Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe
-
Size
456KB
-
MD5
7edef74913d652319fac40c96e24e4b0
-
SHA1
5657b507961f28c44a750dced0e7c3b0c816be35
-
SHA256
23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acf
-
SHA512
dfe80a6481147049bcb142d69c88d0d921b4a8a5e893182319704d6812abb0d3e2f2485a3de1500efac09b3524d2b284cf1643e3fdd6c5f1e2e2986e6cbc08cb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRk:q7Tc2NYHUrAwfMp3CDRk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2828-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-37-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2656-35-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2332-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-149-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2924-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-413-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1292-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-444-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2276-463-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/588-466-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2520-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-691-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 bbtnnb.exe 2768 3jvpp.exe 2656 rxfrrfl.exe 2808 htbhbt.exe 2332 bbntnt.exe 2516 btntbb.exe 2340 9rrrxxl.exe 2220 3frrxxl.exe 1096 9lxlffl.exe 2844 tbhhnn.exe 1700 hnbtnt.exe 764 rfrrrrx.exe 1996 7hhntt.exe 1284 hbtbhn.exe 1496 lfxxxxr.exe 1248 7hnntt.exe 2180 9pddp.exe 2924 3xlxrlf.exe 2416 3jjjp.exe 1092 5fxxffl.exe 2500 jjdjv.exe 1512 3nhntb.exe 2484 jpdjv.exe 1084 3rxrfxr.exe 1664 pjvdp.exe 1328 hhthht.exe 2152 hntthh.exe 632 pjvdp.exe 996 9tntbb.exe 1304 fxlfffl.exe 2028 nbtntt.exe 2828 xfflrrx.exe 840 nnbhnt.exe 2776 ddvdj.exe 2684 rxrfrrf.exe 2380 nhbnbb.exe 2808 btbhtb.exe 2596 pjvvd.exe 2688 xlxrrrr.exe 2580 nhtbhh.exe 2624 1htbnn.exe 1964 lxffrfl.exe 812 btnthh.exe 2800 vpvdv.exe 2652 pjdjd.exe 2008 xxxffrr.exe 2444 nhtthh.exe 336 vpdjv.exe 1984 ppddj.exe 2292 rfrrffr.exe 1292 tnbnbb.exe 588 jdjdd.exe 2368 rlxlrxl.exe 2284 rfrxllr.exe 2276 btbhhh.exe 1036 jdvdp.exe 1628 pjvdj.exe 2520 rlxxxrx.exe 904 hbnbbn.exe 2500 ddvjv.exe 1512 xlxrffl.exe 1672 rrrfrrx.exe 1516 hhbnth.exe 1352 jdppd.exe -
resource yara_rule behavioral1/memory/2828-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-55-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2220-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-691-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1736-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-818-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2396 2828 23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe 30 PID 2828 wrote to memory of 2396 2828 23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe 30 PID 2828 wrote to memory of 2396 2828 23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe 30 PID 2828 wrote to memory of 2396 2828 23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe 30 PID 2396 wrote to memory of 2768 2396 bbtnnb.exe 31 PID 2396 wrote to memory of 2768 2396 bbtnnb.exe 31 PID 2396 wrote to memory of 2768 2396 bbtnnb.exe 31 PID 2396 wrote to memory of 2768 2396 bbtnnb.exe 31 PID 2768 wrote to memory of 2656 2768 3jvpp.exe 32 PID 2768 wrote to memory of 2656 2768 3jvpp.exe 32 PID 2768 wrote to memory of 2656 2768 3jvpp.exe 32 PID 2768 wrote to memory of 2656 2768 3jvpp.exe 32 PID 2656 wrote to memory of 2808 2656 rxfrrfl.exe 33 PID 2656 wrote to memory of 2808 2656 rxfrrfl.exe 33 PID 2656 wrote to memory of 2808 2656 rxfrrfl.exe 33 PID 2656 wrote to memory of 2808 2656 rxfrrfl.exe 33 PID 2808 wrote to memory of 2332 2808 htbhbt.exe 34 PID 2808 wrote to memory of 2332 2808 htbhbt.exe 34 PID 2808 wrote to memory of 2332 2808 htbhbt.exe 34 PID 2808 wrote to memory of 2332 2808 htbhbt.exe 34 PID 2332 wrote to memory of 2516 2332 bbntnt.exe 35 PID 2332 wrote to memory of 2516 2332 bbntnt.exe 35 PID 2332 wrote to memory of 2516 2332 bbntnt.exe 35 PID 2332 wrote to memory of 2516 2332 bbntnt.exe 35 PID 2516 wrote to memory of 2340 2516 btntbb.exe 36 PID 2516 wrote to memory of 2340 2516 btntbb.exe 36 PID 2516 wrote to memory of 2340 2516 btntbb.exe 36 PID 2516 wrote to memory of 2340 2516 btntbb.exe 36 PID 2340 wrote to memory of 2220 2340 9rrrxxl.exe 37 PID 2340 wrote to memory of 2220 2340 9rrrxxl.exe 37 PID 2340 wrote to memory of 2220 2340 9rrrxxl.exe 37 PID 2340 wrote to memory of 2220 2340 9rrrxxl.exe 37 PID 2220 wrote to memory of 1096 2220 3frrxxl.exe 38 PID 2220 wrote to memory of 1096 2220 3frrxxl.exe 38 PID 2220 wrote to memory of 1096 2220 3frrxxl.exe 38 PID 2220 wrote to memory of 1096 2220 3frrxxl.exe 38 PID 1096 wrote to memory of 2844 1096 9lxlffl.exe 39 PID 1096 wrote to memory of 2844 1096 9lxlffl.exe 39 PID 1096 wrote to memory of 2844 1096 9lxlffl.exe 39 PID 1096 wrote to memory of 2844 1096 9lxlffl.exe 39 PID 2844 wrote to memory of 1700 2844 tbhhnn.exe 40 PID 2844 wrote to memory of 1700 2844 tbhhnn.exe 40 PID 2844 wrote to memory of 1700 2844 tbhhnn.exe 40 PID 2844 wrote to memory of 1700 2844 tbhhnn.exe 40 PID 1700 wrote to memory of 764 1700 hnbtnt.exe 41 PID 1700 wrote to memory of 764 1700 hnbtnt.exe 41 PID 1700 wrote to memory of 764 1700 hnbtnt.exe 41 PID 1700 wrote to memory of 764 1700 hnbtnt.exe 41 PID 764 wrote to memory of 1996 764 rfrrrrx.exe 42 PID 764 wrote to memory of 1996 764 rfrrrrx.exe 42 PID 764 wrote to memory of 1996 764 rfrrrrx.exe 42 PID 764 wrote to memory of 1996 764 rfrrrrx.exe 42 PID 1996 wrote to memory of 1284 1996 7hhntt.exe 43 PID 1996 wrote to memory of 1284 1996 7hhntt.exe 43 PID 1996 wrote to memory of 1284 1996 7hhntt.exe 43 PID 1996 wrote to memory of 1284 1996 7hhntt.exe 43 PID 1284 wrote to memory of 1496 1284 hbtbhn.exe 44 PID 1284 wrote to memory of 1496 1284 hbtbhn.exe 44 PID 1284 wrote to memory of 1496 1284 hbtbhn.exe 44 PID 1284 wrote to memory of 1496 1284 hbtbhn.exe 44 PID 1496 wrote to memory of 1248 1496 lfxxxxr.exe 45 PID 1496 wrote to memory of 1248 1496 lfxxxxr.exe 45 PID 1496 wrote to memory of 1248 1496 lfxxxxr.exe 45 PID 1496 wrote to memory of 1248 1496 lfxxxxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe"C:\Users\Admin\AppData\Local\Temp\23be7236f6b96fb7436ae6cda68fbe0915dc9adeda5cdcecb53a5933b1813acfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\bbtnnb.exec:\bbtnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\3jvpp.exec:\3jvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rxfrrfl.exec:\rxfrrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\htbhbt.exec:\htbhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bbntnt.exec:\bbntnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\btntbb.exec:\btntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9rrrxxl.exec:\9rrrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\3frrxxl.exec:\3frrxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\9lxlffl.exec:\9lxlffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\tbhhnn.exec:\tbhhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hnbtnt.exec:\hnbtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\7hhntt.exec:\7hhntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hbtbhn.exec:\hbtbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\lfxxxxr.exec:\lfxxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\7hnntt.exec:\7hnntt.exe17⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9pddp.exec:\9pddp.exe18⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3xlxrlf.exec:\3xlxrlf.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\3jjjp.exec:\3jjjp.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2416 -
\??\c:\5fxxffl.exec:\5fxxffl.exe21⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jjdjv.exec:\jjdjv.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3nhntb.exec:\3nhntb.exe23⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jpdjv.exec:\jpdjv.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3rxrfxr.exec:\3rxrfxr.exe25⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pjvdp.exec:\pjvdp.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hhthht.exec:\hhthht.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hntthh.exec:\hntthh.exe28⤵
- Executes dropped EXE
PID:2152 -
\??\c:\pjvdp.exec:\pjvdp.exe29⤵
- Executes dropped EXE
PID:632 -
\??\c:\9tntbb.exec:\9tntbb.exe30⤵
- Executes dropped EXE
PID:996 -
\??\c:\fxlfffl.exec:\fxlfffl.exe31⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nbtntt.exec:\nbtntt.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xfflrrx.exec:\xfflrrx.exe33⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nnbhnt.exec:\nnbhnt.exe34⤵
- Executes dropped EXE
PID:840 -
\??\c:\ddvdj.exec:\ddvdj.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rxrfrrf.exec:\rxrfrrf.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhbnbb.exec:\nhbnbb.exe37⤵
- Executes dropped EXE
PID:2380 -
\??\c:\btbhtb.exec:\btbhtb.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pjvvd.exec:\pjvvd.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\nhtbhh.exec:\nhtbhh.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1htbnn.exec:\1htbnn.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lxffrfl.exec:\lxffrfl.exe43⤵
- Executes dropped EXE
PID:1964 -
\??\c:\btnthh.exec:\btnthh.exe44⤵
- Executes dropped EXE
PID:812 -
\??\c:\vpvdv.exec:\vpvdv.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjdjd.exec:\pjdjd.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xxxffrr.exec:\xxxffrr.exe47⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nhtthh.exec:\nhtthh.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vpdjv.exec:\vpdjv.exe49⤵
- Executes dropped EXE
PID:336 -
\??\c:\ppddj.exec:\ppddj.exe50⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rfrrffr.exec:\rfrrffr.exe51⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnbnbb.exec:\tnbnbb.exe52⤵
- Executes dropped EXE
PID:1292 -
\??\c:\jdjdd.exec:\jdjdd.exe53⤵
- Executes dropped EXE
PID:588 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe54⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rfrxllr.exec:\rfrxllr.exe55⤵
- Executes dropped EXE
PID:2284 -
\??\c:\btbhhh.exec:\btbhhh.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdvdp.exec:\jdvdp.exe57⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjvdj.exec:\pjvdj.exe58⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe59⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbnbbn.exec:\hbnbbn.exe60⤵
- Executes dropped EXE
PID:904 -
\??\c:\ddvjv.exec:\ddvjv.exe61⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xlxrffl.exec:\xlxrffl.exe62⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rrrfrrx.exec:\rrrfrrx.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hhbnth.exec:\hhbnth.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jdppd.exec:\jdppd.exe65⤵
- Executes dropped EXE
PID:1352 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe66⤵PID:1664
-
\??\c:\9rfrfrx.exec:\9rfrfrx.exe67⤵PID:1560
-
\??\c:\bnbhnt.exec:\bnbhnt.exe68⤵PID:2056
-
\??\c:\dvjjp.exec:\dvjjp.exe69⤵PID:2440
-
\??\c:\fxfxxlr.exec:\fxfxxlr.exe70⤵PID:2960
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe71⤵PID:1152
-
\??\c:\ttnbhh.exec:\ttnbhh.exe72⤵PID:3040
-
\??\c:\dvjpd.exec:\dvjpd.exe73⤵PID:2996
-
\??\c:\jvvpp.exec:\jvvpp.exe74⤵PID:2028
-
\??\c:\rlllrxl.exec:\rlllrxl.exe75⤵PID:2744
-
\??\c:\ttbhhh.exec:\ttbhhh.exe76⤵PID:2692
-
\??\c:\bbbhtb.exec:\bbbhtb.exe77⤵PID:2780
-
\??\c:\jdpvv.exec:\jdpvv.exe78⤵PID:2732
-
\??\c:\lxllrxf.exec:\lxllrxf.exe79⤵PID:2684
-
\??\c:\lflfrxl.exec:\lflfrxl.exe80⤵PID:2856
-
\??\c:\nnhnbt.exec:\nnhnbt.exe81⤵PID:2808
-
\??\c:\1dpjp.exec:\1dpjp.exe82⤵PID:2564
-
\??\c:\jpjvd.exec:\jpjvd.exe83⤵PID:2980
-
\??\c:\7xffxfr.exec:\7xffxfr.exe84⤵PID:2988
-
\??\c:\rfllrlr.exec:\rfllrlr.exe85⤵PID:2624
-
\??\c:\bnttbt.exec:\bnttbt.exe86⤵PID:2612
-
\??\c:\jdppd.exec:\jdppd.exe87⤵PID:988
-
\??\c:\jvdvj.exec:\jvdvj.exe88⤵PID:2852
-
\??\c:\xrxxfrf.exec:\xrxxfrf.exe89⤵PID:2884
-
\??\c:\btbtbt.exec:\btbtbt.exe90⤵PID:1504
-
\??\c:\nnnttt.exec:\nnnttt.exe91⤵PID:760
-
\??\c:\9jjpd.exec:\9jjpd.exe92⤵PID:1736
-
\??\c:\5xrrxll.exec:\5xrrxll.exe93⤵PID:2300
-
\??\c:\hbbnhh.exec:\hbbnhh.exe94⤵PID:1192
-
\??\c:\jdvvj.exec:\jdvvj.exe95⤵PID:2092
-
\??\c:\ppjvp.exec:\ppjvp.exe96⤵PID:2644
-
\??\c:\xrfffxx.exec:\xrfffxx.exe97⤵PID:2312
-
\??\c:\5xfrlff.exec:\5xfrlff.exe98⤵PID:2180
-
\??\c:\thnnhb.exec:\thnnhb.exe99⤵PID:2480
-
\??\c:\9dppd.exec:\9dppd.exe100⤵PID:2236
-
\??\c:\xxlxxrx.exec:\xxlxxrx.exe101⤵PID:2416
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe102⤵PID:1648
-
\??\c:\tntbhh.exec:\tntbhh.exe103⤵PID:868
-
\??\c:\nnhntt.exec:\nnhntt.exe104⤵PID:2460
-
\??\c:\3dpjd.exec:\3dpjd.exe105⤵PID:1788
-
\??\c:\xrlflrf.exec:\xrlflrf.exe106⤵PID:1688
-
\??\c:\bnhhtt.exec:\bnhhtt.exe107⤵PID:1728
-
\??\c:\9bttnt.exec:\9bttnt.exe108⤵PID:688
-
\??\c:\9pjpj.exec:\9pjpj.exe109⤵PID:1328
-
\??\c:\5fxfllx.exec:\5fxfllx.exe110⤵PID:2472
-
\??\c:\xxrrllx.exec:\xxrrllx.exe111⤵PID:1804
-
\??\c:\hbthtt.exec:\hbthtt.exe112⤵PID:2632
-
\??\c:\dpvvd.exec:\dpvvd.exe113⤵PID:1780
-
\??\c:\1vdvj.exec:\1vdvj.exe114⤵PID:1280
-
\??\c:\lxffffl.exec:\lxffffl.exe115⤵PID:2824
-
\??\c:\3ntntt.exec:\3ntntt.exe116⤵PID:1596
-
\??\c:\hbntbb.exec:\hbntbb.exe117⤵PID:1608
-
\??\c:\3djpp.exec:\3djpp.exe118⤵PID:2744
-
\??\c:\lfxfllr.exec:\lfxfllr.exe119⤵PID:2692
-
\??\c:\llrfllx.exec:\llrfllx.exe120⤵PID:2780
-
\??\c:\nbhntt.exec:\nbhntt.exe121⤵PID:2860
-
\??\c:\7jppv.exec:\7jppv.exe122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-