1348 i822002.exe 31 PID 1348 wrote to memory of 2116 1348 i822002.exe 31 PID 2116 wrote to memory of 2816 2116 c486804.exe 32 PID 2116 wrote to memory of 2816 2116 c486804.exe 32 PID 2116 wrote to memory of 2816 2116 c486804.exe 32 PID 2116 wrote to memory of 2816 2116 c486804.exe 32 PID 2816 wrote to memory of 2452 2816 hnntnb.exe 33 PID 2816 wrote to memory of 2452 2816 hnntnb.exe 33 PID 2816 wrote to memory of 2452 2816 hnntnb.exe 33 PID 2816 wrote to memory of 2452 2816 hnntnb.exe 33 PID 2452 wrote to memory of 2828 2452 jdvjv.exe 34 PID 2452 wrote to memory of 2828 2452 jdvjv.exe 34 PID 2452 wrote to memory of 2828 2452 jdvjv.exe 34 PID 2452 wrote to memory of 2828 2452 jdvjv.exe 34 PID 2828 wrote to memory of 2772 2828 tthhhn.exe 35 PID 2828 wrote to memory of 2772 2828 tthhhn.exe 35 PID 2828 wrote to memory of 2772 2828 tthhhn.exe 35 PID 2828 wrote to memory of 2772 2828 tthhhn.exe 35 PID 2772 wrote to memory of 2808 2772 hbnbtt.exe 36 PID 2772 wrote to memory of 2808 2772 hbnbtt.exe 36 PID 2772 wrote to memory of 2808 2772 hbnbtt.exe 36 PID 2772 wrote to memory of 2808 2772 hbnbtt.exe 36 PID 2808 wrote to memory of 3044 2808 i646840.exe 37 PID 2808 wrote to memory of 3044 2808 i646840.exe 37 PID 2808 wrote to memory of 3044 2808 i646840.exe 37 PID 2808 wrote to memory of 3044 2808 i646840.exe 37 PID 3044 wrote to memory of 2792 3044 264088.exe 38 PID 3044 wrote to memory of 2792 3044 264088.exe 38 PID 3044 wrote to memory of 2792 3044 264088.exe 38 PID 3044 wrote to memory of 2792 3044 264088.exe 38 PID 2792 wrote to memory of 2636 2792 o468068.exe 39 PID 2792 wrote to memory of 2636 2792 o468068.exe 39 PID 2792 wrote to memory of 2636 2792 o468068.exe 39 PID 2792 wrote to memory of 2636 2792 o468068.exe 39 PID 2636 wrote to memory of 320 2636 264628.exe 40 PID 2636 wrote to memory of 320 2636 264628.exe 40 PID 2636 wrote to memory of 320 2636 264628.exe 40 PID 2636 wrote to memory of 320 2636 264628.exe 40 PID 320 wrote to memory of 684 320 608088.exe 41 PID 320 wrote to memory of 684 320 608088.exe 41 PID 320 wrote to memory of 684 320 608088.exe 41 PID 320 wrote to memory of 684 320 608088.exe 41 PID 684 wrote to memory of 2980 684 824848.exe 42 PID 684 wrote to memory of 2980 684 824848.exe 42 PID 684 wrote to memory of 2980 684 824848.exe 42 PID 684 wrote to memory of 2980 684 824848.exe 42 PID 2980 wrote to memory of 2964 2980 4822668.exe 43 PID 2980 wrote to memory of 2964 2980 4822668.exe 43 PID 2980 wrote to memory of 2964 2980 4822668.exe 43 PID 2980 wrote to memory of 2964 2980 4822668.exe 43 PID 2964 wrote to memory of 2904 2964 nhbbtt.exe 44 PID 2964 wrote to memory of 2904 2964 nhbbtt.exe 44 PID 2964 wrote to memory of 2904 2964 nhbbtt.exe 44 PID 2964 wrote to memory of 2904 2964 nhbbtt.exe 44 PID 2904 wrote to memory of 3024 2904 868066.exe 45 PID 2904 wrote to memory of 3024 2904 868066.exe 45 PID 2904 wrote to memory of 3024 2904 868066.exe 45 PID 2904 wrote to memory of 3024 2904 868066.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe"C:\Users\Admin\AppData\Local\Temp\750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\i822002.exec:\i822002.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\c486804.exec:\c486804.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hnntnb.exec:\hnntnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jdvjv.exec:\jdvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\tthhhn.exec:\tthhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hbnbtt.exec:\hbnbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\i646840.exec:\i646840.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\264088.exec:\264088.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\o468068.exec:\o468068.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\264628.exec:\264628.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\608088.exec:\608088.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\824848.exec:\824848.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\4822668.exec:\4822668.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nhbbtt.exec:\nhbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\868066.exec:\868066.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ppjpd.exec:\ppjpd.exe17⤵
- Executes dropped EXE
PID:3024 -
\??\c:\u484668.exec:\u484668.exe18⤵
- Executes dropped EXE
PID:2000 -
\??\c:\2642442.exec:\2642442.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1340 -
\??\c:\648884.exec:\648884.exe20⤵
- Executes dropped EXE
PID:1616 -
\??\c:\m2642.exec:\m2642.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tthnth.exec:\tthnth.exe22⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5llxrrl.exec:\5llxrrl.exe23⤵
- Executes dropped EXE
PID:2204 -
\??\c:\04246.exec:\04246.exe24⤵
- Executes dropped EXE
PID:2060 -
\??\c:\s6004.exec:\s6004.exe25⤵
- Executes dropped EXE
PID:2180 -
\??\c:\048428.exec:\048428.exe26⤵
- Executes dropped EXE
PID:1396 -
\??\c:\0688204.exec:\0688204.exe27⤵
- Executes dropped EXE
PID:560 -
\??\c:\8246280.exec:\8246280.exe28⤵
- Executes dropped EXE
PID:2332 -
\??\c:\60424.exec:\60424.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\q44604.exec:\q44604.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\pvpvj.exec:\pvpvj.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\660240.exec:\660240.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\8246240.exec:\8246240.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\a4240.exec:\a4240.exe34⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7thhhb.exec:\7thhhb.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\8406202.exec:\8406202.exe36⤵
- Executes dropped EXE
PID:812 -
\??\c:\hhthnt.exec:\hhthnt.exe37⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5lrlxfr.exec:\5lrlxfr.exe38⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pjdjp.exec:\pjdjp.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\q04648.exec:\q04648.exe40⤵
- Executes dropped EXE
PID:2320 -
\??\c:\044020.exec:\044020.exe41⤵
- Executes dropped EXE
PID:2292 -
\??\c:\s8288.exec:\s8288.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\i266664.exec:\i266664.exe43⤵
- Executes dropped EXE
PID:2216 -
\??\c:\btnbbb.exec:\btnbbb.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\264428.exec:\264428.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\0406886.exec:\0406886.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\c884288.exec:\c884288.exe47⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5jvdv.exec:\5jvdv.exe48⤵
- Executes dropped EXE
PID:3052 -
\??\c:\w68400.exec:\w68400.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\2606062.exec:\2606062.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pjvvj.exec:\pjvvj.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\3lxxxfl.exec:\3lxxxfl.exe52⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9pvjd.exec:\9pvjd.exe53⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lfrxlrr.exec:\lfrxlrr.exe54⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tnhnth.exec:\tnhnth.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\o428000.exec:\o428000.exe56⤵
- Executes dropped EXE
PID:2980 -
\??\c:\8628666.exec:\8628666.exe57⤵
- Executes dropped EXE
PID:2716 -
\??\c:\g0464.exec:\g0464.exe58⤵
- Executes dropped EXE
PID:3068 -
\??\c:\0484686.exec:\0484686.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rlflffr.exec:\rlflffr.exe60⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dvjdj.exec:\dvjdj.exe61⤵
- Executes dropped EXE
PID:3056 -
\??\c:\8248000.exec:\8248000.exe62⤵
- Executes dropped EXE
PID:872 -
\??\c:\m4846.exec:\m4846.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nbtnnt.exec:\nbtnnt.exe64⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ffffrxl.exec:\ffffrxl.exe65⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hbhthh.exec:\hbhthh.exe66⤵PID:536
-
\??\c:\ffxxrxf.exec:\ffxxrxf.exe67⤵PID:1744
-
\??\c:\084008.exec:\084008.exe68⤵PID:1776
-
\??\c:\5rffllr.exec:\5rffllr.exe69⤵PID:1640
-
\??\c:\2006222.exec:\2006222.exe70⤵PID:2060
-
\??\c:\604680.exec:\604680.exe71⤵PID:960
-
\??\c:\5jvjp.exec:\5jvjp.exe72⤵PID:1212
-
\??\c:\60284.exec:\60284.exe73⤵PID:544
-
\??\c:\7bbbbh.exec:\7bbbbh.exe74⤵PID:1712
-
\??\c:\s0808.exec:\s0808.exe75⤵PID:1752
-
\??\c:\pdpdd.exec:\pdpdd.exe76⤵PID:1780
-
\??\c:\044002.exec:\044002.exe77⤵PID:1364
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe78⤵PID:968
-
\??\c:\jvjdd.exec:\jvjdd.exe79⤵PID:2184
-
\??\c:\m0884.exec:\m0884.exe80⤵PID:572
-
\??\c:\k08660.exec:\k08660.exe81⤵
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\606468.exec:\606468.exe82⤵PID:1508
-
\??\c:\040224.exec:\040224.exe83⤵PID:2084
-
\??\c:\bnhnnn.exec:\bnhnnn.exe84⤵PID:1764
-
\??\c:\jdvdd.exec:\jdvdd.exe85⤵PID:2508
-
\??\c:\tthnbb.exec:\tthnbb.exe86⤵PID:1348
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe87⤵
- System Location Discovery: System Language Discovery
PID:288 -
\??\c:\bnttbb.exec:\bnttbb.exe88⤵PID:1604
-
\??\c:\fxrxffr.exec:\fxrxffr.exe89⤵PID:328
-
\??\c:\48440.exec:\48440.exe90⤵PID:2448
-
\??\c:\xrllrrx.exec:\xrllrrx.exe91⤵PID:2776
-
\??\c:\48686.exec:\48686.exe92⤵PID:2736
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe93⤵PID:2784
-
\??\c:\264068.exec:\264068.exe94⤵PID:2780
-
\??\c:\2082846.exec:\2082846.exe95⤵PID:2772
-
\??\c:\jjjjv.exec:\jjjjv.exe96⤵PID:2972
-
\??\c:\g8206.exec:\g8206.exe97⤵PID:1392
-
\??\c:\8202440.exec:\8202440.exe98⤵PID:3052
-
\??\c:\208400.exec:\208400.exe99⤵PID:2620
-
\??\c:\rxrxxfl.exec:\rxrxxfl.exe100⤵PID:2628
-
\??\c:\4866824.exec:\4866824.exe101⤵PID:2704
-
\??\c:\vvjvp.exec:\vvjvp.exe102⤵PID:2640
-
\??\c:\0480628.exec:\0480628.exe103⤵PID:1008
-
\??\c:\pdddp.exec:\pdddp.exe104⤵PID:1296
-
\??\c:\4824680.exec:\4824680.exe105⤵PID:3040
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe106⤵PID:3004
-
\??\c:\c646468.exec:\c646468.exe107⤵PID:3020
-
\??\c:\w04080.exec:\w04080.exe108⤵PID:2904
-
\??\c:\fxlrffl.exec:\fxlrffl.exe109⤵PID:3064
-
\??\c:\pjvdj.exec:\pjvdj.exe110⤵PID:3012
-
\??\c:\o866220.exec:\o866220.exe111⤵PID:1292
-
\??\c:\nhnbnn.exec:\nhnbnn.exe112⤵PID:1668
-
\??\c:\jjjpj.exec:\jjjpj.exe113⤵PID:2268
-
\??\c:\080662.exec:\080662.exe114⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\6462806.exec:\6462806.exe115⤵PID:2132
-
\??\c:\6466848.exec:\6466848.exe116⤵PID:2364
-
\??\c:\3tnntt.exec:\3tnntt.exe117⤵PID:884
-
\??\c:\xrrxflr.exec:\xrrxflr.exe118⤵PID:780
-
\??\c:\lflrfrx.exec:\lflrfrx.exe119⤵PID:272
-
\??\c:\tnhnbn.exec:\tnhnbn.exe120⤵PID:1344
-
\??\c:\02440.exec:\02440.exe121⤵PID:964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-