Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe
-
Size
456KB
-
MD5
b4cd63ddd017be32465fb58b4caa4c50
-
SHA1
4ba920daa0018ef241d0dc931e601d14446c3750
-
SHA256
127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517
-
SHA512
abcd83974c30c4f4966f6a8fdbece812f77d964d41373f167ce20285ad68502313817b605a8ce7165ccb7647391420f7ce4a3eab97fc5bec9b94ba999273326e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRG:q7Tc2NYHUrAwfMp3CDRG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-93-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/804-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-113-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/2764-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-238-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1752-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-394-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/340-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-411-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/540-450-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2084-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-804-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1592-858-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 ddpvj.exe 2928 xrrxlrl.exe 2832 pdvvd.exe 2584 nhbhnt.exe 2596 pjvdp.exe 2568 lfffllx.exe 2600 9bhhnt.exe 576 7dvpd.exe 2204 bttbnn.exe 2148 nhtthh.exe 804 xfrrrlr.exe 340 btnthh.exe 2764 xfxlxff.exe 2076 rlfrxlr.exe 2856 tnbbhh.exe 1820 vvjvd.exe 588 1tbtbb.exe 2404 hbntbb.exe 2272 bbbntb.exe 2332 rrfrxxf.exe 408 tbthnn.exe 2116 lfxflxr.exe 956 xfrfllr.exe 2448 3dvdj.exe 2496 fxllfxf.exe 664 1hnnnn.exe 2252 vdpdv.exe 2428 ffflrlf.exe 2944 vjjvv.exe 880 xlfxflx.exe 1752 bthntb.exe 2232 llxlffl.exe 1596 hbthtb.exe 2704 vvvvp.exe 2780 xrlrxfr.exe 2668 bhbbhn.exe 2884 9pddd.exe 2808 dvjjp.exe 2580 rlffllf.exe 1204 bhbbhh.exe 2672 3pppd.exe 1660 dvpvj.exe 1096 5xllfff.exe 2396 hbbbhn.exe 2096 vpjjp.exe 1356 5jdjv.exe 1764 llflxrx.exe 340 7vvvv.exe 484 9pjpd.exe 1732 5rffllr.exe 2652 hnhtnn.exe 2856 pjppp.exe 1820 9jvvd.exe 540 lxfffxl.exe 588 hhnnnt.exe 2084 lxrrxxl.exe 2460 nnhtnt.exe 2344 jjddj.exe 2108 lxrrffr.exe 1920 btnntt.exe 2152 ddjpd.exe 936 pjddj.exe 1640 5fxxlrf.exe 2528 5bhhhn.exe -
resource yara_rule behavioral1/memory/2644-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-95-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/804-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-569-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2884-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-858-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2120 2644 127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe 30 PID 2644 wrote to memory of 2120 2644 127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe 30 PID 2644 wrote to memory of 2120 2644 127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe 30 PID 2644 wrote to memory of 2120 2644 127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe 30 PID 2120 wrote to memory of 2928 2120 ddpvj.exe 31 PID 2120 wrote to memory of 2928 2120 ddpvj.exe 31 PID 2120 wrote to memory of 2928 2120 ddpvj.exe 31 PID 2120 wrote to memory of 2928 2120 ddpvj.exe 31 PID 2928 wrote to memory of 2832 2928 xrrxlrl.exe 32 PID 2928 wrote to memory of 2832 2928 xrrxlrl.exe 32 PID 2928 wrote to memory of 2832 2928 xrrxlrl.exe 32 PID 2928 wrote to memory of 2832 2928 xrrxlrl.exe 32 PID 2832 wrote to memory of 2584 2832 pdvvd.exe 33 PID 2832 wrote to memory of 2584 2832 pdvvd.exe 33 PID 2832 wrote to memory of 2584 2832 pdvvd.exe 33 PID 2832 wrote to memory of 2584 2832 pdvvd.exe 33 PID 2584 wrote to memory of 2596 2584 nhbhnt.exe 34 PID 2584 wrote to memory of 2596 2584 nhbhnt.exe 34 PID 2584 wrote to memory of 2596 2584 nhbhnt.exe 34 PID 2584 wrote to memory of 2596 2584 nhbhnt.exe 34 PID 2596 wrote to memory of 2568 2596 pjvdp.exe 35 PID 2596 wrote to memory of 2568 2596 pjvdp.exe 35 PID 2596 wrote to memory of 2568 2596 pjvdp.exe 35 PID 2596 wrote to memory of 2568 2596 pjvdp.exe 35 PID 2568 wrote to memory of 2600 2568 lfffllx.exe 36 PID 2568 wrote to memory of 2600 2568 lfffllx.exe 36 PID 2568 wrote to memory of 2600 2568 lfffllx.exe 36 PID 2568 wrote to memory of 2600 2568 lfffllx.exe 36 PID 2600 wrote to memory of 576 2600 9bhhnt.exe 37 PID 2600 wrote to memory of 576 2600 9bhhnt.exe 37 PID 2600 wrote to memory of 576 2600 9bhhnt.exe 37 PID 2600 wrote to memory of 576 2600 9bhhnt.exe 37 PID 576 wrote to memory of 2204 576 7dvpd.exe 38 PID 576 wrote to memory of 2204 576 7dvpd.exe 38 PID 576 wrote to memory of 2204 576 7dvpd.exe 38 PID 576 wrote to memory of 2204 576 7dvpd.exe 38 PID 2204 wrote to memory of 2148 2204 bttbnn.exe 39 PID 2204 wrote to memory of 2148 2204 bttbnn.exe 39 PID 2204 wrote to memory of 2148 2204 bttbnn.exe 39 PID 2204 wrote to memory of 2148 2204 bttbnn.exe 39 PID 2148 wrote to memory of 804 2148 nhtthh.exe 40 PID 2148 wrote to memory of 804 2148 nhtthh.exe 40 PID 2148 wrote to memory of 804 2148 nhtthh.exe 40 PID 2148 wrote to memory of 804 2148 nhtthh.exe 40 PID 804 wrote to memory of 340 804 xfrrrlr.exe 41 PID 804 wrote to memory of 340 804 xfrrrlr.exe 41 PID 804 wrote to memory of 340 804 xfrrrlr.exe 41 PID 804 wrote to memory of 340 804 xfrrrlr.exe 41 PID 340 wrote to memory of 2764 340 btnthh.exe 42 PID 340 wrote to memory of 2764 340 btnthh.exe 42 PID 340 wrote to memory of 2764 340 btnthh.exe 42 PID 340 wrote to memory of 2764 340 btnthh.exe 42 PID 2764 wrote to memory of 2076 2764 xfxlxff.exe 43 PID 2764 wrote to memory of 2076 2764 xfxlxff.exe 43 PID 2764 wrote to memory of 2076 2764 xfxlxff.exe 43 PID 2764 wrote to memory of 2076 2764 xfxlxff.exe 43 PID 2076 wrote to memory of 2856 2076 rlfrxlr.exe 44 PID 2076 wrote to memory of 2856 2076 rlfrxlr.exe 44 PID 2076 wrote to memory of 2856 2076 rlfrxlr.exe 44 PID 2076 wrote to memory of 2856 2076 rlfrxlr.exe 44 PID 2856 wrote to memory of 1820 2856 tnbbhh.exe 45 PID 2856 wrote to memory of 1820 2856 tnbbhh.exe 45 PID 2856 wrote to memory of 1820 2856 tnbbhh.exe 45 PID 2856 wrote to memory of 1820 2856 tnbbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe"C:\Users\Admin\AppData\Local\Temp\127d5b896cd264d74ea4cf7e8d2b5e0c7c79c4cc20b72acbf2cfb22b896d8517N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ddpvj.exec:\ddpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pdvvd.exec:\pdvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nhbhnt.exec:\nhbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pjvdp.exec:\pjvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lfffllx.exec:\lfffllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9bhhnt.exec:\9bhhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7dvpd.exec:\7dvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\bttbnn.exec:\bttbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\nhtthh.exec:\nhtthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\xfrrrlr.exec:\xfrrrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\btnthh.exec:\btnthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\xfxlxff.exec:\xfxlxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlfrxlr.exec:\rlfrxlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\tnbbhh.exec:\tnbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vvjvd.exec:\vvjvd.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1tbtbb.exec:\1tbtbb.exe18⤵
- Executes dropped EXE
PID:588 -
\??\c:\hbntbb.exec:\hbntbb.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bbbntb.exec:\bbbntb.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rrfrxxf.exec:\rrfrxxf.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tbthnn.exec:\tbthnn.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\lfxflxr.exec:\lfxflxr.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xfrfllr.exec:\xfrfllr.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\3dvdj.exec:\3dvdj.exe25⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fxllfxf.exec:\fxllfxf.exe26⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1hnnnn.exec:\1hnnnn.exe27⤵
- Executes dropped EXE
PID:664 -
\??\c:\vdpdv.exec:\vdpdv.exe28⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ffflrlf.exec:\ffflrlf.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vjjvv.exec:\vjjvv.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xlfxflx.exec:\xlfxflx.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\bthntb.exec:\bthntb.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752 -
\??\c:\llxlffl.exec:\llxlffl.exe33⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hbthtb.exec:\hbthtb.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vvvvp.exec:\vvvvp.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bhbbhn.exec:\bhbbhn.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9pddd.exec:\9pddd.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dvjjp.exec:\dvjjp.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rlffllf.exec:\rlffllf.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bhbbhh.exec:\bhbbhh.exe41⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3pppd.exec:\3pppd.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dvpvj.exec:\dvpvj.exe43⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5xllfff.exec:\5xllfff.exe44⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hbbbhn.exec:\hbbbhn.exe45⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vpjjp.exec:\vpjjp.exe46⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5jdjv.exec:\5jdjv.exe47⤵
- Executes dropped EXE
PID:1356 -
\??\c:\llflxrx.exec:\llflxrx.exe48⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7vvvv.exec:\7vvvv.exe49⤵
- Executes dropped EXE
PID:340 -
\??\c:\9pjpd.exec:\9pjpd.exe50⤵
- Executes dropped EXE
PID:484 -
\??\c:\5rffllr.exec:\5rffllr.exe51⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hnhtnn.exec:\hnhtnn.exe52⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pjppp.exec:\pjppp.exe53⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9jvvd.exec:\9jvvd.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lxfffxl.exec:\lxfffxl.exe55⤵
- Executes dropped EXE
PID:540 -
\??\c:\hhnnnt.exec:\hhnnnt.exe56⤵
- Executes dropped EXE
PID:588 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe57⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nnhtnt.exec:\nnhtnt.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjddj.exec:\jjddj.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lxrrffr.exec:\lxrrffr.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\btnntt.exec:\btnntt.exe61⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ddjpd.exec:\ddjpd.exe62⤵
- Executes dropped EXE
PID:2152 -
\??\c:\pjddj.exec:\pjddj.exe63⤵
- Executes dropped EXE
PID:936 -
\??\c:\5fxxlrf.exec:\5fxxlrf.exe64⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5bhhhn.exec:\5bhhhn.exe65⤵
- Executes dropped EXE
PID:2528 -
\??\c:\pjvjv.exec:\pjvjv.exe66⤵PID:2496
-
\??\c:\dpvpj.exec:\dpvpj.exe67⤵PID:1656
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe68⤵PID:2092
-
\??\c:\bbthhn.exec:\bbthhn.exe69⤵PID:2500
-
\??\c:\dvjpd.exec:\dvjpd.exe70⤵PID:2368
-
\??\c:\ddpvd.exec:\ddpvd.exe71⤵PID:1940
-
\??\c:\lrfxffr.exec:\lrfxffr.exe72⤵PID:2980
-
\??\c:\nhttnh.exec:\nhttnh.exe73⤵PID:1848
-
\??\c:\9jjpj.exec:\9jjpj.exe74⤵PID:1032
-
\??\c:\pdvjj.exec:\pdvjj.exe75⤵PID:2232
-
\??\c:\flxfrxr.exec:\flxfrxr.exe76⤵PID:2804
-
\??\c:\1bnbnt.exec:\1bnbnt.exe77⤵
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\1hbbhh.exec:\1hbbhh.exe78⤵PID:2756
-
\??\c:\dvpjp.exec:\dvpjp.exe79⤵PID:2788
-
\??\c:\llxxflx.exec:\llxxflx.exe80⤵PID:2828
-
\??\c:\lxllrlr.exec:\lxllrlr.exe81⤵PID:2884
-
\??\c:\hbthnn.exec:\hbthnn.exe82⤵PID:2604
-
\??\c:\9pdvv.exec:\9pdvv.exe83⤵PID:2720
-
\??\c:\pjdjd.exec:\pjdjd.exe84⤵PID:1856
-
\??\c:\rflxfxf.exec:\rflxfxf.exe85⤵PID:2988
-
\??\c:\1bnnbh.exec:\1bnnbh.exe86⤵PID:2648
-
\??\c:\jvjpp.exec:\jvjpp.exe87⤵PID:2360
-
\??\c:\pjvjp.exec:\pjvjp.exe88⤵PID:2160
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe89⤵PID:828
-
\??\c:\5tbhnt.exec:\5tbhnt.exe90⤵PID:1580
-
\??\c:\1dppj.exec:\1dppj.exe91⤵PID:1764
-
\??\c:\djvjp.exec:\djvjp.exe92⤵PID:2764
-
\??\c:\lffxrrl.exec:\lffxrrl.exe93⤵PID:984
-
\??\c:\hhbhtb.exec:\hhbhtb.exe94⤵PID:2844
-
\??\c:\7vppv.exec:\7vppv.exe95⤵PID:896
-
\??\c:\jdvvd.exec:\jdvvd.exe96⤵PID:1936
-
\??\c:\rrllrrf.exec:\rrllrrf.exe97⤵PID:2184
-
\??\c:\btbnbh.exec:\btbnbh.exe98⤵PID:2028
-
\??\c:\hhbhhn.exec:\hhbhhn.exe99⤵PID:2180
-
\??\c:\5jvvd.exec:\5jvvd.exe100⤵PID:2320
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe101⤵PID:2460
-
\??\c:\lfrxffx.exec:\lfrxffx.exe102⤵PID:2036
-
\??\c:\nhhthn.exec:\nhhthn.exe103⤵PID:2456
-
\??\c:\jpjpd.exec:\jpjpd.exe104⤵PID:840
-
\??\c:\vppjd.exec:\vppjd.exe105⤵PID:2432
-
\??\c:\xlflxxl.exec:\xlflxxl.exe106⤵PID:860
-
\??\c:\3nhtbn.exec:\3nhtbn.exe107⤵PID:1440
-
\??\c:\dvvdv.exec:\dvvdv.exe108⤵PID:2224
-
\??\c:\rlfxlxr.exec:\rlfxlxr.exe109⤵PID:1992
-
\??\c:\1xrrlrf.exec:\1xrrlrf.exe110⤵PID:2388
-
\??\c:\nhhntn.exec:\nhhntn.exe111⤵PID:2408
-
\??\c:\vvpvj.exec:\vvpvj.exe112⤵PID:1976
-
\??\c:\7jvpv.exec:\7jvpv.exe113⤵PID:1956
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe114⤵PID:1832
-
\??\c:\frfrlll.exec:\frfrlll.exe115⤵PID:3040
-
\??\c:\nhnbhh.exec:\nhnbhh.exe116⤵PID:2660
-
\??\c:\jjvdj.exec:\jjvdj.exe117⤵PID:1592
-
\??\c:\9llxlff.exec:\9llxlff.exe118⤵PID:2008
-
\??\c:\xrfllrr.exec:\xrfllrr.exe119⤵PID:2928
-
\??\c:\bntttn.exec:\bntttn.exe120⤵PID:2712
-
\??\c:\dvppv.exec:\dvppv.exe121⤵PID:2776
-
\??\c:\jdvdp.exec:\jdvdp.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-