Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe
-
Size
453KB
-
MD5
70cef72baffbc3256eeaf172b22ac290
-
SHA1
653d957c90dd47aa28cdf6af35705de5c71cc6f6
-
SHA256
90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806a
-
SHA512
893ee7f91ee9e6f8f069b95d25c0c0de8f69d80c836126a81da4f9d92ee44830a1559dafbf02d7ceb3ccd9ab6ac2877ea3024856c45c39ba8f60c57d910e6234
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-42-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1896-53-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1896-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1048-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-225-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-277-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1796-276-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/880-286-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2284-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-357-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2876-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-404-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1332-417-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1332-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-432-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/884-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-492-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3064-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-756-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3028-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-856-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-883-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2696-912-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/680-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-930-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-937-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/680-944-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2272-1039-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-1111-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2764-1130-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3040-1137-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2352-1205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2556 nnbntb.exe 1944 jjvvp.exe 1628 nntbtt.exe 2960 htnhbh.exe 1896 hbtnhh.exe 2956 hbtntb.exe 1048 vvpdd.exe 2800 nhbhtb.exe 2732 jpjpv.exe 2696 nhnttb.exe 2304 3jdjj.exe 1200 1htnnn.exe 1668 7vddd.exe 1988 fxffxxl.exe 2828 nbtnbt.exe 2996 hnnhtb.exe 2680 5dpdd.exe 1964 hbthnt.exe 2260 9pvvd.exe 2716 tntthh.exe 1868 hbhbhh.exe 340 9rxfllx.exe 708 ntthhb.exe 1920 jjpdd.exe 304 3xfffxf.exe 2232 7rxfxrx.exe 1704 fxlxxlx.exe 2964 3bhntt.exe 1796 llxlrrf.exe 880 1htbhh.exe 2284 pdvjp.exe 1588 3jjpd.exe 2572 3frlxfl.exe 264 btbnhn.exe 2100 jvpjj.exe 580 fxlrxrf.exe 2724 rlrrxxf.exe 2924 nnbhbt.exe 2916 pjdpv.exe 2936 9rffflr.exe 2984 hbntbt.exe 2876 vppvp.exe 2792 pjvdj.exe 2676 frxllxx.exe 2112 9bhhnh.exe 1092 7pdjp.exe 1108 vjpjj.exe 3008 ffrfrxf.exe 1332 5tbbhh.exe 2840 5bnntb.exe 2708 5pdvd.exe 2988 3fxxlrf.exe 2996 hththh.exe 1968 jvdvd.exe 884 ppjjp.exe 1880 xrfxxff.exe 2068 hbhbhb.exe 2380 1tntbh.exe 1888 1dppv.exe 2496 xlffllx.exe 2504 btbbnh.exe 3064 1htnhh.exe 1920 pdvvv.exe 2128 xrfxxfl.exe -
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-100-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2696-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-350-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2936-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-756-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/772-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-1205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2556 2196 90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe 30 PID 2196 wrote to memory of 2556 2196 90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe 30 PID 2196 wrote to memory of 2556 2196 90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe 30 PID 2196 wrote to memory of 2556 2196 90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe 30 PID 2556 wrote to memory of 1944 2556 nnbntb.exe 31 PID 2556 wrote to memory of 1944 2556 nnbntb.exe 31 PID 2556 wrote to memory of 1944 2556 nnbntb.exe 31 PID 2556 wrote to memory of 1944 2556 nnbntb.exe 31 PID 1944 wrote to memory of 1628 1944 jjvvp.exe 32 PID 1944 wrote to memory of 1628 1944 jjvvp.exe 32 PID 1944 wrote to memory of 1628 1944 jjvvp.exe 32 PID 1944 wrote to memory of 1628 1944 jjvvp.exe 32 PID 1628 wrote to memory of 2960 1628 nntbtt.exe 33 PID 1628 wrote to memory of 2960 1628 nntbtt.exe 33 PID 1628 wrote to memory of 2960 1628 nntbtt.exe 33 PID 1628 wrote to memory of 2960 1628 nntbtt.exe 33 PID 2960 wrote to memory of 1896 2960 htnhbh.exe 34 PID 2960 wrote to memory of 1896 2960 htnhbh.exe 34 PID 2960 wrote to memory of 1896 2960 htnhbh.exe 34 PID 2960 wrote to memory of 1896 2960 htnhbh.exe 34 PID 1896 wrote to memory of 2956 1896 hbtnhh.exe 35 PID 1896 wrote to memory of 2956 1896 hbtnhh.exe 35 PID 1896 wrote to memory of 2956 1896 hbtnhh.exe 35 PID 1896 wrote to memory of 2956 1896 hbtnhh.exe 35 PID 2956 wrote to memory of 1048 2956 hbtntb.exe 36 PID 2956 wrote to memory of 1048 2956 hbtntb.exe 36 PID 2956 wrote to memory of 1048 2956 hbtntb.exe 36 PID 2956 wrote to memory of 1048 2956 hbtntb.exe 36 PID 1048 wrote to memory of 2800 1048 vvpdd.exe 37 PID 1048 wrote to memory of 2800 1048 vvpdd.exe 37 PID 1048 wrote to memory of 2800 1048 vvpdd.exe 37 PID 1048 wrote to memory of 2800 1048 vvpdd.exe 37 PID 2800 wrote to memory of 2732 2800 nhbhtb.exe 38 PID 2800 wrote to memory of 2732 2800 nhbhtb.exe 38 PID 2800 wrote to memory of 2732 2800 nhbhtb.exe 38 PID 2800 wrote to memory of 2732 2800 nhbhtb.exe 38 PID 2732 wrote to memory of 2696 2732 jpjpv.exe 39 PID 2732 wrote to memory of 2696 2732 jpjpv.exe 39 PID 2732 wrote to memory of 2696 2732 jpjpv.exe 39 PID 2732 wrote to memory of 2696 2732 jpjpv.exe 39 PID 2696 wrote to memory of 2304 2696 nhnttb.exe 40 PID 2696 wrote to memory of 2304 2696 nhnttb.exe 40 PID 2696 wrote to memory of 2304 2696 nhnttb.exe 40 PID 2696 wrote to memory of 2304 2696 nhnttb.exe 40 PID 2304 wrote to memory of 1200 2304 3jdjj.exe 41 PID 2304 wrote to memory of 1200 2304 3jdjj.exe 41 PID 2304 wrote to memory of 1200 2304 3jdjj.exe 41 PID 2304 wrote to memory of 1200 2304 3jdjj.exe 41 PID 1200 wrote to memory of 1668 1200 1htnnn.exe 42 PID 1200 wrote to memory of 1668 1200 1htnnn.exe 42 PID 1200 wrote to memory of 1668 1200 1htnnn.exe 42 PID 1200 wrote to memory of 1668 1200 1htnnn.exe 42 PID 1668 wrote to memory of 1988 1668 7vddd.exe 43 PID 1668 wrote to memory of 1988 1668 7vddd.exe 43 PID 1668 wrote to memory of 1988 1668 7vddd.exe 43 PID 1668 wrote to memory of 1988 1668 7vddd.exe 43 PID 1988 wrote to memory of 2828 1988 fxffxxl.exe 44 PID 1988 wrote to memory of 2828 1988 fxffxxl.exe 44 PID 1988 wrote to memory of 2828 1988 fxffxxl.exe 44 PID 1988 wrote to memory of 2828 1988 fxffxxl.exe 44 PID 2828 wrote to memory of 2996 2828 nbtnbt.exe 45 PID 2828 wrote to memory of 2996 2828 nbtnbt.exe 45 PID 2828 wrote to memory of 2996 2828 nbtnbt.exe 45 PID 2828 wrote to memory of 2996 2828 nbtnbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe"C:\Users\Admin\AppData\Local\Temp\90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nnbntb.exec:\nnbntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jjvvp.exec:\jjvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nntbtt.exec:\nntbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\htnhbh.exec:\htnhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hbtnhh.exec:\hbtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\hbtntb.exec:\hbtntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\vvpdd.exec:\vvpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\nhbhtb.exec:\nhbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jpjpv.exec:\jpjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nhnttb.exec:\nhnttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3jdjj.exec:\3jdjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1htnnn.exec:\1htnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\7vddd.exec:\7vddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\fxffxxl.exec:\fxffxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\nbtnbt.exec:\nbtnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hnnhtb.exec:\hnnhtb.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5dpdd.exec:\5dpdd.exe18⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hbthnt.exec:\hbthnt.exe19⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9pvvd.exec:\9pvvd.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tntthh.exec:\tntthh.exe21⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hbhbhh.exec:\hbhbhh.exe22⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9rxfllx.exec:\9rxfllx.exe23⤵
- Executes dropped EXE
PID:340 -
\??\c:\ntthhb.exec:\ntthhb.exe24⤵
- Executes dropped EXE
PID:708 -
\??\c:\jjpdd.exec:\jjpdd.exe25⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3xfffxf.exec:\3xfffxf.exe26⤵
- Executes dropped EXE
PID:304 -
\??\c:\7rxfxrx.exec:\7rxfxrx.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fxlxxlx.exec:\fxlxxlx.exe28⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3bhntt.exec:\3bhntt.exe29⤵
- Executes dropped EXE
PID:2964 -
\??\c:\llxlrrf.exec:\llxlrrf.exe30⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1htbhh.exec:\1htbhh.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\pdvjp.exec:\pdvjp.exe32⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3jjpd.exec:\3jjpd.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\3frlxfl.exec:\3frlxfl.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\btbnhn.exec:\btbnhn.exe35⤵
- Executes dropped EXE
PID:264 -
\??\c:\jvpjj.exec:\jvpjj.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\fxlrxrf.exec:\fxlrxrf.exe37⤵
- Executes dropped EXE
PID:580 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nnbhbt.exec:\nnbhbt.exe39⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pjdpv.exec:\pjdpv.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9rffflr.exec:\9rffflr.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hbntbt.exec:\hbntbt.exe42⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vppvp.exec:\vppvp.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjvdj.exec:\pjvdj.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\frxllxx.exec:\frxllxx.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9bhhnh.exec:\9bhhnh.exe46⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7pdjp.exec:\7pdjp.exe47⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vjpjj.exec:\vjpjj.exe48⤵
- Executes dropped EXE
PID:1108 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe49⤵
- Executes dropped EXE
PID:3008 -
\??\c:\5tbbhh.exec:\5tbbhh.exe50⤵
- Executes dropped EXE
PID:1332 -
\??\c:\5bnntb.exec:\5bnntb.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5pdvd.exec:\5pdvd.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3fxxlrf.exec:\3fxxlrf.exe53⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hththh.exec:\hththh.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jvdvd.exec:\jvdvd.exe55⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ppjjp.exec:\ppjjp.exe56⤵
- Executes dropped EXE
PID:884 -
\??\c:\xrfxxff.exec:\xrfxxff.exe57⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbhbhb.exec:\hbhbhb.exe58⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1tntbh.exec:\1tntbh.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1dppv.exec:\1dppv.exe60⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xlffllx.exec:\xlffllx.exe61⤵
- Executes dropped EXE
PID:2496 -
\??\c:\btbbnh.exec:\btbbnh.exe62⤵
- Executes dropped EXE
PID:2504 -
\??\c:\1htnhh.exec:\1htnhh.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\pdvvv.exec:\pdvvv.exe64⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xrfxxfl.exec:\xrfxxfl.exe65⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rfrlxxf.exec:\rfrlxxf.exe66⤵PID:380
-
\??\c:\tnhntb.exec:\tnhntb.exe67⤵
- System Location Discovery: System Language Discovery
PID:1904 -
\??\c:\ddddp.exec:\ddddp.exe68⤵PID:992
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe69⤵PID:284
-
\??\c:\frxxflr.exec:\frxxflr.exe70⤵PID:1732
-
\??\c:\bthhtt.exec:\bthhtt.exe71⤵PID:1260
-
\??\c:\jvjpd.exec:\jvjpd.exe72⤵PID:1636
-
\??\c:\xlffxff.exec:\xlffxff.exe73⤵PID:2540
-
\??\c:\5xrxllx.exec:\5xrxllx.exe74⤵PID:2204
-
\??\c:\tnhtbh.exec:\tnhtbh.exe75⤵PID:2120
-
\??\c:\jvpjd.exec:\jvpjd.exe76⤵PID:1700
-
\??\c:\rxffllf.exec:\rxffllf.exe77⤵PID:2340
-
\??\c:\xxlrfll.exec:\xxlrfll.exe78⤵PID:264
-
\??\c:\tntbbb.exec:\tntbbb.exe79⤵PID:2768
-
\??\c:\1tnbhh.exec:\1tnbhh.exe80⤵PID:2912
-
\??\c:\ddjdd.exec:\ddjdd.exe81⤵PID:1896
-
\??\c:\1lxxxxf.exec:\1lxxxxf.exe82⤵PID:3036
-
\??\c:\rffffxf.exec:\rffffxf.exe83⤵PID:1348
-
\??\c:\bthttt.exec:\bthttt.exe84⤵PID:1396
-
\??\c:\vpdjp.exec:\vpdjp.exe85⤵PID:2464
-
\??\c:\vdvvv.exec:\vdvvv.exe86⤵PID:2876
-
\??\c:\frllxrr.exec:\frllxrr.exe87⤵PID:2116
-
\??\c:\nhthnn.exec:\nhthnn.exe88⤵PID:1716
-
\??\c:\btnbnt.exec:\btnbnt.exe89⤵PID:2296
-
\??\c:\pjddj.exec:\pjddj.exe90⤵PID:980
-
\??\c:\lfxfrrr.exec:\lfxfrrr.exe91⤵PID:692
-
\??\c:\9htttn.exec:\9htttn.exe92⤵PID:1508
-
\??\c:\nhhnhn.exec:\nhhnhn.exe93⤵PID:1776
-
\??\c:\vjvvv.exec:\vjvvv.exe94⤵PID:2192
-
\??\c:\pdjjp.exec:\pdjjp.exe95⤵PID:1992
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe96⤵PID:1744
-
\??\c:\bthbhb.exec:\bthbhb.exe97⤵PID:2996
-
\??\c:\tnhhhb.exec:\tnhhhb.exe98⤵PID:1968
-
\??\c:\9pvdj.exec:\9pvdj.exe99⤵PID:768
-
\??\c:\1rxxxff.exec:\1rxxxff.exe100⤵PID:1880
-
\??\c:\xrfffxf.exec:\xrfffxf.exe101⤵PID:1912
-
\??\c:\btbhnh.exec:\btbhnh.exe102⤵PID:2408
-
\??\c:\5pdvd.exec:\5pdvd.exe103⤵PID:2140
-
\??\c:\1jvvv.exec:\1jvvv.exe104⤵PID:3068
-
\??\c:\7xffxfl.exec:\7xffxfl.exe105⤵PID:2428
-
\??\c:\btnbbt.exec:\btnbbt.exe106⤵PID:2272
-
\??\c:\7ppjj.exec:\7ppjj.exe107⤵PID:1088
-
\??\c:\1djdv.exec:\1djdv.exe108⤵PID:3060
-
\??\c:\fxrlrrr.exec:\fxrlrrr.exe109⤵PID:2072
-
\??\c:\thnhnh.exec:\thnhnh.exe110⤵PID:1784
-
\??\c:\hbnbhh.exec:\hbnbhh.exe111⤵PID:536
-
\??\c:\7pjjj.exec:\7pjjj.exe112⤵PID:772
-
\??\c:\5jvpv.exec:\5jvpv.exe113⤵PID:1692
-
\??\c:\xrxxfxl.exec:\xrxxfxl.exe114⤵PID:2168
-
\??\c:\3thhnn.exec:\3thhnn.exe115⤵PID:880
-
\??\c:\hntntn.exec:\hntntn.exe116⤵PID:2552
-
\??\c:\dvjdj.exec:\dvjdj.exe117⤵PID:2336
-
\??\c:\9dppd.exec:\9dppd.exe118⤵PID:1740
-
\??\c:\llfxflx.exec:\llfxflx.exe119⤵PID:1748
-
\??\c:\5btbnn.exec:\5btbnn.exe120⤵PID:3028
-
\??\c:\vvjpv.exec:\vvjpv.exe121⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-