Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe
-
Size
453KB
-
MD5
e5c171430cb182203f2645f892699be0
-
SHA1
f79201f99a960fc4869ada10bca51115cd98f641
-
SHA256
6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2dea
-
SHA512
5f716ed8ca716befefaa0e4cf6d735e2e38ad50ab1eedb6aac8ccecd325342a2c0ea3d87df43271e54551d28f4bb70491fe1b50d01117d10faf7924808c381f1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1884-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-102-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2568-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-123-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2472-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1408-179-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1408-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-260-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-290-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1588-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-336-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2764-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-359-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2604-370-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2868-377-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2092-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-542-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/3012-549-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2508-563-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2524-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-620-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-647-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2172-649-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-744-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-749-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2512-854-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1884 rxxxfxf.exe 2488 ntnhtn.exe 2352 jppdd.exe 2288 lllffrr.exe 2172 tnhnnt.exe 2776 ppdpv.exe 2712 ffrxrxr.exe 2728 hhhntn.exe 2756 7llxlxf.exe 2568 tbhhtt.exe 2644 tthhnn.exe 2156 1thnth.exe 2824 1nbhbh.exe 2472 nnhnhn.exe 596 tbbnhn.exe 772 jjddp.exe 2184 7hbthh.exe 1408 jjvdp.exe 2928 nhbhhn.exe 2176 9xxfxfx.exe 1664 9bthtb.exe 1656 jddpj.exe 868 ddvjp.exe 1812 vpjjj.exe 1672 btthbn.exe 916 jjdpj.exe 1636 bttbhh.exe 3008 5pjvj.exe 2188 hnnbbt.exe 1740 jppjd.exe 2396 btnthh.exe 1588 jdvpv.exe 2300 nnhtbh.exe 1992 7bnttn.exe 2888 9jvdv.exe 2280 xfflrxr.exe 1712 3btbbh.exe 2444 hhbhhh.exe 2024 dvpdv.exe 2764 rfrfxrf.exe 2576 5hhtnb.exe 2604 bttttb.exe 2868 dvvdj.exe 2624 9xrxrrr.exe 2612 hbntbn.exe 1244 nhhtnt.exe 676 dvvvj.exe 944 lfrfrfl.exe 264 nnnbnt.exe 1856 dpddd.exe 1444 vpjdv.exe 272 fxrlxrf.exe 1732 bttbhn.exe 1948 jjddj.exe 2668 fxrxrrx.exe 2916 bbbbth.exe 2752 tnhbnb.exe 2908 vppvj.exe 2924 xlfflrr.exe 1664 hbtnnt.exe 968 vpvdp.exe 1536 vpdpj.exe 1056 rrflrxf.exe 2548 nnhtbb.exe -
resource yara_rule behavioral1/memory/1884-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-45-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2172-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-84-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2756-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-244-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/916-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-336-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2024-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-370-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2868-377-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2612-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-620-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1628-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-647-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/3064-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-744-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2664-749-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2452-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-821-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1884 1972 6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe 30 PID 1972 wrote to memory of 1884 1972 6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe 30 PID 1972 wrote to memory of 1884 1972 6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe 30 PID 1972 wrote to memory of 1884 1972 6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe 30 PID 1884 wrote to memory of 2488 1884 rxxxfxf.exe 31 PID 1884 wrote to memory of 2488 1884 rxxxfxf.exe 31 PID 1884 wrote to memory of 2488 1884 rxxxfxf.exe 31 PID 1884 wrote to memory of 2488 1884 rxxxfxf.exe 31 PID 2488 wrote to memory of 2352 2488 ntnhtn.exe 32 PID 2488 wrote to memory of 2352 2488 ntnhtn.exe 32 PID 2488 wrote to memory of 2352 2488 ntnhtn.exe 32 PID 2488 wrote to memory of 2352 2488 ntnhtn.exe 32 PID 2352 wrote to memory of 2288 2352 jppdd.exe 33 PID 2352 wrote to memory of 2288 2352 jppdd.exe 33 PID 2352 wrote to memory of 2288 2352 jppdd.exe 33 PID 2352 wrote to memory of 2288 2352 jppdd.exe 33 PID 2288 wrote to memory of 2172 2288 lllffrr.exe 34 PID 2288 wrote to memory of 2172 2288 lllffrr.exe 34 PID 2288 wrote to memory of 2172 2288 lllffrr.exe 34 PID 2288 wrote to memory of 2172 2288 lllffrr.exe 34 PID 2172 wrote to memory of 2776 2172 tnhnnt.exe 35 PID 2172 wrote to memory of 2776 2172 tnhnnt.exe 35 PID 2172 wrote to memory of 2776 2172 tnhnnt.exe 35 PID 2172 wrote to memory of 2776 2172 tnhnnt.exe 35 PID 2776 wrote to memory of 2712 2776 ppdpv.exe 36 PID 2776 wrote to memory of 2712 2776 ppdpv.exe 36 PID 2776 wrote to memory of 2712 2776 ppdpv.exe 36 PID 2776 wrote to memory of 2712 2776 ppdpv.exe 36 PID 2712 wrote to memory of 2728 2712 ffrxrxr.exe 37 PID 2712 wrote to memory of 2728 2712 ffrxrxr.exe 37 PID 2712 wrote to memory of 2728 2712 ffrxrxr.exe 37 PID 2712 wrote to memory of 2728 2712 ffrxrxr.exe 37 PID 2728 wrote to memory of 2756 2728 hhhntn.exe 38 PID 2728 wrote to memory of 2756 2728 hhhntn.exe 38 PID 2728 wrote to memory of 2756 2728 hhhntn.exe 38 PID 2728 wrote to memory of 2756 2728 hhhntn.exe 38 PID 2756 wrote to memory of 2568 2756 7llxlxf.exe 39 PID 2756 wrote to memory of 2568 2756 7llxlxf.exe 39 PID 2756 wrote to memory of 2568 2756 7llxlxf.exe 39 PID 2756 wrote to memory of 2568 2756 7llxlxf.exe 39 PID 2568 wrote to memory of 2644 2568 tbhhtt.exe 40 PID 2568 wrote to memory of 2644 2568 tbhhtt.exe 40 PID 2568 wrote to memory of 2644 2568 tbhhtt.exe 40 PID 2568 wrote to memory of 2644 2568 tbhhtt.exe 40 PID 2644 wrote to memory of 2156 2644 tthhnn.exe 41 PID 2644 wrote to memory of 2156 2644 tthhnn.exe 41 PID 2644 wrote to memory of 2156 2644 tthhnn.exe 41 PID 2644 wrote to memory of 2156 2644 tthhnn.exe 41 PID 2156 wrote to memory of 2824 2156 1thnth.exe 42 PID 2156 wrote to memory of 2824 2156 1thnth.exe 42 PID 2156 wrote to memory of 2824 2156 1thnth.exe 42 PID 2156 wrote to memory of 2824 2156 1thnth.exe 42 PID 2824 wrote to memory of 2472 2824 1nbhbh.exe 43 PID 2824 wrote to memory of 2472 2824 1nbhbh.exe 43 PID 2824 wrote to memory of 2472 2824 1nbhbh.exe 43 PID 2824 wrote to memory of 2472 2824 1nbhbh.exe 43 PID 2472 wrote to memory of 596 2472 nnhnhn.exe 44 PID 2472 wrote to memory of 596 2472 nnhnhn.exe 44 PID 2472 wrote to memory of 596 2472 nnhnhn.exe 44 PID 2472 wrote to memory of 596 2472 nnhnhn.exe 44 PID 596 wrote to memory of 772 596 tbbnhn.exe 45 PID 596 wrote to memory of 772 596 tbbnhn.exe 45 PID 596 wrote to memory of 772 596 tbbnhn.exe 45 PID 596 wrote to memory of 772 596 tbbnhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe"C:\Users\Admin\AppData\Local\Temp\6da97d7d75c0820341ff9a85e1ab9384b1185b1cf0b66ef3745ac9873d4b2deaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\rxxxfxf.exec:\rxxxfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\ntnhtn.exec:\ntnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jppdd.exec:\jppdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lllffrr.exec:\lllffrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\tnhnnt.exec:\tnhnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\ppdpv.exec:\ppdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ffrxrxr.exec:\ffrxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hhhntn.exec:\hhhntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7llxlxf.exec:\7llxlxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tbhhtt.exec:\tbhhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tthhnn.exec:\tthhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1thnth.exec:\1thnth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\1nbhbh.exec:\1nbhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nnhnhn.exec:\nnhnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\tbbnhn.exec:\tbbnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\jjddp.exec:\jjddp.exe17⤵
- Executes dropped EXE
PID:772 -
\??\c:\7hbthh.exec:\7hbthh.exe18⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jjvdp.exec:\jjvdp.exe19⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nhbhhn.exec:\nhbhhn.exe20⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9xxfxfx.exec:\9xxfxfx.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9bthtb.exec:\9bthtb.exe22⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jddpj.exec:\jddpj.exe23⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ddvjp.exec:\ddvjp.exe24⤵
- Executes dropped EXE
PID:868 -
\??\c:\vpjjj.exec:\vpjjj.exe25⤵
- Executes dropped EXE
PID:1812 -
\??\c:\btthbn.exec:\btthbn.exe26⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jjdpj.exec:\jjdpj.exe27⤵
- Executes dropped EXE
PID:916 -
\??\c:\bttbhh.exec:\bttbhh.exe28⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5pjvj.exec:\5pjvj.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hnnbbt.exec:\hnnbbt.exe30⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jppjd.exec:\jppjd.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btnthh.exec:\btnthh.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\jdvpv.exec:\jdvpv.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nnhtbh.exec:\nnhtbh.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7bnttn.exec:\7bnttn.exe35⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9jvdv.exec:\9jvdv.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xfflrxr.exec:\xfflrxr.exe37⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3btbbh.exec:\3btbbh.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hhbhhh.exec:\hhbhhh.exe39⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dvpdv.exec:\dvpdv.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rfrfxrf.exec:\rfrfxrf.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5hhtnb.exec:\5hhtnb.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bttttb.exec:\bttttb.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dvvdj.exec:\dvvdj.exe44⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9xrxrrr.exec:\9xrxrrr.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hbntbn.exec:\hbntbn.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhhtnt.exec:\nhhtnt.exe47⤵
- Executes dropped EXE
PID:1244 -
\??\c:\dvvvj.exec:\dvvvj.exe48⤵
- Executes dropped EXE
PID:676 -
\??\c:\lfrfrfl.exec:\lfrfrfl.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\nnnbnt.exec:\nnnbnt.exe50⤵
- Executes dropped EXE
PID:264 -
\??\c:\dpddd.exec:\dpddd.exe51⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vpjdv.exec:\vpjdv.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe53⤵
- Executes dropped EXE
PID:272 -
\??\c:\bttbhn.exec:\bttbhn.exe54⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jjddj.exec:\jjddj.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe56⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bbbbth.exec:\bbbbth.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tnhbnb.exec:\tnhbnb.exe58⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vppvj.exec:\vppvj.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xlfflrr.exec:\xlfflrr.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hbtnnt.exec:\hbtnnt.exe61⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vpvdp.exec:\vpvdp.exe62⤵
- Executes dropped EXE
PID:968 -
\??\c:\vpdpj.exec:\vpdpj.exe63⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rrflrxf.exec:\rrflrxf.exe64⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nnhtbb.exec:\nnhtbb.exe65⤵
- Executes dropped EXE
PID:2548 -
\??\c:\9jpdd.exec:\9jpdd.exe66⤵PID:1384
-
\??\c:\5vjdj.exec:\5vjdj.exe67⤵PID:3000
-
\??\c:\7rrflxl.exec:\7rrflxl.exe68⤵PID:2092
-
\??\c:\3bttbh.exec:\3bttbh.exe69⤵PID:1332
-
\??\c:\1jvpv.exec:\1jvpv.exe70⤵PID:3012
-
\??\c:\3rlllxl.exec:\3rlllxl.exe71⤵PID:2296
-
\??\c:\7hhntb.exec:\7hhntb.exe72⤵PID:2508
-
\??\c:\7bnnhh.exec:\7bnnhh.exe73⤵PID:2356
-
\??\c:\ppjjp.exec:\ppjjp.exe74⤵PID:2524
-
\??\c:\xxfrxfx.exec:\xxfrxfx.exe75⤵PID:1588
-
\??\c:\9nnhth.exec:\9nnhth.exe76⤵PID:3024
-
\??\c:\jvpjp.exec:\jvpjp.exe77⤵PID:2032
-
\??\c:\jdjjp.exec:\jdjjp.exe78⤵PID:2960
-
\??\c:\lfrfllx.exec:\lfrfllx.exe79⤵PID:2748
-
\??\c:\nnhntn.exec:\nnhntn.exe80⤵PID:1712
-
\??\c:\vpdpd.exec:\vpdpd.exe81⤵PID:2768
-
\??\c:\jppvp.exec:\jppvp.exe82⤵PID:2172
-
\??\c:\flxlrxx.exec:\flxlrxx.exe83⤵
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\nbbhnt.exec:\nbbhnt.exe84⤵PID:1628
-
\??\c:\ppjdv.exec:\ppjdv.exe85⤵PID:2596
-
\??\c:\pjvvp.exec:\pjvvp.exe86⤵PID:2756
-
\??\c:\xxxlxxr.exec:\xxxlxxr.exe87⤵PID:2632
-
\??\c:\5thhhn.exec:\5thhhn.exe88⤵PID:2800
-
\??\c:\djjvv.exec:\djjvv.exe89⤵PID:1316
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe90⤵PID:3064
-
\??\c:\rxxlxfr.exec:\rxxlxfr.exe91⤵PID:2476
-
\??\c:\hhhtnn.exec:\hhhtnn.exe92⤵PID:1108
-
\??\c:\3pjpp.exec:\3pjpp.exe93⤵PID:2636
-
\??\c:\5llrxlf.exec:\5llrxlf.exe94⤵PID:1444
-
\??\c:\flffxxl.exec:\flffxxl.exe95⤵PID:980
-
\??\c:\ttnthh.exec:\ttnthh.exe96⤵PID:2316
-
\??\c:\ppppd.exec:\ppppd.exe97⤵PID:1624
-
\??\c:\5vjvp.exec:\5vjvp.exe98⤵PID:2324
-
\??\c:\lrrlflf.exec:\lrrlflf.exe99⤵PID:1408
-
\??\c:\tthtbh.exec:\tthtbh.exe100⤵PID:2812
-
\??\c:\7pvjv.exec:\7pvjv.exe101⤵PID:2664
-
\??\c:\llllxfr.exec:\llllxfr.exe102⤵PID:1876
-
\??\c:\1tnbtb.exec:\1tnbtb.exe103⤵PID:880
-
\??\c:\7nbntt.exec:\7nbntt.exe104⤵
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\jdppd.exec:\jdppd.exe105⤵PID:1656
-
\??\c:\ffxflrx.exec:\ffxflrx.exe106⤵PID:1540
-
\??\c:\9xrxlxl.exec:\9xrxlxl.exe107⤵PID:1720
-
\??\c:\bnthbb.exec:\bnthbb.exe108⤵PID:1776
-
\??\c:\5jvdd.exec:\5jvdd.exe109⤵PID:916
-
\??\c:\rlxxflx.exec:\rlxxflx.exe110⤵PID:2440
-
\??\c:\btttbb.exec:\btttbb.exe111⤵PID:2092
-
\??\c:\5xllrxf.exec:\5xllrxf.exe112⤵PID:2192
-
\??\c:\hhhtbh.exec:\hhhtbh.exe113⤵PID:2344
-
\??\c:\ppjdp.exec:\ppjdp.exe114⤵PID:2512
-
\??\c:\1fxxrxl.exec:\1fxxrxl.exe115⤵PID:1972
-
\??\c:\ntbhtb.exec:\ntbhtb.exe116⤵PID:1584
-
\??\c:\jdvjd.exec:\jdvjd.exe117⤵PID:2332
-
\??\c:\rxrfxfr.exec:\rxrfxfr.exe118⤵PID:1252
-
\??\c:\tbbbbh.exec:\tbbbbh.exe119⤵PID:2292
-
\??\c:\ttnbbh.exec:\ttnbbh.exe120⤵PID:2348
-
\??\c:\ddvdv.exec:\ddvdv.exe121⤵
- System Location Discovery: System Language Discovery
PID:860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-