Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe
-
Size
453KB
-
MD5
b70d25eed3d9ed33864f62e5090b2583
-
SHA1
a31aa27f72b9f48c7e80ea5dac32f99653c35063
-
SHA256
3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568
-
SHA512
65b962fa8f481d7867f1a7cc9e46f170b1a68b87c1ba7ab482360dc190041c8e997d8cd807b3e092ad8395dc1762226512737c7799691ffd60bec999b5b8cd69
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-106-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-144-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/676-161-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/480-177-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2696-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-199-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1284-216-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2144-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-344-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-404-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1196-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-430-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1404-444-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-488-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1732-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-568-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2684-566-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2668-686-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-706-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1972-725-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-891-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2064-953-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/264-1004-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1532-1101-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1960-1133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1976-1142-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-1171-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-1191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1776-1365-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2428 xlxllrf.exe 1764 nhnbhb.exe 2192 htbbbt.exe 2740 frlfrxl.exe 2872 thtnnh.exe 2732 9pdvd.exe 2636 jdjdj.exe 2744 nhhhbt.exe 2616 vpvvd.exe 2172 xrllflr.exe 1760 djdjv.exe 660 rlxrflr.exe 2640 jjjjv.exe 2912 5nbhhh.exe 604 bntttt.exe 2532 5xllxxl.exe 676 1hnhnb.exe 3032 djpdd.exe 480 xlxflfl.exe 2696 5rlrrrx.exe 836 frlllrx.exe 1444 5nbnnh.exe 1284 llxflfr.exe 2076 nbtntb.exe 1572 fxffrrx.exe 888 jvjdj.exe 2264 dpvvd.exe 1656 xlxfflf.exe 2144 tnnhhb.exe 1772 nnbhnn.exe 1640 tnbbbt.exe 2540 bntttt.exe 2996 thnthb.exe 1764 3rxrxrl.exe 2344 hthbbb.exe 2192 9jvvv.exe 2520 pdvvd.exe 2868 frrrfxf.exe 2864 bthbbb.exe 2936 tnttbb.exe 2724 9djjp.exe 2072 rfxxffr.exe 2596 lxfrfxf.exe 2796 9nhntb.exe 2556 jdppv.exe 1456 9jvvv.exe 1760 fxlxxrx.exe 2892 bnhnbh.exe 1196 tbnntn.exe 3000 pdjpd.exe 2000 lfxxlrl.exe 2108 rxlxxxl.exe 2316 hbhntb.exe 1404 ddpvd.exe 676 frrfxff.exe 3040 xrlrflr.exe 2780 nhtbnh.exe 2024 9pvpd.exe 2248 dvpvd.exe 2136 xlxxllf.exe 2124 hbnthh.exe 1576 bnbtbt.exe 1732 pjjjp.exe 1688 9rfxffl.exe -
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-110-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1760-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-235-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2144-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-1004-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1268-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-1064-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-1077-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-1190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-1204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-1253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-1344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-1365-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2008-1370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-1377-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2428 2540 3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe 30 PID 2540 wrote to memory of 2428 2540 3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe 30 PID 2540 wrote to memory of 2428 2540 3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe 30 PID 2540 wrote to memory of 2428 2540 3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe 30 PID 2428 wrote to memory of 1764 2428 xlxllrf.exe 31 PID 2428 wrote to memory of 1764 2428 xlxllrf.exe 31 PID 2428 wrote to memory of 1764 2428 xlxllrf.exe 31 PID 2428 wrote to memory of 1764 2428 xlxllrf.exe 31 PID 1764 wrote to memory of 2192 1764 nhnbhb.exe 32 PID 1764 wrote to memory of 2192 1764 nhnbhb.exe 32 PID 1764 wrote to memory of 2192 1764 nhnbhb.exe 32 PID 1764 wrote to memory of 2192 1764 nhnbhb.exe 32 PID 2192 wrote to memory of 2740 2192 htbbbt.exe 33 PID 2192 wrote to memory of 2740 2192 htbbbt.exe 33 PID 2192 wrote to memory of 2740 2192 htbbbt.exe 33 PID 2192 wrote to memory of 2740 2192 htbbbt.exe 33 PID 2740 wrote to memory of 2872 2740 frlfrxl.exe 34 PID 2740 wrote to memory of 2872 2740 frlfrxl.exe 34 PID 2740 wrote to memory of 2872 2740 frlfrxl.exe 34 PID 2740 wrote to memory of 2872 2740 frlfrxl.exe 34 PID 2872 wrote to memory of 2732 2872 thtnnh.exe 35 PID 2872 wrote to memory of 2732 2872 thtnnh.exe 35 PID 2872 wrote to memory of 2732 2872 thtnnh.exe 35 PID 2872 wrote to memory of 2732 2872 thtnnh.exe 35 PID 2732 wrote to memory of 2636 2732 9pdvd.exe 36 PID 2732 wrote to memory of 2636 2732 9pdvd.exe 36 PID 2732 wrote to memory of 2636 2732 9pdvd.exe 36 PID 2732 wrote to memory of 2636 2732 9pdvd.exe 36 PID 2636 wrote to memory of 2744 2636 jdjdj.exe 37 PID 2636 wrote to memory of 2744 2636 jdjdj.exe 37 PID 2636 wrote to memory of 2744 2636 jdjdj.exe 37 PID 2636 wrote to memory of 2744 2636 jdjdj.exe 37 PID 2744 wrote to memory of 2616 2744 nhhhbt.exe 38 PID 2744 wrote to memory of 2616 2744 nhhhbt.exe 38 PID 2744 wrote to memory of 2616 2744 nhhhbt.exe 38 PID 2744 wrote to memory of 2616 2744 nhhhbt.exe 38 PID 2616 wrote to memory of 2172 2616 vpvvd.exe 39 PID 2616 wrote to memory of 2172 2616 vpvvd.exe 39 PID 2616 wrote to memory of 2172 2616 vpvvd.exe 39 PID 2616 wrote to memory of 2172 2616 vpvvd.exe 39 PID 2172 wrote to memory of 1760 2172 xrllflr.exe 40 PID 2172 wrote to memory of 1760 2172 xrllflr.exe 40 PID 2172 wrote to memory of 1760 2172 xrllflr.exe 40 PID 2172 wrote to memory of 1760 2172 xrllflr.exe 40 PID 1760 wrote to memory of 660 1760 djdjv.exe 41 PID 1760 wrote to memory of 660 1760 djdjv.exe 41 PID 1760 wrote to memory of 660 1760 djdjv.exe 41 PID 1760 wrote to memory of 660 1760 djdjv.exe 41 PID 660 wrote to memory of 2640 660 rlxrflr.exe 42 PID 660 wrote to memory of 2640 660 rlxrflr.exe 42 PID 660 wrote to memory of 2640 660 rlxrflr.exe 42 PID 660 wrote to memory of 2640 660 rlxrflr.exe 42 PID 2640 wrote to memory of 2912 2640 jjjjv.exe 43 PID 2640 wrote to memory of 2912 2640 jjjjv.exe 43 PID 2640 wrote to memory of 2912 2640 jjjjv.exe 43 PID 2640 wrote to memory of 2912 2640 jjjjv.exe 43 PID 2912 wrote to memory of 604 2912 5nbhhh.exe 44 PID 2912 wrote to memory of 604 2912 5nbhhh.exe 44 PID 2912 wrote to memory of 604 2912 5nbhhh.exe 44 PID 2912 wrote to memory of 604 2912 5nbhhh.exe 44 PID 604 wrote to memory of 2532 604 bntttt.exe 45 PID 604 wrote to memory of 2532 604 bntttt.exe 45 PID 604 wrote to memory of 2532 604 bntttt.exe 45 PID 604 wrote to memory of 2532 604 bntttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe"C:\Users\Admin\AppData\Local\Temp\3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xlxllrf.exec:\xlxllrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\nhnbhb.exec:\nhnbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\htbbbt.exec:\htbbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\frlfrxl.exec:\frlfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\thtnnh.exec:\thtnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9pdvd.exec:\9pdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jdjdj.exec:\jdjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nhhhbt.exec:\nhhhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vpvvd.exec:\vpvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xrllflr.exec:\xrllflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\djdjv.exec:\djdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\rlxrflr.exec:\rlxrflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\jjjjv.exec:\jjjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5nbhhh.exec:\5nbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\bntttt.exec:\bntttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\5xllxxl.exec:\5xllxxl.exe17⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1hnhnb.exec:\1hnhnb.exe18⤵
- Executes dropped EXE
PID:676 -
\??\c:\djpdd.exec:\djpdd.exe19⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xlxflfl.exec:\xlxflfl.exe20⤵
- Executes dropped EXE
PID:480 -
\??\c:\5rlrrrx.exec:\5rlrrrx.exe21⤵
- Executes dropped EXE
PID:2696 -
\??\c:\frlllrx.exec:\frlllrx.exe22⤵
- Executes dropped EXE
PID:836 -
\??\c:\5nbnnh.exec:\5nbnnh.exe23⤵
- Executes dropped EXE
PID:1444 -
\??\c:\llxflfr.exec:\llxflfr.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nbtntb.exec:\nbtntb.exe25⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxffrrx.exec:\fxffrrx.exe26⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jvjdj.exec:\jvjdj.exe27⤵
- Executes dropped EXE
PID:888 -
\??\c:\dpvvd.exec:\dpvvd.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xlxfflf.exec:\xlxfflf.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnnhhb.exec:\tnnhhb.exe30⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nnbhnn.exec:\nnbhnn.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tnbbbt.exec:\tnbbbt.exe32⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bntttt.exec:\bntttt.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\thnthb.exec:\thnthb.exe34⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3rxrxrl.exec:\3rxrxrl.exe35⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hthbbb.exec:\hthbbb.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9jvvv.exec:\9jvvv.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pdvvd.exec:\pdvvd.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frrrfxf.exec:\frrrfxf.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bthbbb.exec:\bthbbb.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tnttbb.exec:\tnttbb.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9djjp.exec:\9djjp.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rfxxffr.exec:\rfxxffr.exe43⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lxfrfxf.exec:\lxfrfxf.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9nhntb.exec:\9nhntb.exe45⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jdppv.exec:\jdppv.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9jvvv.exec:\9jvvv.exe47⤵
- Executes dropped EXE
PID:1456 -
\??\c:\fxlxxrx.exec:\fxlxxrx.exe48⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bnhnbh.exec:\bnhnbh.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tbnntn.exec:\tbnntn.exe50⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pdjpd.exec:\pdjpd.exe51⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lfxxlrl.exec:\lfxxlrl.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rxlxxxl.exec:\rxlxxxl.exe53⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hbhntb.exec:\hbhntb.exe54⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ddpvd.exec:\ddpvd.exe55⤵
- Executes dropped EXE
PID:1404 -
\??\c:\frrfxff.exec:\frrfxff.exe56⤵
- Executes dropped EXE
PID:676 -
\??\c:\xrlrflr.exec:\xrlrflr.exe57⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nhtbnh.exec:\nhtbnh.exe58⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9pvpd.exec:\9pvpd.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dvpvd.exec:\dvpvd.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xlxxllf.exec:\xlxxllf.exe61⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbnthh.exec:\hbnthh.exe62⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bnbtbt.exec:\bnbtbt.exe63⤵
- Executes dropped EXE
PID:1576 -
\??\c:\pjjjp.exec:\pjjjp.exe64⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9rfxffl.exec:\9rfxffl.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\tbntnn.exec:\tbntnn.exe66⤵PID:108
-
\??\c:\7tbtnh.exec:\7tbtnh.exe67⤵PID:748
-
\??\c:\jdjdp.exec:\jdjdp.exe68⤵PID:2504
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe69⤵PID:1888
-
\??\c:\9flflll.exec:\9flflll.exe70⤵PID:2564
-
\??\c:\nbhhnn.exec:\nbhhnn.exe71⤵PID:3052
-
\??\c:\vpvvv.exec:\vpvvv.exe72⤵PID:1968
-
\??\c:\xrllxxl.exec:\xrllxxl.exe73⤵PID:2440
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe74⤵PID:2684
-
\??\c:\hhbnth.exec:\hhbnth.exe75⤵PID:2540
-
\??\c:\pdppd.exec:\pdppd.exe76⤵PID:2428
-
\??\c:\1lrrrrx.exec:\1lrrrrx.exe77⤵PID:1624
-
\??\c:\rlflrlx.exec:\rlflrlx.exe78⤵PID:2164
-
\??\c:\9nbbbb.exec:\9nbbbb.exe79⤵
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\jjpvj.exec:\jjpvj.exe80⤵PID:2872
-
\??\c:\jpdvv.exec:\jpdvv.exe81⤵PID:2804
-
\??\c:\xlxlrff.exec:\xlxlrff.exe82⤵PID:2816
-
\??\c:\1bnnnn.exec:\1bnnnn.exe83⤵PID:2864
-
\??\c:\bhnnbt.exec:\bhnnbt.exe84⤵PID:2728
-
\??\c:\5jppp.exec:\5jppp.exe85⤵PID:2724
-
\??\c:\rlflrxl.exec:\rlflrxl.exe86⤵PID:2004
-
\??\c:\7xxflfl.exec:\7xxflfl.exe87⤵PID:2596
-
\??\c:\9nbtth.exec:\9nbtth.exe88⤵PID:2604
-
\??\c:\9vpvj.exec:\9vpvj.exe89⤵PID:2296
-
\??\c:\vdvpp.exec:\vdvpp.exe90⤵PID:568
-
\??\c:\fxfflfx.exec:\fxfflfx.exe91⤵PID:1396
-
\??\c:\bbnthh.exec:\bbnthh.exe92⤵PID:1932
-
\??\c:\hbthhn.exec:\hbthhn.exe93⤵PID:2668
-
\??\c:\3ppdv.exec:\3ppdv.exe94⤵PID:2900
-
\??\c:\9rrlrll.exec:\9rrlrll.exe95⤵PID:1884
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe96⤵PID:604
-
\??\c:\nbbttt.exec:\nbbttt.exe97⤵PID:2080
-
\??\c:\pdvdj.exec:\pdvdj.exe98⤵PID:1048
-
\??\c:\vjdvd.exec:\vjdvd.exe99⤵PID:1972
-
\??\c:\7xlflrr.exec:\7xlflrr.exe100⤵PID:264
-
\??\c:\tbnhnn.exec:\tbnhnn.exe101⤵PID:2020
-
\??\c:\7ntnth.exec:\7ntnth.exe102⤵PID:1556
-
\??\c:\vjvvv.exec:\vjvvv.exe103⤵PID:1836
-
\??\c:\lxllrlr.exec:\lxllrlr.exe104⤵PID:1512
-
\??\c:\1lxxfxf.exec:\1lxxfxf.exe105⤵PID:956
-
\??\c:\5tbnhh.exec:\5tbnhh.exe106⤵PID:2124
-
\??\c:\thhhhb.exec:\thhhhb.exe107⤵PID:1576
-
\??\c:\3djdd.exec:\3djdd.exe108⤵PID:1732
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe109⤵PID:2468
-
\??\c:\frfflfl.exec:\frfflfl.exe110⤵PID:1724
-
\??\c:\hbbbbt.exec:\hbbbbt.exe111⤵PID:1452
-
\??\c:\nbhhnh.exec:\nbhhnh.exe112⤵PID:1544
-
\??\c:\3dpjd.exec:\3dpjd.exe113⤵PID:2052
-
\??\c:\xxrrffr.exec:\xxrrffr.exe114⤵PID:2212
-
\??\c:\hbtbhn.exec:\hbtbhn.exe115⤵PID:1912
-
\??\c:\9nbbhh.exec:\9nbbhh.exe116⤵PID:2416
-
\??\c:\vpddp.exec:\vpddp.exe117⤵PID:1640
-
\??\c:\llfrxfl.exec:\llfrxfl.exe118⤵PID:792
-
\??\c:\rfrxxxl.exec:\rfrxxxl.exe119⤵PID:1928
-
\??\c:\tbnnnn.exec:\tbnnnn.exe120⤵PID:2884
-
\??\c:\7ddpp.exec:\7ddpp.exe121⤵PID:2896
-
\??\c:\1pddj.exec:\1pddj.exe122⤵PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-