Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe
-
Size
453KB
-
MD5
04fc4f3237ec8bfb841a240dd4235a2c
-
SHA1
a70ee0996f9b06cf76ba95f19de28126c2c78bf1
-
SHA256
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48
-
SHA512
2ea2754785469ee527d7398cb05a7f7cbb49c6660963a6b906a7133aba47ff75b31099ce8f01e910bf8545a721cc74c46f560dcc295c696d1bc9f76e72f855f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2232-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-316-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3004-330-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2428-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-364-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2744-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-391-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-449-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1284-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-544-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2668-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-826-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-851-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-858-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1276 hbntbt.exe 2916 dvppd.exe 2448 xrfrffl.exe 2668 ttnbnb.exe 3048 ddpdj.exe 2708 nbtbnt.exe 2620 1jjvd.exe 2752 3pvjv.exe 2676 nhnnbh.exe 2484 dvjjv.exe 1536 dvjpd.exe 2944 lrllflx.exe 1972 tththn.exe 1752 vpvpd.exe 2392 hbtttt.exe 2248 thttbb.exe 2244 xxlflrx.exe 1360 tnbtnt.exe 2296 jpjjd.exe 2760 3ffxlll.exe 2736 jjdjp.exe 1916 jvjjp.exe 1796 tthhnn.exe 1660 7bbhbb.exe 1708 tntnbh.exe 2196 pjddj.exe 852 nhttnn.exe 1672 tnhhtt.exe 1612 7nbhtt.exe 1880 3fxrrrx.exe 2328 tbtbtb.exe 2084 ppddp.exe 2968 3thnnt.exe 2308 9dppd.exe 1000 rrlrrxr.exe 3004 ffxfrxf.exe 2428 bthntb.exe 3000 5dpjv.exe 2684 dvpvj.exe 3044 1fxxlrr.exe 2772 3tntbb.exe 2512 jdjpp.exe 2780 dvvvj.exe 2600 3rxlrfl.exe 2488 nntbnt.exe 2744 bthhnh.exe 2948 vvppd.exe 1636 xrfxflr.exe 2416 rrrxrxl.exe 1940 btbhhn.exe 2268 bbthtb.exe 380 3vpvd.exe 1984 llfrfrr.exe 2236 nhbhbb.exe 1496 1hnnbb.exe 1540 jvjjv.exe 2732 3frfrfr.exe 2444 lfrrxxl.exe 1316 nhhhbh.exe 2548 9dvvj.exe 1284 1vdvj.exe 912 frxrflr.exe 1216 nhtbnt.exe 1220 ddvvj.exe -
resource yara_rule behavioral1/memory/1276-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-984-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrrrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1276 2232 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 31 PID 2232 wrote to memory of 1276 2232 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 31 PID 2232 wrote to memory of 1276 2232 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 31 PID 2232 wrote to memory of 1276 2232 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 31 PID 1276 wrote to memory of 2916 1276 hbntbt.exe 32 PID 1276 wrote to memory of 2916 1276 hbntbt.exe 32 PID 1276 wrote to memory of 2916 1276 hbntbt.exe 32 PID 1276 wrote to memory of 2916 1276 hbntbt.exe 32 PID 2916 wrote to memory of 2448 2916 dvppd.exe 33 PID 2916 wrote to memory of 2448 2916 dvppd.exe 33 PID 2916 wrote to memory of 2448 2916 dvppd.exe 33 PID 2916 wrote to memory of 2448 2916 dvppd.exe 33 PID 2448 wrote to memory of 2668 2448 xrfrffl.exe 34 PID 2448 wrote to memory of 2668 2448 xrfrffl.exe 34 PID 2448 wrote to memory of 2668 2448 xrfrffl.exe 34 PID 2448 wrote to memory of 2668 2448 xrfrffl.exe 34 PID 2668 wrote to memory of 3048 2668 ttnbnb.exe 35 PID 2668 wrote to memory of 3048 2668 ttnbnb.exe 35 PID 2668 wrote to memory of 3048 2668 ttnbnb.exe 35 PID 2668 wrote to memory of 3048 2668 ttnbnb.exe 35 PID 3048 wrote to memory of 2708 3048 ddpdj.exe 36 PID 3048 wrote to memory of 2708 3048 ddpdj.exe 36 PID 3048 wrote to memory of 2708 3048 ddpdj.exe 36 PID 3048 wrote to memory of 2708 3048 ddpdj.exe 36 PID 2708 wrote to memory of 2620 2708 nbtbnt.exe 37 PID 2708 wrote to memory of 2620 2708 nbtbnt.exe 37 PID 2708 wrote to memory of 2620 2708 nbtbnt.exe 37 PID 2708 wrote to memory of 2620 2708 nbtbnt.exe 37 PID 2620 wrote to memory of 2752 2620 1jjvd.exe 38 PID 2620 wrote to memory of 2752 2620 1jjvd.exe 38 PID 2620 wrote to memory of 2752 2620 1jjvd.exe 38 PID 2620 wrote to memory of 2752 2620 1jjvd.exe 38 PID 2752 wrote to memory of 2676 2752 3pvjv.exe 39 PID 2752 wrote to memory of 2676 2752 3pvjv.exe 39 PID 2752 wrote to memory of 2676 2752 3pvjv.exe 39 PID 2752 wrote to memory of 2676 2752 3pvjv.exe 39 PID 2676 wrote to memory of 2484 2676 nhnnbh.exe 40 PID 2676 wrote to memory of 2484 2676 nhnnbh.exe 40 PID 2676 wrote to memory of 2484 2676 nhnnbh.exe 40 PID 2676 wrote to memory of 2484 2676 nhnnbh.exe 40 PID 2484 wrote to memory of 1536 2484 dvjjv.exe 41 PID 2484 wrote to memory of 1536 2484 dvjjv.exe 41 PID 2484 wrote to memory of 1536 2484 dvjjv.exe 41 PID 2484 wrote to memory of 1536 2484 dvjjv.exe 41 PID 1536 wrote to memory of 2944 1536 dvjpd.exe 42 PID 1536 wrote to memory of 2944 1536 dvjpd.exe 42 PID 1536 wrote to memory of 2944 1536 dvjpd.exe 42 PID 1536 wrote to memory of 2944 1536 dvjpd.exe 42 PID 2944 wrote to memory of 1972 2944 lrllflx.exe 43 PID 2944 wrote to memory of 1972 2944 lrllflx.exe 43 PID 2944 wrote to memory of 1972 2944 lrllflx.exe 43 PID 2944 wrote to memory of 1972 2944 lrllflx.exe 43 PID 1972 wrote to memory of 1752 1972 tththn.exe 44 PID 1972 wrote to memory of 1752 1972 tththn.exe 44 PID 1972 wrote to memory of 1752 1972 tththn.exe 44 PID 1972 wrote to memory of 1752 1972 tththn.exe 44 PID 1752 wrote to memory of 2392 1752 vpvpd.exe 45 PID 1752 wrote to memory of 2392 1752 vpvpd.exe 45 PID 1752 wrote to memory of 2392 1752 vpvpd.exe 45 PID 1752 wrote to memory of 2392 1752 vpvpd.exe 45 PID 2392 wrote to memory of 2248 2392 hbtttt.exe 46 PID 2392 wrote to memory of 2248 2392 hbtttt.exe 46 PID 2392 wrote to memory of 2248 2392 hbtttt.exe 46 PID 2392 wrote to memory of 2248 2392 hbtttt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe"C:\Users\Admin\AppData\Local\Temp\17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hbntbt.exec:\hbntbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\dvppd.exec:\dvppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\xrfrffl.exec:\xrfrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ttnbnb.exec:\ttnbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\ddpdj.exec:\ddpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nbtbnt.exec:\nbtbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1jjvd.exec:\1jjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3pvjv.exec:\3pvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\nhnnbh.exec:\nhnnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dvjjv.exec:\dvjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\dvjpd.exec:\dvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\lrllflx.exec:\lrllflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tththn.exec:\tththn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vpvpd.exec:\vpvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\hbtttt.exec:\hbtttt.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\thttbb.exec:\thttbb.exe17⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xxlflrx.exec:\xxlflrx.exe18⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tnbtnt.exec:\tnbtnt.exe19⤵
- Executes dropped EXE
PID:1360 -
\??\c:\jpjjd.exec:\jpjjd.exe20⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3ffxlll.exec:\3ffxlll.exe21⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjdjp.exec:\jjdjp.exe22⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jvjjp.exec:\jvjjp.exe23⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tthhnn.exec:\tthhnn.exe24⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7bbhbb.exec:\7bbhbb.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tntnbh.exec:\tntnbh.exe26⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pjddj.exec:\pjddj.exe27⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nhttnn.exec:\nhttnn.exe28⤵
- Executes dropped EXE
PID:852 -
\??\c:\tnhhtt.exec:\tnhhtt.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7nbhtt.exec:\7nbhtt.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\3fxrrrx.exec:\3fxrrrx.exe31⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tbtbtb.exec:\tbtbtb.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ppddp.exec:\ppddp.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3thnnt.exec:\3thnnt.exe34⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9dppd.exec:\9dppd.exe35⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe36⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bthntb.exec:\bthntb.exe38⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5dpjv.exec:\5dpjv.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dvpvj.exec:\dvpvj.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1fxxlrr.exec:\1fxxlrr.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3tntbb.exec:\3tntbb.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jdjpp.exec:\jdjpp.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dvvvj.exec:\dvvvj.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3rxlrfl.exec:\3rxlrfl.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nntbnt.exec:\nntbnt.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488 -
\??\c:\bthhnh.exec:\bthhnh.exe47⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvppd.exec:\vvppd.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xrfxflr.exec:\xrfxflr.exe49⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rrrxrxl.exec:\rrrxrxl.exe50⤵
- Executes dropped EXE
PID:2416 -
\??\c:\btbhhn.exec:\btbhhn.exe51⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bbthtb.exec:\bbthtb.exe52⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3vpvd.exec:\3vpvd.exe53⤵
- Executes dropped EXE
PID:380 -
\??\c:\llfrfrr.exec:\llfrfrr.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nhbhbb.exec:\nhbhbb.exe55⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1hnnbb.exec:\1hnnbb.exe56⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jvjjv.exec:\jvjjv.exe57⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3frfrfr.exec:\3frfrfr.exe58⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe59⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nhhhbh.exec:\nhhhbh.exe60⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9dvvj.exec:\9dvvj.exe61⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1vdvj.exec:\1vdvj.exe62⤵
- Executes dropped EXE
PID:1284 -
\??\c:\frxrflr.exec:\frxrflr.exe63⤵
- Executes dropped EXE
PID:912 -
\??\c:\nhtbnt.exec:\nhtbnt.exe64⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ddvvj.exec:\ddvvj.exe65⤵
- Executes dropped EXE
PID:1220 -
\??\c:\9jvvj.exec:\9jvvj.exe66⤵PID:2196
-
\??\c:\9fxfffr.exec:\9fxfffr.exe67⤵PID:492
-
\??\c:\fxllrrl.exec:\fxllrrl.exe68⤵PID:2128
-
\??\c:\hhnnnt.exec:\hhnnnt.exe69⤵PID:2704
-
\??\c:\1jdjv.exec:\1jdjv.exe70⤵PID:1404
-
\??\c:\1rlllrx.exec:\1rlllrx.exe71⤵PID:1552
-
\??\c:\rfxxllf.exec:\rfxxllf.exe72⤵PID:584
-
\??\c:\hbhtbt.exec:\hbhtbt.exe73⤵PID:2776
-
\??\c:\dvjpj.exec:\dvjpj.exe74⤵PID:2068
-
\??\c:\pddjp.exec:\pddjp.exe75⤵PID:1508
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe76⤵PID:2308
-
\??\c:\1tbntb.exec:\1tbntb.exe77⤵PID:2924
-
\??\c:\nnbbhh.exec:\nnbbhh.exe78⤵PID:2668
-
\??\c:\1dddp.exec:\1dddp.exe79⤵PID:2840
-
\??\c:\xxflxxr.exec:\xxflxxr.exe80⤵PID:2972
-
\??\c:\rfrxxfr.exec:\rfrxxfr.exe81⤵PID:2612
-
\??\c:\tthbnh.exec:\tthbnh.exe82⤵PID:648
-
\??\c:\ppjjp.exec:\ppjjp.exe83⤵PID:2964
-
\??\c:\5dppj.exec:\5dppj.exe84⤵PID:2764
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe85⤵PID:2652
-
\??\c:\3flllrr.exec:\3flllrr.exe86⤵PID:2528
-
\??\c:\btnthn.exec:\btnthn.exe87⤵PID:2984
-
\??\c:\jdvpd.exec:\jdvpd.exe88⤵PID:1892
-
\??\c:\dvvvv.exec:\dvvvv.exe89⤵PID:2944
-
\??\c:\fxfxflr.exec:\fxfxflr.exe90⤵PID:2396
-
\??\c:\bnbhnn.exec:\bnbhnn.exe91⤵PID:1664
-
\??\c:\hbnttb.exec:\hbnttb.exe92⤵PID:1972
-
\??\c:\pdvvp.exec:\pdvvp.exe93⤵PID:812
-
\??\c:\9xxrxxx.exec:\9xxrxxx.exe94⤵PID:816
-
\??\c:\lfxxrxl.exec:\lfxxrxl.exe95⤵PID:1844
-
\??\c:\nhttbh.exec:\nhttbh.exe96⤵PID:1740
-
\??\c:\pdjpv.exec:\pdjpv.exe97⤵PID:1556
-
\??\c:\jddvd.exec:\jddvd.exe98⤵PID:1896
-
\??\c:\fxrrxff.exec:\fxrrxff.exe99⤵PID:1884
-
\??\c:\hbnnbh.exec:\hbnnbh.exe100⤵PID:1540
-
\??\c:\hhnntt.exec:\hhnntt.exe101⤵PID:2908
-
\??\c:\5dppv.exec:\5dppv.exe102⤵PID:856
-
\??\c:\5pjjj.exec:\5pjjj.exe103⤵PID:2724
-
\??\c:\5xllrrx.exec:\5xllrrx.exe104⤵PID:972
-
\??\c:\ttbbhb.exec:\ttbbhb.exe105⤵PID:1796
-
\??\c:\thbnbb.exec:\thbnbb.exe106⤵PID:924
-
\??\c:\ddvdp.exec:\ddvdp.exe107⤵PID:2288
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe108⤵PID:3040
-
\??\c:\1fllrrx.exec:\1fllrrx.exe109⤵PID:2524
-
\??\c:\nbnhnh.exec:\nbnhnh.exe110⤵PID:2072
-
\??\c:\bnhnnh.exec:\bnhnnh.exe111⤵PID:1976
-
\??\c:\9jvpj.exec:\9jvpj.exe112⤵PID:2128
-
\??\c:\lfrlrff.exec:\lfrlrff.exe113⤵PID:344
-
\??\c:\rlrxrlr.exec:\rlrxrlr.exe114⤵PID:2332
-
\??\c:\9bttbt.exec:\9bttbt.exe115⤵PID:2008
-
\??\c:\1pvdp.exec:\1pvdp.exe116⤵PID:1276
-
\??\c:\3dpjj.exec:\3dpjj.exe117⤵
- System Location Discovery: System Language Discovery
PID:2232 -
\??\c:\fxffrlr.exec:\fxffrlr.exe118⤵PID:2960
-
\??\c:\9nbttt.exec:\9nbttt.exe119⤵PID:2420
-
\??\c:\7nbhbb.exec:\7nbhbb.exe120⤵PID:2316
-
\??\c:\9pdjp.exec:\9pdjp.exe121⤵PID:2088
-
\??\c:\frllrrf.exec:\frllrrf.exe122⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-