Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe
-
Size
453KB
-
MD5
4fdd10b459c02e3e888e9a53edb64d72
-
SHA1
691f618d57a8f9e4b037d95b6e902ae19b1a46c1
-
SHA256
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244
-
SHA512
86f3d01e99750799753c8240fb9f635f70447d13609766eaedb192cc203dcd730517d7beef2b6d849d3d4e8e88a54e7e2a9b8bbceb86d67ac6dbfa9e79073825
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet1:q7Tc2NYHUrAwfMp3CDt1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/596-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-63-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2180-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-127-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1400-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-320-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2876-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-470-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2268-481-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3004-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-778-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2616-830-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-900-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2392-990-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-1045-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-1060-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2132-1080-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-1095-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1760-1094-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 nbthhn.exe 2608 642240.exe 2500 462622.exe 2876 82406.exe 580 426682.exe 2992 s6444.exe 2180 dpddd.exe 2724 m0222.exe 2860 frrrrfl.exe 2708 7rxrrrx.exe 2748 u200606.exe 1788 242284.exe 1692 hthntt.exe 1400 5xflrlf.exe 1524 5jvvv.exe 2592 c228826.exe 804 20006.exe 1540 204062.exe 324 0840262.exe 1324 7hbtth.exe 2284 pjpvv.exe 3016 hbbhbt.exe 1628 u084606.exe 2000 5pdjj.exe 1984 806662.exe 612 s2068.exe 2172 pdpjv.exe 3068 680060.exe 2104 468022.exe 892 86884.exe 296 6080628.exe 2108 lxfxfxl.exe 1584 k02248.exe 1500 vjvvd.exe 2212 08628.exe 2264 40808.exe 2480 3ppjd.exe 2876 82062.exe 2972 k02400.exe 2216 082628.exe 2816 02440.exe 2856 2066666.exe 2892 e20400.exe 2712 5hnnnn.exe 2540 7jddv.exe 2688 s4260.exe 2812 rlxrfrx.exe 2748 6466202.exe 1724 820622.exe 1436 1lxlllr.exe 1976 6084044.exe 1736 thbhnt.exe 1524 c022228.exe 1852 rfrxffl.exe 2080 ntbttn.exe 1952 68044.exe 1540 xlxrrrx.exe 1568 xlrrrlr.exe 324 vpvdv.exe 2268 djjdd.exe 3004 a4228.exe 1336 hthhtt.exe 3020 080026.exe 3028 bbtbhb.exe -
resource yara_rule behavioral1/memory/596-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-470-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2268-481-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3004-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-873-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-1024-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1064-1031-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-1046-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0840262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s2000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6462284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 042840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2644622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 596 wrote to memory of 2056 596 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 30 PID 596 wrote to memory of 2056 596 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 30 PID 596 wrote to memory of 2056 596 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 30 PID 596 wrote to memory of 2056 596 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 30 PID 2056 wrote to memory of 2608 2056 nbthhn.exe 31 PID 2056 wrote to memory of 2608 2056 nbthhn.exe 31 PID 2056 wrote to memory of 2608 2056 nbthhn.exe 31 PID 2056 wrote to memory of 2608 2056 nbthhn.exe 31 PID 2608 wrote to memory of 2500 2608 642240.exe 32 PID 2608 wrote to memory of 2500 2608 642240.exe 32 PID 2608 wrote to memory of 2500 2608 642240.exe 32 PID 2608 wrote to memory of 2500 2608 642240.exe 32 PID 2500 wrote to memory of 2876 2500 462622.exe 33 PID 2500 wrote to memory of 2876 2500 462622.exe 33 PID 2500 wrote to memory of 2876 2500 462622.exe 33 PID 2500 wrote to memory of 2876 2500 462622.exe 33 PID 2876 wrote to memory of 580 2876 82406.exe 34 PID 2876 wrote to memory of 580 2876 82406.exe 34 PID 2876 wrote to memory of 580 2876 82406.exe 34 PID 2876 wrote to memory of 580 2876 82406.exe 34 PID 580 wrote to memory of 2992 580 426682.exe 35 PID 580 wrote to memory of 2992 580 426682.exe 35 PID 580 wrote to memory of 2992 580 426682.exe 35 PID 580 wrote to memory of 2992 580 426682.exe 35 PID 2992 wrote to memory of 2180 2992 s6444.exe 36 PID 2992 wrote to memory of 2180 2992 s6444.exe 36 PID 2992 wrote to memory of 2180 2992 s6444.exe 36 PID 2992 wrote to memory of 2180 2992 s6444.exe 36 PID 2180 wrote to memory of 2724 2180 dpddd.exe 37 PID 2180 wrote to memory of 2724 2180 dpddd.exe 37 PID 2180 wrote to memory of 2724 2180 dpddd.exe 37 PID 2180 wrote to memory of 2724 2180 dpddd.exe 37 PID 2724 wrote to memory of 2860 2724 m0222.exe 38 PID 2724 wrote to memory of 2860 2724 m0222.exe 38 PID 2724 wrote to memory of 2860 2724 m0222.exe 38 PID 2724 wrote to memory of 2860 2724 m0222.exe 38 PID 2860 wrote to memory of 2708 2860 frrrrfl.exe 39 PID 2860 wrote to memory of 2708 2860 frrrrfl.exe 39 PID 2860 wrote to memory of 2708 2860 frrrrfl.exe 39 PID 2860 wrote to memory of 2708 2860 frrrrfl.exe 39 PID 2708 wrote to memory of 2748 2708 7rxrrrx.exe 40 PID 2708 wrote to memory of 2748 2708 7rxrrrx.exe 40 PID 2708 wrote to memory of 2748 2708 7rxrrrx.exe 40 PID 2708 wrote to memory of 2748 2708 7rxrrrx.exe 40 PID 2748 wrote to memory of 1788 2748 u200606.exe 41 PID 2748 wrote to memory of 1788 2748 u200606.exe 41 PID 2748 wrote to memory of 1788 2748 u200606.exe 41 PID 2748 wrote to memory of 1788 2748 u200606.exe 41 PID 1788 wrote to memory of 1692 1788 242284.exe 42 PID 1788 wrote to memory of 1692 1788 242284.exe 42 PID 1788 wrote to memory of 1692 1788 242284.exe 42 PID 1788 wrote to memory of 1692 1788 242284.exe 42 PID 1692 wrote to memory of 1400 1692 hthntt.exe 43 PID 1692 wrote to memory of 1400 1692 hthntt.exe 43 PID 1692 wrote to memory of 1400 1692 hthntt.exe 43 PID 1692 wrote to memory of 1400 1692 hthntt.exe 43 PID 1400 wrote to memory of 1524 1400 5xflrlf.exe 44 PID 1400 wrote to memory of 1524 1400 5xflrlf.exe 44 PID 1400 wrote to memory of 1524 1400 5xflrlf.exe 44 PID 1400 wrote to memory of 1524 1400 5xflrlf.exe 44 PID 1524 wrote to memory of 2592 1524 5jvvv.exe 45 PID 1524 wrote to memory of 2592 1524 5jvvv.exe 45 PID 1524 wrote to memory of 2592 1524 5jvvv.exe 45 PID 1524 wrote to memory of 2592 1524 5jvvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe"C:\Users\Admin\AppData\Local\Temp\5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\nbthhn.exec:\nbthhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\642240.exec:\642240.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\462622.exec:\462622.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\82406.exec:\82406.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\426682.exec:\426682.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\s6444.exec:\s6444.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\dpddd.exec:\dpddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\m0222.exec:\m0222.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\frrrrfl.exec:\frrrrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\7rxrrrx.exec:\7rxrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\u200606.exec:\u200606.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\242284.exec:\242284.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\hthntt.exec:\hthntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\5xflrlf.exec:\5xflrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\5jvvv.exec:\5jvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\c228826.exec:\c228826.exe17⤵
- Executes dropped EXE
PID:2592 -
\??\c:\20006.exec:\20006.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\204062.exec:\204062.exe19⤵
- Executes dropped EXE
PID:1540 -
\??\c:\0840262.exec:\0840262.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:324 -
\??\c:\7hbtth.exec:\7hbtth.exe21⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pjpvv.exec:\pjpvv.exe22⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hbbhbt.exec:\hbbhbt.exe23⤵
- Executes dropped EXE
PID:3016 -
\??\c:\u084606.exec:\u084606.exe24⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5pdjj.exec:\5pdjj.exe25⤵
- Executes dropped EXE
PID:2000 -
\??\c:\806662.exec:\806662.exe26⤵
- Executes dropped EXE
PID:1984 -
\??\c:\s2068.exec:\s2068.exe27⤵
- Executes dropped EXE
PID:612 -
\??\c:\pdpjv.exec:\pdpjv.exe28⤵
- Executes dropped EXE
PID:2172 -
\??\c:\680060.exec:\680060.exe29⤵
- Executes dropped EXE
PID:3068 -
\??\c:\468022.exec:\468022.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\86884.exec:\86884.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\6080628.exec:\6080628.exe32⤵
- Executes dropped EXE
PID:296 -
\??\c:\lxfxfxl.exec:\lxfxfxl.exe33⤵
- Executes dropped EXE
PID:2108 -
\??\c:\k02248.exec:\k02248.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vjvvd.exec:\vjvvd.exe35⤵
- Executes dropped EXE
PID:1500 -
\??\c:\08628.exec:\08628.exe36⤵
- Executes dropped EXE
PID:2212 -
\??\c:\40808.exec:\40808.exe37⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3ppjd.exec:\3ppjd.exe38⤵
- Executes dropped EXE
PID:2480 -
\??\c:\82062.exec:\82062.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\k02400.exec:\k02400.exe40⤵
- Executes dropped EXE
PID:2972 -
\??\c:\082628.exec:\082628.exe41⤵
- Executes dropped EXE
PID:2216 -
\??\c:\02440.exec:\02440.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\2066666.exec:\2066666.exe43⤵
- Executes dropped EXE
PID:2856 -
\??\c:\e20400.exec:\e20400.exe44⤵
- Executes dropped EXE
PID:2892 -
\??\c:\5hnnnn.exec:\5hnnnn.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7jddv.exec:\7jddv.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\s4260.exec:\s4260.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rlxrfrx.exec:\rlxrfrx.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\6466202.exec:\6466202.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\820622.exec:\820622.exe50⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1lxlllr.exec:\1lxlllr.exe51⤵
- Executes dropped EXE
PID:1436 -
\??\c:\6084044.exec:\6084044.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\thbhnt.exec:\thbhnt.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\c022228.exec:\c022228.exe54⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rfrxffl.exec:\rfrxffl.exe55⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ntbttn.exec:\ntbttn.exe56⤵
- Executes dropped EXE
PID:2080 -
\??\c:\68044.exec:\68044.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe58⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xlrrrlr.exec:\xlrrrlr.exe59⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpvdv.exec:\vpvdv.exe60⤵
- Executes dropped EXE
PID:324 -
\??\c:\djjdd.exec:\djjdd.exe61⤵
- Executes dropped EXE
PID:2268 -
\??\c:\a4228.exec:\a4228.exe62⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hthhtt.exec:\hthhtt.exe63⤵
- Executes dropped EXE
PID:1336 -
\??\c:\080026.exec:\080026.exe64⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bbtbhb.exec:\bbtbhb.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\080064.exec:\080064.exe66⤵PID:1560
-
\??\c:\60828.exec:\60828.exe67⤵PID:2576
-
\??\c:\9nnhbt.exec:\9nnhbt.exe68⤵PID:612
-
\??\c:\086240.exec:\086240.exe69⤵PID:1444
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe70⤵PID:2208
-
\??\c:\7pvpj.exec:\7pvpj.exe71⤵PID:552
-
\??\c:\dpdvv.exec:\dpdvv.exe72⤵PID:880
-
\??\c:\rxlxfrr.exec:\rxlxfrr.exe73⤵
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe74⤵PID:1356
-
\??\c:\jvvjv.exec:\jvvjv.exe75⤵PID:2228
-
\??\c:\646004.exec:\646004.exe76⤵PID:2016
-
\??\c:\2006884.exec:\2006884.exe77⤵PID:1716
-
\??\c:\8088006.exec:\8088006.exe78⤵PID:2120
-
\??\c:\5rrxxrx.exec:\5rrxxrx.exe79⤵PID:688
-
\??\c:\o200462.exec:\o200462.exe80⤵PID:1492
-
\??\c:\9thntt.exec:\9thntt.exe81⤵PID:2204
-
\??\c:\vpjjp.exec:\vpjjp.exe82⤵PID:1040
-
\??\c:\1fxrlll.exec:\1fxrlll.exe83⤵PID:3040
-
\??\c:\86444.exec:\86444.exe84⤵PID:2296
-
\??\c:\4240006.exec:\4240006.exe85⤵PID:2216
-
\??\c:\bnbbhb.exec:\bnbbhb.exe86⤵PID:2696
-
\??\c:\vjvdd.exec:\vjvdd.exe87⤵PID:2856
-
\??\c:\nbbtnh.exec:\nbbtnh.exe88⤵PID:2836
-
\??\c:\3bbttn.exec:\3bbttn.exe89⤵PID:1996
-
\??\c:\7hhhnt.exec:\7hhhnt.exe90⤵PID:2700
-
\??\c:\nhtbhh.exec:\nhtbhh.exe91⤵PID:2356
-
\??\c:\q80448.exec:\q80448.exe92⤵PID:932
-
\??\c:\llxxxxl.exec:\llxxxxl.exe93⤵PID:632
-
\??\c:\20008.exec:\20008.exe94⤵PID:1484
-
\??\c:\fxrxffl.exec:\fxrxffl.exe95⤵PID:1692
-
\??\c:\i466224.exec:\i466224.exe96⤵PID:2088
-
\??\c:\48622.exec:\48622.exe97⤵PID:2372
-
\??\c:\bnhhhh.exec:\bnhhhh.exe98⤵PID:2392
-
\??\c:\642882.exec:\642882.exe99⤵PID:496
-
\??\c:\dpvpp.exec:\dpvpp.exe100⤵PID:804
-
\??\c:\xrffxxx.exec:\xrffxxx.exe101⤵PID:1900
-
\??\c:\dpvpj.exec:\dpvpj.exe102⤵PID:2908
-
\??\c:\7vddd.exec:\7vddd.exe103⤵PID:3024
-
\??\c:\frxxxxl.exec:\frxxxxl.exe104⤵PID:832
-
\??\c:\vjjjd.exec:\vjjjd.exe105⤵PID:2728
-
\??\c:\7djdd.exec:\7djdd.exe106⤵PID:1192
-
\??\c:\086488.exec:\086488.exe107⤵PID:1480
-
\??\c:\424444.exec:\424444.exe108⤵PID:2292
-
\??\c:\jvjjv.exec:\jvjjv.exe109⤵PID:344
-
\??\c:\7rxxxxf.exec:\7rxxxxf.exe110⤵PID:1352
-
\??\c:\9jpjj.exec:\9jpjj.exe111⤵PID:2068
-
\??\c:\xlrxxrr.exec:\xlrxxrr.exe112⤵PID:2132
-
\??\c:\lxlrfxl.exec:\lxlrfxl.exe113⤵PID:2840
-
\??\c:\2084206.exec:\2084206.exe114⤵PID:2104
-
\??\c:\bnbbhb.exec:\bnbbhb.exe115⤵PID:2648
-
\??\c:\4248866.exec:\4248866.exe116⤵PID:2244
-
\??\c:\422800.exec:\422800.exe117⤵PID:2616
-
\??\c:\thtnhb.exec:\thtnhb.exe118⤵PID:1512
-
\??\c:\u244666.exec:\u244666.exe119⤵PID:596
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe120⤵PID:2604
-
\??\c:\dpdjj.exec:\dpdjj.exe121⤵PID:1488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-