Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe
-
Size
456KB
-
MD5
6d8a3ca08c7d94564ab16f0dfac9172c
-
SHA1
ad9be8a481c19e43900d9b653dafd5133a7a834c
-
SHA256
be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98
-
SHA512
6c4f2eadfc8b03162c94b58a1babd398f084a7ff79c23c4f137c682d8c97548479e6e300c1b00bae59dd283267650e62a3f737263fd1f1091a3ee65960e2a527
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRg:q7Tc2NYHUrAwfMp3CDRg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2008-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/564-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-240-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1916-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-907-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-1274-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 hbtthn.exe 2984 7ttthn.exe 2560 3rrfxfl.exe 2868 tttnnb.exe 2600 vddvd.exe 2584 xrxlrxr.exe 3056 ttbthb.exe 1584 vpdjj.exe 2924 3jjpv.exe 2852 5fxxlxx.exe 1056 1nbnnt.exe 1344 xrlrrrx.exe 1536 1httht.exe 1400 3jjpd.exe 2640 5tnhth.exe 564 nhntbn.exe 3000 3pdpd.exe 2808 7nhnhn.exe 1120 pdpdp.exe 2396 rxrlfrf.exe 2524 pppvd.exe 832 9rfrxfl.exe 1696 xxlrflf.exe 1472 3ttbnn.exe 2216 ddjvd.exe 2104 rrrlffr.exe 2240 vvpvp.exe 1916 ppjvj.exe 752 9xrrrff.exe 628 pjdpv.exe 880 1btbhn.exe 3016 rlflrlr.exe 1516 1nbhbb.exe 2756 jvvjd.exe 2976 xlxfrxf.exe 2972 3bhhhh.exe 2580 hbtntt.exe 2720 dpjvp.exe 2552 fxxxfrf.exe 2604 1tnbnb.exe 2716 vvppd.exe 2564 fxxlxxx.exe 552 rrlxffr.exe 2932 hhhnnt.exe 2936 7pdjp.exe 2068 7fxxlrf.exe 1680 tbbnbn.exe 1056 dvpdp.exe 2612 rrxrlxx.exe 1720 btnhtt.exe 1536 nnhhbh.exe 388 vpdjp.exe 584 rrrfrxx.exe 1228 ffxfllx.exe 2532 btnnbh.exe 2160 vvvvj.exe 1912 9rlxlxr.exe 444 hhhttb.exe 2968 1btbtn.exe 2192 pjjvp.exe 1656 3xrflrf.exe 1792 9nnnbn.exe 1580 vdvdv.exe 2428 jpjpd.exe -
resource yara_rule behavioral1/memory/2008-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-976-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-1127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-1183-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2928-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-1210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-1274-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2692 2008 be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe 30 PID 2008 wrote to memory of 2692 2008 be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe 30 PID 2008 wrote to memory of 2692 2008 be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe 30 PID 2008 wrote to memory of 2692 2008 be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe 30 PID 2692 wrote to memory of 2984 2692 hbtthn.exe 31 PID 2692 wrote to memory of 2984 2692 hbtthn.exe 31 PID 2692 wrote to memory of 2984 2692 hbtthn.exe 31 PID 2692 wrote to memory of 2984 2692 hbtthn.exe 31 PID 2984 wrote to memory of 2560 2984 7ttthn.exe 32 PID 2984 wrote to memory of 2560 2984 7ttthn.exe 32 PID 2984 wrote to memory of 2560 2984 7ttthn.exe 32 PID 2984 wrote to memory of 2560 2984 7ttthn.exe 32 PID 2560 wrote to memory of 2868 2560 3rrfxfl.exe 33 PID 2560 wrote to memory of 2868 2560 3rrfxfl.exe 33 PID 2560 wrote to memory of 2868 2560 3rrfxfl.exe 33 PID 2560 wrote to memory of 2868 2560 3rrfxfl.exe 33 PID 2868 wrote to memory of 2600 2868 tttnnb.exe 34 PID 2868 wrote to memory of 2600 2868 tttnnb.exe 34 PID 2868 wrote to memory of 2600 2868 tttnnb.exe 34 PID 2868 wrote to memory of 2600 2868 tttnnb.exe 34 PID 2600 wrote to memory of 2584 2600 vddvd.exe 35 PID 2600 wrote to memory of 2584 2600 vddvd.exe 35 PID 2600 wrote to memory of 2584 2600 vddvd.exe 35 PID 2600 wrote to memory of 2584 2600 vddvd.exe 35 PID 2584 wrote to memory of 3056 2584 xrxlrxr.exe 36 PID 2584 wrote to memory of 3056 2584 xrxlrxr.exe 36 PID 2584 wrote to memory of 3056 2584 xrxlrxr.exe 36 PID 2584 wrote to memory of 3056 2584 xrxlrxr.exe 36 PID 3056 wrote to memory of 1584 3056 ttbthb.exe 37 PID 3056 wrote to memory of 1584 3056 ttbthb.exe 37 PID 3056 wrote to memory of 1584 3056 ttbthb.exe 37 PID 3056 wrote to memory of 1584 3056 ttbthb.exe 37 PID 1584 wrote to memory of 2924 1584 vpdjj.exe 38 PID 1584 wrote to memory of 2924 1584 vpdjj.exe 38 PID 1584 wrote to memory of 2924 1584 vpdjj.exe 38 PID 1584 wrote to memory of 2924 1584 vpdjj.exe 38 PID 2924 wrote to memory of 2852 2924 3jjpv.exe 39 PID 2924 wrote to memory of 2852 2924 3jjpv.exe 39 PID 2924 wrote to memory of 2852 2924 3jjpv.exe 39 PID 2924 wrote to memory of 2852 2924 3jjpv.exe 39 PID 2852 wrote to memory of 1056 2852 5fxxlxx.exe 40 PID 2852 wrote to memory of 1056 2852 5fxxlxx.exe 40 PID 2852 wrote to memory of 1056 2852 5fxxlxx.exe 40 PID 2852 wrote to memory of 1056 2852 5fxxlxx.exe 40 PID 1056 wrote to memory of 1344 1056 1nbnnt.exe 41 PID 1056 wrote to memory of 1344 1056 1nbnnt.exe 41 PID 1056 wrote to memory of 1344 1056 1nbnnt.exe 41 PID 1056 wrote to memory of 1344 1056 1nbnnt.exe 41 PID 1344 wrote to memory of 1536 1344 xrlrrrx.exe 42 PID 1344 wrote to memory of 1536 1344 xrlrrrx.exe 42 PID 1344 wrote to memory of 1536 1344 xrlrrrx.exe 42 PID 1344 wrote to memory of 1536 1344 xrlrrrx.exe 42 PID 1536 wrote to memory of 1400 1536 1httht.exe 43 PID 1536 wrote to memory of 1400 1536 1httht.exe 43 PID 1536 wrote to memory of 1400 1536 1httht.exe 43 PID 1536 wrote to memory of 1400 1536 1httht.exe 43 PID 1400 wrote to memory of 2640 1400 3jjpd.exe 44 PID 1400 wrote to memory of 2640 1400 3jjpd.exe 44 PID 1400 wrote to memory of 2640 1400 3jjpd.exe 44 PID 1400 wrote to memory of 2640 1400 3jjpd.exe 44 PID 2640 wrote to memory of 564 2640 5tnhth.exe 45 PID 2640 wrote to memory of 564 2640 5tnhth.exe 45 PID 2640 wrote to memory of 564 2640 5tnhth.exe 45 PID 2640 wrote to memory of 564 2640 5tnhth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe"C:\Users\Admin\AppData\Local\Temp\be0c525cb00960d1f0e7bd50a1ffb71f736198b79ffb8b4d2f476b1efa387e98.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\hbtthn.exec:\hbtthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7ttthn.exec:\7ttthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\3rrfxfl.exec:\3rrfxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\tttnnb.exec:\tttnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vddvd.exec:\vddvd.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\xrxlrxr.exec:\xrxlrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ttbthb.exec:\ttbthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vpdjj.exec:\vpdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\3jjpv.exec:\3jjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\5fxxlxx.exec:\5fxxlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\1nbnnt.exec:\1nbnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\xrlrrrx.exec:\xrlrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\1httht.exec:\1httht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\3jjpd.exec:\3jjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\5tnhth.exec:\5tnhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nhntbn.exec:\nhntbn.exe17⤵
- Executes dropped EXE
PID:564 -
\??\c:\3pdpd.exec:\3pdpd.exe18⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7nhnhn.exec:\7nhnhn.exe19⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pdpdp.exec:\pdpdp.exe20⤵
- Executes dropped EXE
PID:1120 -
\??\c:\rxrlfrf.exec:\rxrlfrf.exe21⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pppvd.exec:\pppvd.exe22⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9rfrxfl.exec:\9rfrxfl.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\xxlrflf.exec:\xxlrflf.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3ttbnn.exec:\3ttbnn.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\ddjvd.exec:\ddjvd.exe26⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rrrlffr.exec:\rrrlffr.exe27⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vvpvp.exec:\vvpvp.exe28⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ppjvj.exec:\ppjvj.exe29⤵
- Executes dropped EXE
PID:1916 -
\??\c:\9xrrrff.exec:\9xrrrff.exe30⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjdpv.exec:\pjdpv.exe31⤵
- Executes dropped EXE
PID:628 -
\??\c:\1btbhn.exec:\1btbhn.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\rlflrlr.exec:\rlflrlr.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\1nbhbb.exec:\1nbhbb.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jvvjd.exec:\jvvjd.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3bhhhh.exec:\3bhhhh.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972 -
\??\c:\hbtntt.exec:\hbtntt.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dpjvp.exec:\dpjvp.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxxxfrf.exec:\fxxxfrf.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1tnbnb.exec:\1tnbnb.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vvppd.exec:\vvppd.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxxlxxx.exec:\fxxlxxx.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rrlxffr.exec:\rrlxffr.exe44⤵
- Executes dropped EXE
PID:552 -
\??\c:\hhhnnt.exec:\hhhnnt.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7pdjp.exec:\7pdjp.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7fxxlrf.exec:\7fxxlrf.exe47⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tbbnbn.exec:\tbbnbn.exe48⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dvpdp.exec:\dvpdp.exe49⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rrxrlxx.exec:\rrxrlxx.exe50⤵
- Executes dropped EXE
PID:2612 -
\??\c:\btnhtt.exec:\btnhtt.exe51⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnhhbh.exec:\nnhhbh.exe52⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vpdjp.exec:\vpdjp.exe53⤵
- Executes dropped EXE
PID:388 -
\??\c:\rrrfrxx.exec:\rrrfrxx.exe54⤵
- Executes dropped EXE
PID:584 -
\??\c:\ffxfllx.exec:\ffxfllx.exe55⤵
- Executes dropped EXE
PID:1228 -
\??\c:\btnnbh.exec:\btnnbh.exe56⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vvvvj.exec:\vvvvj.exe57⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9rlxlxr.exec:\9rlxlxr.exe58⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hhhttb.exec:\hhhttb.exe59⤵
- Executes dropped EXE
PID:444 -
\??\c:\1btbtn.exec:\1btbtn.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pjjvp.exec:\pjjvp.exe61⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3xrflrf.exec:\3xrflrf.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9nnnbn.exec:\9nnnbn.exe63⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vdvdv.exec:\vdvdv.exe64⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jpjpd.exec:\jpjpd.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xllrlrr.exec:\xllrlrr.exe66⤵PID:1724
-
\??\c:\hhthnh.exec:\hhthnh.exe67⤵PID:1708
-
\??\c:\dvjvj.exec:\dvjvj.exe68⤵PID:848
-
\??\c:\5rlfrxr.exec:\5rlfrxr.exe69⤵PID:1244
-
\??\c:\hhtthn.exec:\hhtthn.exe70⤵
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\tthhth.exec:\tthhth.exe71⤵PID:2240
-
\??\c:\pjdjp.exec:\pjdjp.exe72⤵PID:2980
-
\??\c:\3fxlfrl.exec:\3fxlfrl.exe73⤵PID:1564
-
\??\c:\1htbhn.exec:\1htbhn.exe74⤵PID:2792
-
\??\c:\vvvvd.exec:\vvvvd.exe75⤵PID:2352
-
\??\c:\vpjpj.exec:\vpjpj.exe76⤵PID:880
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe77⤵PID:1568
-
\??\c:\hbtnhb.exec:\hbtnhb.exe78⤵PID:2776
-
\??\c:\jdpdv.exec:\jdpdv.exe79⤵PID:2984
-
\??\c:\xrxlrlr.exec:\xrxlrlr.exe80⤵PID:2804
-
\??\c:\7tbhnt.exec:\7tbhnt.exe81⤵PID:1968
-
\??\c:\pdvdj.exec:\pdvdj.exe82⤵PID:2580
-
\??\c:\pjjpd.exec:\pjjpd.exe83⤵PID:2616
-
\??\c:\rlflxxl.exec:\rlflxxl.exe84⤵PID:2556
-
\??\c:\nnthnn.exec:\nnthnn.exe85⤵PID:2604
-
\??\c:\vpjpv.exec:\vpjpv.exe86⤵PID:2092
-
\??\c:\3rlxlrl.exec:\3rlxlrl.exe87⤵PID:2564
-
\??\c:\hnhhht.exec:\hnhhht.exe88⤵PID:1796
-
\??\c:\pvjvp.exec:\pvjvp.exe89⤵PID:2836
-
\??\c:\9rfflrf.exec:\9rfflrf.exe90⤵PID:1624
-
\??\c:\hhhtht.exec:\hhhtht.exe91⤵PID:2592
-
\??\c:\pppdv.exec:\pppdv.exe92⤵PID:1680
-
\??\c:\vvvdj.exec:\vvvdj.exe93⤵PID:1056
-
\??\c:\thbtht.exec:\thbtht.exe94⤵PID:592
-
\??\c:\3hbtnb.exec:\3hbtnb.exe95⤵PID:1404
-
\??\c:\7pjvp.exec:\7pjvp.exe96⤵PID:1712
-
\??\c:\rlflrxr.exec:\rlflrxr.exe97⤵PID:388
-
\??\c:\nnhbnn.exec:\nnhbnn.exe98⤵PID:876
-
\??\c:\hbntbh.exec:\hbntbh.exe99⤵PID:1220
-
\??\c:\jpjvj.exec:\jpjvj.exe100⤵PID:2900
-
\??\c:\3xllrxl.exec:\3xllrxl.exe101⤵PID:2160
-
\??\c:\hhhhnb.exec:\hhhhnb.exe102⤵PID:1444
-
\??\c:\vvdpj.exec:\vvdpj.exe103⤵PID:688
-
\??\c:\lrrxllx.exec:\lrrxllx.exe104⤵PID:2968
-
\??\c:\nntnht.exec:\nntnht.exe105⤵PID:1268
-
\??\c:\pjvdj.exec:\pjvdj.exe106⤵PID:856
-
\??\c:\3lffrxf.exec:\3lffrxf.exe107⤵PID:1792
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe108⤵PID:1580
-
\??\c:\5htthn.exec:\5htthn.exe109⤵PID:1592
-
\??\c:\1jvvd.exec:\1jvvd.exe110⤵PID:1724
-
\??\c:\9rflrxl.exec:\9rflrxl.exe111⤵PID:1708
-
\??\c:\rrlrflf.exec:\rrlrflf.exe112⤵PID:2216
-
\??\c:\hhnnhh.exec:\hhnnhh.exe113⤵PID:1244
-
\??\c:\1vjjv.exec:\1vjjv.exe114⤵PID:2632
-
\??\c:\vpppv.exec:\vpppv.exe115⤵PID:996
-
\??\c:\1rflxlr.exec:\1rflxlr.exe116⤵PID:2980
-
\??\c:\nhhnbb.exec:\nhhnbb.exe117⤵PID:1372
-
\??\c:\vvdjv.exec:\vvdjv.exe118⤵PID:2792
-
\??\c:\9jvdj.exec:\9jvdj.exe119⤵PID:2352
-
\??\c:\frlrflx.exec:\frlrflx.exe120⤵PID:2752
-
\??\c:\1btthh.exec:\1btthh.exe121⤵PID:1512
-
\??\c:\nnhthb.exec:\nnhthb.exe122⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-