Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe
-
Size
455KB
-
MD5
2fef0c6a30725a39961b0b0c7676c7d0
-
SHA1
a2c8252330b4acc52a5dfb291247f2a53cbfee0b
-
SHA256
91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638
-
SHA512
5b623c2234080930cbde4ad325feb77893552eb4ddc452f7b31d99cc3a3842038ceb5bddcc6c39394ac1235e4ac51b85f434cf0d3fa8a8c9224641f653a44d25
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2988-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-39-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2064-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-48-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-54-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2172-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-95-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2712-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1856-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-186-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/608-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-228-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-223-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1692-236-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1364-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-256-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1760-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-286-0x0000000077740000-0x000000007783A000-memory.dmp family_blackmoon behavioral1/memory/3052-285-0x0000000077840000-0x000000007795F000-memory.dmp family_blackmoon behavioral1/memory/3028-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-337-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-359-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-578-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-625-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1380-780-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2140-811-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2772-871-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-886-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2740-926-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-935-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1968 9pddd.exe 2516 thbtbn.exe 2064 9fxrllx.exe 2784 htntnn.exe 2172 7rxrrxr.exe 2792 hnhbhn.exe 2804 vpdpv.exe 2800 djjjv.exe 2712 bbhtnn.exe 2564 5ntnnt.exe 3000 9dvvp.exe 1644 5bhhnn.exe 1612 pjpdd.exe 2392 1vppv.exe 1856 3lxfrll.exe 1248 ppvpv.exe 864 7jpvj.exe 1764 lxrlllr.exe 1068 3nbnbb.exe 2424 vjvvd.exe 608 xxlxffl.exe 1684 bhnnnh.exe 2320 jjvvd.exe 1692 lxrlllr.exe 1364 thtnnn.exe 1328 jdpvj.exe 1760 tbnbnn.exe 2420 9tbnnh.exe 1360 3vjjp.exe 3052 hnnbhh.exe 2308 3pdjv.exe 1976 btbbhb.exe 1528 tnbbhh.exe 3028 frxlxll.exe 1740 lxrrxxf.exe 2760 tthbbb.exe 2656 vjvvd.exe 2812 5jvvd.exe 2584 xrflrxl.exe 2756 hbtbnb.exe 2604 7hbttb.exe 2560 5jvpv.exe 2740 9jdjv.exe 2968 xrxfrxf.exe 1496 nbtbnt.exe 1656 9nhnnb.exe 2096 5vppj.exe 1300 5vppv.exe 2392 rlfrxlr.exe 2044 frlrrfl.exe 1820 7bnntt.exe 1168 pjdjv.exe 1164 7jppd.exe 2832 fxxxfxl.exe 1764 9xrrrxf.exe 2428 hbtthn.exe 2156 jvppd.exe 1396 jjvjd.exe 608 1frxllr.exe 2940 xrxrllr.exe 2644 thttnh.exe 1116 bnhhnh.exe 1340 1vddv.exe 3008 lrflxxr.exe -
resource yara_rule behavioral1/memory/2988-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-67-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2792-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-285-0x0000000077840000-0x000000007795F000-memory.dmp upx behavioral1/memory/3028-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-780-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2140-811-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2584-886-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/588-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-926-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2968-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-997-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1968 2988 91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe 30 PID 2988 wrote to memory of 1968 2988 91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe 30 PID 2988 wrote to memory of 1968 2988 91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe 30 PID 2988 wrote to memory of 1968 2988 91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe 30 PID 1968 wrote to memory of 2516 1968 9pddd.exe 31 PID 1968 wrote to memory of 2516 1968 9pddd.exe 31 PID 1968 wrote to memory of 2516 1968 9pddd.exe 31 PID 1968 wrote to memory of 2516 1968 9pddd.exe 31 PID 2516 wrote to memory of 2064 2516 thbtbn.exe 32 PID 2516 wrote to memory of 2064 2516 thbtbn.exe 32 PID 2516 wrote to memory of 2064 2516 thbtbn.exe 32 PID 2516 wrote to memory of 2064 2516 thbtbn.exe 32 PID 2064 wrote to memory of 2784 2064 9fxrllx.exe 33 PID 2064 wrote to memory of 2784 2064 9fxrllx.exe 33 PID 2064 wrote to memory of 2784 2064 9fxrllx.exe 33 PID 2064 wrote to memory of 2784 2064 9fxrllx.exe 33 PID 2784 wrote to memory of 2172 2784 htntnn.exe 34 PID 2784 wrote to memory of 2172 2784 htntnn.exe 34 PID 2784 wrote to memory of 2172 2784 htntnn.exe 34 PID 2784 wrote to memory of 2172 2784 htntnn.exe 34 PID 2172 wrote to memory of 2792 2172 7rxrrxr.exe 35 PID 2172 wrote to memory of 2792 2172 7rxrrxr.exe 35 PID 2172 wrote to memory of 2792 2172 7rxrrxr.exe 35 PID 2172 wrote to memory of 2792 2172 7rxrrxr.exe 35 PID 2792 wrote to memory of 2804 2792 hnhbhn.exe 36 PID 2792 wrote to memory of 2804 2792 hnhbhn.exe 36 PID 2792 wrote to memory of 2804 2792 hnhbhn.exe 36 PID 2792 wrote to memory of 2804 2792 hnhbhn.exe 36 PID 2804 wrote to memory of 2800 2804 vpdpv.exe 37 PID 2804 wrote to memory of 2800 2804 vpdpv.exe 37 PID 2804 wrote to memory of 2800 2804 vpdpv.exe 37 PID 2804 wrote to memory of 2800 2804 vpdpv.exe 37 PID 2800 wrote to memory of 2712 2800 djjjv.exe 38 PID 2800 wrote to memory of 2712 2800 djjjv.exe 38 PID 2800 wrote to memory of 2712 2800 djjjv.exe 38 PID 2800 wrote to memory of 2712 2800 djjjv.exe 38 PID 2712 wrote to memory of 2564 2712 bbhtnn.exe 39 PID 2712 wrote to memory of 2564 2712 bbhtnn.exe 39 PID 2712 wrote to memory of 2564 2712 bbhtnn.exe 39 PID 2712 wrote to memory of 2564 2712 bbhtnn.exe 39 PID 2564 wrote to memory of 3000 2564 5ntnnt.exe 40 PID 2564 wrote to memory of 3000 2564 5ntnnt.exe 40 PID 2564 wrote to memory of 3000 2564 5ntnnt.exe 40 PID 2564 wrote to memory of 3000 2564 5ntnnt.exe 40 PID 3000 wrote to memory of 1644 3000 9dvvp.exe 41 PID 3000 wrote to memory of 1644 3000 9dvvp.exe 41 PID 3000 wrote to memory of 1644 3000 9dvvp.exe 41 PID 3000 wrote to memory of 1644 3000 9dvvp.exe 41 PID 1644 wrote to memory of 1612 1644 5bhhnn.exe 42 PID 1644 wrote to memory of 1612 1644 5bhhnn.exe 42 PID 1644 wrote to memory of 1612 1644 5bhhnn.exe 42 PID 1644 wrote to memory of 1612 1644 5bhhnn.exe 42 PID 1612 wrote to memory of 2392 1612 pjpdd.exe 43 PID 1612 wrote to memory of 2392 1612 pjpdd.exe 43 PID 1612 wrote to memory of 2392 1612 pjpdd.exe 43 PID 1612 wrote to memory of 2392 1612 pjpdd.exe 43 PID 2392 wrote to memory of 1856 2392 1vppv.exe 44 PID 2392 wrote to memory of 1856 2392 1vppv.exe 44 PID 2392 wrote to memory of 1856 2392 1vppv.exe 44 PID 2392 wrote to memory of 1856 2392 1vppv.exe 44 PID 1856 wrote to memory of 1248 1856 3lxfrll.exe 45 PID 1856 wrote to memory of 1248 1856 3lxfrll.exe 45 PID 1856 wrote to memory of 1248 1856 3lxfrll.exe 45 PID 1856 wrote to memory of 1248 1856 3lxfrll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe"C:\Users\Admin\AppData\Local\Temp\91992c9c171d7aaa336e9b8cc90fc4784f58fdd2bb1083248fa39bd9b67d6638N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\9pddd.exec:\9pddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\thbtbn.exec:\thbtbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9fxrllx.exec:\9fxrllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\htntnn.exec:\htntnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\7rxrrxr.exec:\7rxrrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hnhbhn.exec:\hnhbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vpdpv.exec:\vpdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\djjjv.exec:\djjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bbhtnn.exec:\bbhtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5ntnnt.exec:\5ntnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\9dvvp.exec:\9dvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\5bhhnn.exec:\5bhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\pjpdd.exec:\pjpdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\1vppv.exec:\1vppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\3lxfrll.exec:\3lxfrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\ppvpv.exec:\ppvpv.exe17⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7jpvj.exec:\7jpvj.exe18⤵
- Executes dropped EXE
PID:864 -
\??\c:\lxrlllr.exec:\lxrlllr.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3nbnbb.exec:\3nbnbb.exe20⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vjvvd.exec:\vjvvd.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xxlxffl.exec:\xxlxffl.exe22⤵
- Executes dropped EXE
PID:608 -
\??\c:\bhnnnh.exec:\bhnnnh.exe23⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jjvvd.exec:\jjvvd.exe24⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lxrlllr.exec:\lxrlllr.exe25⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thtnnn.exec:\thtnnn.exe26⤵
- Executes dropped EXE
PID:1364 -
\??\c:\jdpvj.exec:\jdpvj.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\tbnbnn.exec:\tbnbnn.exe28⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9tbnnh.exec:\9tbnnh.exe29⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3vjjp.exec:\3vjjp.exe30⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hnnbhh.exec:\hnnbhh.exe31⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3dvjp.exec:\3dvjp.exe32⤵PID:1604
-
\??\c:\3pdjv.exec:\3pdjv.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\btbbhb.exec:\btbbhb.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tnbbhh.exec:\tnbbhh.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\frxlxll.exec:\frxlxll.exe36⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe37⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tthbbb.exec:\tthbbb.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vjvvd.exec:\vjvvd.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5jvvd.exec:\5jvvd.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xrflrxl.exec:\xrflrxl.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbtbnb.exec:\hbtbnb.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7hbttb.exec:\7hbttb.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5jvpv.exec:\5jvpv.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9jdjv.exec:\9jdjv.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrxfrxf.exec:\xrxfrxf.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nbtbnt.exec:\nbtbnt.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
\??\c:\9nhnnb.exec:\9nhnnb.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5vppj.exec:\5vppj.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5vppv.exec:\5vppv.exe50⤵
- Executes dropped EXE
PID:1300 -
\??\c:\rlfrxlr.exec:\rlfrxlr.exe51⤵
- Executes dropped EXE
PID:2392 -
\??\c:\frlrrfl.exec:\frlrrfl.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7bnntt.exec:\7bnntt.exe53⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjdjv.exec:\pjdjv.exe54⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7jppd.exec:\7jppd.exe55⤵
- Executes dropped EXE
PID:1164 -
\??\c:\fxxxfxl.exec:\fxxxfxl.exe56⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9xrrrxf.exec:\9xrrrxf.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hbtthn.exec:\hbtthn.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jvppd.exec:\jvppd.exe59⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjvjd.exec:\jjvjd.exe60⤵
- Executes dropped EXE
PID:1396 -
\??\c:\1frxllr.exec:\1frxllr.exe61⤵
- Executes dropped EXE
PID:608 -
\??\c:\xrxrllr.exec:\xrxrllr.exe62⤵
- Executes dropped EXE
PID:2940 -
\??\c:\thttnh.exec:\thttnh.exe63⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bnhhnh.exec:\bnhhnh.exe64⤵
- Executes dropped EXE
PID:1116 -
\??\c:\1vddv.exec:\1vddv.exe65⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lrflxxr.exec:\lrflxxr.exe66⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xrffrxf.exec:\xrffrxf.exe67⤵PID:2000
-
\??\c:\hhtbnh.exec:\hhtbnh.exe68⤵PID:560
-
\??\c:\bbnthh.exec:\bbnthh.exe69⤵PID:2240
-
\??\c:\dvpvd.exec:\dvpvd.exe70⤵PID:2184
-
\??\c:\lfflrrx.exec:\lfflrrx.exe71⤵PID:2996
-
\??\c:\nhtbnt.exec:\nhtbnt.exe72⤵PID:2112
-
\??\c:\bthnbb.exec:\bthnbb.exe73⤵PID:1604
-
\??\c:\vpjpj.exec:\vpjpj.exe74⤵PID:1936
-
\??\c:\jjvdj.exec:\jjvdj.exe75⤵PID:2160
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe76⤵PID:2640
-
\??\c:\frfxxxx.exec:\frfxxxx.exe77⤵PID:1060
-
\??\c:\bthntb.exec:\bthntb.exe78⤵PID:2056
-
\??\c:\3dvvj.exec:\3dvvj.exe79⤵PID:2704
-
\??\c:\7pdvv.exec:\7pdvv.exe80⤵PID:2768
-
\??\c:\3lfxrll.exec:\3lfxrll.exe81⤵PID:2664
-
\??\c:\nhtnbt.exec:\nhtnbt.exe82⤵PID:588
-
\??\c:\bthntn.exec:\bthntn.exe83⤵PID:2708
-
\??\c:\ddpdd.exec:\ddpdd.exe84⤵PID:2840
-
\??\c:\pdpjj.exec:\pdpjj.exe85⤵PID:2348
-
\??\c:\frxfxxl.exec:\frxfxxl.exe86⤵PID:2544
-
\??\c:\lfrllll.exec:\lfrllll.exe87⤵PID:2740
-
\??\c:\hbhhbb.exec:\hbhhbb.exe88⤵PID:2968
-
\??\c:\pjddj.exec:\pjddj.exe89⤵PID:1152
-
\??\c:\pjvdj.exec:\pjvdj.exe90⤵PID:1640
-
\??\c:\ffrfflx.exec:\ffrfflx.exe91⤵PID:1704
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe92⤵PID:1300
-
\??\c:\hhtbnn.exec:\hhtbnn.exe93⤵PID:2392
-
\??\c:\nnbhnt.exec:\nnbhnt.exe94⤵PID:1548
-
\??\c:\pjjdv.exec:\pjjdv.exe95⤵PID:2016
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe96⤵PID:852
-
\??\c:\lfflxxf.exec:\lfflxxf.exe97⤵PID:1896
-
\??\c:\tthnbh.exec:\tthnbh.exe98⤵PID:2340
-
\??\c:\dvppd.exec:\dvppd.exe99⤵PID:2120
-
\??\c:\pjvdp.exec:\pjvdp.exe100⤵PID:2248
-
\??\c:\9xrfrrx.exec:\9xrfrrx.exe101⤵PID:2436
-
\??\c:\lfrrxff.exec:\lfrrxff.exe102⤵PID:408
-
\??\c:\tthhnt.exec:\tthhnt.exe103⤵PID:1260
-
\??\c:\5bhbhn.exec:\5bhbhn.exe104⤵PID:2336
-
\??\c:\jdppv.exec:\jdppv.exe105⤵PID:976
-
\??\c:\1rxxrlf.exec:\1rxxrlf.exe106⤵PID:844
-
\??\c:\frxfrrf.exec:\frxfrrf.exe107⤵PID:1380
-
\??\c:\dvvdp.exec:\dvvdp.exe108⤵PID:1796
-
\??\c:\7djjp.exec:\7djjp.exe109⤵PID:1628
-
\??\c:\rrflrll.exec:\rrflrll.exe110⤵PID:1848
-
\??\c:\hhbntt.exec:\hhbntt.exe111⤵PID:3004
-
\??\c:\jvjdd.exec:\jvjdd.exe112⤵PID:2140
-
\??\c:\1lxxfrr.exec:\1lxxfrr.exe113⤵PID:900
-
\??\c:\1ppjj.exec:\1ppjj.exe114⤵PID:2112
-
\??\c:\1btnnn.exec:\1btnnn.exe115⤵PID:2488
-
\??\c:\nbnnnn.exec:\nbnnnn.exe116⤵PID:2476
-
\??\c:\thbbhh.exec:\thbbhh.exe117⤵PID:1528
-
\??\c:\dvjjp.exec:\dvjjp.exe118⤵PID:2512
-
\??\c:\pjvdp.exec:\pjvdp.exe119⤵PID:2736
-
\??\c:\jjdpv.exec:\jjdpv.exe120⤵PID:2796
-
\??\c:\7vddp.exec:\7vddp.exe121⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-