Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe
-
Size
453KB
-
MD5
c8c7c21816054c0c009066b168c4c969
-
SHA1
40fa896b2235fdb5121ddf8ea6772c6ef4bea805
-
SHA256
ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5
-
SHA512
9af638a8b359cfd47296e19c490b5015909818425b988ca36f3a684c980051f31daeccf03373a52d7892622ad84fda8bba7bce47d94ad80f01c2ca29048413a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2980-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/736-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-457-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2248-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-523-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1604-593-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2636-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-648-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1796-728-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/348-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-863-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-932-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 nhbnbb.exe 2716 3lffrlr.exe 2612 9dvdp.exe 2780 xrxfflr.exe 2748 7pjpd.exe 2508 rxxfrfx.exe 2056 3frxfff.exe 2388 5dppp.exe 2684 1htbth.exe 2832 pppvd.exe 2956 ttnbnb.exe 1652 5vpvd.exe 1728 hbbbnt.exe 2476 lfxfxxr.exe 2568 bthnhh.exe 2188 vjdjp.exe 1808 ttnthh.exe 1944 vdvjp.exe 3028 nnhbtt.exe 2900 7jvdj.exe 2080 fxlllrx.exe 932 3bhnhn.exe 2692 dvjdj.exe 1920 lxflrll.exe 736 nnhbtt.exe 752 5hbthn.exe 2044 dvvpj.exe 1372 nnhtnt.exe 1748 jdppv.exe 1188 tnbnht.exe 2996 fffxrxr.exe 3064 1hbnbh.exe 2708 rrflflr.exe 1804 lxxxxxf.exe 2636 btbnth.exe 2624 vjddp.exe 2608 xrrxllx.exe 2780 hhbhtb.exe 2680 7ntntt.exe 808 9dpdj.exe 3016 1ffrxfx.exe 1744 nhtbnt.exe 2804 bttbnt.exe 2828 pjdjp.exe 2856 xxxlflf.exe 1532 bbnnhn.exe 1060 tnthnt.exe 1088 pjjvp.exe 2012 1fxfrxl.exe 772 xxxfrxr.exe 1684 hbhbbb.exe 2260 pjddj.exe 1800 3frlrrx.exe 1764 3fxrxfl.exe 2196 bbtbnt.exe 3056 5vpdj.exe 2248 rllrlrf.exe 2140 fxrxfxl.exe 2904 tbnntt.exe 2080 ppddp.exe 1480 xrllrlx.exe 2692 ffffrlf.exe 1852 7hnbtb.exe 2892 ppppd.exe -
resource yara_rule behavioral1/memory/2980-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-172-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1944-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/736-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-247-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1188-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-523-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1780-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-791-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/348-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-863-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2508-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-901-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2192 2980 ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe 30 PID 2980 wrote to memory of 2192 2980 ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe 30 PID 2980 wrote to memory of 2192 2980 ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe 30 PID 2980 wrote to memory of 2192 2980 ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe 30 PID 2192 wrote to memory of 2716 2192 nhbnbb.exe 31 PID 2192 wrote to memory of 2716 2192 nhbnbb.exe 31 PID 2192 wrote to memory of 2716 2192 nhbnbb.exe 31 PID 2192 wrote to memory of 2716 2192 nhbnbb.exe 31 PID 2716 wrote to memory of 2612 2716 3lffrlr.exe 32 PID 2716 wrote to memory of 2612 2716 3lffrlr.exe 32 PID 2716 wrote to memory of 2612 2716 3lffrlr.exe 32 PID 2716 wrote to memory of 2612 2716 3lffrlr.exe 32 PID 2612 wrote to memory of 2780 2612 9dvdp.exe 33 PID 2612 wrote to memory of 2780 2612 9dvdp.exe 33 PID 2612 wrote to memory of 2780 2612 9dvdp.exe 33 PID 2612 wrote to memory of 2780 2612 9dvdp.exe 33 PID 2780 wrote to memory of 2748 2780 xrxfflr.exe 34 PID 2780 wrote to memory of 2748 2780 xrxfflr.exe 34 PID 2780 wrote to memory of 2748 2780 xrxfflr.exe 34 PID 2780 wrote to memory of 2748 2780 xrxfflr.exe 34 PID 2748 wrote to memory of 2508 2748 7pjpd.exe 35 PID 2748 wrote to memory of 2508 2748 7pjpd.exe 35 PID 2748 wrote to memory of 2508 2748 7pjpd.exe 35 PID 2748 wrote to memory of 2508 2748 7pjpd.exe 35 PID 2508 wrote to memory of 2056 2508 rxxfrfx.exe 36 PID 2508 wrote to memory of 2056 2508 rxxfrfx.exe 36 PID 2508 wrote to memory of 2056 2508 rxxfrfx.exe 36 PID 2508 wrote to memory of 2056 2508 rxxfrfx.exe 36 PID 2056 wrote to memory of 2388 2056 3frxfff.exe 37 PID 2056 wrote to memory of 2388 2056 3frxfff.exe 37 PID 2056 wrote to memory of 2388 2056 3frxfff.exe 37 PID 2056 wrote to memory of 2388 2056 3frxfff.exe 37 PID 2388 wrote to memory of 2684 2388 5dppp.exe 38 PID 2388 wrote to memory of 2684 2388 5dppp.exe 38 PID 2388 wrote to memory of 2684 2388 5dppp.exe 38 PID 2388 wrote to memory of 2684 2388 5dppp.exe 38 PID 2684 wrote to memory of 2832 2684 1htbth.exe 39 PID 2684 wrote to memory of 2832 2684 1htbth.exe 39 PID 2684 wrote to memory of 2832 2684 1htbth.exe 39 PID 2684 wrote to memory of 2832 2684 1htbth.exe 39 PID 2832 wrote to memory of 2956 2832 pppvd.exe 40 PID 2832 wrote to memory of 2956 2832 pppvd.exe 40 PID 2832 wrote to memory of 2956 2832 pppvd.exe 40 PID 2832 wrote to memory of 2956 2832 pppvd.exe 40 PID 2956 wrote to memory of 1652 2956 ttnbnb.exe 41 PID 2956 wrote to memory of 1652 2956 ttnbnb.exe 41 PID 2956 wrote to memory of 1652 2956 ttnbnb.exe 41 PID 2956 wrote to memory of 1652 2956 ttnbnb.exe 41 PID 1652 wrote to memory of 1728 1652 5vpvd.exe 42 PID 1652 wrote to memory of 1728 1652 5vpvd.exe 42 PID 1652 wrote to memory of 1728 1652 5vpvd.exe 42 PID 1652 wrote to memory of 1728 1652 5vpvd.exe 42 PID 1728 wrote to memory of 2476 1728 hbbbnt.exe 43 PID 1728 wrote to memory of 2476 1728 hbbbnt.exe 43 PID 1728 wrote to memory of 2476 1728 hbbbnt.exe 43 PID 1728 wrote to memory of 2476 1728 hbbbnt.exe 43 PID 2476 wrote to memory of 2568 2476 lfxfxxr.exe 44 PID 2476 wrote to memory of 2568 2476 lfxfxxr.exe 44 PID 2476 wrote to memory of 2568 2476 lfxfxxr.exe 44 PID 2476 wrote to memory of 2568 2476 lfxfxxr.exe 44 PID 2568 wrote to memory of 2188 2568 bthnhh.exe 45 PID 2568 wrote to memory of 2188 2568 bthnhh.exe 45 PID 2568 wrote to memory of 2188 2568 bthnhh.exe 45 PID 2568 wrote to memory of 2188 2568 bthnhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe"C:\Users\Admin\AppData\Local\Temp\ad81641efd6057cbb3117f2bcb0a457789444f4313a17aa1a1b371405cf4b8a5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nhbnbb.exec:\nhbnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\3lffrlr.exec:\3lffrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\9dvdp.exec:\9dvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xrxfflr.exec:\xrxfflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7pjpd.exec:\7pjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rxxfrfx.exec:\rxxfrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\3frxfff.exec:\3frxfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5dppp.exec:\5dppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\1htbth.exec:\1htbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pppvd.exec:\pppvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ttnbnb.exec:\ttnbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\5vpvd.exec:\5vpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\hbbbnt.exec:\hbbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\lfxfxxr.exec:\lfxfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bthnhh.exec:\bthnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vjdjp.exec:\vjdjp.exe17⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ttnthh.exec:\ttnthh.exe18⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vdvjp.exec:\vdvjp.exe19⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nnhbtt.exec:\nnhbtt.exe20⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7jvdj.exec:\7jvdj.exe21⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fxlllrx.exec:\fxlllrx.exe22⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3bhnhn.exec:\3bhnhn.exe23⤵
- Executes dropped EXE
PID:932 -
\??\c:\dvjdj.exec:\dvjdj.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxflrll.exec:\lxflrll.exe25⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nnhbtt.exec:\nnhbtt.exe26⤵
- Executes dropped EXE
PID:736 -
\??\c:\5hbthn.exec:\5hbthn.exe27⤵
- Executes dropped EXE
PID:752 -
\??\c:\dvvpj.exec:\dvvpj.exe28⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nnhtnt.exec:\nnhtnt.exe29⤵
- Executes dropped EXE
PID:1372 -
\??\c:\jdppv.exec:\jdppv.exe30⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tnbnht.exec:\tnbnht.exe31⤵
- Executes dropped EXE
PID:1188 -
\??\c:\fffxrxr.exec:\fffxrxr.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1hbnbh.exec:\1hbnbh.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rrflflr.exec:\rrflflr.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe35⤵
- Executes dropped EXE
PID:1804 -
\??\c:\btbnth.exec:\btbnth.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vjddp.exec:\vjddp.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xrrxllx.exec:\xrrxllx.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hhbhtb.exec:\hhbhtb.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7ntntt.exec:\7ntntt.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9dpdj.exec:\9dpdj.exe41⤵
- Executes dropped EXE
PID:808 -
\??\c:\1ffrxfx.exec:\1ffrxfx.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nhtbnt.exec:\nhtbnt.exe43⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bttbnt.exec:\bttbnt.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pjdjp.exec:\pjdjp.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xxxlflf.exec:\xxxlflf.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bbnnhn.exec:\bbnnhn.exe47⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tnthnt.exec:\tnthnt.exe48⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pjjvp.exec:\pjjvp.exe49⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1fxfrxl.exec:\1fxfrxl.exe50⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe51⤵
- Executes dropped EXE
PID:772 -
\??\c:\hbhbbb.exec:\hbhbbb.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pjddj.exec:\pjddj.exe53⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3frlrrx.exec:\3frlrrx.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3fxrxfl.exec:\3fxrxfl.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bbtbnt.exec:\bbtbnt.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5vpdj.exec:\5vpdj.exe57⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rllrlrf.exec:\rllrlrf.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxrxfxl.exec:\fxrxfxl.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tbnntt.exec:\tbnntt.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ppddp.exec:\ppddp.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrllrlx.exec:\xrllrlx.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ffffrlf.exec:\ffffrlf.exe63⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7hnbtb.exec:\7hnbtb.exe64⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ppppd.exec:\ppppd.exe65⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3lfxffl.exec:\3lfxffl.exe66⤵PID:2276
-
\??\c:\rllrlrx.exec:\rllrlrx.exe67⤵PID:1548
-
\??\c:\htbhnh.exec:\htbhnh.exe68⤵PID:2436
-
\??\c:\pvjdj.exec:\pvjdj.exe69⤵PID:2032
-
\??\c:\xlffxlx.exec:\xlffxlx.exe70⤵PID:612
-
\??\c:\llflflx.exec:\llflflx.exe71⤵PID:2468
-
\??\c:\btnnht.exec:\btnnht.exe72⤵PID:348
-
\??\c:\jjdjj.exec:\jjdjj.exe73⤵PID:2600
-
\??\c:\7pddv.exec:\7pddv.exe74⤵PID:1780
-
\??\c:\fffrfxf.exec:\fffrfxf.exe75⤵PID:1596
-
\??\c:\tntttb.exec:\tntttb.exe76⤵PID:2732
-
\??\c:\dppvd.exec:\dppvd.exe77⤵PID:1604
-
\??\c:\3vpjp.exec:\3vpjp.exe78⤵PID:2636
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe79⤵PID:2992
-
\??\c:\1thnbh.exec:\1thnbh.exe80⤵PID:2776
-
\??\c:\dvdjd.exec:\dvdjd.exe81⤵PID:2552
-
\??\c:\lrllxfr.exec:\lrllxfr.exe82⤵PID:2572
-
\??\c:\rflfxxf.exec:\rflfxxf.exe83⤵PID:704
-
\??\c:\nnbnbh.exec:\nnbnbh.exe84⤵PID:1232
-
\??\c:\vjvvj.exec:\vjvvj.exe85⤵PID:2820
-
\??\c:\vppvd.exec:\vppvd.exe86⤵
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\fxrflxf.exec:\fxrflxf.exe87⤵PID:2868
-
\??\c:\hbtthh.exec:\hbtthh.exe88⤵PID:2004
-
\??\c:\vvjpd.exec:\vvjpd.exe89⤵PID:1656
-
\??\c:\5xrxflx.exec:\5xrxflx.exe90⤵PID:1964
-
\??\c:\fflfrrx.exec:\fflfrrx.exe91⤵PID:1728
-
\??\c:\9nbbnn.exec:\9nbbnn.exe92⤵PID:676
-
\??\c:\jdpdj.exec:\jdpdj.exe93⤵PID:1412
-
\??\c:\9jvjj.exec:\9jvjj.exe94⤵PID:1416
-
\??\c:\xrllrxr.exec:\xrllrxr.exe95⤵PID:2492
-
\??\c:\5tbbhh.exec:\5tbbhh.exe96⤵PID:2128
-
\??\c:\hbnbnn.exec:\hbnbnn.exe97⤵PID:1796
-
\??\c:\jpjpp.exec:\jpjpp.exe98⤵PID:1312
-
\??\c:\flfflrx.exec:\flfflrx.exe99⤵
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\bhhtnt.exec:\bhhtnt.exe100⤵PID:2236
-
\??\c:\dvjjp.exec:\dvjjp.exe101⤵PID:2200
-
\??\c:\pdvvd.exec:\pdvvd.exe102⤵PID:464
-
\??\c:\xflrffx.exec:\xflrffx.exe103⤵PID:1996
-
\??\c:\7thbbt.exec:\7thbbt.exe104⤵PID:2204
-
\??\c:\nbhhnn.exec:\nbhhnn.exe105⤵PID:2692
-
\??\c:\vvpdj.exec:\vvpdj.exe106⤵PID:1524
-
\??\c:\5xllxfr.exec:\5xllxfr.exe107⤵PID:2432
-
\??\c:\3flfrlx.exec:\3flfrlx.exe108⤵PID:1028
-
\??\c:\hbnnhn.exec:\hbnnhn.exe109⤵PID:2268
-
\??\c:\dvjjv.exec:\dvjjv.exe110⤵PID:2420
-
\??\c:\jjvdp.exec:\jjvdp.exe111⤵PID:2308
-
\??\c:\rrlrrxl.exec:\rrlrrxl.exe112⤵PID:2924
-
\??\c:\nnhtht.exec:\nnhtht.exe113⤵PID:1512
-
\??\c:\dddvp.exec:\dddvp.exe114⤵PID:348
-
\??\c:\xrflxfl.exec:\xrflxfl.exe115⤵PID:2600
-
\??\c:\5xfllxr.exec:\5xfllxr.exe116⤵PID:1780
-
\??\c:\7hbtnt.exec:\7hbtnt.exe117⤵
- System Location Discovery: System Language Discovery
PID:1596 -
\??\c:\vvvdd.exec:\vvvdd.exe118⤵PID:2640
-
\??\c:\xxxfrfx.exec:\xxxfrfx.exe119⤵PID:2632
-
\??\c:\hhtbhn.exec:\hhtbhn.exe120⤵PID:2624
-
\??\c:\frxrrlf.exec:\frxrrlf.exe121⤵PID:2764
-
\??\c:\5fllllx.exec:\5fllllx.exe122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-