Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe
-
Size
454KB
-
MD5
d7958561ed405c77bdfa3c89432062dd
-
SHA1
60e8d6f319290bc6a2d65ad29c6e88b73ada9f18
-
SHA256
9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2
-
SHA512
70b4016c52cb7ce2c714fac56d1784ba8e902bb95bea6a814cccd1d9d56faba5d094acb9ac89a14a58c80688fee90497c5638da74ecef8d728ff485aac35b9e6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2884-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-536-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2336-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-697-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1528-813-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2012-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 xrxxxxl.exe 3064 bhhtnh.exe 3020 5lfxllx.exe 2700 fxlffrl.exe 2636 hhhhhb.exe 2320 3lfrrrx.exe 320 nhnhnn.exe 1480 jjpjp.exe 2504 nhnhhh.exe 2508 ppvvp.exe 2096 nthhbb.exe 2932 dpddd.exe 3028 rlxrrrf.exe 2960 tnbhnn.exe 876 7frrrrf.exe 2252 thttnn.exe 2016 5jpjj.exe 2060 bthnbb.exe 2232 7dvdd.exe 2324 5lxxffl.exe 1076 tnntbb.exe 1956 rlxxlff.exe 2552 9hhhhh.exe 1912 thbhnn.exe 1804 9lxxllf.exe 1668 thtttb.exe 852 3dpjj.exe 1292 7xllxxf.exe 1548 1vppv.exe 1124 1xfxxff.exe 1092 htbbtn.exe 892 jvdvd.exe 2840 bnbhhn.exe 1700 nhtttt.exe 2740 dvjjd.exe 3064 9fllxxf.exe 2732 7lrxrfx.exe 2592 nbhnnn.exe 2660 vvjpv.exe 2892 dvjdd.exe 1244 rlrlrll.exe 884 3htbhh.exe 2924 vjpjp.exe 1888 vdvpj.exe 2084 lxxrfxx.exe 2996 1bhhhh.exe 2540 5hbnnt.exe 3036 vjvvj.exe 2984 9xfffxx.exe 2952 7ttbbb.exe 3028 tnbnnn.exe 2944 vpddd.exe 2960 lfrxxrx.exe 1296 rfrlrrr.exe 2264 7hnhnh.exe 2468 3jvjp.exe 3060 frffxxx.exe 1080 thnthh.exe 2172 bhnntb.exe 768 7jvvp.exe 844 3xfffrl.exe 1900 bnthnh.exe 1568 nbbbht.exe 1352 1jpjp.exe -
resource yara_rule behavioral1/memory/2884-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-574-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2532-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-891-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2740 2884 9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe 30 PID 2884 wrote to memory of 2740 2884 9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe 30 PID 2884 wrote to memory of 2740 2884 9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe 30 PID 2884 wrote to memory of 2740 2884 9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe 30 PID 2740 wrote to memory of 3064 2740 xrxxxxl.exe 31 PID 2740 wrote to memory of 3064 2740 xrxxxxl.exe 31 PID 2740 wrote to memory of 3064 2740 xrxxxxl.exe 31 PID 2740 wrote to memory of 3064 2740 xrxxxxl.exe 31 PID 3064 wrote to memory of 3020 3064 bhhtnh.exe 32 PID 3064 wrote to memory of 3020 3064 bhhtnh.exe 32 PID 3064 wrote to memory of 3020 3064 bhhtnh.exe 32 PID 3064 wrote to memory of 3020 3064 bhhtnh.exe 32 PID 3020 wrote to memory of 2700 3020 5lfxllx.exe 33 PID 3020 wrote to memory of 2700 3020 5lfxllx.exe 33 PID 3020 wrote to memory of 2700 3020 5lfxllx.exe 33 PID 3020 wrote to memory of 2700 3020 5lfxllx.exe 33 PID 2700 wrote to memory of 2636 2700 fxlffrl.exe 34 PID 2700 wrote to memory of 2636 2700 fxlffrl.exe 34 PID 2700 wrote to memory of 2636 2700 fxlffrl.exe 34 PID 2700 wrote to memory of 2636 2700 fxlffrl.exe 34 PID 2636 wrote to memory of 2320 2636 hhhhhb.exe 35 PID 2636 wrote to memory of 2320 2636 hhhhhb.exe 35 PID 2636 wrote to memory of 2320 2636 hhhhhb.exe 35 PID 2636 wrote to memory of 2320 2636 hhhhhb.exe 35 PID 2320 wrote to memory of 320 2320 3lfrrrx.exe 36 PID 2320 wrote to memory of 320 2320 3lfrrrx.exe 36 PID 2320 wrote to memory of 320 2320 3lfrrrx.exe 36 PID 2320 wrote to memory of 320 2320 3lfrrrx.exe 36 PID 320 wrote to memory of 1480 320 nhnhnn.exe 37 PID 320 wrote to memory of 1480 320 nhnhnn.exe 37 PID 320 wrote to memory of 1480 320 nhnhnn.exe 37 PID 320 wrote to memory of 1480 320 nhnhnn.exe 37 PID 1480 wrote to memory of 2504 1480 jjpjp.exe 38 PID 1480 wrote to memory of 2504 1480 jjpjp.exe 38 PID 1480 wrote to memory of 2504 1480 jjpjp.exe 38 PID 1480 wrote to memory of 2504 1480 jjpjp.exe 38 PID 2504 wrote to memory of 2508 2504 nhnhhh.exe 39 PID 2504 wrote to memory of 2508 2504 nhnhhh.exe 39 PID 2504 wrote to memory of 2508 2504 nhnhhh.exe 39 PID 2504 wrote to memory of 2508 2504 nhnhhh.exe 39 PID 2508 wrote to memory of 2096 2508 ppvvp.exe 40 PID 2508 wrote to memory of 2096 2508 ppvvp.exe 40 PID 2508 wrote to memory of 2096 2508 ppvvp.exe 40 PID 2508 wrote to memory of 2096 2508 ppvvp.exe 40 PID 2096 wrote to memory of 2932 2096 nthhbb.exe 41 PID 2096 wrote to memory of 2932 2096 nthhbb.exe 41 PID 2096 wrote to memory of 2932 2096 nthhbb.exe 41 PID 2096 wrote to memory of 2932 2096 nthhbb.exe 41 PID 2932 wrote to memory of 3028 2932 dpddd.exe 42 PID 2932 wrote to memory of 3028 2932 dpddd.exe 42 PID 2932 wrote to memory of 3028 2932 dpddd.exe 42 PID 2932 wrote to memory of 3028 2932 dpddd.exe 42 PID 3028 wrote to memory of 2960 3028 rlxrrrf.exe 43 PID 3028 wrote to memory of 2960 3028 rlxrrrf.exe 43 PID 3028 wrote to memory of 2960 3028 rlxrrrf.exe 43 PID 3028 wrote to memory of 2960 3028 rlxrrrf.exe 43 PID 2960 wrote to memory of 876 2960 tnbhnn.exe 44 PID 2960 wrote to memory of 876 2960 tnbhnn.exe 44 PID 2960 wrote to memory of 876 2960 tnbhnn.exe 44 PID 2960 wrote to memory of 876 2960 tnbhnn.exe 44 PID 876 wrote to memory of 2252 876 7frrrrf.exe 45 PID 876 wrote to memory of 2252 876 7frrrrf.exe 45 PID 876 wrote to memory of 2252 876 7frrrrf.exe 45 PID 876 wrote to memory of 2252 876 7frrrrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe"C:\Users\Admin\AppData\Local\Temp\9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xrxxxxl.exec:\xrxxxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bhhtnh.exec:\bhhtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\5lfxllx.exec:\5lfxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\fxlffrl.exec:\fxlffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hhhhhb.exec:\hhhhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3lfrrrx.exec:\3lfrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\nhnhnn.exec:\nhnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\jjpjp.exec:\jjpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\nhnhhh.exec:\nhnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\ppvvp.exec:\ppvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\nthhbb.exec:\nthhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\dpddd.exec:\dpddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\tnbhnn.exec:\tnbhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\7frrrrf.exec:\7frrrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\thttnn.exec:\thttnn.exe17⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5jpjj.exec:\5jpjj.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bthnbb.exec:\bthnbb.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\7dvdd.exec:\7dvdd.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\5lxxffl.exec:\5lxxffl.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\tnntbb.exec:\tnntbb.exe22⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rlxxlff.exec:\rlxxlff.exe23⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9hhhhh.exec:\9hhhhh.exe24⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thbhnn.exec:\thbhnn.exe25⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9lxxllf.exec:\9lxxllf.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\thtttb.exec:\thtttb.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\3dpjj.exec:\3dpjj.exe28⤵
- Executes dropped EXE
PID:852 -
\??\c:\7xllxxf.exec:\7xllxxf.exe29⤵
- Executes dropped EXE
PID:1292 -
\??\c:\1vppv.exec:\1vppv.exe30⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1xfxxff.exec:\1xfxxff.exe31⤵
- Executes dropped EXE
PID:1124 -
\??\c:\htbbtn.exec:\htbbtn.exe32⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jvdvd.exec:\jvdvd.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\bnbhhn.exec:\bnbhhn.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhtttt.exec:\nhtttt.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvjjd.exec:\dvjjd.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9fllxxf.exec:\9fllxxf.exe37⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7lrxrfx.exec:\7lrxrfx.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nbhnnn.exec:\nbhnnn.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vvjpv.exec:\vvjpv.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dvjdd.exec:\dvjdd.exe41⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlrlrll.exec:\rlrlrll.exe42⤵
- Executes dropped EXE
PID:1244 -
\??\c:\3htbhh.exec:\3htbhh.exe43⤵
- Executes dropped EXE
PID:884 -
\??\c:\vjpjp.exec:\vjpjp.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vdvpj.exec:\vdvpj.exe45⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lxxrfxx.exec:\lxxrfxx.exe46⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1bhhhh.exec:\1bhhhh.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5hbnnt.exec:\5hbnnt.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjvvj.exec:\vjvvj.exe49⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9xfffxx.exec:\9xfffxx.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7ttbbb.exec:\7ttbbb.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tnbnnn.exec:\tnbnnn.exe52⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vpddd.exec:\vpddd.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe55⤵
- Executes dropped EXE
PID:1296 -
\??\c:\7hnhnh.exec:\7hnhnh.exe56⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3jvjp.exec:\3jvjp.exe57⤵
- Executes dropped EXE
PID:2468 -
\??\c:\frffxxx.exec:\frffxxx.exe58⤵
- Executes dropped EXE
PID:3060 -
\??\c:\thnthh.exec:\thnthh.exe59⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bhnntb.exec:\bhnntb.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7jvvp.exec:\7jvvp.exe61⤵
- Executes dropped EXE
PID:768 -
\??\c:\3xfffrl.exec:\3xfffrl.exe62⤵
- Executes dropped EXE
PID:844 -
\??\c:\bnthnh.exec:\bnthnh.exe63⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nbbbht.exec:\nbbbht.exe64⤵
- Executes dropped EXE
PID:1568 -
\??\c:\1jpjp.exec:\1jpjp.exe65⤵
- Executes dropped EXE
PID:1352 -
\??\c:\frrlrfl.exec:\frrlrfl.exe66⤵PID:1524
-
\??\c:\btbbtt.exec:\btbbtt.exe67⤵PID:1536
-
\??\c:\9tbhnh.exec:\9tbhnh.exe68⤵PID:1716
-
\??\c:\vdjdd.exec:\vdjdd.exe69⤵PID:912
-
\??\c:\9xrlrlr.exec:\9xrlrlr.exe70⤵PID:924
-
\??\c:\nhbhhh.exec:\nhbhhh.exe71⤵PID:2428
-
\??\c:\dpvpj.exec:\dpvpj.exe72⤵PID:1616
-
\??\c:\dvjdv.exec:\dvjdv.exe73⤵PID:996
-
\??\c:\xfllfxl.exec:\xfllfxl.exe74⤵PID:1664
-
\??\c:\3nnnhh.exec:\3nnnhh.exe75⤵PID:1964
-
\??\c:\3hhbth.exec:\3hhbth.exe76⤵PID:1776
-
\??\c:\pdpjd.exec:\pdpjd.exe77⤵PID:1592
-
\??\c:\frfxrrl.exec:\frfxrrl.exe78⤵PID:1588
-
\??\c:\7tbtth.exec:\7tbtth.exe79⤵PID:2336
-
\??\c:\thnhbt.exec:\thnhbt.exe80⤵PID:2132
-
\??\c:\dpdvd.exec:\dpdvd.exe81⤵PID:2644
-
\??\c:\7xlrrrl.exec:\7xlrrrl.exe82⤵PID:2700
-
\??\c:\nhbbtt.exec:\nhbbtt.exe83⤵PID:2756
-
\??\c:\bthhhb.exec:\bthhhb.exe84⤵PID:2256
-
\??\c:\jjdpv.exec:\jjdpv.exe85⤵PID:1868
-
\??\c:\rrflrrr.exec:\rrflrrr.exe86⤵PID:560
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe87⤵PID:476
-
\??\c:\bthhtb.exec:\bthhtb.exe88⤵PID:2980
-
\??\c:\vvjdd.exec:\vvjdd.exe89⤵PID:796
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe90⤵PID:2532
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe91⤵PID:1228
-
\??\c:\nhhhnh.exec:\nhhhnh.exe92⤵PID:2964
-
\??\c:\1nbbtb.exec:\1nbbtb.exe93⤵PID:2976
-
\??\c:\pdvvd.exec:\pdvvd.exe94⤵PID:3008
-
\??\c:\xxxrxfl.exec:\xxxrxfl.exe95⤵PID:2952
-
\??\c:\hbbnhn.exec:\hbbnhn.exe96⤵PID:2092
-
\??\c:\jdpvd.exec:\jdpvd.exe97⤵PID:2684
-
\??\c:\vpdjv.exec:\vpdjv.exe98⤵PID:2136
-
\??\c:\1frlfff.exec:\1frlfff.exe99⤵PID:1288
-
\??\c:\tnbhnn.exec:\tnbhnn.exe100⤵PID:2016
-
\??\c:\nnhhnn.exec:\nnhhnn.exe101⤵PID:1628
-
\??\c:\vpdjv.exec:\vpdjv.exe102⤵PID:1988
-
\??\c:\ddddp.exec:\ddddp.exe103⤵PID:1108
-
\??\c:\1fflrrx.exec:\1fflrrx.exe104⤵PID:2344
-
\??\c:\btnbbb.exec:\btnbbb.exe105⤵PID:1056
-
\??\c:\vpdjp.exec:\vpdjp.exe106⤵PID:1900
-
\??\c:\pddvd.exec:\pddvd.exe107⤵PID:1568
-
\??\c:\llflfxl.exec:\llflfxl.exe108⤵PID:1812
-
\??\c:\tnbbhh.exec:\tnbbhh.exe109⤵PID:1524
-
\??\c:\ppdjj.exec:\ppdjj.exe110⤵PID:2296
-
\??\c:\3llllrx.exec:\3llllrx.exe111⤵PID:1528
-
\??\c:\frxxfff.exec:\frxxfff.exe112⤵PID:2012
-
\??\c:\thnhnn.exec:\thnhnn.exe113⤵PID:1784
-
\??\c:\dpdjj.exec:\dpdjj.exe114⤵PID:2800
-
\??\c:\vvjjp.exec:\vvjjp.exe115⤵PID:2100
-
\??\c:\frfxxxf.exec:\frfxxxf.exe116⤵PID:1644
-
\??\c:\btntbh.exec:\btntbh.exe117⤵PID:1664
-
\??\c:\9thbbb.exec:\9thbbb.exe118⤵PID:1964
-
\??\c:\pjvpv.exec:\pjvpv.exe119⤵PID:2848
-
\??\c:\frflrlr.exec:\frflrlr.exe120⤵PID:1896
-
\??\c:\nhhhbh.exec:\nhhhbh.exe121⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-