Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 18:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe
-
Size
454KB
-
MD5
8de096c759f4a80189902bf7be87c630
-
SHA1
dc2e3e422649ca7365594bd1e47f59afe9092050
-
SHA256
45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4ba
-
SHA512
82195ed80ccff663794a4a00f7861bf4bc47ea0eb89c8601376ef22f330034f5e35982e66c00e68684b4b4992693baf131851b5cf6d09bb95db45579681601ed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2112-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-97-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2428-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-118-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1884-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/112-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-241-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2248-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-281-0x0000000077410000-0x000000007752F000-memory.dmp family_blackmoon behavioral1/memory/2064-282-0x0000000077530000-0x000000007762A000-memory.dmp family_blackmoon behavioral1/memory/2704-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-429-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1140-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-535-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1732-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-653-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1804-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-822-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2340-825-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 hbthtb.exe 2812 jvdpd.exe 2420 xfxrfxl.exe 2876 hbnttb.exe 2724 dpppj.exe 2588 rffxfxf.exe 1004 btbbbh.exe 1528 nhhttn.exe 3004 3pjpp.exe 2428 3flrrrr.exe 1824 bnhnbb.exe 2292 ffflrxl.exe 1884 bnhhbh.exe 2616 dvpdj.exe 2836 frffffl.exe 584 dpvpj.exe 112 rlxrffr.exe 1568 fxxxffr.exe 2016 bthtbh.exe 2920 vpjjv.exe 2220 thtbhn.exe 1104 jjvdv.exe 972 3nbhnb.exe 2504 pjddp.exe 820 3nbhnb.exe 2332 nbnbhb.exe 2020 9frrxxf.exe 2248 5bthhb.exe 2356 lfrlrrx.exe 548 thhhtn.exe 2064 jvdvv.exe 2704 lrflrlr.exe 2812 bnbbhb.exe 2744 xrxflxl.exe 2856 lllrxfx.exe 1732 hbthhn.exe 2596 9vppv.exe 2664 xxfffff.exe 2588 xrxlrxl.exe 1652 tbtbnh.exe 2560 1jvdj.exe 2964 ddpvv.exe 2584 rlxrrrx.exe 2288 httbhb.exe 1328 jjdpj.exe 1816 pjpjp.exe 2440 rfxflrf.exe 1324 bntbbn.exe 596 bttbhb.exe 2032 5dvvd.exe 1212 9lffffl.exe 2524 9bbtnn.exe 3060 9ntnnh.exe 2204 vvppv.exe 1168 1fxrxxf.exe 2936 tnhttb.exe 3048 dvvdd.exe 2960 1lxffll.exe 2156 5flllff.exe 1140 3nntbh.exe 944 jvdpv.exe 2504 lfxxffr.exe 2320 9fxxllr.exe 3024 bhbbnt.exe -
resource yara_rule behavioral1/memory/2112-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-58-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1004-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-653-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1804-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-822-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2692 2112 45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe 31 PID 2112 wrote to memory of 2692 2112 45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe 31 PID 2112 wrote to memory of 2692 2112 45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe 31 PID 2112 wrote to memory of 2692 2112 45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe 31 PID 2692 wrote to memory of 2812 2692 hbthtb.exe 32 PID 2692 wrote to memory of 2812 2692 hbthtb.exe 32 PID 2692 wrote to memory of 2812 2692 hbthtb.exe 32 PID 2692 wrote to memory of 2812 2692 hbthtb.exe 32 PID 2812 wrote to memory of 2420 2812 jvdpd.exe 33 PID 2812 wrote to memory of 2420 2812 jvdpd.exe 33 PID 2812 wrote to memory of 2420 2812 jvdpd.exe 33 PID 2812 wrote to memory of 2420 2812 jvdpd.exe 33 PID 2420 wrote to memory of 2876 2420 xfxrfxl.exe 34 PID 2420 wrote to memory of 2876 2420 xfxrfxl.exe 34 PID 2420 wrote to memory of 2876 2420 xfxrfxl.exe 34 PID 2420 wrote to memory of 2876 2420 xfxrfxl.exe 34 PID 2876 wrote to memory of 2724 2876 hbnttb.exe 35 PID 2876 wrote to memory of 2724 2876 hbnttb.exe 35 PID 2876 wrote to memory of 2724 2876 hbnttb.exe 35 PID 2876 wrote to memory of 2724 2876 hbnttb.exe 35 PID 2724 wrote to memory of 2588 2724 dpppj.exe 36 PID 2724 wrote to memory of 2588 2724 dpppj.exe 36 PID 2724 wrote to memory of 2588 2724 dpppj.exe 36 PID 2724 wrote to memory of 2588 2724 dpppj.exe 36 PID 2588 wrote to memory of 1004 2588 rffxfxf.exe 37 PID 2588 wrote to memory of 1004 2588 rffxfxf.exe 37 PID 2588 wrote to memory of 1004 2588 rffxfxf.exe 37 PID 2588 wrote to memory of 1004 2588 rffxfxf.exe 37 PID 1004 wrote to memory of 1528 1004 btbbbh.exe 38 PID 1004 wrote to memory of 1528 1004 btbbbh.exe 38 PID 1004 wrote to memory of 1528 1004 btbbbh.exe 38 PID 1004 wrote to memory of 1528 1004 btbbbh.exe 38 PID 1528 wrote to memory of 3004 1528 nhhttn.exe 39 PID 1528 wrote to memory of 3004 1528 nhhttn.exe 39 PID 1528 wrote to memory of 3004 1528 nhhttn.exe 39 PID 1528 wrote to memory of 3004 1528 nhhttn.exe 39 PID 3004 wrote to memory of 2428 3004 3pjpp.exe 40 PID 3004 wrote to memory of 2428 3004 3pjpp.exe 40 PID 3004 wrote to memory of 2428 3004 3pjpp.exe 40 PID 3004 wrote to memory of 2428 3004 3pjpp.exe 40 PID 2428 wrote to memory of 1824 2428 3flrrrr.exe 41 PID 2428 wrote to memory of 1824 2428 3flrrrr.exe 41 PID 2428 wrote to memory of 1824 2428 3flrrrr.exe 41 PID 2428 wrote to memory of 1824 2428 3flrrrr.exe 41 PID 1824 wrote to memory of 2292 1824 bnhnbb.exe 42 PID 1824 wrote to memory of 2292 1824 bnhnbb.exe 42 PID 1824 wrote to memory of 2292 1824 bnhnbb.exe 42 PID 1824 wrote to memory of 2292 1824 bnhnbb.exe 42 PID 2292 wrote to memory of 1884 2292 ffflrxl.exe 43 PID 2292 wrote to memory of 1884 2292 ffflrxl.exe 43 PID 2292 wrote to memory of 1884 2292 ffflrxl.exe 43 PID 2292 wrote to memory of 1884 2292 ffflrxl.exe 43 PID 1884 wrote to memory of 2616 1884 bnhhbh.exe 44 PID 1884 wrote to memory of 2616 1884 bnhhbh.exe 44 PID 1884 wrote to memory of 2616 1884 bnhhbh.exe 44 PID 1884 wrote to memory of 2616 1884 bnhhbh.exe 44 PID 2616 wrote to memory of 2836 2616 dvpdj.exe 45 PID 2616 wrote to memory of 2836 2616 dvpdj.exe 45 PID 2616 wrote to memory of 2836 2616 dvpdj.exe 45 PID 2616 wrote to memory of 2836 2616 dvpdj.exe 45 PID 2836 wrote to memory of 584 2836 frffffl.exe 46 PID 2836 wrote to memory of 584 2836 frffffl.exe 46 PID 2836 wrote to memory of 584 2836 frffffl.exe 46 PID 2836 wrote to memory of 584 2836 frffffl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe"C:\Users\Admin\AppData\Local\Temp\45cba6672e91cd76cf1d38c53161e3c4a676ad115fd99f9e093a3bae1ffbe4baN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\hbthtb.exec:\hbthtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jvdpd.exec:\jvdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xfxrfxl.exec:\xfxrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\hbnttb.exec:\hbnttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\dpppj.exec:\dpppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rffxfxf.exec:\rffxfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\btbbbh.exec:\btbbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\nhhttn.exec:\nhhttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\3pjpp.exec:\3pjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\3flrrrr.exec:\3flrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\bnhnbb.exec:\bnhnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\ffflrxl.exec:\ffflrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\bnhhbh.exec:\bnhhbh.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\dvpdj.exec:\dvpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\frffffl.exec:\frffffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dpvpj.exec:\dpvpj.exe17⤵
- Executes dropped EXE
PID:584 -
\??\c:\rlxrffr.exec:\rlxrffr.exe18⤵
- Executes dropped EXE
PID:112 -
\??\c:\fxxxffr.exec:\fxxxffr.exe19⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bthtbh.exec:\bthtbh.exe20⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vpjjv.exec:\vpjjv.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\thtbhn.exec:\thtbhn.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jjvdv.exec:\jjvdv.exe23⤵
- Executes dropped EXE
PID:1104 -
\??\c:\3nbhnb.exec:\3nbhnb.exe24⤵
- Executes dropped EXE
PID:972 -
\??\c:\pjddp.exec:\pjddp.exe25⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3nbhnb.exec:\3nbhnb.exe26⤵
- Executes dropped EXE
PID:820 -
\??\c:\nbnbhb.exec:\nbnbhb.exe27⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9frrxxf.exec:\9frrxxf.exe28⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5bthhb.exec:\5bthhb.exe29⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\thhhtn.exec:\thhhtn.exe31⤵
- Executes dropped EXE
PID:548 -
\??\c:\jvdvv.exec:\jvdvv.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\frfllrl.exec:\frfllrl.exe33⤵PID:2692
-
\??\c:\lrflrlr.exec:\lrflrlr.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bnbbhb.exec:\bnbbhb.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xrxflxl.exec:\xrxflxl.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lllrxfx.exec:\lllrxfx.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hbthhn.exec:\hbthhn.exe38⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9vppv.exec:\9vppv.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xxfffff.exec:\xxfffff.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\xrxlrxl.exec:\xrxlrxl.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tbtbnh.exec:\tbtbnh.exe42⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1jvdj.exec:\1jvdj.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ddpvv.exec:\ddpvv.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\httbhb.exec:\httbhb.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jjdpj.exec:\jjdpj.exe47⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pjpjp.exec:\pjpjp.exe48⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rfxflrf.exec:\rfxflrf.exe49⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bntbbn.exec:\bntbbn.exe50⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bttbhb.exec:\bttbhb.exe51⤵
- Executes dropped EXE
PID:596 -
\??\c:\5dvvd.exec:\5dvvd.exe52⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9lffffl.exec:\9lffffl.exe53⤵
- Executes dropped EXE
PID:1212 -
\??\c:\9bbtnn.exec:\9bbtnn.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9ntnnh.exec:\9ntnnh.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vvppv.exec:\vvppv.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1fxrxxf.exec:\1fxrxxf.exe57⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tnhttb.exec:\tnhttb.exe58⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dvvdd.exec:\dvvdd.exe59⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1lxffll.exec:\1lxffll.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5flllff.exec:\5flllff.exe61⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3nntbh.exec:\3nntbh.exe62⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jvdpv.exec:\jvdpv.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\lfxxffr.exec:\lfxxffr.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9fxxllr.exec:\9fxxllr.exe65⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bhbbnt.exec:\bhbbnt.exe66⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3ppvv.exec:\3ppvv.exe67⤵PID:556
-
\??\c:\7vpjj.exec:\7vpjj.exe68⤵PID:2080
-
\??\c:\lxfxffr.exec:\lxfxffr.exe69⤵PID:2340
-
\??\c:\hbtnbb.exec:\hbtnbb.exe70⤵PID:1016
-
\??\c:\9jvvd.exec:\9jvvd.exe71⤵PID:1764
-
\??\c:\pjdjp.exec:\pjdjp.exe72⤵PID:2112
-
\??\c:\flfxllx.exec:\flfxllx.exe73⤵PID:2792
-
\??\c:\5nhhnn.exec:\5nhhnn.exe74⤵PID:1592
-
\??\c:\3dvdj.exec:\3dvdj.exe75⤵PID:2668
-
\??\c:\vjddd.exec:\vjddd.exe76⤵PID:2812
-
\??\c:\ffxflrl.exec:\ffxflrl.exe77⤵PID:2572
-
\??\c:\bbttnn.exec:\bbttnn.exe78⤵PID:2580
-
\??\c:\5hhbbb.exec:\5hhbbb.exe79⤵PID:1732
-
\??\c:\jjvvd.exec:\jjvvd.exe80⤵PID:2992
-
\??\c:\rlfrrrf.exec:\rlfrrrf.exe81⤵PID:3000
-
\??\c:\3hhnhn.exec:\3hhnhn.exe82⤵PID:2012
-
\??\c:\9ttthb.exec:\9ttthb.exe83⤵PID:3008
-
\??\c:\pjjjv.exec:\pjjjv.exe84⤵PID:2240
-
\??\c:\lflxflx.exec:\lflxflx.exe85⤵PID:1080
-
\??\c:\nbttbb.exec:\nbttbb.exe86⤵PID:1172
-
\??\c:\hbttht.exec:\hbttht.exe87⤵PID:308
-
\??\c:\ddvdp.exec:\ddvdp.exe88⤵PID:1564
-
\??\c:\xlfxflf.exec:\xlfxflf.exe89⤵PID:1884
-
\??\c:\9hbtbb.exec:\9hbtbb.exe90⤵PID:1356
-
\??\c:\hhbnbh.exec:\hhbnbh.exe91⤵PID:2868
-
\??\c:\dddpd.exec:\dddpd.exe92⤵PID:2860
-
\??\c:\5fflrxf.exec:\5fflrxf.exe93⤵PID:1928
-
\??\c:\bbtbnt.exec:\bbtbnt.exe94⤵PID:2756
-
\??\c:\hbtnbn.exec:\hbtnbn.exe95⤵PID:1828
-
\??\c:\9vvvd.exec:\9vvvd.exe96⤵PID:2044
-
\??\c:\lfxxlfx.exec:\lfxxlfx.exe97⤵PID:2096
-
\??\c:\fflrxxr.exec:\fflrxxr.exe98⤵PID:1804
-
\??\c:\9bhnbb.exec:\9bhnbb.exe99⤵PID:2164
-
\??\c:\vvpvd.exec:\vvpvd.exe100⤵PID:3048
-
\??\c:\pdvdp.exec:\pdvdp.exe101⤵PID:2960
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe102⤵PID:2228
-
\??\c:\xrlfrxx.exec:\xrlfrxx.exe103⤵PID:236
-
\??\c:\9ntnnn.exec:\9ntnnn.exe104⤵PID:2500
-
\??\c:\jvdjp.exec:\jvdjp.exe105⤵PID:2284
-
\??\c:\rlflrxx.exec:\rlflrxx.exe106⤵PID:280
-
\??\c:\rlffrrx.exec:\rlffrrx.exe107⤵PID:1380
-
\??\c:\htbbhb.exec:\htbbhb.exe108⤵PID:2084
-
\??\c:\jjdpp.exec:\jjdpp.exe109⤵PID:904
-
\??\c:\frlrxlx.exec:\frlrxlx.exe110⤵PID:2340
-
\??\c:\9lxlxxl.exec:\9lxlxxl.exe111⤵PID:1016
-
\??\c:\bnbhnt.exec:\bnbhnt.exe112⤵PID:2064
-
\??\c:\9dvvp.exec:\9dvvp.exe113⤵PID:2692
-
\??\c:\jjppv.exec:\jjppv.exe114⤵PID:2908
-
\??\c:\lxrrflx.exec:\lxrrflx.exe115⤵PID:1588
-
\??\c:\tnttbb.exec:\tnttbb.exe116⤵PID:2668
-
\??\c:\7nhhth.exec:\7nhhth.exe117⤵PID:2768
-
\??\c:\vppdp.exec:\vppdp.exe118⤵PID:2748
-
\??\c:\7rxxxfr.exec:\7rxxxfr.exe119⤵PID:2540
-
\??\c:\nhbbbn.exec:\nhbbbn.exe120⤵PID:2988
-
\??\c:\nhhhhn.exec:\nhhhhn.exe121⤵PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-