Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe
-
Size
454KB
-
MD5
e882a5b551a224d50ac38dc99a864c97
-
SHA1
ebdb5a9ccf31d506f62f26552a906a18ce44a731
-
SHA256
c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97
-
SHA512
c0cc29ea60c686fb479df0f70d0f3e3da16eba0ce860b1e2d5ab2eaa047ade19725dbdbedcdb3feb52cb02004e6d164d3086ae9136aa75e21d7aaaa2d692f140
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-54-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2488-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-84-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2856-82-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2680-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-738-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/824-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-906-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-937-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-939-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-964-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1824-1014-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-1382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2476 lfrfflf.exe 2116 3xxlxlf.exe 2188 5xllffr.exe 2800 bbthbh.exe 2740 xxrxfrf.exe 2488 hbtthn.exe 3068 xffrllx.exe 2856 1lfrxlx.exe 2680 hnhnht.exe 2500 7fxrxfl.exe 1104 tnhbhn.exe 1924 nnbnth.exe 1584 lfrrflr.exe 2096 pvjpd.exe 1956 7rlrrxr.exe 648 llxflxl.exe 1920 pjdvd.exe 280 llxlxlf.exe 492 thtttt.exe 2296 jjjjp.exe 3012 tnhnnt.exe 2844 vpjvj.exe 2976 hbnnhn.exe 380 5htbbb.exe 1640 lllxrrl.exe 1828 xrlxlxl.exe 572 ffffflx.exe 2572 7dppd.exe 2164 xrlrxlf.exe 2212 vpjvd.exe 300 5vppj.exe 1412 jvpvj.exe 2288 ppjpj.exe 2376 fxrflrx.exe 2232 btnttb.exe 2340 3pjjj.exe 2524 9vpjp.exe 2896 frrfrrx.exe 2188 3hhnhb.exe 2616 nhbhth.exe 2884 9dppv.exe 2488 flffrlx.exe 2776 rlxfflr.exe 1624 7tntbh.exe 2608 ppdpd.exe 2140 7vppp.exe 2684 rrflxfl.exe 1764 hbhhbt.exe 2032 bbnbnt.exe 1900 jvdjp.exe 1704 1lrfrrx.exe 1892 3nhhnt.exe 476 nnnntt.exe 1972 ppjpp.exe 1860 3xflxfl.exe 1732 rlffrrf.exe 2044 nhhhnt.exe 2676 vvjpp.exe 1044 9pdvj.exe 2248 rrrlxxr.exe 1708 hhtbhh.exe 2084 dvvjp.exe 2592 dddpd.exe 832 flxflrl.exe -
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-165-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/492-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-879-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2476 2692 c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe 30 PID 2692 wrote to memory of 2476 2692 c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe 30 PID 2692 wrote to memory of 2476 2692 c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe 30 PID 2692 wrote to memory of 2476 2692 c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe 30 PID 2476 wrote to memory of 2116 2476 lfrfflf.exe 31 PID 2476 wrote to memory of 2116 2476 lfrfflf.exe 31 PID 2476 wrote to memory of 2116 2476 lfrfflf.exe 31 PID 2476 wrote to memory of 2116 2476 lfrfflf.exe 31 PID 2116 wrote to memory of 2188 2116 3xxlxlf.exe 32 PID 2116 wrote to memory of 2188 2116 3xxlxlf.exe 32 PID 2116 wrote to memory of 2188 2116 3xxlxlf.exe 32 PID 2116 wrote to memory of 2188 2116 3xxlxlf.exe 32 PID 2188 wrote to memory of 2800 2188 5xllffr.exe 33 PID 2188 wrote to memory of 2800 2188 5xllffr.exe 33 PID 2188 wrote to memory of 2800 2188 5xllffr.exe 33 PID 2188 wrote to memory of 2800 2188 5xllffr.exe 33 PID 2800 wrote to memory of 2740 2800 bbthbh.exe 34 PID 2800 wrote to memory of 2740 2800 bbthbh.exe 34 PID 2800 wrote to memory of 2740 2800 bbthbh.exe 34 PID 2800 wrote to memory of 2740 2800 bbthbh.exe 34 PID 2740 wrote to memory of 2488 2740 xxrxfrf.exe 35 PID 2740 wrote to memory of 2488 2740 xxrxfrf.exe 35 PID 2740 wrote to memory of 2488 2740 xxrxfrf.exe 35 PID 2740 wrote to memory of 2488 2740 xxrxfrf.exe 35 PID 2488 wrote to memory of 3068 2488 hbtthn.exe 36 PID 2488 wrote to memory of 3068 2488 hbtthn.exe 36 PID 2488 wrote to memory of 3068 2488 hbtthn.exe 36 PID 2488 wrote to memory of 3068 2488 hbtthn.exe 36 PID 3068 wrote to memory of 2856 3068 xffrllx.exe 37 PID 3068 wrote to memory of 2856 3068 xffrllx.exe 37 PID 3068 wrote to memory of 2856 3068 xffrllx.exe 37 PID 3068 wrote to memory of 2856 3068 xffrllx.exe 37 PID 2856 wrote to memory of 2680 2856 1lfrxlx.exe 38 PID 2856 wrote to memory of 2680 2856 1lfrxlx.exe 38 PID 2856 wrote to memory of 2680 2856 1lfrxlx.exe 38 PID 2856 wrote to memory of 2680 2856 1lfrxlx.exe 38 PID 2680 wrote to memory of 2500 2680 hnhnht.exe 39 PID 2680 wrote to memory of 2500 2680 hnhnht.exe 39 PID 2680 wrote to memory of 2500 2680 hnhnht.exe 39 PID 2680 wrote to memory of 2500 2680 hnhnht.exe 39 PID 2500 wrote to memory of 1104 2500 7fxrxfl.exe 40 PID 2500 wrote to memory of 1104 2500 7fxrxfl.exe 40 PID 2500 wrote to memory of 1104 2500 7fxrxfl.exe 40 PID 2500 wrote to memory of 1104 2500 7fxrxfl.exe 40 PID 1104 wrote to memory of 1924 1104 tnhbhn.exe 41 PID 1104 wrote to memory of 1924 1104 tnhbhn.exe 41 PID 1104 wrote to memory of 1924 1104 tnhbhn.exe 41 PID 1104 wrote to memory of 1924 1104 tnhbhn.exe 41 PID 1924 wrote to memory of 1584 1924 nnbnth.exe 42 PID 1924 wrote to memory of 1584 1924 nnbnth.exe 42 PID 1924 wrote to memory of 1584 1924 nnbnth.exe 42 PID 1924 wrote to memory of 1584 1924 nnbnth.exe 42 PID 1584 wrote to memory of 2096 1584 lfrrflr.exe 43 PID 1584 wrote to memory of 2096 1584 lfrrflr.exe 43 PID 1584 wrote to memory of 2096 1584 lfrrflr.exe 43 PID 1584 wrote to memory of 2096 1584 lfrrflr.exe 43 PID 2096 wrote to memory of 1956 2096 pvjpd.exe 44 PID 2096 wrote to memory of 1956 2096 pvjpd.exe 44 PID 2096 wrote to memory of 1956 2096 pvjpd.exe 44 PID 2096 wrote to memory of 1956 2096 pvjpd.exe 44 PID 1956 wrote to memory of 648 1956 7rlrrxr.exe 45 PID 1956 wrote to memory of 648 1956 7rlrrxr.exe 45 PID 1956 wrote to memory of 648 1956 7rlrrxr.exe 45 PID 1956 wrote to memory of 648 1956 7rlrrxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe"C:\Users\Admin\AppData\Local\Temp\c7f8ea140e161d9bd8e06de18d6a6d3a7534a4a0a0d8ba470935a6416fc44e97.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\lfrfflf.exec:\lfrfflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\3xxlxlf.exec:\3xxlxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\5xllffr.exec:\5xllffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\bbthbh.exec:\bbthbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hbtthn.exec:\hbtthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xffrllx.exec:\xffrllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\1lfrxlx.exec:\1lfrxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\hnhnht.exec:\hnhnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\7fxrxfl.exec:\7fxrxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\tnhbhn.exec:\tnhbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\nnbnth.exec:\nnbnth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\lfrrflr.exec:\lfrrflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\pvjpd.exec:\pvjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\7rlrrxr.exec:\7rlrrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\llxflxl.exec:\llxflxl.exe17⤵
- Executes dropped EXE
PID:648 -
\??\c:\pjdvd.exec:\pjdvd.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\llxlxlf.exec:\llxlxlf.exe19⤵
- Executes dropped EXE
PID:280 -
\??\c:\thtttt.exec:\thtttt.exe20⤵
- Executes dropped EXE
PID:492 -
\??\c:\jjjjp.exec:\jjjjp.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tnhnnt.exec:\tnhnnt.exe22⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vpjvj.exec:\vpjvj.exe23⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hbnnhn.exec:\hbnnhn.exe24⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5htbbb.exec:\5htbbb.exe25⤵
- Executes dropped EXE
PID:380 -
\??\c:\lllxrrl.exec:\lllxrrl.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xrlxlxl.exec:\xrlxlxl.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ffffflx.exec:\ffffflx.exe28⤵
- Executes dropped EXE
PID:572 -
\??\c:\7dppd.exec:\7dppd.exe29⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xrlrxlf.exec:\xrlrxlf.exe30⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vpjvd.exec:\vpjvd.exe31⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5vppj.exec:\5vppj.exe32⤵
- Executes dropped EXE
PID:300 -
\??\c:\jvpvj.exec:\jvpvj.exe33⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ppjpj.exec:\ppjpj.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fxrflrx.exec:\fxrflrx.exe35⤵
- Executes dropped EXE
PID:2376 -
\??\c:\btnttb.exec:\btnttb.exe36⤵
- Executes dropped EXE
PID:2232 -
\??\c:\3pjjj.exec:\3pjjj.exe37⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9vpjp.exec:\9vpjp.exe38⤵
- Executes dropped EXE
PID:2524 -
\??\c:\frrfrrx.exec:\frrfrrx.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3hhnhb.exec:\3hhnhb.exe40⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nhbhth.exec:\nhbhth.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9dppv.exec:\9dppv.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\flffrlx.exec:\flffrlx.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rlxfflr.exec:\rlxfflr.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7tntbh.exec:\7tntbh.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1624 -
\??\c:\ppdpd.exec:\ppdpd.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7vppp.exec:\7vppp.exe47⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rrflxfl.exec:\rrflxfl.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hbhhbt.exec:\hbhhbt.exe49⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bbnbnt.exec:\bbnbnt.exe50⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvdjp.exec:\jvdjp.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1lrfrrx.exec:\1lrfrrx.exe52⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3nhhnt.exec:\3nhhnt.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nnnntt.exec:\nnnntt.exe54⤵
- Executes dropped EXE
PID:476 -
\??\c:\ppjpp.exec:\ppjpp.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3xflxfl.exec:\3xflxfl.exe56⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rlffrrf.exec:\rlffrrf.exe57⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nhhhnt.exec:\nhhhnt.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vvjpp.exec:\vvjpp.exe59⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9pdvj.exec:\9pdvj.exe60⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rrrlxxr.exec:\rrrlxxr.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hhtbhh.exec:\hhtbhh.exe62⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dvvjp.exec:\dvvjp.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dddpd.exec:\dddpd.exe64⤵
- Executes dropped EXE
PID:2592 -
\??\c:\flxflrl.exec:\flxflrl.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe66⤵PID:2968
-
\??\c:\1bthbh.exec:\1bthbh.exe67⤵PID:1768
-
\??\c:\pppvj.exec:\pppvj.exe68⤵PID:1200
-
\??\c:\dvvjd.exec:\dvvjd.exe69⤵PID:1604
-
\??\c:\xrlrrxl.exec:\xrlrrxl.exe70⤵PID:1596
-
\??\c:\nnntbh.exec:\nnntbh.exe71⤵PID:556
-
\??\c:\9jvvd.exec:\9jvvd.exe72⤵PID:572
-
\??\c:\vpjdp.exec:\vpjdp.exe73⤵PID:2356
-
\??\c:\lxxfxfr.exec:\lxxfxfr.exe74⤵PID:2536
-
\??\c:\nnntnt.exec:\nnntnt.exe75⤵PID:2552
-
\??\c:\ttnthh.exec:\ttnthh.exe76⤵PID:2132
-
\??\c:\dpvvd.exec:\dpvvd.exe77⤵PID:880
-
\??\c:\ffrxrxl.exec:\ffrxrxl.exe78⤵PID:1412
-
\??\c:\5flxxxf.exec:\5flxxxf.exe79⤵PID:2424
-
\??\c:\tthbhh.exec:\tthbhh.exe80⤵PID:1508
-
\??\c:\jddjv.exec:\jddjv.exe81⤵PID:2100
-
\??\c:\5lllrrx.exec:\5lllrrx.exe82⤵PID:2476
-
\??\c:\nththh.exec:\nththh.exe83⤵PID:2116
-
\??\c:\hbbntn.exec:\hbbntn.exe84⤵PID:2320
-
\??\c:\vpjpd.exec:\vpjpd.exe85⤵PID:2188
-
\??\c:\lfxlllr.exec:\lfxlllr.exe86⤵PID:2616
-
\??\c:\bbbntb.exec:\bbbntb.exe87⤵PID:2208
-
\??\c:\jdppp.exec:\jdppp.exe88⤵PID:2488
-
\??\c:\3ppvv.exec:\3ppvv.exe89⤵PID:2664
-
\??\c:\xlrlllr.exec:\xlrlllr.exe90⤵PID:2620
-
\??\c:\rlxrllr.exec:\rlxrllr.exe91⤵PID:2652
-
\??\c:\bbthhh.exec:\bbthhh.exe92⤵PID:1928
-
\??\c:\vvjpv.exec:\vvjpv.exe93⤵PID:1636
-
\??\c:\vjvjp.exec:\vjvjp.exe94⤵PID:2432
-
\??\c:\fflxlxl.exec:\fflxlxl.exe95⤵PID:584
-
\??\c:\5tnhnt.exec:\5tnhnt.exe96⤵PID:2360
-
\??\c:\bbntbb.exec:\bbntbb.exe97⤵PID:2580
-
\??\c:\vjppv.exec:\vjppv.exe98⤵PID:2096
-
\??\c:\1lxfrlx.exec:\1lxfrlx.exe99⤵PID:1432
-
\??\c:\hbnhtn.exec:\hbnhtn.exe100⤵PID:1932
-
\??\c:\9nbtbb.exec:\9nbtbb.exe101⤵PID:1216
-
\??\c:\ppddv.exec:\ppddv.exe102⤵PID:1872
-
\??\c:\fxffflx.exec:\fxffflx.exe103⤵PID:1920
-
\??\c:\xrffrrf.exec:\xrffrrf.exe104⤵PID:2596
-
\??\c:\tnhnbb.exec:\tnhnbb.exe105⤵PID:2704
-
\??\c:\dvjvd.exec:\dvjvd.exe106⤵PID:1772
-
\??\c:\dpvpv.exec:\dpvpv.exe107⤵PID:1284
-
\??\c:\xrffrrf.exec:\xrffrrf.exe108⤵PID:2388
-
\??\c:\hbbbnb.exec:\hbbbnb.exe109⤵PID:824
-
\??\c:\3bnnnt.exec:\3bnnnt.exe110⤵PID:1272
-
\??\c:\jpdpd.exec:\jpdpd.exe111⤵PID:976
-
\??\c:\7rfxxxl.exec:\7rfxxxl.exe112⤵PID:1456
-
\??\c:\flllxxr.exec:\flllxxr.exe113⤵PID:292
-
\??\c:\hbtbbh.exec:\hbtbbh.exe114⤵PID:1828
-
\??\c:\vvvjv.exec:\vvvjv.exe115⤵PID:920
-
\??\c:\llxxrrl.exec:\llxxrrl.exe116⤵PID:2508
-
\??\c:\thtttt.exec:\thtttt.exe117⤵PID:1648
-
\??\c:\bthhhn.exec:\bthhhn.exe118⤵PID:2352
-
\??\c:\pjjpd.exec:\pjjpd.exe119⤵PID:2164
-
\??\c:\fxlrffl.exec:\fxlrffl.exe120⤵PID:316
-
\??\c:\nnbhtb.exec:\nnbhtb.exe121⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-