Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe
-
Size
454KB
-
MD5
8eefee70680d2e00d3eef3bcfa2e723b
-
SHA1
54b1ef2a8185fd618e5b5f866bfa107f6435995e
-
SHA256
6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553
-
SHA512
395b3d607ff535e17024cbb09cf8817412b854783ade6dd49438cbae60e5979d991bc2a551d814ce460e897f44bc055dada59bd30e3428bf945ffc5bfa212544
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2300-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-166-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/608-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-188-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1168-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-478-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-516-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2084-525-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1372-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-675-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/944-689-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-1142-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1972-1320-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 380 flrxfxx.exe 2840 vvjjp.exe 2792 5rxrrlr.exe 2944 tthhbn.exe 2660 xxxxxff.exe 2036 vpvdp.exe 1852 xxrxllr.exe 2652 1pjdp.exe 1388 7lrllxx.exe 2052 jdvvj.exe 2388 9frrxxf.exe 2420 vjvdj.exe 2056 llrlrll.exe 3068 jjvdj.exe 1252 nhbbbt.exe 1560 jdjpv.exe 2152 rllllfl.exe 608 7vpjp.exe 1168 ffrrfxr.exe 1772 vvdjp.exe 2132 xlrrrrx.exe 1488 vjpdv.exe 304 bbtntt.exe 1960 lfrlrll.exe 2252 bthhtt.exe 988 7lfxffx.exe 332 tbnnbh.exe 1532 xxrrxrf.exe 1600 tbnnbh.exe 2308 lffxxrr.exe 2076 ffffrrx.exe 1616 7pvdj.exe 2744 5rlrrxl.exe 2560 thtbnt.exe 3060 ddpdd.exe 2784 llfffff.exe 2988 nnbbhn.exe 2660 nnnnnn.exe 2788 pppvv.exe 2904 rrrrfxr.exe 2724 bbnnhn.exe 2696 3dpdp.exe 1388 xrrrxll.exe 2052 1lrlxxx.exe 2424 nbnnnn.exe 2320 ddvvv.exe 3024 rrfffff.exe 2880 7hnhnh.exe 1072 ntbnbh.exe 2844 pjjdj.exe 1540 rrxffff.exe 1596 hbttnh.exe 1180 bthbnh.exe 808 vddvd.exe 2444 1xflrlr.exe 2204 hnnhtt.exe 2140 3djjp.exe 1912 jjppv.exe 2332 9lxfllr.exe 696 3nbbbt.exe 1544 jpvvp.exe 2208 7jvjj.exe 2248 rxxxffl.exe 1712 bttnnh.exe -
resource yara_rule behavioral1/memory/2300-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-516-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2620-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-954-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-1186-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 380 2300 6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe 30 PID 2300 wrote to memory of 380 2300 6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe 30 PID 2300 wrote to memory of 380 2300 6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe 30 PID 2300 wrote to memory of 380 2300 6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe 30 PID 380 wrote to memory of 2840 380 flrxfxx.exe 31 PID 380 wrote to memory of 2840 380 flrxfxx.exe 31 PID 380 wrote to memory of 2840 380 flrxfxx.exe 31 PID 380 wrote to memory of 2840 380 flrxfxx.exe 31 PID 2840 wrote to memory of 2792 2840 vvjjp.exe 32 PID 2840 wrote to memory of 2792 2840 vvjjp.exe 32 PID 2840 wrote to memory of 2792 2840 vvjjp.exe 32 PID 2840 wrote to memory of 2792 2840 vvjjp.exe 32 PID 2792 wrote to memory of 2944 2792 5rxrrlr.exe 33 PID 2792 wrote to memory of 2944 2792 5rxrrlr.exe 33 PID 2792 wrote to memory of 2944 2792 5rxrrlr.exe 33 PID 2792 wrote to memory of 2944 2792 5rxrrlr.exe 33 PID 2944 wrote to memory of 2660 2944 tthhbn.exe 34 PID 2944 wrote to memory of 2660 2944 tthhbn.exe 34 PID 2944 wrote to memory of 2660 2944 tthhbn.exe 34 PID 2944 wrote to memory of 2660 2944 tthhbn.exe 34 PID 2660 wrote to memory of 2036 2660 xxxxxff.exe 35 PID 2660 wrote to memory of 2036 2660 xxxxxff.exe 35 PID 2660 wrote to memory of 2036 2660 xxxxxff.exe 35 PID 2660 wrote to memory of 2036 2660 xxxxxff.exe 35 PID 2036 wrote to memory of 1852 2036 vpvdp.exe 36 PID 2036 wrote to memory of 1852 2036 vpvdp.exe 36 PID 2036 wrote to memory of 1852 2036 vpvdp.exe 36 PID 2036 wrote to memory of 1852 2036 vpvdp.exe 36 PID 1852 wrote to memory of 2652 1852 xxrxllr.exe 37 PID 1852 wrote to memory of 2652 1852 xxrxllr.exe 37 PID 1852 wrote to memory of 2652 1852 xxrxllr.exe 37 PID 1852 wrote to memory of 2652 1852 xxrxllr.exe 37 PID 2652 wrote to memory of 1388 2652 1pjdp.exe 38 PID 2652 wrote to memory of 1388 2652 1pjdp.exe 38 PID 2652 wrote to memory of 1388 2652 1pjdp.exe 38 PID 2652 wrote to memory of 1388 2652 1pjdp.exe 38 PID 1388 wrote to memory of 2052 1388 7lrllxx.exe 39 PID 1388 wrote to memory of 2052 1388 7lrllxx.exe 39 PID 1388 wrote to memory of 2052 1388 7lrllxx.exe 39 PID 1388 wrote to memory of 2052 1388 7lrllxx.exe 39 PID 2052 wrote to memory of 2388 2052 jdvvj.exe 40 PID 2052 wrote to memory of 2388 2052 jdvvj.exe 40 PID 2052 wrote to memory of 2388 2052 jdvvj.exe 40 PID 2052 wrote to memory of 2388 2052 jdvvj.exe 40 PID 2388 wrote to memory of 2420 2388 9frrxxf.exe 41 PID 2388 wrote to memory of 2420 2388 9frrxxf.exe 41 PID 2388 wrote to memory of 2420 2388 9frrxxf.exe 41 PID 2388 wrote to memory of 2420 2388 9frrxxf.exe 41 PID 2420 wrote to memory of 2056 2420 vjvdj.exe 42 PID 2420 wrote to memory of 2056 2420 vjvdj.exe 42 PID 2420 wrote to memory of 2056 2420 vjvdj.exe 42 PID 2420 wrote to memory of 2056 2420 vjvdj.exe 42 PID 2056 wrote to memory of 3068 2056 llrlrll.exe 43 PID 2056 wrote to memory of 3068 2056 llrlrll.exe 43 PID 2056 wrote to memory of 3068 2056 llrlrll.exe 43 PID 2056 wrote to memory of 3068 2056 llrlrll.exe 43 PID 3068 wrote to memory of 1252 3068 jjvdj.exe 44 PID 3068 wrote to memory of 1252 3068 jjvdj.exe 44 PID 3068 wrote to memory of 1252 3068 jjvdj.exe 44 PID 3068 wrote to memory of 1252 3068 jjvdj.exe 44 PID 1252 wrote to memory of 1560 1252 nhbbbt.exe 45 PID 1252 wrote to memory of 1560 1252 nhbbbt.exe 45 PID 1252 wrote to memory of 1560 1252 nhbbbt.exe 45 PID 1252 wrote to memory of 1560 1252 nhbbbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe"C:\Users\Admin\AppData\Local\Temp\6b365fc99b26fdb51801ec770d2536319269834be5bcfabdcb6f3afdd1b82553.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\flrxfxx.exec:\flrxfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\vvjjp.exec:\vvjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5rxrrlr.exec:\5rxrrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tthhbn.exec:\tthhbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xxxxxff.exec:\xxxxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\vpvdp.exec:\vpvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xxrxllr.exec:\xxrxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\1pjdp.exec:\1pjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7lrllxx.exec:\7lrllxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\jdvvj.exec:\jdvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\9frrxxf.exec:\9frrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\vjvdj.exec:\vjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\llrlrll.exec:\llrlrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\jjvdj.exec:\jjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nhbbbt.exec:\nhbbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\jdjpv.exec:\jdjpv.exe17⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rllllfl.exec:\rllllfl.exe18⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7vpjp.exec:\7vpjp.exe19⤵
- Executes dropped EXE
PID:608 -
\??\c:\ffrrfxr.exec:\ffrrfxr.exe20⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vvdjp.exec:\vvdjp.exe21⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe22⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vjpdv.exec:\vjpdv.exe23⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bbtntt.exec:\bbtntt.exe24⤵
- Executes dropped EXE
PID:304 -
\??\c:\lfrlrll.exec:\lfrlrll.exe25⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bthhtt.exec:\bthhtt.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7lfxffx.exec:\7lfxffx.exe27⤵
- Executes dropped EXE
PID:988 -
\??\c:\tbnnbh.exec:\tbnnbh.exe28⤵
- Executes dropped EXE
PID:332 -
\??\c:\xxrrxrf.exec:\xxrrxrf.exe29⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tbnnbh.exec:\tbnnbh.exe30⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lffxxrr.exec:\lffxxrr.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ffffrrx.exec:\ffffrrx.exe32⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7pvdj.exec:\7pvdj.exe33⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5rlrrxl.exec:\5rlrrxl.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\thtbnt.exec:\thtbnt.exe35⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ddpdd.exec:\ddpdd.exe36⤵
- Executes dropped EXE
PID:3060 -
\??\c:\llfffff.exec:\llfffff.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nnbbhn.exec:\nnbbhn.exe38⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nnnnnn.exec:\nnnnnn.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pppvv.exec:\pppvv.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrrrfxr.exec:\rrrrfxr.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bbnnhn.exec:\bbnnhn.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3dpdp.exec:\3dpdp.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xrrrxll.exec:\xrrrxll.exe44⤵
- Executes dropped EXE
PID:1388 -
\??\c:\1lrlxxx.exec:\1lrlxxx.exe45⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nbnnnn.exec:\nbnnnn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\ddvvv.exec:\ddvvv.exe47⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rrfffff.exec:\rrfffff.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7hnhnh.exec:\7hnhnh.exe49⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ntbnbh.exec:\ntbnbh.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pjjdj.exec:\pjjdj.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rrxffff.exec:\rrxffff.exe52⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hbttnh.exec:\hbttnh.exe53⤵
- Executes dropped EXE
PID:1596 -
\??\c:\bthbnh.exec:\bthbnh.exe54⤵
- Executes dropped EXE
PID:1180 -
\??\c:\vddvd.exec:\vddvd.exe55⤵
- Executes dropped EXE
PID:808 -
\??\c:\1xflrlr.exec:\1xflrlr.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hnnhtt.exec:\hnnhtt.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3djjp.exec:\3djjp.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jjppv.exec:\jjppv.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9lxfllr.exec:\9lxfllr.exe60⤵
- Executes dropped EXE
PID:2332 -
\??\c:\3nbbbt.exec:\3nbbbt.exe61⤵
- Executes dropped EXE
PID:696 -
\??\c:\jpvvp.exec:\jpvvp.exe62⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7jvjj.exec:\7jvjj.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxxxffl.exec:\rxxxffl.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bttnnh.exec:\bttnnh.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nnbbhh.exec:\nnbbhh.exe66⤵PID:2084
-
\??\c:\jdpjp.exec:\jdpjp.exe67⤵PID:2620
-
\??\c:\xflrfff.exec:\xflrfff.exe68⤵PID:1372
-
\??\c:\hhnnnt.exec:\hhnnnt.exe69⤵PID:1776
-
\??\c:\9jvpv.exec:\9jvpv.exe70⤵PID:844
-
\??\c:\vvppp.exec:\vvppp.exe71⤵PID:1600
-
\??\c:\rfllrxl.exec:\rfllrxl.exe72⤵PID:1724
-
\??\c:\bnnhnn.exec:\bnnhnn.exe73⤵PID:2368
-
\??\c:\ppvpv.exec:\ppvpv.exe74⤵PID:1612
-
\??\c:\5jpjj.exec:\5jpjj.exe75⤵PID:2756
-
\??\c:\lllrlrx.exec:\lllrlrx.exe76⤵PID:2192
-
\??\c:\5nbtnh.exec:\5nbtnh.exe77⤵
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\bhnntt.exec:\bhnntt.exe78⤵PID:3060
-
\??\c:\9pvdp.exec:\9pvdp.exe79⤵PID:2768
-
\??\c:\9llllll.exec:\9llllll.exe80⤵PID:2932
-
\??\c:\lffflll.exec:\lffflll.exe81⤵PID:2036
-
\??\c:\bbhhnt.exec:\bbhhnt.exe82⤵PID:2648
-
\??\c:\pjvpv.exec:\pjvpv.exe83⤵PID:2672
-
\??\c:\vppvd.exec:\vppvd.exe84⤵PID:2400
-
\??\c:\xrxrlff.exec:\xrxrlff.exe85⤵PID:2384
-
\??\c:\nttbnn.exec:\nttbnn.exe86⤵PID:1144
-
\??\c:\ppjjp.exec:\ppjjp.exe87⤵PID:2416
-
\??\c:\vvdjp.exec:\vvdjp.exe88⤵PID:2340
-
\??\c:\rrxxxrx.exec:\rrxxxrx.exe89⤵PID:568
-
\??\c:\7xllrrr.exec:\7xllrrr.exe90⤵PID:1588
-
\??\c:\nntnhh.exec:\nntnhh.exe91⤵PID:2056
-
\??\c:\5dvvj.exec:\5dvvj.exe92⤵PID:944
-
\??\c:\5fffllf.exec:\5fffllf.exe93⤵PID:2896
-
\??\c:\9xxrflr.exec:\9xxrflr.exe94⤵PID:2828
-
\??\c:\7bhntb.exec:\7bhntb.exe95⤵PID:2264
-
\??\c:\5jvvd.exec:\5jvvd.exe96⤵PID:276
-
\??\c:\vjjpv.exec:\vjjpv.exe97⤵PID:1648
-
\??\c:\xxllrrx.exec:\xxllrrx.exe98⤵PID:1968
-
\??\c:\hhnhnb.exec:\hhnhnb.exe99⤵PID:2496
-
\??\c:\5htbnn.exec:\5htbnn.exe100⤵PID:2356
-
\??\c:\djvpp.exec:\djvpp.exe101⤵PID:292
-
\??\c:\frfrxfx.exec:\frfrxfx.exe102⤵PID:612
-
\??\c:\xfrxlrx.exec:\xfrxlrx.exe103⤵PID:1604
-
\??\c:\nbbbhh.exec:\nbbbhh.exe104⤵PID:1564
-
\??\c:\3vjjp.exec:\3vjjp.exe105⤵PID:304
-
\??\c:\ppppp.exec:\ppppp.exe106⤵PID:2244
-
\??\c:\fflrllr.exec:\fflrllr.exe107⤵PID:1708
-
\??\c:\nntbbb.exec:\nntbbb.exe108⤵PID:2312
-
\??\c:\3pvpv.exec:\3pvpv.exe109⤵PID:2252
-
\??\c:\9dvdp.exec:\9dvdp.exe110⤵PID:2292
-
\??\c:\1xrrrxf.exec:\1xrrrxf.exe111⤵PID:1372
-
\??\c:\bbtbbh.exec:\bbtbbh.exe112⤵PID:2452
-
\??\c:\3nhhtt.exec:\3nhhtt.exe113⤵PID:2300
-
\??\c:\ddvpd.exec:\ddvpd.exe114⤵PID:1484
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe115⤵PID:2372
-
\??\c:\7rfrllr.exec:\7rfrllr.exe116⤵PID:2392
-
\??\c:\tttbbb.exec:\tttbbb.exe117⤵PID:2920
-
\??\c:\1xlfrlx.exec:\1xlfrlx.exe118⤵PID:2948
-
\??\c:\lfffflr.exec:\lfffflr.exe119⤵PID:2964
-
\??\c:\nthnhn.exec:\nthnhn.exe120⤵PID:2792
-
\??\c:\5jjvd.exec:\5jjvd.exe121⤵PID:2940
-
\??\c:\xflrllx.exec:\xflrllx.exe122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-