Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe
-
Size
453KB
-
MD5
f4aa05e3d665e90e07ccb953d0548ab2
-
SHA1
95a037523541999335985290daf1cdfc10a00777
-
SHA256
ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc
-
SHA512
76fff6aa6d8c542a3464f1b53e9ac7d19eae0de39aefdb4389fe960344c4214185939074015b1a4427e9ba8a553de5465a5ec396c233cd7537a591514c4de029
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/3060-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-144-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2624-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-202-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-229-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1792-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-255-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1744-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-315-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2640-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-398-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-437-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2136-489-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2200-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-608-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/276-648-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1520-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-674-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/396-686-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1820-708-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-716-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-714-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1632-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1296-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-1074-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1756-1152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-1184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-1223-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2460 hnbhnn.exe 2400 nnhntt.exe 2628 jjdjp.exe 2732 jdvdj.exe 2688 pjdjp.exe 2652 hbnhtb.exe 2560 3xrrrrf.exe 2648 xxfffff.exe 2600 5frlrrr.exe 1700 7xffrxx.exe 1488 pddpv.exe 1252 frffrxf.exe 2868 1rfrxrf.exe 1524 xrfllff.exe 2636 nhtbtn.exe 2624 pvvjd.exe 2872 xxxllxl.exe 2576 7jvdd.exe 1860 nhtthb.exe 2188 frxxxrx.exe 1988 flrxrrl.exe 1632 bbtbtt.exe 3008 3lxxflr.exe 1792 dvjjp.exe 1312 3nbttn.exe 2012 5pvvj.exe 2408 lllrffx.exe 1744 ddpjj.exe 900 xxxfxlf.exe 2344 pjddp.exe 2616 vpjvp.exe 1572 1rflrfl.exe 320 vjjpd.exe 2628 9ppvj.exe 2640 9llfxrf.exe 2544 ffxlrll.exe 2372 bttbnn.exe 2864 3dvdp.exe 1316 rrlrflf.exe 2532 lrlfrxl.exe 2584 nhbthn.exe 1960 djpdv.exe 1700 jvppv.exe 2288 7rlrrrx.exe 2860 bhhtht.exe 1640 1tthnt.exe 1588 jdvdv.exe 1524 xrlxrlf.exe 2596 lxrrxfr.exe 1836 tnhtbb.exe 2024 dvdvv.exe 1740 9vvdv.exe 2968 xxxlfrl.exe 2576 bhbnhn.exe 2120 5djdd.exe 2188 vdvdp.exe 1672 lfrlllx.exe 2136 bbtbhh.exe 3024 5ntbnt.exe 1944 9djvj.exe 3008 xfxxlxx.exe 1876 lfxxfrl.exe 1680 tttbhh.exe 2280 jjjjd.exe -
resource yara_rule behavioral1/memory/3060-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-53-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2652-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-480-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2184-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-648-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1520-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-774-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1028-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-1159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-1236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2460 3060 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 31 PID 3060 wrote to memory of 2460 3060 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 31 PID 3060 wrote to memory of 2460 3060 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 31 PID 3060 wrote to memory of 2460 3060 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 31 PID 2460 wrote to memory of 2400 2460 hnbhnn.exe 32 PID 2460 wrote to memory of 2400 2460 hnbhnn.exe 32 PID 2460 wrote to memory of 2400 2460 hnbhnn.exe 32 PID 2460 wrote to memory of 2400 2460 hnbhnn.exe 32 PID 2400 wrote to memory of 2628 2400 nnhntt.exe 33 PID 2400 wrote to memory of 2628 2400 nnhntt.exe 33 PID 2400 wrote to memory of 2628 2400 nnhntt.exe 33 PID 2400 wrote to memory of 2628 2400 nnhntt.exe 33 PID 2628 wrote to memory of 2732 2628 jjdjp.exe 34 PID 2628 wrote to memory of 2732 2628 jjdjp.exe 34 PID 2628 wrote to memory of 2732 2628 jjdjp.exe 34 PID 2628 wrote to memory of 2732 2628 jjdjp.exe 34 PID 2732 wrote to memory of 2688 2732 jdvdj.exe 35 PID 2732 wrote to memory of 2688 2732 jdvdj.exe 35 PID 2732 wrote to memory of 2688 2732 jdvdj.exe 35 PID 2732 wrote to memory of 2688 2732 jdvdj.exe 35 PID 2688 wrote to memory of 2652 2688 pjdjp.exe 36 PID 2688 wrote to memory of 2652 2688 pjdjp.exe 36 PID 2688 wrote to memory of 2652 2688 pjdjp.exe 36 PID 2688 wrote to memory of 2652 2688 pjdjp.exe 36 PID 2652 wrote to memory of 2560 2652 hbnhtb.exe 37 PID 2652 wrote to memory of 2560 2652 hbnhtb.exe 37 PID 2652 wrote to memory of 2560 2652 hbnhtb.exe 37 PID 2652 wrote to memory of 2560 2652 hbnhtb.exe 37 PID 2560 wrote to memory of 2648 2560 3xrrrrf.exe 38 PID 2560 wrote to memory of 2648 2560 3xrrrrf.exe 38 PID 2560 wrote to memory of 2648 2560 3xrrrrf.exe 38 PID 2560 wrote to memory of 2648 2560 3xrrrrf.exe 38 PID 2648 wrote to memory of 2600 2648 xxfffff.exe 39 PID 2648 wrote to memory of 2600 2648 xxfffff.exe 39 PID 2648 wrote to memory of 2600 2648 xxfffff.exe 39 PID 2648 wrote to memory of 2600 2648 xxfffff.exe 39 PID 2600 wrote to memory of 1700 2600 5frlrrr.exe 40 PID 2600 wrote to memory of 1700 2600 5frlrrr.exe 40 PID 2600 wrote to memory of 1700 2600 5frlrrr.exe 40 PID 2600 wrote to memory of 1700 2600 5frlrrr.exe 40 PID 1700 wrote to memory of 1488 1700 7xffrxx.exe 41 PID 1700 wrote to memory of 1488 1700 7xffrxx.exe 41 PID 1700 wrote to memory of 1488 1700 7xffrxx.exe 41 PID 1700 wrote to memory of 1488 1700 7xffrxx.exe 41 PID 1488 wrote to memory of 1252 1488 pddpv.exe 42 PID 1488 wrote to memory of 1252 1488 pddpv.exe 42 PID 1488 wrote to memory of 1252 1488 pddpv.exe 42 PID 1488 wrote to memory of 1252 1488 pddpv.exe 42 PID 1252 wrote to memory of 2868 1252 frffrxf.exe 43 PID 1252 wrote to memory of 2868 1252 frffrxf.exe 43 PID 1252 wrote to memory of 2868 1252 frffrxf.exe 43 PID 1252 wrote to memory of 2868 1252 frffrxf.exe 43 PID 2868 wrote to memory of 1524 2868 1rfrxrf.exe 44 PID 2868 wrote to memory of 1524 2868 1rfrxrf.exe 44 PID 2868 wrote to memory of 1524 2868 1rfrxrf.exe 44 PID 2868 wrote to memory of 1524 2868 1rfrxrf.exe 44 PID 1524 wrote to memory of 2636 1524 xrfllff.exe 45 PID 1524 wrote to memory of 2636 1524 xrfllff.exe 45 PID 1524 wrote to memory of 2636 1524 xrfllff.exe 45 PID 1524 wrote to memory of 2636 1524 xrfllff.exe 45 PID 2636 wrote to memory of 2624 2636 nhtbtn.exe 46 PID 2636 wrote to memory of 2624 2636 nhtbtn.exe 46 PID 2636 wrote to memory of 2624 2636 nhtbtn.exe 46 PID 2636 wrote to memory of 2624 2636 nhtbtn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe"C:\Users\Admin\AppData\Local\Temp\ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\hnbhnn.exec:\hnbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\nnhntt.exec:\nnhntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jjdjp.exec:\jjdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jdvdj.exec:\jdvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\pjdjp.exec:\pjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hbnhtb.exec:\hbnhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3xrrrrf.exec:\3xrrrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xxfffff.exec:\xxfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\5frlrrr.exec:\5frlrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7xffrxx.exec:\7xffrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\pddpv.exec:\pddpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\frffrxf.exec:\frffrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\1rfrxrf.exec:\1rfrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\xrfllff.exec:\xrfllff.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nhtbtn.exec:\nhtbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pvvjd.exec:\pvvjd.exe17⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xxxllxl.exec:\xxxllxl.exe18⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7jvdd.exec:\7jvdd.exe19⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nhtthb.exec:\nhtthb.exe20⤵
- Executes dropped EXE
PID:1860 -
\??\c:\frxxxrx.exec:\frxxxrx.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\flrxrrl.exec:\flrxrrl.exe22⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbtbtt.exec:\bbtbtt.exe23⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3lxxflr.exec:\3lxxflr.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dvjjp.exec:\dvjjp.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3nbttn.exec:\3nbttn.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5pvvj.exec:\5pvvj.exe27⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lllrffx.exec:\lllrffx.exe28⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ddpjj.exec:\ddpjj.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xxxfxlf.exec:\xxxfxlf.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\pjddp.exec:\pjddp.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dpppv.exec:\dpppv.exe32⤵PID:2876
-
\??\c:\vpjvp.exec:\vpjvp.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1rflrfl.exec:\1rflrfl.exe34⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vjjpd.exec:\vjjpd.exe35⤵
- Executes dropped EXE
PID:320 -
\??\c:\9ppvj.exec:\9ppvj.exe36⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9llfxrf.exec:\9llfxrf.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ffxlrll.exec:\ffxlrll.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bttbnn.exec:\bttbnn.exe39⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3dvdp.exec:\3dvdp.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rrlrflf.exec:\rrlrflf.exe41⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lrlfrxl.exec:\lrlfrxl.exe42⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nhbthn.exec:\nhbthn.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\djpdv.exec:\djpdv.exe44⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jvppv.exec:\jvppv.exe45⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7rlrrrx.exec:\7rlrrrx.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bhhtht.exec:\bhhtht.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1tthnt.exec:\1tthnt.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jdvdv.exec:\jdvdv.exe49⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xrlxrlf.exec:\xrlxrlf.exe50⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lxrrxfr.exec:\lxrrxfr.exe51⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tnhtbb.exec:\tnhtbb.exe52⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dvdvv.exec:\dvdvv.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9vvdv.exec:\9vvdv.exe54⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bhbnhn.exec:\bhbnhn.exe56⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5djdd.exec:\5djdd.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vdvdp.exec:\vdvdp.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lfrlllx.exec:\lfrlllx.exe59⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bbtbhh.exec:\bbtbhh.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5ntbnt.exec:\5ntbnt.exe61⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9djvj.exec:\9djvj.exe62⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xfxxlxx.exec:\xfxxlxx.exe63⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lfxxfrl.exec:\lfxxfrl.exe64⤵
- Executes dropped EXE
PID:1876 -
\??\c:\tttbhh.exec:\tttbhh.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jjjjd.exec:\jjjjd.exe66⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pjvvv.exec:\pjvvv.exe67⤵PID:2184
-
\??\c:\rxxlxlf.exec:\rxxlxlf.exe68⤵PID:2200
-
\??\c:\rrlxrlr.exec:\rrlxrlr.exe69⤵PID:904
-
\??\c:\bbntnn.exec:\bbntnn.exe70⤵PID:1752
-
\??\c:\ppddd.exec:\ppddd.exe71⤵PID:1628
-
\??\c:\llxxlrf.exec:\llxxlrf.exe72⤵PID:1972
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe73⤵PID:1996
-
\??\c:\7hbhbh.exec:\7hbhbh.exe74⤵PID:1772
-
\??\c:\djjvp.exec:\djjvp.exe75⤵PID:304
-
\??\c:\ppjjv.exec:\ppjjv.exe76⤵PID:2772
-
\??\c:\rrrrfrx.exec:\rrrrfrx.exe77⤵PID:2660
-
\??\c:\9tbtnb.exec:\9tbtnb.exe78⤵PID:2736
-
\??\c:\bnthbn.exec:\bnthbn.exe79⤵PID:2820
-
\??\c:\dpjdj.exec:\dpjdj.exe80⤵PID:2564
-
\??\c:\xlxrxxl.exec:\xlxrxxl.exe81⤵PID:2796
-
\??\c:\hbhnht.exec:\hbhnht.exe82⤵PID:2548
-
\??\c:\nhhthn.exec:\nhhthn.exe83⤵PID:576
-
\??\c:\dppjv.exec:\dppjv.exe84⤵PID:2988
-
\??\c:\5jdvd.exec:\5jdvd.exe85⤵PID:3000
-
\??\c:\1rxflrx.exec:\1rxflrx.exe86⤵PID:636
-
\??\c:\nhtnnt.exec:\nhtnnt.exe87⤵PID:1404
-
\??\c:\tnnthn.exec:\tnnthn.exe88⤵PID:1880
-
\??\c:\1vvvj.exec:\1vvvj.exe89⤵PID:276
-
\??\c:\lfrlxfr.exec:\lfrlxfr.exe90⤵PID:1520
-
\??\c:\nhnnnb.exec:\nhnnnb.exe91⤵PID:1948
-
\??\c:\3bntbh.exec:\3bntbh.exe92⤵PID:2636
-
\??\c:\ppjjd.exec:\ppjjd.exe93⤵PID:768
-
\??\c:\lrrrlxr.exec:\lrrrlxr.exe94⤵PID:396
-
\??\c:\bhnbbh.exec:\bhnbbh.exe95⤵PID:2980
-
\??\c:\vdjpv.exec:\vdjpv.exe96⤵PID:2968
-
\??\c:\3vppd.exec:\3vppd.exe97⤵PID:1820
-
\??\c:\rffxlxl.exec:\rffxlxl.exe98⤵PID:2120
-
\??\c:\nhtbhh.exec:\nhtbhh.exe99⤵
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\tbbnnh.exec:\tbbnnh.exe100⤵PID:1632
-
\??\c:\pvpdp.exec:\pvpdp.exe101⤵PID:964
-
\??\c:\llrfrlx.exec:\llrfrlx.exe102⤵PID:2420
-
\??\c:\9thbhh.exec:\9thbhh.exe103⤵PID:1296
-
\??\c:\vvpvj.exec:\vvpvj.exe104⤵PID:1244
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe105⤵PID:1760
-
\??\c:\thtbtt.exec:\thtbtt.exe106⤵PID:2496
-
\??\c:\bthhtn.exec:\bthhtn.exe107⤵PID:2172
-
\??\c:\vpddj.exec:\vpddj.exe108⤵PID:1028
-
\??\c:\9xrrrrr.exec:\9xrrrrr.exe109⤵PID:1076
-
\??\c:\lfllflr.exec:\lfllflr.exe110⤵PID:2956
-
\??\c:\5bntbh.exec:\5bntbh.exe111⤵PID:1500
-
\??\c:\pvpdd.exec:\pvpdd.exe112⤵PID:1400
-
\??\c:\3djjp.exec:\3djjp.exe113⤵PID:1592
-
\??\c:\lxrrflx.exec:\lxrrflx.exe114⤵PID:2836
-
\??\c:\nnbhnb.exec:\nnbhnb.exe115⤵PID:2676
-
\??\c:\nhtnbh.exec:\nhtnbh.exe116⤵PID:2788
-
\??\c:\5pjpv.exec:\5pjpv.exe117⤵PID:2628
-
\??\c:\9fffrxl.exec:\9fffrxl.exe118⤵PID:2660
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe119⤵PID:2544
-
\??\c:\hbntnt.exec:\hbntnt.exe120⤵PID:2372
-
\??\c:\bhhtbh.exec:\bhhtbh.exe121⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-