Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe
-
Size
453KB
-
MD5
97feb28f0e447340ec6bf8dd58ba249f
-
SHA1
179b749a42ce30fb49443f3a163dde6c1b541cb1
-
SHA256
820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63
-
SHA512
5e0266f3226adf2ea72e5c1b6379f6bd5751391f23e40a1b9e5a945f7234abd4a46fe11bc7bb306d2245585a209f0f6e7fbbc3c634bbd4c94adb9b778d3b141f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-31-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2836-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-148-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/820-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2356-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-203-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2128-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-312-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2560-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-355-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2932-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/616-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-559-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-571-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2376-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-621-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-703-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 bthnhh.exe 2836 9bthtb.exe 2856 fxlrfrf.exe 2716 tthhnt.exe 2724 9rfxfxf.exe 2568 tnbbtn.exe 3024 rfrrxxl.exe 3040 vpdjv.exe 2820 tnbhnt.exe 3004 ppdjd.exe 2368 lxrrxfl.exe 1796 9jvvd.exe 1496 rlflrfr.exe 1612 hhbbtb.exe 2816 pjpjp.exe 820 7lxxlrr.exe 2012 vdjdp.exe 2356 hthhnn.exe 2036 jdpjp.exe 1256 xxfrxlx.exe 2124 nhntbb.exe 2128 5djjp.exe 876 llxxlxl.exe 2732 dvppv.exe 1728 nhttht.exe 3000 1fxxlrx.exe 2100 9tbhtb.exe 2328 7lrxfxx.exe 2336 5xrxfrx.exe 900 dvppv.exe 2632 9rlrflf.exe 2696 vdvdp.exe 1592 rlxlffr.exe 2956 3bnhnn.exe 2560 vjvdj.exe 2588 ffxxffl.exe 2896 lfrffrf.exe 2844 3bnnnt.exe 2548 jvjjj.exe 2628 llrfllx.exe 848 tnbhhh.exe 1616 dpdvd.exe 1532 xrflfxf.exe 2932 xrfxrrf.exe 2224 thbhtt.exe 2540 jvjdd.exe 1580 5xllrxf.exe 1796 nbnhnn.exe 1632 1nbtbh.exe 2348 vvjpj.exe 2744 lfrrrrx.exe 1636 hbtttn.exe 660 5hnnbh.exe 1028 dpjvj.exe 2536 rlrlxfl.exe 2356 tnbbbt.exe 2404 pdpjv.exe 1160 ppdjv.exe 1084 xrxxllf.exe 2360 bhbhbb.exe 1972 jdpvj.exe 2128 rrlxrxx.exe 1868 9llfrxf.exe 2340 5nhnbh.exe -
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-890-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2664 2188 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2188 wrote to memory of 2664 2188 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2188 wrote to memory of 2664 2188 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2188 wrote to memory of 2664 2188 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2664 wrote to memory of 2836 2664 bthnhh.exe 31 PID 2664 wrote to memory of 2836 2664 bthnhh.exe 31 PID 2664 wrote to memory of 2836 2664 bthnhh.exe 31 PID 2664 wrote to memory of 2836 2664 bthnhh.exe 31 PID 2836 wrote to memory of 2856 2836 9bthtb.exe 32 PID 2836 wrote to memory of 2856 2836 9bthtb.exe 32 PID 2836 wrote to memory of 2856 2836 9bthtb.exe 32 PID 2836 wrote to memory of 2856 2836 9bthtb.exe 32 PID 2856 wrote to memory of 2716 2856 fxlrfrf.exe 33 PID 2856 wrote to memory of 2716 2856 fxlrfrf.exe 33 PID 2856 wrote to memory of 2716 2856 fxlrfrf.exe 33 PID 2856 wrote to memory of 2716 2856 fxlrfrf.exe 33 PID 2716 wrote to memory of 2724 2716 tthhnt.exe 34 PID 2716 wrote to memory of 2724 2716 tthhnt.exe 34 PID 2716 wrote to memory of 2724 2716 tthhnt.exe 34 PID 2716 wrote to memory of 2724 2716 tthhnt.exe 34 PID 2724 wrote to memory of 2568 2724 9rfxfxf.exe 35 PID 2724 wrote to memory of 2568 2724 9rfxfxf.exe 35 PID 2724 wrote to memory of 2568 2724 9rfxfxf.exe 35 PID 2724 wrote to memory of 2568 2724 9rfxfxf.exe 35 PID 2568 wrote to memory of 3024 2568 tnbbtn.exe 36 PID 2568 wrote to memory of 3024 2568 tnbbtn.exe 36 PID 2568 wrote to memory of 3024 2568 tnbbtn.exe 36 PID 2568 wrote to memory of 3024 2568 tnbbtn.exe 36 PID 3024 wrote to memory of 3040 3024 rfrrxxl.exe 37 PID 3024 wrote to memory of 3040 3024 rfrrxxl.exe 37 PID 3024 wrote to memory of 3040 3024 rfrrxxl.exe 37 PID 3024 wrote to memory of 3040 3024 rfrrxxl.exe 37 PID 3040 wrote to memory of 2820 3040 vpdjv.exe 38 PID 3040 wrote to memory of 2820 3040 vpdjv.exe 38 PID 3040 wrote to memory of 2820 3040 vpdjv.exe 38 PID 3040 wrote to memory of 2820 3040 vpdjv.exe 38 PID 2820 wrote to memory of 3004 2820 tnbhnt.exe 39 PID 2820 wrote to memory of 3004 2820 tnbhnt.exe 39 PID 2820 wrote to memory of 3004 2820 tnbhnt.exe 39 PID 2820 wrote to memory of 3004 2820 tnbhnt.exe 39 PID 3004 wrote to memory of 2368 3004 ppdjd.exe 40 PID 3004 wrote to memory of 2368 3004 ppdjd.exe 40 PID 3004 wrote to memory of 2368 3004 ppdjd.exe 40 PID 3004 wrote to memory of 2368 3004 ppdjd.exe 40 PID 2368 wrote to memory of 1796 2368 lxrrxfl.exe 41 PID 2368 wrote to memory of 1796 2368 lxrrxfl.exe 41 PID 2368 wrote to memory of 1796 2368 lxrrxfl.exe 41 PID 2368 wrote to memory of 1796 2368 lxrrxfl.exe 41 PID 1796 wrote to memory of 1496 1796 9jvvd.exe 42 PID 1796 wrote to memory of 1496 1796 9jvvd.exe 42 PID 1796 wrote to memory of 1496 1796 9jvvd.exe 42 PID 1796 wrote to memory of 1496 1796 9jvvd.exe 42 PID 1496 wrote to memory of 1612 1496 rlflrfr.exe 43 PID 1496 wrote to memory of 1612 1496 rlflrfr.exe 43 PID 1496 wrote to memory of 1612 1496 rlflrfr.exe 43 PID 1496 wrote to memory of 1612 1496 rlflrfr.exe 43 PID 1612 wrote to memory of 2816 1612 hhbbtb.exe 44 PID 1612 wrote to memory of 2816 1612 hhbbtb.exe 44 PID 1612 wrote to memory of 2816 1612 hhbbtb.exe 44 PID 1612 wrote to memory of 2816 1612 hhbbtb.exe 44 PID 2816 wrote to memory of 820 2816 pjpjp.exe 45 PID 2816 wrote to memory of 820 2816 pjpjp.exe 45 PID 2816 wrote to memory of 820 2816 pjpjp.exe 45 PID 2816 wrote to memory of 820 2816 pjpjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe"C:\Users\Admin\AppData\Local\Temp\820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\bthnhh.exec:\bthnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9bthtb.exec:\9bthtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\fxlrfrf.exec:\fxlrfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tthhnt.exec:\tthhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\9rfxfxf.exec:\9rfxfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tnbbtn.exec:\tnbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\vpdjv.exec:\vpdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\tnbhnt.exec:\tnbhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ppdjd.exec:\ppdjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lxrrxfl.exec:\lxrrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\9jvvd.exec:\9jvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\rlflrfr.exec:\rlflrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hhbbtb.exec:\hhbbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\pjpjp.exec:\pjpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\7lxxlrr.exec:\7lxxlrr.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820 -
\??\c:\vdjdp.exec:\vdjdp.exe18⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hthhnn.exec:\hthhnn.exe19⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jdpjp.exec:\jdpjp.exe20⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xxfrxlx.exec:\xxfrxlx.exe21⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nhntbb.exec:\nhntbb.exe22⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5djjp.exec:\5djjp.exe23⤵
- Executes dropped EXE
PID:2128 -
\??\c:\llxxlxl.exec:\llxxlxl.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\dvppv.exec:\dvppv.exe25⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhttht.exec:\nhttht.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1fxxlrx.exec:\1fxxlrx.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9tbhtb.exec:\9tbhtb.exe28⤵
- Executes dropped EXE
PID:2100 -
\??\c:\7lrxfxx.exec:\7lrxfxx.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5xrxfrx.exec:\5xrxfrx.exe30⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dvppv.exec:\dvppv.exe31⤵
- Executes dropped EXE
PID:900 -
\??\c:\9rlrflf.exec:\9rlrflf.exe32⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vdvdp.exec:\vdvdp.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlxlffr.exec:\rlxlffr.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3bnhnn.exec:\3bnhnn.exe35⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vjvdj.exec:\vjvdj.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ffxxffl.exec:\ffxxffl.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lfrffrf.exec:\lfrffrf.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3bnnnt.exec:\3bnnnt.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jvjjj.exec:\jvjjj.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\llrfllx.exec:\llrfllx.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnbhhh.exec:\tnbhhh.exe42⤵
- Executes dropped EXE
PID:848 -
\??\c:\dpdvd.exec:\dpdvd.exe43⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xrflfxf.exec:\xrflfxf.exe44⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xrfxrrf.exec:\xrfxrrf.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\thbhtt.exec:\thbhtt.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jvjdd.exec:\jvjdd.exe47⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5xllrxf.exec:\5xllrxf.exe48⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nbnhnn.exec:\nbnhnn.exe49⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1nbtbh.exec:\1nbtbh.exe50⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vvjpj.exec:\vvjpj.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe52⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hbtttn.exec:\hbtttn.exe53⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5hnnbh.exec:\5hnnbh.exe54⤵
- Executes dropped EXE
PID:660 -
\??\c:\dpjvj.exec:\dpjvj.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rlrlxfl.exec:\rlrlxfl.exe56⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tnbbbt.exec:\tnbbbt.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pdpjv.exec:\pdpjv.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ppdjv.exec:\ppdjv.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xrxxllf.exec:\xrxxllf.exe60⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bhbhbb.exec:\bhbhbb.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jdpvj.exec:\jdpvj.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rrlxrxx.exec:\rrlxrxx.exe63⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9llfrxf.exec:\9llfrxf.exe64⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5nhnbh.exec:\5nhnbh.exe65⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hhbnnt.exec:\hhbnnt.exe66⤵PID:616
-
\??\c:\1pppv.exec:\1pppv.exe67⤵PID:2296
-
\??\c:\lfxxrxl.exec:\lfxxrxl.exe68⤵PID:3068
-
\??\c:\thnnnn.exec:\thnnnn.exe69⤵PID:3008
-
\??\c:\dvdvv.exec:\dvdvv.exe70⤵PID:2992
-
\??\c:\7vpjp.exec:\7vpjp.exe71⤵PID:2084
-
\??\c:\5fllxxx.exec:\5fllxxx.exe72⤵PID:3052
-
\??\c:\9tbbhh.exec:\9tbbhh.exe73⤵PID:1948
-
\??\c:\thttbb.exec:\thttbb.exe74⤵PID:2704
-
\??\c:\dvpvp.exec:\dvpvp.exe75⤵PID:2376
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe76⤵PID:2660
-
\??\c:\nbtbth.exec:\nbtbth.exe77⤵PID:2756
-
\??\c:\dddpd.exec:\dddpd.exe78⤵PID:2944
-
\??\c:\jdvdp.exec:\jdvdp.exe79⤵PID:2884
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe80⤵PID:2896
-
\??\c:\hhbnhh.exec:\hhbnhh.exe81⤵PID:1152
-
\??\c:\hhthhb.exec:\hhthhb.exe82⤵PID:2616
-
\??\c:\3dppp.exec:\3dppp.exe83⤵PID:1732
-
\??\c:\llxxllx.exec:\llxxllx.exe84⤵PID:2880
-
\??\c:\hnhhtn.exec:\hnhhtn.exe85⤵PID:2900
-
\??\c:\3dvvd.exec:\3dvvd.exe86⤵PID:2820
-
\??\c:\pdvvv.exec:\pdvvv.exe87⤵PID:2648
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe88⤵PID:1168
-
\??\c:\5thhhh.exec:\5thhhh.exe89⤵PID:2368
-
\??\c:\pdpvj.exec:\pdpvj.exe90⤵PID:1380
-
\??\c:\pjjdp.exec:\pjjdp.exe91⤵PID:2072
-
\??\c:\xrflxrx.exec:\xrflxrx.exe92⤵PID:2832
-
\??\c:\bhthhn.exec:\bhthhn.exe93⤵PID:2272
-
\??\c:\1dppv.exec:\1dppv.exe94⤵PID:536
-
\??\c:\rrxlflx.exec:\rrxlflx.exe95⤵PID:2976
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe96⤵PID:856
-
\??\c:\hbhhnh.exec:\hbhhnh.exe97⤵PID:2808
-
\??\c:\jvppd.exec:\jvppd.exe98⤵PID:1048
-
\??\c:\frflxff.exec:\frflxff.exe99⤵PID:1004
-
\??\c:\rlffrrx.exec:\rlffrrx.exe100⤵PID:1256
-
\??\c:\hbbnbh.exec:\hbbnbh.exe101⤵PID:2984
-
\??\c:\dvjdj.exec:\dvjdj.exe102⤵PID:1056
-
\??\c:\vjjjp.exec:\vjjjp.exe103⤵PID:1316
-
\??\c:\xxlrffl.exec:\xxlrffl.exe104⤵PID:1872
-
\??\c:\thtbhh.exec:\thtbhh.exe105⤵PID:696
-
\??\c:\hbbbhh.exec:\hbbbhh.exe106⤵PID:1864
-
\??\c:\7ddvd.exec:\7ddvd.exe107⤵PID:1728
-
\??\c:\5lfllxl.exec:\5lfllxl.exe108⤵PID:760
-
\??\c:\rrffrrf.exec:\rrffrrf.exe109⤵PID:2524
-
\??\c:\hhbhbb.exec:\hhbhbb.exe110⤵PID:2468
-
\??\c:\5vjpv.exec:\5vjpv.exe111⤵PID:2472
-
\??\c:\rlfxrxf.exec:\rlfxrxf.exe112⤵PID:2992
-
\??\c:\tnhnbh.exec:\tnhnbh.exe113⤵PID:2084
-
\??\c:\vvppp.exec:\vvppp.exe114⤵PID:3052
-
\??\c:\9jvpv.exec:\9jvpv.exe115⤵PID:1716
-
\??\c:\7rfxrxf.exec:\7rfxrxf.exe116⤵PID:2784
-
\??\c:\1nhhbt.exec:\1nhhbt.exe117⤵PID:2664
-
\??\c:\pvvpd.exec:\pvvpd.exe118⤵PID:2948
-
\??\c:\1rlrxfl.exec:\1rlrxfl.exe119⤵PID:2560
-
\??\c:\hbhttb.exec:\hbhttb.exe120⤵PID:2672
-
\??\c:\jvjjp.exec:\jvjjp.exe121⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-