Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe
-
Size
453KB
-
MD5
4d284d7c0fde181ea419aa9e09974467
-
SHA1
beef0ac4456b5d3483d6b694b944caca74b3c02f
-
SHA256
52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537
-
SHA512
1e1654674cfb1b7fd8e548bdabd4b427d3fb07acf6671af963db27924b60c6e4e0a6f251bcfa8d6cd9f02227dfa1bed56f70a761d17c5eb70a39a9246b856492
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2312-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-95-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-171-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2280-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-226-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1012-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-297-0x0000000077520000-0x000000007763F000-memory.dmp family_blackmoon behavioral1/memory/2464-298-0x0000000077640000-0x000000007773A000-memory.dmp family_blackmoon behavioral1/memory/2108-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-513-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-699-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1524-725-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1944-759-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/760-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/348-879-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/348-898-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2888-928-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-936-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2656-943-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-1100-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/572-1114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-1151-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1280 8628840.exe 2340 rlflllf.exe 1244 20286.exe 2140 bnbhnt.exe 2848 1dpvd.exe 2268 642282.exe 2912 424440.exe 2832 rlflllx.exe 2684 lfxflrl.exe 2672 nbnbnt.exe 2688 nhttbb.exe 784 1btbhh.exe 2956 024888.exe 2012 c206228.exe 2984 5dvvv.exe 1052 864004.exe 804 1bbhhn.exe 3008 nhntbb.exe 2736 4424280.exe 2280 604866.exe 408 00284.exe 1520 64806.exe 1380 04628.exe 2424 vpjjv.exe 1012 66468.exe 2512 6484668.exe 2532 vvpdj.exe 1712 bbbbnn.exe 2448 2422440.exe 1152 26008.exe 2336 1nhthn.exe 2464 hhtbhh.exe 2176 rrfflrx.exe 1696 04024.exe 2368 860060.exe 1244 7rfffff.exe 2780 60806.exe 2108 08444.exe 2844 dvpvd.exe 2792 nbtbhh.exe 2260 5htbbt.exe 2908 1ttnnh.exe 2808 e82806.exe 2636 nhnntn.exe 2684 6084000.exe 2172 6024048.exe 340 48802.exe 2104 3nthbt.exe 784 462660.exe 2956 jvjjd.exe 1880 tnbhnn.exe 1652 084666.exe 2972 ffrrxrl.exe 1092 64240.exe 3000 xrlrrxx.exe 1916 6840666.exe 2544 2688046.exe 2180 26288.exe 1028 hhbnnn.exe 1216 4244440.exe 1248 1hbhtb.exe 1104 86260.exe 760 nnhnnt.exe 1684 k84888.exe -
resource yara_rule behavioral1/memory/2312-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-155-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2736-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-297-0x0000000077520000-0x000000007763F000-memory.dmp upx behavioral1/memory/2108-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/400-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-605-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2140-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-699-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1592-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-931-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2656-943-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-987-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-1031-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-1081-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1688-1080-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0462228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642282.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6684624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1280 2312 52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe 31 PID 2312 wrote to memory of 1280 2312 52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe 31 PID 2312 wrote to memory of 1280 2312 52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe 31 PID 2312 wrote to memory of 1280 2312 52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe 31 PID 1280 wrote to memory of 2340 1280 8628840.exe 32 PID 1280 wrote to memory of 2340 1280 8628840.exe 32 PID 1280 wrote to memory of 2340 1280 8628840.exe 32 PID 1280 wrote to memory of 2340 1280 8628840.exe 32 PID 2340 wrote to memory of 1244 2340 rlflllf.exe 33 PID 2340 wrote to memory of 1244 2340 rlflllf.exe 33 PID 2340 wrote to memory of 1244 2340 rlflllf.exe 33 PID 2340 wrote to memory of 1244 2340 rlflllf.exe 33 PID 1244 wrote to memory of 2140 1244 20286.exe 34 PID 1244 wrote to memory of 2140 1244 20286.exe 34 PID 1244 wrote to memory of 2140 1244 20286.exe 34 PID 1244 wrote to memory of 2140 1244 20286.exe 34 PID 2140 wrote to memory of 2848 2140 bnbhnt.exe 35 PID 2140 wrote to memory of 2848 2140 bnbhnt.exe 35 PID 2140 wrote to memory of 2848 2140 bnbhnt.exe 35 PID 2140 wrote to memory of 2848 2140 bnbhnt.exe 35 PID 2848 wrote to memory of 2268 2848 1dpvd.exe 36 PID 2848 wrote to memory of 2268 2848 1dpvd.exe 36 PID 2848 wrote to memory of 2268 2848 1dpvd.exe 36 PID 2848 wrote to memory of 2268 2848 1dpvd.exe 36 PID 2268 wrote to memory of 2912 2268 642282.exe 37 PID 2268 wrote to memory of 2912 2268 642282.exe 37 PID 2268 wrote to memory of 2912 2268 642282.exe 37 PID 2268 wrote to memory of 2912 2268 642282.exe 37 PID 2912 wrote to memory of 2832 2912 424440.exe 38 PID 2912 wrote to memory of 2832 2912 424440.exe 38 PID 2912 wrote to memory of 2832 2912 424440.exe 38 PID 2912 wrote to memory of 2832 2912 424440.exe 38 PID 2832 wrote to memory of 2684 2832 rlflllx.exe 39 PID 2832 wrote to memory of 2684 2832 rlflllx.exe 39 PID 2832 wrote to memory of 2684 2832 rlflllx.exe 39 PID 2832 wrote to memory of 2684 2832 rlflllx.exe 39 PID 2684 wrote to memory of 2672 2684 lfxflrl.exe 40 PID 2684 wrote to memory of 2672 2684 lfxflrl.exe 40 PID 2684 wrote to memory of 2672 2684 lfxflrl.exe 40 PID 2684 wrote to memory of 2672 2684 lfxflrl.exe 40 PID 2672 wrote to memory of 2688 2672 nbnbnt.exe 41 PID 2672 wrote to memory of 2688 2672 nbnbnt.exe 41 PID 2672 wrote to memory of 2688 2672 nbnbnt.exe 41 PID 2672 wrote to memory of 2688 2672 nbnbnt.exe 41 PID 2688 wrote to memory of 784 2688 nhttbb.exe 42 PID 2688 wrote to memory of 784 2688 nhttbb.exe 42 PID 2688 wrote to memory of 784 2688 nhttbb.exe 42 PID 2688 wrote to memory of 784 2688 nhttbb.exe 42 PID 784 wrote to memory of 2956 784 1btbhh.exe 43 PID 784 wrote to memory of 2956 784 1btbhh.exe 43 PID 784 wrote to memory of 2956 784 1btbhh.exe 43 PID 784 wrote to memory of 2956 784 1btbhh.exe 43 PID 2956 wrote to memory of 2012 2956 024888.exe 44 PID 2956 wrote to memory of 2012 2956 024888.exe 44 PID 2956 wrote to memory of 2012 2956 024888.exe 44 PID 2956 wrote to memory of 2012 2956 024888.exe 44 PID 2012 wrote to memory of 2984 2012 c206228.exe 45 PID 2012 wrote to memory of 2984 2012 c206228.exe 45 PID 2012 wrote to memory of 2984 2012 c206228.exe 45 PID 2012 wrote to memory of 2984 2012 c206228.exe 45 PID 2984 wrote to memory of 1052 2984 5dvvv.exe 46 PID 2984 wrote to memory of 1052 2984 5dvvv.exe 46 PID 2984 wrote to memory of 1052 2984 5dvvv.exe 46 PID 2984 wrote to memory of 1052 2984 5dvvv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe"C:\Users\Admin\AppData\Local\Temp\52a1d050b74f097c14d0a349e22d9fa71ca26e39de4309040945b67df26a3537.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\8628840.exec:\8628840.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\rlflllf.exec:\rlflllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\20286.exec:\20286.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\bnbhnt.exec:\bnbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\1dpvd.exec:\1dpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\642282.exec:\642282.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\424440.exec:\424440.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rlflllx.exec:\rlflllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lfxflrl.exec:\lfxflrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nbnbnt.exec:\nbnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nhttbb.exec:\nhttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1btbhh.exec:\1btbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\024888.exec:\024888.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\c206228.exec:\c206228.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\5dvvv.exec:\5dvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\864004.exec:\864004.exe17⤵
- Executes dropped EXE
PID:1052 -
\??\c:\1bbhhn.exec:\1bbhhn.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\nhntbb.exec:\nhntbb.exe19⤵
- Executes dropped EXE
PID:3008 -
\??\c:\4424280.exec:\4424280.exe20⤵
- Executes dropped EXE
PID:2736 -
\??\c:\604866.exec:\604866.exe21⤵
- Executes dropped EXE
PID:2280 -
\??\c:\00284.exec:\00284.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\64806.exec:\64806.exe23⤵
- Executes dropped EXE
PID:1520 -
\??\c:\04628.exec:\04628.exe24⤵
- Executes dropped EXE
PID:1380 -
\??\c:\vpjjv.exec:\vpjjv.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\66468.exec:\66468.exe26⤵
- Executes dropped EXE
PID:1012 -
\??\c:\6484668.exec:\6484668.exe27⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vvpdj.exec:\vvpdj.exe28⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bbbbnn.exec:\bbbbnn.exe29⤵
- Executes dropped EXE
PID:1712 -
\??\c:\2422440.exec:\2422440.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\26008.exec:\26008.exe31⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1nhthn.exec:\1nhthn.exe32⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hhtbhh.exec:\hhtbhh.exe33⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hbthnt.exec:\hbthnt.exe34⤵PID:2344
-
\??\c:\rrfflrx.exec:\rrfflrx.exe35⤵
- Executes dropped EXE
PID:2176 -
\??\c:\04024.exec:\04024.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\860060.exec:\860060.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7rfffff.exec:\7rfffff.exe38⤵
- Executes dropped EXE
PID:1244 -
\??\c:\60806.exec:\60806.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\08444.exec:\08444.exe40⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvpvd.exec:\dvpvd.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nbtbhh.exec:\nbtbhh.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5htbbt.exec:\5htbbt.exe43⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1ttnnh.exec:\1ttnnh.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\e82806.exec:\e82806.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhnntn.exec:\nhnntn.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\6084000.exec:\6084000.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\6024048.exec:\6024048.exe48⤵
- Executes dropped EXE
PID:2172 -
\??\c:\48802.exec:\48802.exe49⤵
- Executes dropped EXE
PID:340 -
\??\c:\3nthbt.exec:\3nthbt.exe50⤵
- Executes dropped EXE
PID:2104 -
\??\c:\462660.exec:\462660.exe51⤵
- Executes dropped EXE
PID:784 -
\??\c:\jvjjd.exec:\jvjjd.exe52⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tnbhnn.exec:\tnbhnn.exe53⤵
- Executes dropped EXE
PID:1880 -
\??\c:\084666.exec:\084666.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ffrrxrl.exec:\ffrrxrl.exe55⤵
- Executes dropped EXE
PID:2972 -
\??\c:\64240.exec:\64240.exe56⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrlrrxx.exec:\xrlrrxx.exe57⤵
- Executes dropped EXE
PID:3000 -
\??\c:\6840666.exec:\6840666.exe58⤵
- Executes dropped EXE
PID:1916 -
\??\c:\2688046.exec:\2688046.exe59⤵
- Executes dropped EXE
PID:2544 -
\??\c:\26288.exec:\26288.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hhbnnn.exec:\hhbnnn.exe61⤵
- Executes dropped EXE
PID:1028 -
\??\c:\4244440.exec:\4244440.exe62⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1hbhtb.exec:\1hbhtb.exe63⤵
- Executes dropped EXE
PID:1248 -
\??\c:\86260.exec:\86260.exe64⤵
- Executes dropped EXE
PID:1104 -
\??\c:\nnhnnt.exec:\nnhnnt.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\k84888.exec:\k84888.exe66⤵
- Executes dropped EXE
PID:1684 -
\??\c:\k80622.exec:\k80622.exe67⤵PID:896
-
\??\c:\pjpjj.exec:\pjpjj.exe68⤵PID:1716
-
\??\c:\dvppj.exec:\dvppj.exe69⤵PID:944
-
\??\c:\ppddd.exec:\ppddd.exe70⤵PID:3060
-
\??\c:\btnbhn.exec:\btnbhn.exe71⤵PID:2608
-
\??\c:\20228.exec:\20228.exe72⤵PID:572
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe73⤵PID:2612
-
\??\c:\xfrffxx.exec:\xfrffxx.exe74⤵PID:2592
-
\??\c:\602844.exec:\602844.exe75⤵PID:876
-
\??\c:\xlxrrfl.exec:\xlxrrfl.exe76⤵PID:400
-
\??\c:\3pvvd.exec:\3pvvd.exe77⤵PID:1884
-
\??\c:\hthtbb.exec:\hthtbb.exe78⤵PID:684
-
\??\c:\xrffffl.exec:\xrffffl.exe79⤵PID:2312
-
\??\c:\5xxllff.exec:\5xxllff.exe80⤵PID:348
-
\??\c:\w00662.exec:\w00662.exe81⤵PID:3016
-
\??\c:\68688.exec:\68688.exe82⤵PID:2516
-
\??\c:\vppvj.exec:\vppvj.exe83⤵PID:2140
-
\??\c:\40608.exec:\40608.exe84⤵PID:2872
-
\??\c:\fxlfffl.exec:\fxlfffl.exe85⤵PID:3024
-
\??\c:\c462266.exec:\c462266.exe86⤵PID:3028
-
\??\c:\nbnttb.exec:\nbnttb.exe87⤵PID:2740
-
\??\c:\rflrfff.exec:\rflrfff.exe88⤵PID:2904
-
\??\c:\826284.exec:\826284.exe89⤵PID:2640
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe90⤵PID:2712
-
\??\c:\684004.exec:\684004.exe91⤵PID:1476
-
\??\c:\btbhnt.exec:\btbhnt.exe92⤵PID:2672
-
\??\c:\rlfflrx.exec:\rlfflrx.exe93⤵PID:1264
-
\??\c:\04220.exec:\04220.exe94⤵PID:2824
-
\??\c:\vpjjp.exec:\vpjjp.exe95⤵PID:2104
-
\??\c:\dpvpp.exec:\dpvpp.exe96⤵PID:2012
-
\??\c:\3tbtbt.exec:\3tbtbt.exe97⤵
- System Location Discovery: System Language Discovery
PID:864 -
\??\c:\thbbtt.exec:\thbbtt.exe98⤵PID:2016
-
\??\c:\4806840.exec:\4806840.exe99⤵PID:888
-
\??\c:\08602.exec:\08602.exe100⤵PID:1524
-
\??\c:\20062.exec:\20062.exe101⤵PID:2680
-
\??\c:\9hnhhn.exec:\9hnhhn.exe102⤵PID:1944
-
\??\c:\dvddj.exec:\dvddj.exe103⤵PID:2276
-
\??\c:\rlfxrll.exec:\rlfxrll.exe104⤵PID:2180
-
\??\c:\208400.exec:\208400.exe105⤵PID:1592
-
\??\c:\ffxflxl.exec:\ffxflxl.exe106⤵PID:1216
-
\??\c:\7frxxfl.exec:\7frxxfl.exe107⤵PID:1248
-
\??\c:\k48444.exec:\k48444.exe108⤵PID:1104
-
\??\c:\5xrxxxf.exec:\5xrxxxf.exe109⤵PID:760
-
\??\c:\lxxrrll.exec:\lxxrrll.exe110⤵PID:1684
-
\??\c:\0462228.exec:\0462228.exe111⤵PID:1788
-
\??\c:\6888484.exec:\6888484.exe112⤵PID:1932
-
\??\c:\xxxxllr.exec:\xxxxllr.exe113⤵PID:1284
-
\??\c:\tthnbn.exec:\tthnbn.exe114⤵PID:2412
-
\??\c:\2022280.exec:\2022280.exe115⤵PID:2608
-
\??\c:\202604.exec:\202604.exe116⤵PID:572
-
\??\c:\jjdjp.exec:\jjdjp.exe117⤵PID:688
-
\??\c:\bbttbb.exec:\bbttbb.exe118⤵PID:988
-
\??\c:\4648484.exec:\4648484.exe119⤵PID:1612
-
\??\c:\2004000.exec:\2004000.exe120⤵PID:400
-
\??\c:\3frrxxl.exec:\3frrxxl.exe121⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-