Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe
-
Size
456KB
-
MD5
0d12c61dc11a85d34dbf08b64fd089e0
-
SHA1
ffc3f622eab3d03cd318def652d81e5fe85d02be
-
SHA256
3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83b
-
SHA512
8d083400e253c956ce7a192daaa4de2e70e7cdd56a7e00508f131d23533448e0005d5551ca00821ab4d78031d19e0ffe97dcdc1880932405f4eb0459929d4e3f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRz:q7Tc2NYHUrAwfMp3CDRz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1972-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-106-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2240-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-137-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2848-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-145-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/980-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-190-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2924-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-199-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2256-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-435-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1732-442-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2096-503-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-527-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1724-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-828-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1252-870-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2768-893-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1948-991-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1884 htntbh.exe 2300 ttnnhh.exe 2372 1dpvp.exe 2380 lxllfxf.exe 2120 tthntt.exe 2724 5frflrf.exe 2720 1tthnn.exe 2684 pjdjp.exe 2592 tttthn.exe 2788 3dvdj.exe 2612 7hntbb.exe 2240 nhttbh.exe 480 hbtntb.exe 2848 nnnhnt.exe 2100 htnbnt.exe 980 tthtbh.exe 1088 bthhtt.exe 1624 7dvjp.exe 2916 rrfrfrx.exe 2932 1hthtt.exe 2924 vpjjd.exe 2256 bthhtt.exe 2656 jjvvd.exe 2096 ffxfrrf.exe 1812 hbtbhn.exe 1952 5dvpd.exe 2988 tnhhnn.exe 2460 9ppvd.exe 2304 tbnnhb.exe 2216 djppv.exe 1740 nnhnhh.exe 2396 pjjjv.exe 1584 rlflxfx.exe 3032 nbnnht.exe 2488 pjpjj.exe 2376 xrxxllr.exe 2372 1tnntt.exe 2008 5bnttt.exe 2024 ppjjp.exe 2120 ddvjd.exe 2796 xrflrxl.exe 2692 9bbttt.exe 2720 thbhtt.exe 2872 9pjvd.exe 2860 fxlrxxf.exe 2564 bbnhnt.exe 2788 bbhnbb.exe 2800 jdppv.exe 1820 dvppd.exe 2840 xrllffr.exe 264 3bnnbh.exe 1108 tnhthn.exe 780 vvpjd.exe 772 llxrxxl.exe 1732 hhbhbh.exe 1412 9nhnhh.exe 1660 pjvvd.exe 1624 xxxxfxl.exe 2176 frffflx.exe 2812 hbhnnt.exe 2420 jjjdv.exe 3068 jjvdj.exe 584 lfxxxxf.exe 2656 hbthtn.exe -
resource yara_rule behavioral1/memory/1884-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-139-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2848-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-199-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/2256-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-527-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1724-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-847-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2788-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-953-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1948-1010-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2812-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-1036-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1884 1972 3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe 30 PID 1972 wrote to memory of 1884 1972 3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe 30 PID 1972 wrote to memory of 1884 1972 3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe 30 PID 1972 wrote to memory of 1884 1972 3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe 30 PID 1884 wrote to memory of 2300 1884 htntbh.exe 31 PID 1884 wrote to memory of 2300 1884 htntbh.exe 31 PID 1884 wrote to memory of 2300 1884 htntbh.exe 31 PID 1884 wrote to memory of 2300 1884 htntbh.exe 31 PID 2300 wrote to memory of 2372 2300 ttnnhh.exe 32 PID 2300 wrote to memory of 2372 2300 ttnnhh.exe 32 PID 2300 wrote to memory of 2372 2300 ttnnhh.exe 32 PID 2300 wrote to memory of 2372 2300 ttnnhh.exe 32 PID 2372 wrote to memory of 2380 2372 1dpvp.exe 33 PID 2372 wrote to memory of 2380 2372 1dpvp.exe 33 PID 2372 wrote to memory of 2380 2372 1dpvp.exe 33 PID 2372 wrote to memory of 2380 2372 1dpvp.exe 33 PID 2380 wrote to memory of 2120 2380 lxllfxf.exe 34 PID 2380 wrote to memory of 2120 2380 lxllfxf.exe 34 PID 2380 wrote to memory of 2120 2380 lxllfxf.exe 34 PID 2380 wrote to memory of 2120 2380 lxllfxf.exe 34 PID 2120 wrote to memory of 2724 2120 tthntt.exe 35 PID 2120 wrote to memory of 2724 2120 tthntt.exe 35 PID 2120 wrote to memory of 2724 2120 tthntt.exe 35 PID 2120 wrote to memory of 2724 2120 tthntt.exe 35 PID 2724 wrote to memory of 2720 2724 5frflrf.exe 36 PID 2724 wrote to memory of 2720 2724 5frflrf.exe 36 PID 2724 wrote to memory of 2720 2724 5frflrf.exe 36 PID 2724 wrote to memory of 2720 2724 5frflrf.exe 36 PID 2720 wrote to memory of 2684 2720 1tthnn.exe 37 PID 2720 wrote to memory of 2684 2720 1tthnn.exe 37 PID 2720 wrote to memory of 2684 2720 1tthnn.exe 37 PID 2720 wrote to memory of 2684 2720 1tthnn.exe 37 PID 2684 wrote to memory of 2592 2684 pjdjp.exe 38 PID 2684 wrote to memory of 2592 2684 pjdjp.exe 38 PID 2684 wrote to memory of 2592 2684 pjdjp.exe 38 PID 2684 wrote to memory of 2592 2684 pjdjp.exe 38 PID 2592 wrote to memory of 2788 2592 tttthn.exe 39 PID 2592 wrote to memory of 2788 2592 tttthn.exe 39 PID 2592 wrote to memory of 2788 2592 tttthn.exe 39 PID 2592 wrote to memory of 2788 2592 tttthn.exe 39 PID 2788 wrote to memory of 2612 2788 3dvdj.exe 40 PID 2788 wrote to memory of 2612 2788 3dvdj.exe 40 PID 2788 wrote to memory of 2612 2788 3dvdj.exe 40 PID 2788 wrote to memory of 2612 2788 3dvdj.exe 40 PID 2612 wrote to memory of 2240 2612 7hntbb.exe 41 PID 2612 wrote to memory of 2240 2612 7hntbb.exe 41 PID 2612 wrote to memory of 2240 2612 7hntbb.exe 41 PID 2612 wrote to memory of 2240 2612 7hntbb.exe 41 PID 2240 wrote to memory of 480 2240 nhttbh.exe 42 PID 2240 wrote to memory of 480 2240 nhttbh.exe 42 PID 2240 wrote to memory of 480 2240 nhttbh.exe 42 PID 2240 wrote to memory of 480 2240 nhttbh.exe 42 PID 480 wrote to memory of 2848 480 hbtntb.exe 43 PID 480 wrote to memory of 2848 480 hbtntb.exe 43 PID 480 wrote to memory of 2848 480 hbtntb.exe 43 PID 480 wrote to memory of 2848 480 hbtntb.exe 43 PID 2848 wrote to memory of 2100 2848 nnnhnt.exe 44 PID 2848 wrote to memory of 2100 2848 nnnhnt.exe 44 PID 2848 wrote to memory of 2100 2848 nnnhnt.exe 44 PID 2848 wrote to memory of 2100 2848 nnnhnt.exe 44 PID 2100 wrote to memory of 980 2100 htnbnt.exe 45 PID 2100 wrote to memory of 980 2100 htnbnt.exe 45 PID 2100 wrote to memory of 980 2100 htnbnt.exe 45 PID 2100 wrote to memory of 980 2100 htnbnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe"C:\Users\Admin\AppData\Local\Temp\3f20aafc481add492cc73da02ef10f1862b0cc0dee29b00b835ef2b9183fb83bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\htntbh.exec:\htntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\ttnnhh.exec:\ttnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\1dpvp.exec:\1dpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lxllfxf.exec:\lxllfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\tthntt.exec:\tthntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\5frflrf.exec:\5frflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1tthnn.exec:\1tthnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pjdjp.exec:\pjdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\tttthn.exec:\tttthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\3dvdj.exec:\3dvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\7hntbb.exec:\7hntbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nhttbh.exec:\nhttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hbtntb.exec:\hbtntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\nnnhnt.exec:\nnnhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\htnbnt.exec:\htnbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\tthtbh.exec:\tthtbh.exe17⤵
- Executes dropped EXE
PID:980 -
\??\c:\bthhtt.exec:\bthhtt.exe18⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7dvjp.exec:\7dvjp.exe19⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rrfrfrx.exec:\rrfrfrx.exe20⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1hthtt.exec:\1hthtt.exe21⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vpjjd.exec:\vpjjd.exe22⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bthhtt.exec:\bthhtt.exe23⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jjvvd.exec:\jjvvd.exe24⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe25⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hbtbhn.exec:\hbtbhn.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5dvpd.exec:\5dvpd.exe27⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tnhhnn.exec:\tnhhnn.exe28⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9ppvd.exec:\9ppvd.exe29⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tbnnhb.exec:\tbnnhb.exe30⤵
- Executes dropped EXE
PID:2304 -
\??\c:\djppv.exec:\djppv.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nnhnhh.exec:\nnhnhh.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pjjjv.exec:\pjjjv.exe33⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rlflxfx.exec:\rlflxfx.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nbnnht.exec:\nbnnht.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjpjj.exec:\pjpjj.exe36⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xrxxllr.exec:\xrxxllr.exe37⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1tnntt.exec:\1tnntt.exe38⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5bnttt.exec:\5bnttt.exe39⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ppjjp.exec:\ppjjp.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ddvjd.exec:\ddvjd.exe41⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xrflrxl.exec:\xrflrxl.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9bbttt.exec:\9bbttt.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\thbhtt.exec:\thbhtt.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\9pjvd.exec:\9pjvd.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\bbnhnt.exec:\bbnhnt.exe47⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbhnbb.exec:\bbhnbb.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdppv.exec:\jdppv.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dvppd.exec:\dvppd.exe50⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xrllffr.exec:\xrllffr.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3bnnbh.exec:\3bnnbh.exe52⤵
- Executes dropped EXE
PID:264 -
\??\c:\tnhthn.exec:\tnhthn.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vvpjd.exec:\vvpjd.exe54⤵
- Executes dropped EXE
PID:780 -
\??\c:\llxrxxl.exec:\llxrxxl.exe55⤵
- Executes dropped EXE
PID:772 -
\??\c:\hhbhbh.exec:\hhbhbh.exe56⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9nhnhh.exec:\9nhnhh.exe57⤵
- Executes dropped EXE
PID:1412 -
\??\c:\pjvvd.exec:\pjvvd.exe58⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xxxxfxl.exec:\xxxxfxl.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\frffflx.exec:\frffflx.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hbhnnt.exec:\hbhnnt.exe61⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jjjdv.exec:\jjjdv.exe62⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jjvdj.exec:\jjvdj.exe63⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\hbthtn.exec:\hbthtn.exe65⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vpddp.exec:\vpddp.exe66⤵PID:2096
-
\??\c:\1jvvv.exec:\1jvvv.exe67⤵PID:2152
-
\??\c:\rrffrrx.exec:\rrffrrx.exe68⤵PID:1680
-
\??\c:\hbtbbh.exec:\hbtbbh.exe69⤵PID:1720
-
\??\c:\thtthn.exec:\thtthn.exe70⤵PID:2988
-
\??\c:\vpdjj.exec:\vpdjj.exe71⤵PID:1868
-
\??\c:\5rllrrx.exec:\5rllrrx.exe72⤵PID:1724
-
\??\c:\3lxxffl.exec:\3lxxffl.exe73⤵PID:1136
-
\??\c:\hbntnt.exec:\hbntnt.exe74⤵PID:2216
-
\??\c:\dvjjp.exec:\dvjjp.exe75⤵PID:2516
-
\??\c:\vpjpp.exec:\vpjpp.exe76⤵PID:1576
-
\??\c:\xlxxflx.exec:\xlxxflx.exe77⤵PID:2984
-
\??\c:\7nnbbh.exec:\7nnbbh.exe78⤵PID:1784
-
\??\c:\ttbbhh.exec:\ttbbhh.exe79⤵PID:2332
-
\??\c:\ddpvj.exec:\ddpvj.exe80⤵PID:1752
-
\??\c:\7llxlrx.exec:\7llxlrx.exe81⤵PID:2748
-
\??\c:\xllrllx.exec:\xllrllx.exe82⤵PID:2884
-
\??\c:\nhhtbh.exec:\nhhtbh.exe83⤵PID:860
-
\??\c:\3vdpd.exec:\3vdpd.exe84⤵PID:2792
-
\??\c:\ppjpj.exec:\ppjpj.exe85⤵PID:2576
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe86⤵PID:2972
-
\??\c:\btnnbh.exec:\btnnbh.exe87⤵PID:2920
-
\??\c:\9nbhbh.exec:\9nbhbh.exe88⤵PID:1960
-
\??\c:\dpddp.exec:\dpddp.exe89⤵PID:2568
-
\??\c:\1lrrxrf.exec:\1lrrxrf.exe90⤵PID:2640
-
\??\c:\1frrflr.exec:\1frrflr.exe91⤵PID:1808
-
\??\c:\9bttnn.exec:\9bttnn.exe92⤵PID:2612
-
\??\c:\3pddd.exec:\3pddd.exe93⤵PID:2240
-
\??\c:\ddpvd.exec:\ddpvd.exe94⤵PID:2832
-
\??\c:\lflfrrf.exec:\lflfrrf.exe95⤵PID:944
-
\??\c:\1nhbnn.exec:\1nhbnn.exe96⤵PID:804
-
\??\c:\nhtbnt.exec:\nhtbnt.exe97⤵PID:1144
-
\??\c:\ddddv.exec:\ddddv.exe98⤵PID:1284
-
\??\c:\frflrlr.exec:\frflrlr.exe99⤵PID:1036
-
\??\c:\tntthn.exec:\tntthn.exe100⤵PID:1516
-
\??\c:\bthhnn.exec:\bthhnn.exe101⤵PID:2940
-
\??\c:\1pddp.exec:\1pddp.exe102⤵
- System Location Discovery: System Language Discovery
PID:2252 -
\??\c:\frlfrrf.exec:\frlfrrf.exe103⤵PID:2808
-
\??\c:\fxxfrxf.exec:\fxxfrxf.exe104⤵PID:2140
-
\??\c:\9bnhbb.exec:\9bnhbb.exe105⤵PID:2924
-
\??\c:\dvvvp.exec:\dvvvp.exe106⤵PID:2256
-
\??\c:\pvpvj.exec:\pvpvj.exe107⤵PID:2952
-
\??\c:\ffrrfxl.exec:\ffrrfxl.exe108⤵PID:1780
-
\??\c:\thttnt.exec:\thttnt.exe109⤵PID:2548
-
\??\c:\hbnbhb.exec:\hbnbhb.exe110⤵PID:2080
-
\??\c:\dvppj.exec:\dvppj.exe111⤵PID:1384
-
\??\c:\9rxxxxl.exec:\9rxxxxl.exe112⤵PID:1988
-
\??\c:\xxflflr.exec:\xxflflr.exe113⤵PID:2092
-
\??\c:\1pddj.exec:\1pddj.exe114⤵PID:1976
-
\??\c:\pjjpd.exec:\pjjpd.exe115⤵PID:3004
-
\??\c:\rlflrrf.exec:\rlflrrf.exe116⤵PID:2344
-
\??\c:\ttnbbn.exec:\ttnbbn.exe117⤵PID:2512
-
\??\c:\jjvjv.exec:\jjvjv.exe118⤵PID:2064
-
\??\c:\pdvdp.exec:\pdvdp.exe119⤵PID:2076
-
\??\c:\frllxfl.exec:\frllxfl.exe120⤵PID:1588
-
\??\c:\hnbbnt.exec:\hnbbnt.exe121⤵PID:2328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-