Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe
-
Size
453KB
-
MD5
c967468cfd5fff190a6403e77fd7fa20
-
SHA1
eff7cd140a0e66ccfe3cd264f869af2319130757
-
SHA256
1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9
-
SHA512
e21cdbddf22c57ea56374a277bea313f0b1d25ddc0f7356ae107359dc97bbf171288ac35e3227415214b1431e915c07deb45dd76d208c6ad90f4005f739bf141
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2168-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1340-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/716-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-561-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-700-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-810-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/896-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2136 ddpvj.exe 2804 lfrfrfl.exe 2396 1vvdj.exe 2772 llrxrrf.exe 2740 hnbnht.exe 2592 fxrxffr.exe 3040 hbnnnb.exe 272 dddpd.exe 1340 jjjvj.exe 2124 rfxrrrx.exe 2556 thnbtb.exe 2672 3xflfrr.exe 2664 ttbtnt.exe 2220 pppvj.exe 2752 bbbnbn.exe 2128 bnbnnn.exe 2164 tbbnhn.exe 2000 tttbbh.exe 2224 9pppj.exe 2192 hhhthn.exe 628 jdvvd.exe 716 bbhnbh.exe 2432 bnhhhb.exe 1544 rrxlxll.exe 1724 hhntnt.exe 1268 5xrxllx.exe 2300 tbbnbh.exe 1460 vdpvd.exe 720 hnhtnb.exe 1048 7pjvd.exe 2028 tnbnth.exe 2380 btthth.exe 2796 ntbthb.exe 2820 vdvpp.exe 2584 nnhnbh.exe 2392 bnbtbn.exe 2920 jjppd.exe 2712 7lrfflf.exe 2572 nnthth.exe 1628 dvppv.exe 2744 7lfrxlx.exe 2884 hbhnbh.exe 448 nnntnt.exe 1284 vvvpd.exe 2880 xlrrfxx.exe 2988 hhhnhh.exe 2556 nhbbhh.exe 2676 9ddpj.exe 2896 3fffrxl.exe 1968 hnntht.exe 2924 vdvdv.exe 2912 dvjpv.exe 792 ffxfrrl.exe 1776 tttnht.exe 3060 1jvvp.exe 2000 ffxlxfr.exe 1408 hhnhbt.exe 540 vjpvv.exe 2192 pddpp.exe 2012 xfflxfx.exe 716 bhhhth.exe 1664 vdvdv.exe 1772 fxlrflr.exe 1736 lxflxfx.exe -
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-108-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2220-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-290-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2796-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-466-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/320-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-561-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1708-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-700-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1964-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-823-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2136 2168 1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe 30 PID 2168 wrote to memory of 2136 2168 1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe 30 PID 2168 wrote to memory of 2136 2168 1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe 30 PID 2168 wrote to memory of 2136 2168 1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe 30 PID 2136 wrote to memory of 2804 2136 ddpvj.exe 31 PID 2136 wrote to memory of 2804 2136 ddpvj.exe 31 PID 2136 wrote to memory of 2804 2136 ddpvj.exe 31 PID 2136 wrote to memory of 2804 2136 ddpvj.exe 31 PID 2804 wrote to memory of 2396 2804 lfrfrfl.exe 32 PID 2804 wrote to memory of 2396 2804 lfrfrfl.exe 32 PID 2804 wrote to memory of 2396 2804 lfrfrfl.exe 32 PID 2804 wrote to memory of 2396 2804 lfrfrfl.exe 32 PID 2396 wrote to memory of 2772 2396 1vvdj.exe 33 PID 2396 wrote to memory of 2772 2396 1vvdj.exe 33 PID 2396 wrote to memory of 2772 2396 1vvdj.exe 33 PID 2396 wrote to memory of 2772 2396 1vvdj.exe 33 PID 2772 wrote to memory of 2740 2772 llrxrrf.exe 34 PID 2772 wrote to memory of 2740 2772 llrxrrf.exe 34 PID 2772 wrote to memory of 2740 2772 llrxrrf.exe 34 PID 2772 wrote to memory of 2740 2772 llrxrrf.exe 34 PID 2740 wrote to memory of 2592 2740 hnbnht.exe 35 PID 2740 wrote to memory of 2592 2740 hnbnht.exe 35 PID 2740 wrote to memory of 2592 2740 hnbnht.exe 35 PID 2740 wrote to memory of 2592 2740 hnbnht.exe 35 PID 2592 wrote to memory of 3040 2592 fxrxffr.exe 36 PID 2592 wrote to memory of 3040 2592 fxrxffr.exe 36 PID 2592 wrote to memory of 3040 2592 fxrxffr.exe 36 PID 2592 wrote to memory of 3040 2592 fxrxffr.exe 36 PID 3040 wrote to memory of 272 3040 hbnnnb.exe 37 PID 3040 wrote to memory of 272 3040 hbnnnb.exe 37 PID 3040 wrote to memory of 272 3040 hbnnnb.exe 37 PID 3040 wrote to memory of 272 3040 hbnnnb.exe 37 PID 272 wrote to memory of 1340 272 dddpd.exe 38 PID 272 wrote to memory of 1340 272 dddpd.exe 38 PID 272 wrote to memory of 1340 272 dddpd.exe 38 PID 272 wrote to memory of 1340 272 dddpd.exe 38 PID 1340 wrote to memory of 2124 1340 jjjvj.exe 39 PID 1340 wrote to memory of 2124 1340 jjjvj.exe 39 PID 1340 wrote to memory of 2124 1340 jjjvj.exe 39 PID 1340 wrote to memory of 2124 1340 jjjvj.exe 39 PID 2124 wrote to memory of 2556 2124 rfxrrrx.exe 40 PID 2124 wrote to memory of 2556 2124 rfxrrrx.exe 40 PID 2124 wrote to memory of 2556 2124 rfxrrrx.exe 40 PID 2124 wrote to memory of 2556 2124 rfxrrrx.exe 40 PID 2556 wrote to memory of 2672 2556 thnbtb.exe 41 PID 2556 wrote to memory of 2672 2556 thnbtb.exe 41 PID 2556 wrote to memory of 2672 2556 thnbtb.exe 41 PID 2556 wrote to memory of 2672 2556 thnbtb.exe 41 PID 2672 wrote to memory of 2664 2672 3xflfrr.exe 42 PID 2672 wrote to memory of 2664 2672 3xflfrr.exe 42 PID 2672 wrote to memory of 2664 2672 3xflfrr.exe 42 PID 2672 wrote to memory of 2664 2672 3xflfrr.exe 42 PID 2664 wrote to memory of 2220 2664 ttbtnt.exe 43 PID 2664 wrote to memory of 2220 2664 ttbtnt.exe 43 PID 2664 wrote to memory of 2220 2664 ttbtnt.exe 43 PID 2664 wrote to memory of 2220 2664 ttbtnt.exe 43 PID 2220 wrote to memory of 2752 2220 pppvj.exe 44 PID 2220 wrote to memory of 2752 2220 pppvj.exe 44 PID 2220 wrote to memory of 2752 2220 pppvj.exe 44 PID 2220 wrote to memory of 2752 2220 pppvj.exe 44 PID 2752 wrote to memory of 2128 2752 bbbnbn.exe 45 PID 2752 wrote to memory of 2128 2752 bbbnbn.exe 45 PID 2752 wrote to memory of 2128 2752 bbbnbn.exe 45 PID 2752 wrote to memory of 2128 2752 bbbnbn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe"C:\Users\Admin\AppData\Local\Temp\1696f45b85f9c29e345bc537fc993158bb8f56aec0612bceea992a83c2e9dad9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ddpvj.exec:\ddpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\lfrfrfl.exec:\lfrfrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\1vvdj.exec:\1vvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\llrxrrf.exec:\llrxrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hnbnht.exec:\hnbnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fxrxffr.exec:\fxrxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hbnnnb.exec:\hbnnnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\dddpd.exec:\dddpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\jjjvj.exec:\jjjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\thnbtb.exec:\thnbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3xflfrr.exec:\3xflfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ttbtnt.exec:\ttbtnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pppvj.exec:\pppvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\bbbnbn.exec:\bbbnbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bnbnnn.exec:\bnbnnn.exe17⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tbbnhn.exec:\tbbnhn.exe18⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tttbbh.exec:\tttbbh.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9pppj.exec:\9pppj.exe20⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hhhthn.exec:\hhhthn.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdvvd.exec:\jdvvd.exe22⤵
- Executes dropped EXE
PID:628 -
\??\c:\bbhnbh.exec:\bbhnbh.exe23⤵
- Executes dropped EXE
PID:716 -
\??\c:\bnhhhb.exec:\bnhhhb.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
\??\c:\rrxlxll.exec:\rrxlxll.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hhntnt.exec:\hhntnt.exe26⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5xrxllx.exec:\5xrxllx.exe27⤵
- Executes dropped EXE
PID:1268 -
\??\c:\tbbnbh.exec:\tbbnbh.exe28⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vdpvd.exec:\vdpvd.exe29⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hnhtnb.exec:\hnhtnb.exe30⤵
- Executes dropped EXE
PID:720 -
\??\c:\7pjvd.exec:\7pjvd.exe31⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tnbnth.exec:\tnbnth.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\btthth.exec:\btthth.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ntbthb.exec:\ntbthb.exe34⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vdvpp.exec:\vdvpp.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nnhnbh.exec:\nnhnbh.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bnbtbn.exec:\bnbtbn.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jjppd.exec:\jjppd.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7lrfflf.exec:\7lrfflf.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nnthth.exec:\nnthth.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvppv.exec:\dvppv.exe41⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7lfrxlx.exec:\7lfrxlx.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hbhnbh.exec:\hbhnbh.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nnntnt.exec:\nnntnt.exe44⤵
- Executes dropped EXE
PID:448 -
\??\c:\vvvpd.exec:\vvvpd.exe45⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xlrrfxx.exec:\xlrrfxx.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hhhnhh.exec:\hhhnhh.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nhbbhh.exec:\nhbbhh.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9ddpj.exec:\9ddpj.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3fffrxl.exec:\3fffrxl.exe50⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hnntht.exec:\hnntht.exe51⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vdvdv.exec:\vdvdv.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvjpv.exec:\dvjpv.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe54⤵
- Executes dropped EXE
PID:792 -
\??\c:\tttnht.exec:\tttnht.exe55⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1jvvp.exec:\1jvvp.exe56⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe57⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hhnhbt.exec:\hhnhbt.exe58⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vjpvv.exec:\vjpvv.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\pddpp.exec:\pddpp.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xfflxfx.exec:\xfflxfx.exe61⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bhhhth.exec:\bhhhth.exe62⤵
- Executes dropped EXE
PID:716 -
\??\c:\vdvdv.exec:\vdvdv.exe63⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxlrflr.exec:\fxlrflr.exe64⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lxflxfx.exec:\lxflxfx.exe65⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hnhntb.exec:\hnhntb.exe66⤵PID:304
-
\??\c:\3ppjp.exec:\3ppjp.exe67⤵PID:1268
-
\??\c:\frlrflr.exec:\frlrflr.exe68⤵PID:332
-
\??\c:\hhhhtb.exec:\hhhhtb.exe69⤵PID:320
-
\??\c:\bbbnht.exec:\bbbnht.exe70⤵PID:1460
-
\??\c:\pjdpv.exec:\pjdpv.exe71⤵PID:2072
-
\??\c:\rlflxfl.exec:\rlflxfl.exe72⤵PID:1760
-
\??\c:\3hhnnn.exec:\3hhnnn.exe73⤵PID:340
-
\??\c:\djvjv.exec:\djvjv.exe74⤵PID:2680
-
\??\c:\fllxlrr.exec:\fllxlrr.exe75⤵PID:1596
-
\??\c:\fxrrfrf.exec:\fxrrfrf.exe76⤵PID:1708
-
\??\c:\hhbbhn.exec:\hhbbhn.exe77⤵PID:2852
-
\??\c:\jdvdj.exec:\jdvdj.exe78⤵PID:2764
-
\??\c:\7dvvp.exec:\7dvvp.exe79⤵PID:2612
-
\??\c:\fxxfllf.exec:\fxxfllf.exe80⤵PID:2800
-
\??\c:\nhntbb.exec:\nhntbb.exe81⤵PID:2624
-
\??\c:\ddddj.exec:\ddddj.exe82⤵PID:2596
-
\??\c:\1dvvd.exec:\1dvvd.exe83⤵PID:1632
-
\??\c:\frrrflx.exec:\frrrflx.exe84⤵PID:324
-
\??\c:\7hbhnt.exec:\7hbhnt.exe85⤵PID:2552
-
\??\c:\vppvj.exec:\vppvj.exe86⤵PID:2540
-
\??\c:\flxllxx.exec:\flxllxx.exe87⤵PID:1496
-
\??\c:\xxlrflr.exec:\xxlrflr.exe88⤵PID:2560
-
\??\c:\hnhtbn.exec:\hnhtbn.exe89⤵PID:2536
-
\??\c:\vppvp.exec:\vppvp.exe90⤵PID:3012
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe91⤵PID:2868
-
\??\c:\9hbhhn.exec:\9hbhhn.exe92⤵PID:2760
-
\??\c:\tnnhth.exec:\tnnhth.exe93⤵PID:1968
-
\??\c:\dddvv.exec:\dddvv.exe94⤵PID:2156
-
\??\c:\llfrrxr.exec:\llfrrxr.exe95⤵PID:796
-
\??\c:\1bthnn.exec:\1bthnn.exe96⤵PID:1964
-
\??\c:\vpdvj.exec:\vpdvj.exe97⤵PID:2344
-
\??\c:\jpppd.exec:\jpppd.exe98⤵PID:2116
-
\??\c:\fffrxlx.exec:\fffrxlx.exe99⤵PID:1984
-
\??\c:\nnbtbb.exec:\nnbtbb.exe100⤵PID:1888
-
\??\c:\ddvdj.exec:\ddvdj.exe101⤵PID:1952
-
\??\c:\rlrxfxl.exec:\rlrxfxl.exe102⤵PID:628
-
\??\c:\lllfrxl.exec:\lllfrxl.exe103⤵PID:920
-
\??\c:\7bnbnn.exec:\7bnbnn.exe104⤵PID:2204
-
\??\c:\vpjpv.exec:\vpjpv.exe105⤵PID:2456
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe106⤵PID:1820
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe107⤵PID:2656
-
\??\c:\ttthtb.exec:\ttthtb.exe108⤵PID:548
-
\??\c:\3djpj.exec:\3djpj.exe109⤵PID:2460
-
\??\c:\ddvjv.exec:\ddvjv.exe110⤵PID:3068
-
\??\c:\nnnhhb.exec:\nnnhhb.exe111⤵PID:1744
-
\??\c:\vvvjv.exec:\vvvjv.exe112⤵PID:1064
-
\??\c:\xffrlll.exec:\xffrlll.exe113⤵PID:896
-
\??\c:\llrrrfx.exec:\llrrrfx.exe114⤵PID:2704
-
\??\c:\7hhhnn.exec:\7hhhnn.exe115⤵PID:2724
-
\??\c:\1jjvj.exec:\1jjvj.exe116⤵PID:2180
-
\??\c:\3pjdj.exec:\3pjdj.exe117⤵PID:2788
-
\??\c:\fxrfxll.exec:\fxrfxll.exe118⤵PID:2228
-
\??\c:\thnhhn.exec:\thnhhn.exe119⤵PID:2584
-
\??\c:\1jddp.exec:\1jddp.exe120⤵PID:2844
-
\??\c:\rxrlffl.exec:\rxrlffl.exe121⤵PID:2688
-
\??\c:\lrllxfx.exec:\lrllxfx.exe122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-