Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe
-
Size
456KB
-
MD5
ce3570d9f4d91ee1c97e7e78e77bb8a0
-
SHA1
5c67965794ac6e10955381e1588ef2d4162f2016
-
SHA256
9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3
-
SHA512
2d1ea8396f930c20fa7dd912473112b608ab40e2dfa1e1b2447a34f5089b7719a4fe0fc66cc7e4515122639f833b85fe85acf2a19f02bf71c8092ca9f3138253
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2524-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-44-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2904-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/988-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-153-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-294-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-362-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2648-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-438-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2508-464-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1768-566-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2536-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-680-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1716-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/872-838-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2392 7nhtnt.exe 1652 ddvdp.exe 2184 lfxfllf.exe 2728 rxxrxff.exe 2904 vpddp.exe 1904 5pdjp.exe 2656 5nhbnh.exe 2732 jjdjp.exe 2852 bththn.exe 2152 fxrxflx.exe 988 tbtbnn.exe 832 lxrfrxr.exe 2228 nhbhnt.exe 2512 3xlrrxf.exe 2016 thttbh.exe 2956 jdppv.exe 1648 bbttbh.exe 1404 pjdjv.exe 2112 hhttbh.exe 2308 btnbhh.exe 540 3frrffr.exe 2544 ntbhtt.exe 876 rlfllrx.exe 1788 nntbht.exe 1684 fxllllx.exe 328 tnnbnn.exe 748 tbbhhb.exe 1324 vvjpv.exe 984 dvpvj.exe 2208 9pdpp.exe 1560 9nnhtt.exe 2540 dpdpv.exe 2020 ntbhtt.exe 1980 dppvd.exe 2336 frxrlrf.exe 2760 rxflxxr.exe 2824 1tbtnb.exe 2728 7jdjp.exe 2904 xxlrxfl.exe 2752 lfxfxxr.exe 2944 7bbtnb.exe 2648 vpjpv.exe 2636 ffrrfff.exe 2696 nbnhnh.exe 2488 9nttnn.exe 2872 jdjpv.exe 988 flfxrfr.exe 2864 tntbhh.exe 1880 jvvdj.exe 2008 vvpjd.exe 2880 lfxrffl.exe 2660 5btttt.exe 2508 ttnnbb.exe 2028 vjvvd.exe 1688 rrrrffr.exe 2424 5bnntb.exe 640 7vpdj.exe 2244 9pjjj.exe 1736 9fxrlrf.exe 2544 ttnbnb.exe 876 3vppj.exe 1320 1xflffx.exe 1664 llxlxlx.exe 1612 hbtbhn.exe -
resource yara_rule behavioral1/memory/2524-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-362-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2648-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-534-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1324-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-785-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/632-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-817-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/3036-824-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/872-838-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2380-854-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2392 2524 9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe 30 PID 2524 wrote to memory of 2392 2524 9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe 30 PID 2524 wrote to memory of 2392 2524 9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe 30 PID 2524 wrote to memory of 2392 2524 9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe 30 PID 2392 wrote to memory of 1652 2392 7nhtnt.exe 31 PID 2392 wrote to memory of 1652 2392 7nhtnt.exe 31 PID 2392 wrote to memory of 1652 2392 7nhtnt.exe 31 PID 2392 wrote to memory of 1652 2392 7nhtnt.exe 31 PID 1652 wrote to memory of 2184 1652 ddvdp.exe 32 PID 1652 wrote to memory of 2184 1652 ddvdp.exe 32 PID 1652 wrote to memory of 2184 1652 ddvdp.exe 32 PID 1652 wrote to memory of 2184 1652 ddvdp.exe 32 PID 2184 wrote to memory of 2728 2184 lfxfllf.exe 33 PID 2184 wrote to memory of 2728 2184 lfxfllf.exe 33 PID 2184 wrote to memory of 2728 2184 lfxfllf.exe 33 PID 2184 wrote to memory of 2728 2184 lfxfllf.exe 33 PID 2728 wrote to memory of 2904 2728 rxxrxff.exe 34 PID 2728 wrote to memory of 2904 2728 rxxrxff.exe 34 PID 2728 wrote to memory of 2904 2728 rxxrxff.exe 34 PID 2728 wrote to memory of 2904 2728 rxxrxff.exe 34 PID 2904 wrote to memory of 1904 2904 vpddp.exe 35 PID 2904 wrote to memory of 1904 2904 vpddp.exe 35 PID 2904 wrote to memory of 1904 2904 vpddp.exe 35 PID 2904 wrote to memory of 1904 2904 vpddp.exe 35 PID 1904 wrote to memory of 2656 1904 5pdjp.exe 36 PID 1904 wrote to memory of 2656 1904 5pdjp.exe 36 PID 1904 wrote to memory of 2656 1904 5pdjp.exe 36 PID 1904 wrote to memory of 2656 1904 5pdjp.exe 36 PID 2656 wrote to memory of 2732 2656 5nhbnh.exe 37 PID 2656 wrote to memory of 2732 2656 5nhbnh.exe 37 PID 2656 wrote to memory of 2732 2656 5nhbnh.exe 37 PID 2656 wrote to memory of 2732 2656 5nhbnh.exe 37 PID 2732 wrote to memory of 2852 2732 jjdjp.exe 38 PID 2732 wrote to memory of 2852 2732 jjdjp.exe 38 PID 2732 wrote to memory of 2852 2732 jjdjp.exe 38 PID 2732 wrote to memory of 2852 2732 jjdjp.exe 38 PID 2852 wrote to memory of 2152 2852 bththn.exe 39 PID 2852 wrote to memory of 2152 2852 bththn.exe 39 PID 2852 wrote to memory of 2152 2852 bththn.exe 39 PID 2852 wrote to memory of 2152 2852 bththn.exe 39 PID 2152 wrote to memory of 988 2152 fxrxflx.exe 40 PID 2152 wrote to memory of 988 2152 fxrxflx.exe 40 PID 2152 wrote to memory of 988 2152 fxrxflx.exe 40 PID 2152 wrote to memory of 988 2152 fxrxflx.exe 40 PID 988 wrote to memory of 832 988 tbtbnn.exe 41 PID 988 wrote to memory of 832 988 tbtbnn.exe 41 PID 988 wrote to memory of 832 988 tbtbnn.exe 41 PID 988 wrote to memory of 832 988 tbtbnn.exe 41 PID 832 wrote to memory of 2228 832 lxrfrxr.exe 42 PID 832 wrote to memory of 2228 832 lxrfrxr.exe 42 PID 832 wrote to memory of 2228 832 lxrfrxr.exe 42 PID 832 wrote to memory of 2228 832 lxrfrxr.exe 42 PID 2228 wrote to memory of 2512 2228 nhbhnt.exe 43 PID 2228 wrote to memory of 2512 2228 nhbhnt.exe 43 PID 2228 wrote to memory of 2512 2228 nhbhnt.exe 43 PID 2228 wrote to memory of 2512 2228 nhbhnt.exe 43 PID 2512 wrote to memory of 2016 2512 3xlrrxf.exe 44 PID 2512 wrote to memory of 2016 2512 3xlrrxf.exe 44 PID 2512 wrote to memory of 2016 2512 3xlrrxf.exe 44 PID 2512 wrote to memory of 2016 2512 3xlrrxf.exe 44 PID 2016 wrote to memory of 2956 2016 thttbh.exe 45 PID 2016 wrote to memory of 2956 2016 thttbh.exe 45 PID 2016 wrote to memory of 2956 2016 thttbh.exe 45 PID 2016 wrote to memory of 2956 2016 thttbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe"C:\Users\Admin\AppData\Local\Temp\9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7nhtnt.exec:\7nhtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\ddvdp.exec:\ddvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\lfxfllf.exec:\lfxfllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\rxxrxff.exec:\rxxrxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vpddp.exec:\vpddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\5pdjp.exec:\5pdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\5nhbnh.exec:\5nhbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\jjdjp.exec:\jjdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bththn.exec:\bththn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fxrxflx.exec:\fxrxflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tbtbnn.exec:\tbtbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\lxrfrxr.exec:\lxrfrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\nhbhnt.exec:\nhbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\3xlrrxf.exec:\3xlrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\thttbh.exec:\thttbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jdppv.exec:\jdppv.exe17⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bbttbh.exec:\bbttbh.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pjdjv.exec:\pjdjv.exe19⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hhttbh.exec:\hhttbh.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\btnbhh.exec:\btnbhh.exe21⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3frrffr.exec:\3frrffr.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\ntbhtt.exec:\ntbhtt.exe23⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rlfllrx.exec:\rlfllrx.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\nntbht.exec:\nntbht.exe25⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fxllllx.exec:\fxllllx.exe26⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tnnbnn.exec:\tnnbnn.exe27⤵
- Executes dropped EXE
PID:328 -
\??\c:\tbbhhb.exec:\tbbhhb.exe28⤵
- Executes dropped EXE
PID:748 -
\??\c:\vvjpv.exec:\vvjpv.exe29⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dvpvj.exec:\dvpvj.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\9pdpp.exec:\9pdpp.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9nnhtt.exec:\9nnhtt.exe32⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dpdpv.exec:\dpdpv.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ntbhtt.exec:\ntbhtt.exe34⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dppvd.exec:\dppvd.exe35⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frxrlrf.exec:\frxrlrf.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rxflxxr.exec:\rxflxxr.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\1tbtnb.exec:\1tbtnb.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7jdjp.exec:\7jdjp.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lfxfxxr.exec:\lfxfxxr.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7bbtnb.exec:\7bbtnb.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpjpv.exec:\vpjpv.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ffrrfff.exec:\ffrrfff.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nbnhnh.exec:\nbnhnh.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9nttnn.exec:\9nttnn.exe46⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jdjpv.exec:\jdjpv.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\flfxrfr.exec:\flfxrfr.exe48⤵
- Executes dropped EXE
PID:988 -
\??\c:\tntbhh.exec:\tntbhh.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jvvdj.exec:\jvvdj.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vvpjd.exec:\vvpjd.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfxrffl.exec:\lfxrffl.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5btttt.exec:\5btttt.exe53⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ttnnbb.exec:\ttnnbb.exe54⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vjvvd.exec:\vjvvd.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rrrrffr.exec:\rrrrffr.exe56⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5bnntb.exec:\5bnntb.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7vpdj.exec:\7vpdj.exe58⤵
- Executes dropped EXE
PID:640 -
\??\c:\9pjjj.exec:\9pjjj.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9fxrlrf.exec:\9fxrlrf.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ttnbnb.exec:\ttnbnb.exe61⤵
- Executes dropped EXE
PID:2544 -
\??\c:\3vppj.exec:\3vppj.exe62⤵
- Executes dropped EXE
PID:876 -
\??\c:\1xflffx.exec:\1xflffx.exe63⤵
- Executes dropped EXE
PID:1320 -
\??\c:\llxlxlx.exec:\llxlxlx.exe64⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbtbhn.exec:\hbtbhn.exe65⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pjddp.exec:\pjddp.exe66⤵PID:936
-
\??\c:\jdppv.exec:\jdppv.exe67⤵PID:2360
-
\??\c:\xxfrlrl.exec:\xxfrlrl.exe68⤵PID:1052
-
\??\c:\thbtbh.exec:\thbtbh.exe69⤵PID:884
-
\??\c:\jppdp.exec:\jppdp.exe70⤵PID:1324
-
\??\c:\vpjdp.exec:\vpjdp.exe71⤵PID:1792
-
\??\c:\llffrxr.exec:\llffrxr.exe72⤵PID:1768
-
\??\c:\hhbhtb.exec:\hhbhtb.exe73⤵PID:2364
-
\??\c:\dvjpj.exec:\dvjpj.exe74⤵PID:2248
-
\??\c:\vpjpp.exec:\vpjpp.exe75⤵PID:2536
-
\??\c:\rlflxxl.exec:\rlflxxl.exe76⤵PID:1180
-
\??\c:\ffxflrf.exec:\ffxflrf.exe77⤵PID:2804
-
\??\c:\7nhhnn.exec:\7nhhnn.exe78⤵PID:2404
-
\??\c:\vpddp.exec:\vpddp.exe79⤵PID:2184
-
\??\c:\rrlxffr.exec:\rrlxffr.exe80⤵PID:2844
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe81⤵PID:2912
-
\??\c:\7nhhnt.exec:\7nhhnt.exe82⤵PID:2628
-
\??\c:\jdvvj.exec:\jdvvj.exe83⤵PID:1584
-
\??\c:\7jdjp.exec:\7jdjp.exe84⤵PID:2888
-
\??\c:\frffflr.exec:\frffflr.exe85⤵PID:2632
-
\??\c:\nhnnnn.exec:\nhnnnn.exe86⤵PID:1236
-
\??\c:\jdjpd.exec:\jdjpd.exe87⤵PID:2852
-
\??\c:\vdvpd.exec:\vdvpd.exe88⤵PID:2024
-
\??\c:\xlfflfl.exec:\xlfflfl.exe89⤵PID:1124
-
\??\c:\tbtbnn.exec:\tbtbnn.exe90⤵PID:1516
-
\??\c:\pdvdd.exec:\pdvdd.exe91⤵PID:2960
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe92⤵PID:2968
-
\??\c:\1ffrxff.exec:\1ffrxff.exe93⤵PID:2688
-
\??\c:\nbnhhb.exec:\nbnhhb.exe94⤵PID:2532
-
\??\c:\vvpvj.exec:\vvpvj.exe95⤵PID:2608
-
\??\c:\1frllrr.exec:\1frllrr.exe96⤵PID:1784
-
\??\c:\rlrxflr.exec:\rlrxflr.exe97⤵PID:2508
-
\??\c:\nnhbnn.exec:\nnhbnn.exe98⤵PID:1832
-
\??\c:\1jppd.exec:\1jppd.exe99⤵PID:1688
-
\??\c:\jddpv.exec:\jddpv.exe100⤵PID:772
-
\??\c:\5xrxlxr.exec:\5xrxlxr.exe101⤵PID:1564
-
\??\c:\hhbbhn.exec:\hhbbhn.exe102⤵PID:2372
-
\??\c:\hbhtbb.exec:\hbhtbb.exe103⤵PID:264
-
\??\c:\ppjvd.exec:\ppjvd.exe104⤵PID:1300
-
\??\c:\llffrlx.exec:\llffrlx.exe105⤵PID:1440
-
\??\c:\nhhnnt.exec:\nhhnnt.exe106⤵PID:1716
-
\??\c:\nttnbt.exec:\nttnbt.exe107⤵PID:1320
-
\??\c:\1dvvd.exec:\1dvvd.exe108⤵PID:840
-
\??\c:\flfxxxr.exec:\flfxxxr.exe109⤵PID:1748
-
\??\c:\nhhbhn.exec:\nhhbhn.exe110⤵PID:632
-
\??\c:\nnbhbh.exec:\nnbhbh.exe111⤵PID:1672
-
\??\c:\lrrfxff.exec:\lrrfxff.exe112⤵PID:3036
-
\??\c:\xxffllr.exec:\xxffllr.exe113⤵PID:1008
-
\??\c:\hhbthn.exec:\hhbthn.exe114⤵PID:872
-
\??\c:\lllxrrx.exec:\lllxrrx.exe115⤵PID:1436
-
\??\c:\7hthhh.exec:\7hthhh.exe116⤵PID:2332
-
\??\c:\htntbb.exec:\htntbb.exe117⤵PID:1636
-
\??\c:\jdppj.exec:\jdppj.exe118⤵PID:2380
-
\??\c:\fxrxffr.exec:\fxrxffr.exe119⤵
- System Location Discovery: System Language Discovery
PID:2988 -
\??\c:\nnhnbn.exec:\nnhnbn.exe120⤵PID:1552
-
\??\c:\jdpdp.exec:\jdpdp.exe121⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-