Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:54
Behavioral task
behavioral1
Sample
ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe
-
Size
334KB
-
MD5
b48dd837641aea91a4fa55810cd93f10
-
SHA1
fcb6ef2aae7577c2981db4940a7f210a52ef5098
-
SHA256
ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7
-
SHA512
0440c775bfd220944c934f278aff31ba1f132f5b24cd1ddc2d89e24eb34fb7037509f18af31f0af5856138d235bf5fb5bc7f700674eb49a06d22d721c0efdb74
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRB:R4wFHoSHYHUrAwfMp3CDRB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2324-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1212-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-90-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1372-96-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1892-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1208-173-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1208-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1188-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-267-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2380-274-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1528-282-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2184-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-402-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/276-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1744-417-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1840-426-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2304-453-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2528-458-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/880-520-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2184-546-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2708-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-573-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-579-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2724-602-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2888-626-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/3060-696-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1188-713-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-747-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3008-764-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2328-16036-0x00000000771A0000-0x000000007729A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 7lxflrx.exe 2416 1hbhtb.exe 2832 7pdjv.exe 2692 fxffllx.exe 2756 9btbhn.exe 2684 ddppv.exe 1372 7lrflrr.exe 2240 nbntbt.exe 1212 9nhntn.exe 2624 nhhbtn.exe 2592 rxxfrrf.exe 1892 bnbbtt.exe 2952 tnbhnn.exe 776 7vpdp.exe 1456 fxrxflx.exe 2736 tnhbhh.exe 2288 dvjpv.exe 1744 fflrxrf.exe 2940 nhntbh.exe 1208 ttnttt.exe 2176 llfrlxl.exe 556 pjvdj.exe 1696 frfxxfl.exe 1188 7bnntt.exe 2516 bthhnn.exe 544 lxffffl.exe 1476 5xxrrrx.exe 1056 nhthth.exe 1936 jpvpj.exe 2380 xrxxrfr.exe 3008 fflllll.exe 1012 tnhnht.exe 1248 9jvdp.exe 2496 1xlfflx.exe 1528 xrflrrx.exe 2184 htbbnh.exe 1020 pjpvv.exe 2832 rrrxxfl.exe 2268 hhbthn.exe 2760 thntbt.exe 2308 9ddpd.exe 2784 1jdpp.exe 2980 rxxflrr.exe 2688 lfrxflr.exe 2920 3hhhtt.exe 1048 hbntbh.exe 2596 7dvjd.exe 2196 9frflrx.exe 2860 3btttb.exe 2888 hnttth.exe 2016 dvpdp.exe 2952 9jppv.exe 1484 3rllflr.exe 1140 lfxxflr.exe 2896 hhnntb.exe 2808 hthbhn.exe 276 7dvjp.exe 1612 jpjvd.exe 1744 lfrrrxl.exe 1840 nhtthh.exe 2648 tnbbhh.exe 2080 pjvpd.exe 1260 rlflrrf.exe 2472 rlrrxfl.exe -
resource yara_rule behavioral1/memory/2324-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012260-8.dat upx behavioral1/files/0x0008000000016276-15.dat upx behavioral1/memory/2064-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001650a-24.dat upx behavioral1/memory/2832-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000167ea-32.dat upx behavioral1/memory/2692-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016a49-41.dat upx behavioral1/memory/2756-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c36-48.dat upx behavioral1/files/0x0008000000016c47-57.dat upx behavioral1/memory/2684-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c53-67.dat upx behavioral1/files/0x0005000000019278-83.dat upx behavioral1/memory/1212-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019263-76.dat upx behavioral1/memory/2240-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019280-91.dat upx behavioral1/memory/2624-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938b-100.dat upx behavioral1/files/0x0005000000019399-107.dat upx behavioral1/memory/1892-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/776-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b7-116.dat upx behavioral1/files/0x00050000000193c1-125.dat upx behavioral1/memory/1456-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c8-133.dat upx behavioral1/files/0x00050000000193d4-141.dat upx behavioral1/memory/2736-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ec-149.dat upx behavioral1/memory/1744-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019417-157.dat upx behavioral1/files/0x000500000001941a-166.dat upx behavioral1/memory/1208-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019436-174.dat upx behavioral1/files/0x0005000000019441-182.dat upx behavioral1/files/0x00050000000194bd-189.dat upx behavioral1/files/0x0009000000015fba-196.dat upx behavioral1/files/0x00050000000194f3-203.dat upx behavioral1/memory/1188-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019537-212.dat upx behavioral1/files/0x00050000000195d9-221.dat upx behavioral1/memory/544-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960a-228.dat upx behavioral1/files/0x000500000001960c-235.dat upx behavioral1/files/0x000500000001960d-242.dat upx behavioral1/memory/2380-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960e-251.dat upx behavioral1/memory/3008-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019610-260.dat upx behavioral1/memory/3008-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1528-282-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2184-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2308-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1048-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-353-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2064 2324 ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe 31 PID 2324 wrote to memory of 2064 2324 ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe 31 PID 2324 wrote to memory of 2064 2324 ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe 31 PID 2324 wrote to memory of 2064 2324 ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe 31 PID 2064 wrote to memory of 2416 2064 7lxflrx.exe 32 PID 2064 wrote to memory of 2416 2064 7lxflrx.exe 32 PID 2064 wrote to memory of 2416 2064 7lxflrx.exe 32 PID 2064 wrote to memory of 2416 2064 7lxflrx.exe 32 PID 2416 wrote to memory of 2832 2416 1hbhtb.exe 33 PID 2416 wrote to memory of 2832 2416 1hbhtb.exe 33 PID 2416 wrote to memory of 2832 2416 1hbhtb.exe 33 PID 2416 wrote to memory of 2832 2416 1hbhtb.exe 33 PID 2832 wrote to memory of 2692 2832 7pdjv.exe 34 PID 2832 wrote to memory of 2692 2832 7pdjv.exe 34 PID 2832 wrote to memory of 2692 2832 7pdjv.exe 34 PID 2832 wrote to memory of 2692 2832 7pdjv.exe 34 PID 2692 wrote to memory of 2756 2692 fxffllx.exe 35 PID 2692 wrote to memory of 2756 2692 fxffllx.exe 35 PID 2692 wrote to memory of 2756 2692 fxffllx.exe 35 PID 2692 wrote to memory of 2756 2692 fxffllx.exe 35 PID 2756 wrote to memory of 2684 2756 9btbhn.exe 36 PID 2756 wrote to memory of 2684 2756 9btbhn.exe 36 PID 2756 wrote to memory of 2684 2756 9btbhn.exe 36 PID 2756 wrote to memory of 2684 2756 9btbhn.exe 36 PID 2684 wrote to memory of 1372 2684 ddppv.exe 37 PID 2684 wrote to memory of 1372 2684 ddppv.exe 37 PID 2684 wrote to memory of 1372 2684 ddppv.exe 37 PID 2684 wrote to memory of 1372 2684 ddppv.exe 37 PID 1372 wrote to memory of 2240 1372 7lrflrr.exe 38 PID 1372 wrote to memory of 2240 1372 7lrflrr.exe 38 PID 1372 wrote to memory of 2240 1372 7lrflrr.exe 38 PID 1372 wrote to memory of 2240 1372 7lrflrr.exe 38 PID 2240 wrote to memory of 1212 2240 nbntbt.exe 39 PID 2240 wrote to memory of 1212 2240 nbntbt.exe 39 PID 2240 wrote to memory of 1212 2240 nbntbt.exe 39 PID 2240 wrote to memory of 1212 2240 nbntbt.exe 39 PID 1212 wrote to memory of 2624 1212 9nhntn.exe 40 PID 1212 wrote to memory of 2624 1212 9nhntn.exe 40 PID 1212 wrote to memory of 2624 1212 9nhntn.exe 40 PID 1212 wrote to memory of 2624 1212 9nhntn.exe 40 PID 2624 wrote to memory of 2592 2624 nhhbtn.exe 41 PID 2624 wrote to memory of 2592 2624 nhhbtn.exe 41 PID 2624 wrote to memory of 2592 2624 nhhbtn.exe 41 PID 2624 wrote to memory of 2592 2624 nhhbtn.exe 41 PID 2592 wrote to memory of 1892 2592 rxxfrrf.exe 42 PID 2592 wrote to memory of 1892 2592 rxxfrrf.exe 42 PID 2592 wrote to memory of 1892 2592 rxxfrrf.exe 42 PID 2592 wrote to memory of 1892 2592 rxxfrrf.exe 42 PID 1892 wrote to memory of 2952 1892 bnbbtt.exe 43 PID 1892 wrote to memory of 2952 1892 bnbbtt.exe 43 PID 1892 wrote to memory of 2952 1892 bnbbtt.exe 43 PID 1892 wrote to memory of 2952 1892 bnbbtt.exe 43 PID 2952 wrote to memory of 776 2952 tnbhnn.exe 44 PID 2952 wrote to memory of 776 2952 tnbhnn.exe 44 PID 2952 wrote to memory of 776 2952 tnbhnn.exe 44 PID 2952 wrote to memory of 776 2952 tnbhnn.exe 44 PID 776 wrote to memory of 1456 776 7vpdp.exe 45 PID 776 wrote to memory of 1456 776 7vpdp.exe 45 PID 776 wrote to memory of 1456 776 7vpdp.exe 45 PID 776 wrote to memory of 1456 776 7vpdp.exe 45 PID 1456 wrote to memory of 2736 1456 fxrxflx.exe 46 PID 1456 wrote to memory of 2736 1456 fxrxflx.exe 46 PID 1456 wrote to memory of 2736 1456 fxrxflx.exe 46 PID 1456 wrote to memory of 2736 1456 fxrxflx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe"C:\Users\Admin\AppData\Local\Temp\ab4ecf8acd4d392dcf8ad638e6edc436d320dddd512f29ce1ef2993fcd8e6ad7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\7lxflrx.exec:\7lxflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\1hbhtb.exec:\1hbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\7pdjv.exec:\7pdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\fxffllx.exec:\fxffllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9btbhn.exec:\9btbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ddppv.exec:\ddppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7lrflrr.exec:\7lrflrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\nbntbt.exec:\nbntbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\9nhntn.exec:\9nhntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\nhhbtn.exec:\nhhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\rxxfrrf.exec:\rxxfrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bnbbtt.exec:\bnbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\tnbhnn.exec:\tnbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\7vpdp.exec:\7vpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\fxrxflx.exec:\fxrxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\tnhbhh.exec:\tnhbhh.exe17⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dvjpv.exec:\dvjpv.exe18⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fflrxrf.exec:\fflrxrf.exe19⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nhntbh.exec:\nhntbh.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ttnttt.exec:\ttnttt.exe21⤵
- Executes dropped EXE
PID:1208 -
\??\c:\llfrlxl.exec:\llfrlxl.exe22⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pjvdj.exec:\pjvdj.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\frfxxfl.exec:\frfxxfl.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7bnntt.exec:\7bnntt.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\bthhnn.exec:\bthhnn.exe26⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lxffffl.exec:\lxffffl.exe27⤵
- Executes dropped EXE
PID:544 -
\??\c:\5xxrrrx.exec:\5xxrrrx.exe28⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nhthth.exec:\nhthth.exe29⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jpvpj.exec:\jpvpj.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xrxxrfr.exec:\xrxxrfr.exe31⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fflllll.exec:\fflllll.exe32⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tnhnht.exec:\tnhnht.exe33⤵
- Executes dropped EXE
PID:1012 -
\??\c:\9jvdp.exec:\9jvdp.exe34⤵
- Executes dropped EXE
PID:1248 -
\??\c:\1xlfflx.exec:\1xlfflx.exe35⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xrflrrx.exec:\xrflrrx.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\htbbnh.exec:\htbbnh.exe37⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pjpvv.exec:\pjpvv.exe38⤵
- Executes dropped EXE
PID:1020 -
\??\c:\rrrxxfl.exec:\rrrxxfl.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hhbthn.exec:\hhbthn.exe40⤵
- Executes dropped EXE
PID:2268 -
\??\c:\thntbt.exec:\thntbt.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9ddpd.exec:\9ddpd.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1jdpp.exec:\1jdpp.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rxxflrr.exec:\rxxflrr.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lfrxflr.exec:\lfrxflr.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3hhhtt.exec:\3hhhtt.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hbntbh.exec:\hbntbh.exe47⤵
- Executes dropped EXE
PID:1048 -
\??\c:\7dvjd.exec:\7dvjd.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9frflrx.exec:\9frflrx.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3btttb.exec:\3btttb.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hnttth.exec:\hnttth.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvpdp.exec:\dvpdp.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9jppv.exec:\9jppv.exe53⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3rllflr.exec:\3rllflr.exe54⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lfxxflr.exec:\lfxxflr.exe55⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hhnntb.exec:\hhnntb.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hthbhn.exec:\hthbhn.exe57⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7dvjp.exec:\7dvjp.exe58⤵
- Executes dropped EXE
PID:276 -
\??\c:\jpjvd.exec:\jpjvd.exe59⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe60⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nhtthh.exec:\nhtthh.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tnbbhh.exec:\tnbbhh.exe62⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjvpd.exec:\pjvpd.exe63⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rlflrrf.exec:\rlflrrf.exe64⤵
- Executes dropped EXE
PID:1260 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe65⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nhhbth.exec:\nhhbth.exe66⤵PID:2304
-
\??\c:\pdppp.exec:\pdppp.exe67⤵PID:2528
-
\??\c:\jvjdd.exec:\jvjdd.exe68⤵PID:372
-
\??\c:\rllrxfl.exec:\rllrxfl.exe69⤵PID:1792
-
\??\c:\bthhtb.exec:\bthhtb.exe70⤵PID:2984
-
\??\c:\9nhhbh.exec:\9nhhbh.exe71⤵PID:752
-
\??\c:\9dpdd.exec:\9dpdd.exe72⤵PID:1780
-
\??\c:\jdppv.exec:\jdppv.exe73⤵PID:2264
-
\??\c:\ffxrflx.exec:\ffxrflx.exe74⤵PID:1936
-
\??\c:\hhnbnb.exec:\hhnbnb.exe75⤵PID:3040
-
\??\c:\bbtbhh.exec:\bbtbhh.exe76⤵PID:1000
-
\??\c:\1jvjv.exec:\1jvjv.exe77⤵PID:984
-
\??\c:\vppjv.exec:\vppjv.exe78⤵PID:880
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe79⤵PID:2020
-
\??\c:\nhbhbh.exec:\nhbhbh.exe80⤵PID:2332
-
\??\c:\nbbhbb.exec:\nbbhbb.exe81⤵PID:2372
-
\??\c:\vpddp.exec:\vpddp.exe82⤵PID:2412
-
\??\c:\xrflrlr.exec:\xrflrlr.exe83⤵PID:2184
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe84⤵PID:2708
-
\??\c:\tnnthb.exec:\tnnthb.exe85⤵PID:2824
-
\??\c:\bnbtbb.exec:\bnbtbb.exe86⤵PID:2740
-
\??\c:\dppjp.exec:\dppjp.exe87⤵PID:2680
-
\??\c:\rxrllxx.exec:\rxrllxx.exe88⤵PID:2556
-
\??\c:\rlxxrxf.exec:\rlxxrxf.exe89⤵PID:2576
-
\??\c:\tntbnn.exec:\tntbnn.exe90⤵PID:2724
-
\??\c:\tttnth.exec:\tttnth.exe91⤵PID:2544
-
\??\c:\1dvvj.exec:\1dvvj.exe92⤵PID:2672
-
\??\c:\frfllff.exec:\frfllff.exe93⤵PID:2628
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe94⤵PID:2116
-
\??\c:\nbthnt.exec:\nbthnt.exe95⤵PID:2196
-
\??\c:\ppjpv.exec:\ppjpv.exe96⤵PID:1036
-
\??\c:\3vjdj.exec:\3vjdj.exe97⤵PID:2888
-
\??\c:\1xflffx.exec:\1xflffx.exe98⤵PID:2640
-
\??\c:\5xxxrxf.exec:\5xxxrxf.exe99⤵PID:2792
-
\??\c:\pjppv.exec:\pjppv.exe100⤵PID:1456
-
\??\c:\pjpdp.exec:\pjpdp.exe101⤵PID:2852
-
\??\c:\rlxfllr.exec:\rlxfllr.exe102⤵PID:1496
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe103⤵PID:1412
-
\??\c:\7nttbn.exec:\7nttbn.exe104⤵PID:628
-
\??\c:\vpvjp.exec:\vpvjp.exe105⤵PID:2916
-
\??\c:\pdjvd.exec:\pdjvd.exe106⤵PID:3060
-
\??\c:\frxxxff.exec:\frxxxff.exe107⤵PID:2096
-
\??\c:\lxffllr.exec:\lxffllr.exe108⤵PID:2176
-
\??\c:\bbnbhh.exec:\bbnbhh.exe109⤵PID:2232
-
\??\c:\pppdv.exec:\pppdv.exe110⤵PID:760
-
\??\c:\jvpdj.exec:\jvpdj.exe111⤵PID:1156
-
\??\c:\5fxfllr.exec:\5fxfllr.exe112⤵PID:1188
-
\??\c:\bntnnh.exec:\bntnnh.exe113⤵PID:1408
-
\??\c:\9tnhnh.exec:\9tnhnh.exe114⤵PID:2516
-
\??\c:\vvpvj.exec:\vvpvj.exe115⤵PID:376
-
\??\c:\vpddp.exec:\vpddp.exe116⤵PID:532
-
\??\c:\fxrxxfr.exec:\fxrxxfr.exe117⤵PID:1056
-
\??\c:\3thhnh.exec:\3thhnh.exe118⤵PID:1692
-
\??\c:\tbbttn.exec:\tbbttn.exe119⤵PID:1784
-
\??\c:\3jpjj.exec:\3jpjj.exe120⤵PID:1580
-
\??\c:\jdjpv.exec:\jdjpv.exe121⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-