Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe
-
Size
456KB
-
MD5
8b996d3ea9cad975a116e6adc01b46f0
-
SHA1
5e7fb3e02588ee6a7507d408dc0367c814431e60
-
SHA256
b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99b
-
SHA512
19c1b8dd27dd07edaf34d110c50b9403f2960b14cc1d1df3a5b058a206c105df30e86a9d50b47b1bd40975c6bf1957ad3d23d4a0c37b15eb86b4f4deca4aac97
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRo:q7Tc2NYHUrAwfMp3CDRo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-24-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2748-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-119-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3020-129-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1508-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-268-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-266-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-303-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-716-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2456-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-790-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2296-884-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2820-1025-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2856-1157-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-1172-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2108-1366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 3tbhhn.exe 2512 7xlflrx.exe 2128 vjjpp.exe 2108 lfflxxf.exe 2348 hbhhtb.exe 2668 5vjjv.exe 2776 9rlrxxx.exe 2948 7jvvj.exe 2936 nhbbhn.exe 2664 5vppv.exe 2748 hnbbhn.exe 2596 1tntnt.exe 3020 1nhnbt.exe 1328 nhbhnn.exe 352 ththhh.exe 1508 1nhnbh.exe 1664 tntntt.exe 1636 jvjpj.exe 1152 lxllllx.exe 2888 bbbbnn.exe 3008 xlrrrrr.exe 2428 tnbhtt.exe 2456 rxlllfl.exe 1124 xfxfrrf.exe 2472 dvjjp.exe 832 fxxxffr.exe 2828 htnntt.exe 2168 vpjpd.exe 2044 7pppv.exe 880 dvddp.exe 1568 rlllfxl.exe 1684 bnhhbb.exe 2100 3thtbb.exe 2068 9dpvd.exe 2128 frxxflr.exe 2484 7hnntt.exe 2928 tthntt.exe 1476 7pjjp.exe 2668 ffffrrx.exe 2728 rxxrrrr.exe 2824 nhntbh.exe 2692 3vvpp.exe 2936 1vjjp.exe 2896 rfrrxxl.exe 2620 tnhhtb.exe 2392 bbhnhn.exe 2160 vvjpv.exe 1608 7rflllr.exe 2024 7xxxffl.exe 2324 nhhttb.exe 1988 jvpjv.exe 1644 dvpjj.exe 2028 1frrxxf.exe 1656 tntthn.exe 1932 ttnbhn.exe 804 jvdvj.exe 2772 rfrrxrx.exe 2996 tnbhhb.exe 2196 nnbhnn.exe 2912 7ddjj.exe 584 9frlflr.exe 1096 rlfxfff.exe 684 htnnbh.exe 3040 dvjpd.exe -
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-666-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1704-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-716-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2456-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-1025-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/904-1221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-1234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-1319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-1338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-1366-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2100 2236 b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe 30 PID 2236 wrote to memory of 2100 2236 b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe 30 PID 2236 wrote to memory of 2100 2236 b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe 30 PID 2236 wrote to memory of 2100 2236 b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe 30 PID 2100 wrote to memory of 2512 2100 3tbhhn.exe 31 PID 2100 wrote to memory of 2512 2100 3tbhhn.exe 31 PID 2100 wrote to memory of 2512 2100 3tbhhn.exe 31 PID 2100 wrote to memory of 2512 2100 3tbhhn.exe 31 PID 2512 wrote to memory of 2128 2512 7xlflrx.exe 32 PID 2512 wrote to memory of 2128 2512 7xlflrx.exe 32 PID 2512 wrote to memory of 2128 2512 7xlflrx.exe 32 PID 2512 wrote to memory of 2128 2512 7xlflrx.exe 32 PID 2128 wrote to memory of 2108 2128 vjjpp.exe 33 PID 2128 wrote to memory of 2108 2128 vjjpp.exe 33 PID 2128 wrote to memory of 2108 2128 vjjpp.exe 33 PID 2128 wrote to memory of 2108 2128 vjjpp.exe 33 PID 2108 wrote to memory of 2348 2108 lfflxxf.exe 34 PID 2108 wrote to memory of 2348 2108 lfflxxf.exe 34 PID 2108 wrote to memory of 2348 2108 lfflxxf.exe 34 PID 2108 wrote to memory of 2348 2108 lfflxxf.exe 34 PID 2348 wrote to memory of 2668 2348 hbhhtb.exe 35 PID 2348 wrote to memory of 2668 2348 hbhhtb.exe 35 PID 2348 wrote to memory of 2668 2348 hbhhtb.exe 35 PID 2348 wrote to memory of 2668 2348 hbhhtb.exe 35 PID 2668 wrote to memory of 2776 2668 5vjjv.exe 36 PID 2668 wrote to memory of 2776 2668 5vjjv.exe 36 PID 2668 wrote to memory of 2776 2668 5vjjv.exe 36 PID 2668 wrote to memory of 2776 2668 5vjjv.exe 36 PID 2776 wrote to memory of 2948 2776 9rlrxxx.exe 37 PID 2776 wrote to memory of 2948 2776 9rlrxxx.exe 37 PID 2776 wrote to memory of 2948 2776 9rlrxxx.exe 37 PID 2776 wrote to memory of 2948 2776 9rlrxxx.exe 37 PID 2948 wrote to memory of 2936 2948 7jvvj.exe 38 PID 2948 wrote to memory of 2936 2948 7jvvj.exe 38 PID 2948 wrote to memory of 2936 2948 7jvvj.exe 38 PID 2948 wrote to memory of 2936 2948 7jvvj.exe 38 PID 2936 wrote to memory of 2664 2936 nhbbhn.exe 39 PID 2936 wrote to memory of 2664 2936 nhbbhn.exe 39 PID 2936 wrote to memory of 2664 2936 nhbbhn.exe 39 PID 2936 wrote to memory of 2664 2936 nhbbhn.exe 39 PID 2664 wrote to memory of 2748 2664 5vppv.exe 40 PID 2664 wrote to memory of 2748 2664 5vppv.exe 40 PID 2664 wrote to memory of 2748 2664 5vppv.exe 40 PID 2664 wrote to memory of 2748 2664 5vppv.exe 40 PID 2748 wrote to memory of 2596 2748 hnbbhn.exe 41 PID 2748 wrote to memory of 2596 2748 hnbbhn.exe 41 PID 2748 wrote to memory of 2596 2748 hnbbhn.exe 41 PID 2748 wrote to memory of 2596 2748 hnbbhn.exe 41 PID 2596 wrote to memory of 3020 2596 1tntnt.exe 42 PID 2596 wrote to memory of 3020 2596 1tntnt.exe 42 PID 2596 wrote to memory of 3020 2596 1tntnt.exe 42 PID 2596 wrote to memory of 3020 2596 1tntnt.exe 42 PID 3020 wrote to memory of 1328 3020 1nhnbt.exe 43 PID 3020 wrote to memory of 1328 3020 1nhnbt.exe 43 PID 3020 wrote to memory of 1328 3020 1nhnbt.exe 43 PID 3020 wrote to memory of 1328 3020 1nhnbt.exe 43 PID 1328 wrote to memory of 352 1328 nhbhnn.exe 44 PID 1328 wrote to memory of 352 1328 nhbhnn.exe 44 PID 1328 wrote to memory of 352 1328 nhbhnn.exe 44 PID 1328 wrote to memory of 352 1328 nhbhnn.exe 44 PID 352 wrote to memory of 1508 352 ththhh.exe 45 PID 352 wrote to memory of 1508 352 ththhh.exe 45 PID 352 wrote to memory of 1508 352 ththhh.exe 45 PID 352 wrote to memory of 1508 352 ththhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe"C:\Users\Admin\AppData\Local\Temp\b471d7daef022cf3586fe49b8e8863ac38666f0faa33da9ea501022a0401b99bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\3tbhhn.exec:\3tbhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\7xlflrx.exec:\7xlflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vjjpp.exec:\vjjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\lfflxxf.exec:\lfflxxf.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\hbhhtb.exec:\hbhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\5vjjv.exec:\5vjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\9rlrxxx.exec:\9rlrxxx.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7jvvj.exec:\7jvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\nhbbhn.exec:\nhbbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5vppv.exec:\5vppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\hnbbhn.exec:\hnbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\1tntnt.exec:\1tntnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1nhnbt.exec:\1nhnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nhbhnn.exec:\nhbhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\ththhh.exec:\ththhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\1nhnbh.exec:\1nhnbh.exe17⤵
- Executes dropped EXE
PID:1508 -
\??\c:\tntntt.exec:\tntntt.exe18⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jvjpj.exec:\jvjpj.exe19⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lxllllx.exec:\lxllllx.exe20⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bbbbnn.exec:\bbbbnn.exe21⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe22⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tnbhtt.exec:\tnbhtt.exe23⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rxlllfl.exec:\rxlllfl.exe24⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xfxfrrf.exec:\xfxfrrf.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dvjjp.exec:\dvjjp.exe26⤵
- Executes dropped EXE
PID:2472 -
\??\c:\fxxxffr.exec:\fxxxffr.exe27⤵
- Executes dropped EXE
PID:832 -
\??\c:\htnntt.exec:\htnntt.exe28⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vpjpd.exec:\vpjpd.exe29⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7pppv.exec:\7pppv.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dvddp.exec:\dvddp.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\rlllfxl.exec:\rlllfxl.exe32⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bnhhbb.exec:\bnhhbb.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\3thtbb.exec:\3thtbb.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9dpvd.exec:\9dpvd.exe35⤵
- Executes dropped EXE
PID:2068 -
\??\c:\frxxflr.exec:\frxxflr.exe36⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7hnntt.exec:\7hnntt.exe37⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tthntt.exec:\tthntt.exe38⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7pjjp.exec:\7pjjp.exe39⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ffffrrx.exec:\ffffrrx.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\nhntbh.exec:\nhntbh.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3vvpp.exec:\3vvpp.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1vjjp.exec:\1vjjp.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe45⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tnhhtb.exec:\tnhhtb.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bbhnhn.exec:\bbhnhn.exe47⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vvjpv.exec:\vvjpv.exe48⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7rflllr.exec:\7rflllr.exe49⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7xxxffl.exec:\7xxxffl.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nhhttb.exec:\nhhttb.exe51⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jvpjv.exec:\jvpjv.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\dvpjj.exec:\dvpjj.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1frrxxf.exec:\1frrxxf.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tntthn.exec:\tntthn.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ttnbhn.exec:\ttnbhn.exe56⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jvdvj.exec:\jvdvj.exe57⤵
- Executes dropped EXE
PID:804 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe58⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnbhhb.exec:\tnbhhb.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nnbhnn.exec:\nnbhnn.exe60⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7ddjj.exec:\7ddjj.exe61⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9frlflr.exec:\9frlflr.exe62⤵
- Executes dropped EXE
PID:584 -
\??\c:\rlfxfff.exec:\rlfxfff.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096 -
\??\c:\htnnbh.exec:\htnnbh.exe64⤵
- Executes dropped EXE
PID:684 -
\??\c:\dvjpd.exec:\dvjpd.exe65⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vjvvj.exec:\vjvvj.exe66⤵PID:2472
-
\??\c:\5lxxxxx.exec:\5lxxxxx.exe67⤵PID:1752
-
\??\c:\hhbhbt.exec:\hhbhbt.exe68⤵PID:1240
-
\??\c:\1nbbhh.exec:\1nbbhh.exe69⤵PID:1732
-
\??\c:\dddpv.exec:\dddpv.exe70⤵PID:2532
-
\??\c:\rflrfxl.exec:\rflrfxl.exe71⤵PID:768
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe72⤵PID:2236
-
\??\c:\bththh.exec:\bththh.exe73⤵PID:1556
-
\??\c:\jvdpj.exec:\jvdpj.exe74⤵PID:1584
-
\??\c:\pjvvj.exec:\pjvvj.exe75⤵PID:2860
-
\??\c:\xrlfrlr.exec:\xrlfrlr.exe76⤵PID:2104
-
\??\c:\nbthnn.exec:\nbthnn.exe77⤵PID:2020
-
\??\c:\nbtbnt.exec:\nbtbnt.exe78⤵PID:1920
-
\??\c:\jjvdj.exec:\jjvdj.exe79⤵PID:2232
-
\??\c:\xrrlrlx.exec:\xrrlrlx.exe80⤵PID:2684
-
\??\c:\3lxxffl.exec:\3lxxffl.exe81⤵PID:2788
-
\??\c:\3htbhh.exec:\3htbhh.exe82⤵PID:2212
-
\??\c:\jppjj.exec:\jppjj.exe83⤵PID:2704
-
\??\c:\djdjv.exec:\djdjv.exe84⤵PID:2868
-
\??\c:\7rrrxfl.exec:\7rrrxfl.exe85⤵PID:2856
-
\??\c:\nbhhnt.exec:\nbhhnt.exe86⤵PID:2740
-
\??\c:\1djjj.exec:\1djjj.exe87⤵PID:2688
-
\??\c:\3pjjj.exec:\3pjjj.exe88⤵PID:2652
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe89⤵PID:3024
-
\??\c:\nhhnbb.exec:\nhhnbb.exe90⤵PID:2592
-
\??\c:\hbtttt.exec:\hbtttt.exe91⤵PID:1676
-
\??\c:\1jjpp.exec:\1jjpp.exe92⤵PID:1896
-
\??\c:\rfxrrlx.exec:\rfxrrlx.exe93⤵PID:1916
-
\??\c:\htttnt.exec:\htttnt.exe94⤵PID:1968
-
\??\c:\hhhthh.exec:\hhhthh.exe95⤵PID:1704
-
\??\c:\9vjjv.exec:\9vjjv.exe96⤵PID:904
-
\??\c:\vjjjj.exec:\vjjjj.exe97⤵PID:1276
-
\??\c:\rlflxxf.exec:\rlflxxf.exe98⤵PID:1432
-
\??\c:\nhtbhh.exec:\nhtbhh.exe99⤵PID:1708
-
\??\c:\pjddv.exec:\pjddv.exe100⤵PID:268
-
\??\c:\dvvdj.exec:\dvvdj.exe101⤵PID:2900
-
\??\c:\rfrlrrf.exec:\rfrlrrf.exe102⤵PID:2884
-
\??\c:\5hbntb.exec:\5hbntb.exe103⤵PID:884
-
\??\c:\thbhtb.exec:\thbhtb.exe104⤵PID:404
-
\??\c:\jjvvd.exec:\jjvvd.exe105⤵PID:2456
-
\??\c:\7rxxfff.exec:\7rxxfff.exe106⤵PID:1716
-
\??\c:\nbhbhh.exec:\nbhbhh.exe107⤵PID:1316
-
\??\c:\bthhnh.exec:\bthhnh.exe108⤵PID:556
-
\??\c:\pdpdj.exec:\pdpdj.exe109⤵PID:2544
-
\??\c:\xlflxfl.exec:\xlflxfl.exe110⤵PID:2828
-
\??\c:\hbnttb.exec:\hbnttb.exe111⤵PID:2136
-
\??\c:\bnbbnn.exec:\bnbbnn.exe112⤵PID:1492
-
\??\c:\dpdjp.exec:\dpdjp.exe113⤵PID:1568
-
\??\c:\3frlffl.exec:\3frlffl.exe114⤵PID:2072
-
\??\c:\3rflxxf.exec:\3rflxxf.exe115⤵PID:2236
-
\??\c:\htttbt.exec:\htttbt.exe116⤵PID:1892
-
\??\c:\1jjdp.exec:\1jjdp.exe117⤵PID:1584
-
\??\c:\pjvvv.exec:\pjvvv.exe118⤵PID:2100
-
\??\c:\9lrlllr.exec:\9lrlllr.exe119⤵PID:2500
-
\??\c:\lfxrrlr.exec:\lfxrrlr.exe120⤵PID:2108
-
\??\c:\bbtbnn.exec:\bbtbnn.exe121⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-