Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe
-
Size
456KB
-
MD5
0b9d47010907aa23bb213bf9aaf30f76
-
SHA1
dcf41e7fbfdd76ccb95e3085359639c39cf32880
-
SHA256
07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a
-
SHA512
2571deece4daef21daab81d472009c7dfc1b1ce97ffc876c379eac5512936c6a1b51c6d522a538323965e00bd94ccc25a871600f8a9bafc6ff67172a2dc27698
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRS:q7Tc2NYHUrAwfMp3CDRS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2516-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-132-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-156-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2948-154-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2100-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-264-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-384-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-394-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1632-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-786-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-882-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-952-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-1087-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1524-1112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-1163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-1188-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2516 3tnnth.exe 1180 rlfflrl.exe 2804 3pppv.exe 2724 9dddp.exe 2848 dvjdj.exe 2628 lfxllxf.exe 2812 vpdjv.exe 2784 pjvdv.exe 2616 lfflxxf.exe 3068 pdvvd.exe 2192 fxxrfxl.exe 912 bnbbnh.exe 2300 3xlfrxf.exe 2512 nhbbnt.exe 1708 pppdp.exe 2948 bthhnt.exe 1452 tnhtbn.exe 1572 5rflxxl.exe 2100 tnbhnn.exe 588 pjvvd.exe 1564 7flxlfl.exe 2604 frlrffr.exe 612 nhbbnt.exe 2224 dpdvd.exe 1096 lxflrrx.exe 936 dpddj.exe 2036 ddvdv.exe 1672 lrrxxfl.exe 2580 dvdpv.exe 3044 lfxxxxf.exe 2492 3tttbb.exe 1520 rrflxxf.exe 2584 7nbhnn.exe 756 jdppv.exe 2184 lxrrrrx.exe 2748 tnnhnn.exe 2828 3nbttn.exe 2776 vpjdd.exe 1904 9xllllr.exe 2648 btnttt.exe 2340 hbhhnn.exe 2868 1pvvp.exe 2640 xlrlfff.exe 2616 7lrxfff.exe 2072 bntthh.exe 2024 9dpdv.exe 1844 xlfflll.exe 2228 9xflfff.exe 1632 thttbb.exe 2000 pvjpd.exe 2708 9lxrrlr.exe 2808 5xlfffr.exe 2880 nthntb.exe 1568 pdvpd.exe 1404 3jppv.exe 1376 xrflxfl.exe 484 3tntht.exe 2244 tnbtnt.exe 1424 5pjjv.exe 544 5xfrxll.exe 916 9tnntt.exe 2220 pjvpv.exe 1944 jvpjj.exe 576 rlflxxl.exe -
resource yara_rule behavioral1/memory/2516-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-116-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/912-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-171-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2100-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-384-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1632-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-824-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2996-889-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1000-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-971-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2516 2352 07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe 30 PID 2352 wrote to memory of 2516 2352 07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe 30 PID 2352 wrote to memory of 2516 2352 07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe 30 PID 2352 wrote to memory of 2516 2352 07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe 30 PID 2516 wrote to memory of 1180 2516 3tnnth.exe 31 PID 2516 wrote to memory of 1180 2516 3tnnth.exe 31 PID 2516 wrote to memory of 1180 2516 3tnnth.exe 31 PID 2516 wrote to memory of 1180 2516 3tnnth.exe 31 PID 1180 wrote to memory of 2804 1180 rlfflrl.exe 32 PID 1180 wrote to memory of 2804 1180 rlfflrl.exe 32 PID 1180 wrote to memory of 2804 1180 rlfflrl.exe 32 PID 1180 wrote to memory of 2804 1180 rlfflrl.exe 32 PID 2804 wrote to memory of 2724 2804 3pppv.exe 33 PID 2804 wrote to memory of 2724 2804 3pppv.exe 33 PID 2804 wrote to memory of 2724 2804 3pppv.exe 33 PID 2804 wrote to memory of 2724 2804 3pppv.exe 33 PID 2724 wrote to memory of 2848 2724 9dddp.exe 34 PID 2724 wrote to memory of 2848 2724 9dddp.exe 34 PID 2724 wrote to memory of 2848 2724 9dddp.exe 34 PID 2724 wrote to memory of 2848 2724 9dddp.exe 34 PID 2848 wrote to memory of 2628 2848 dvjdj.exe 35 PID 2848 wrote to memory of 2628 2848 dvjdj.exe 35 PID 2848 wrote to memory of 2628 2848 dvjdj.exe 35 PID 2848 wrote to memory of 2628 2848 dvjdj.exe 35 PID 2628 wrote to memory of 2812 2628 lfxllxf.exe 36 PID 2628 wrote to memory of 2812 2628 lfxllxf.exe 36 PID 2628 wrote to memory of 2812 2628 lfxllxf.exe 36 PID 2628 wrote to memory of 2812 2628 lfxllxf.exe 36 PID 2812 wrote to memory of 2784 2812 vpdjv.exe 37 PID 2812 wrote to memory of 2784 2812 vpdjv.exe 37 PID 2812 wrote to memory of 2784 2812 vpdjv.exe 37 PID 2812 wrote to memory of 2784 2812 vpdjv.exe 37 PID 2784 wrote to memory of 2616 2784 pjvdv.exe 38 PID 2784 wrote to memory of 2616 2784 pjvdv.exe 38 PID 2784 wrote to memory of 2616 2784 pjvdv.exe 38 PID 2784 wrote to memory of 2616 2784 pjvdv.exe 38 PID 2616 wrote to memory of 3068 2616 lfflxxf.exe 39 PID 2616 wrote to memory of 3068 2616 lfflxxf.exe 39 PID 2616 wrote to memory of 3068 2616 lfflxxf.exe 39 PID 2616 wrote to memory of 3068 2616 lfflxxf.exe 39 PID 3068 wrote to memory of 2192 3068 pdvvd.exe 40 PID 3068 wrote to memory of 2192 3068 pdvvd.exe 40 PID 3068 wrote to memory of 2192 3068 pdvvd.exe 40 PID 3068 wrote to memory of 2192 3068 pdvvd.exe 40 PID 2192 wrote to memory of 912 2192 fxxrfxl.exe 41 PID 2192 wrote to memory of 912 2192 fxxrfxl.exe 41 PID 2192 wrote to memory of 912 2192 fxxrfxl.exe 41 PID 2192 wrote to memory of 912 2192 fxxrfxl.exe 41 PID 912 wrote to memory of 2300 912 bnbbnh.exe 42 PID 912 wrote to memory of 2300 912 bnbbnh.exe 42 PID 912 wrote to memory of 2300 912 bnbbnh.exe 42 PID 912 wrote to memory of 2300 912 bnbbnh.exe 42 PID 2300 wrote to memory of 2512 2300 3xlfrxf.exe 43 PID 2300 wrote to memory of 2512 2300 3xlfrxf.exe 43 PID 2300 wrote to memory of 2512 2300 3xlfrxf.exe 43 PID 2300 wrote to memory of 2512 2300 3xlfrxf.exe 43 PID 2512 wrote to memory of 1708 2512 nhbbnt.exe 44 PID 2512 wrote to memory of 1708 2512 nhbbnt.exe 44 PID 2512 wrote to memory of 1708 2512 nhbbnt.exe 44 PID 2512 wrote to memory of 1708 2512 nhbbnt.exe 44 PID 1708 wrote to memory of 2948 1708 pppdp.exe 45 PID 1708 wrote to memory of 2948 1708 pppdp.exe 45 PID 1708 wrote to memory of 2948 1708 pppdp.exe 45 PID 1708 wrote to memory of 2948 1708 pppdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe"C:\Users\Admin\AppData\Local\Temp\07ec6869ed8b07e3a393aab9726f9978990bccc7ce88b1c1610ceccac7fda50a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\3tnnth.exec:\3tnnth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rlfflrl.exec:\rlfflrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\3pppv.exec:\3pppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\9dddp.exec:\9dddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dvjdj.exec:\dvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lfxllxf.exec:\lfxllxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vpdjv.exec:\vpdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\pjvdv.exec:\pjvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lfflxxf.exec:\lfflxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pdvvd.exec:\pdvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\fxxrfxl.exec:\fxxrfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bnbbnh.exec:\bnbbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\3xlfrxf.exec:\3xlfrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\nhbbnt.exec:\nhbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\pppdp.exec:\pppdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\bthhnt.exec:\bthhnt.exe17⤵
- Executes dropped EXE
PID:2948 -
\??\c:\tnhtbn.exec:\tnhtbn.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\5rflxxl.exec:\5rflxxl.exe19⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tnbhnn.exec:\tnbhnn.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjvvd.exec:\pjvvd.exe21⤵
- Executes dropped EXE
PID:588 -
\??\c:\7flxlfl.exec:\7flxlfl.exe22⤵
- Executes dropped EXE
PID:1564 -
\??\c:\frlrffr.exec:\frlrffr.exe23⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nhbbnt.exec:\nhbbnt.exe24⤵
- Executes dropped EXE
PID:612 -
\??\c:\dpdvd.exec:\dpdvd.exe25⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lxflrrx.exec:\lxflrrx.exe26⤵
- Executes dropped EXE
PID:1096 -
\??\c:\dpddj.exec:\dpddj.exe27⤵
- Executes dropped EXE
PID:936 -
\??\c:\ddvdv.exec:\ddvdv.exe28⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lrrxxfl.exec:\lrrxxfl.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvdpv.exec:\dvdpv.exe30⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3tttbb.exec:\3tttbb.exe32⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rrflxxf.exec:\rrflxxf.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7nbhnn.exec:\7nbhnn.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:756 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe36⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tnnhnn.exec:\tnnhnn.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3nbttn.exec:\3nbttn.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vpjdd.exec:\vpjdd.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9xllllr.exec:\9xllllr.exe40⤵
- Executes dropped EXE
PID:1904 -
\??\c:\btnttt.exec:\btnttt.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbhhnn.exec:\hbhhnn.exe42⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1pvvp.exec:\1pvvp.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xlrlfff.exec:\xlrlfff.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7lrxfff.exec:\7lrxfff.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bntthh.exec:\bntthh.exe46⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9dpdv.exec:\9dpdv.exe47⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xlfflll.exec:\xlfflll.exe48⤵
- Executes dropped EXE
PID:1844 -
\??\c:\9xflfff.exec:\9xflfff.exe49⤵
- Executes dropped EXE
PID:2228 -
\??\c:\thttbb.exec:\thttbb.exe50⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pvjpd.exec:\pvjpd.exe51⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9lxrrlr.exec:\9lxrrlr.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5xlfffr.exec:\5xlfffr.exe53⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nthntb.exec:\nthntb.exe54⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pdvpd.exec:\pdvpd.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\3jppv.exec:\3jppv.exe56⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xrflxfl.exec:\xrflxfl.exe57⤵
- Executes dropped EXE
PID:1376 -
\??\c:\3tntht.exec:\3tntht.exe58⤵
- Executes dropped EXE
PID:484 -
\??\c:\tnbtnt.exec:\tnbtnt.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5pjjv.exec:\5pjjv.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5xfrxll.exec:\5xfrxll.exe61⤵
- Executes dropped EXE
PID:544 -
\??\c:\9tnntt.exec:\9tnntt.exe62⤵
- Executes dropped EXE
PID:916 -
\??\c:\pjvpv.exec:\pjvpv.exe63⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jvpjj.exec:\jvpjj.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rlflxxl.exec:\rlflxxl.exe65⤵
- Executes dropped EXE
PID:576 -
\??\c:\9rrllxr.exec:\9rrllxr.exe66⤵PID:1788
-
\??\c:\tntthn.exec:\tntthn.exe67⤵PID:2076
-
\??\c:\jdppp.exec:\jdppp.exe68⤵PID:2360
-
\??\c:\vpppd.exec:\vpppd.exe69⤵PID:2084
-
\??\c:\xrffxxx.exec:\xrffxxx.exe70⤵PID:1740
-
\??\c:\thtthb.exec:\thtthb.exe71⤵PID:1836
-
\??\c:\dpjvj.exec:\dpjvj.exe72⤵PID:2204
-
\??\c:\jvppp.exec:\jvppp.exe73⤵PID:2540
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe74⤵PID:1924
-
\??\c:\tnbbbb.exec:\tnbbbb.exe75⤵PID:2020
-
\??\c:\9bhhbt.exec:\9bhhbt.exe76⤵PID:2380
-
\??\c:\dvjvv.exec:\dvjvv.exe77⤵PID:1980
-
\??\c:\rlflflx.exec:\rlflflx.exe78⤵PID:1888
-
\??\c:\nbnntb.exec:\nbnntb.exe79⤵PID:2184
-
\??\c:\tnbbhb.exec:\tnbbhb.exe80⤵PID:2844
-
\??\c:\vpjdj.exec:\vpjdj.exe81⤵PID:2828
-
\??\c:\xlxxrxf.exec:\xlxxrxf.exe82⤵PID:2744
-
\??\c:\3bhbhb.exec:\3bhbhb.exe83⤵PID:2628
-
\??\c:\bnnhnh.exec:\bnnhnh.exe84⤵PID:2840
-
\??\c:\pvpjj.exec:\pvpjj.exe85⤵PID:2340
-
\??\c:\frxrlff.exec:\frxrlff.exe86⤵PID:2868
-
\??\c:\xlfflxl.exec:\xlfflxl.exe87⤵PID:2852
-
\??\c:\tnbbbh.exec:\tnbbbh.exe88⤵PID:1860
-
\??\c:\dvdvv.exec:\dvdvv.exe89⤵PID:2872
-
\??\c:\ddvjv.exec:\ddvjv.exe90⤵PID:1000
-
\??\c:\lxxxfxf.exec:\lxxxfxf.exe91⤵PID:1724
-
\??\c:\hbnhnh.exec:\hbnhnh.exe92⤵PID:2300
-
\??\c:\htbbnh.exec:\htbbnh.exe93⤵PID:2228
-
\??\c:\9jddv.exec:\9jddv.exe94⤵PID:2952
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe95⤵PID:2860
-
\??\c:\rfllllr.exec:\rfllllr.exe96⤵PID:2856
-
\??\c:\nhtthh.exec:\nhtthh.exe97⤵PID:2876
-
\??\c:\3djdd.exec:\3djdd.exe98⤵PID:2880
-
\??\c:\xfrlfxf.exec:\xfrlfxf.exe99⤵PID:2028
-
\??\c:\5flfffr.exec:\5flfffr.exe100⤵PID:2424
-
\??\c:\bthntt.exec:\bthntt.exe101⤵PID:692
-
\??\c:\dvddp.exec:\dvddp.exe102⤵
- System Location Discovery: System Language Discovery
PID:2168 -
\??\c:\1jdvp.exec:\1jdvp.exe103⤵PID:2972
-
\??\c:\xlfflfl.exec:\xlfflfl.exe104⤵PID:1732
-
\??\c:\9nnhhh.exec:\9nnhhh.exe105⤵PID:1424
-
\??\c:\nbnbhh.exec:\nbnbhh.exe106⤵PID:544
-
\??\c:\vjpdv.exec:\vjpdv.exe107⤵PID:3012
-
\??\c:\frlrxrx.exec:\frlrxrx.exe108⤵PID:280
-
\??\c:\bntbhb.exec:\bntbhb.exe109⤵PID:2224
-
\??\c:\btnbhn.exec:\btnbhn.exe110⤵PID:2092
-
\??\c:\ppddj.exec:\ppddj.exe111⤵PID:1656
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe112⤵PID:1644
-
\??\c:\nbntnn.exec:\nbntnn.exe113⤵PID:2376
-
\??\c:\dvpdp.exec:\dvpdp.exe114⤵PID:1592
-
\??\c:\vpjpv.exec:\vpjpv.exe115⤵PID:1436
-
\??\c:\9lxllll.exec:\9lxllll.exe116⤵PID:3044
-
\??\c:\ttbbnt.exec:\ttbbnt.exe117⤵PID:2492
-
\??\c:\htbtbt.exec:\htbtbt.exe118⤵PID:3064
-
\??\c:\jdpvj.exec:\jdpvj.exe119⤵PID:2392
-
\??\c:\7xxxrxx.exec:\7xxxrxx.exe120⤵PID:2932
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe121⤵PID:2404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-