Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe
-
Size
453KB
-
MD5
782ec8d725856c099794e4f8e7b9c4a0
-
SHA1
1340978970548913fa4f4d2f56be0f54a547eaa9
-
SHA256
94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1
-
SHA512
e264f4afdd4902da3cab52f621b35b9bf82660b0ba4b7fb9e5a1d58c06ffbdbe99a18681ceec08bde26c85d4c4395d92b2f0f2fde7362fe16cebd2a71a559773
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2132-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-65-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2500-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-155-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/264-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-764-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1188-798-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-731-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1988-585-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-486-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-451-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1860-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-256-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1732-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-870-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-909-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3040 hbntnn.exe 2680 dvjpd.exe 2616 nhhnhh.exe 2656 dpvjj.exe 2820 llxfffr.exe 2724 lfrxflx.exe 2500 btntbt.exe 2508 jdjpp.exe 536 fxrrxfr.exe 1296 nbtbhh.exe 2772 pddpd.exe 2964 rlfrfxl.exe 2992 hhbnbn.exe 2024 ppjpd.exe 1992 xxllllr.exe 2204 7ttbhn.exe 856 1bnnnt.exe 1924 fxxfxfr.exe 2124 hthnbb.exe 2348 jvdpd.exe 2344 rrflxfr.exe 2864 bbthbn.exe 2116 dpvvj.exe 1140 rrxxxxx.exe 1204 1llxfxl.exe 1732 pjdpj.exe 2152 vdpvj.exe 1596 rrlrflf.exe 1436 9tthtb.exe 2384 jvjdp.exe 900 lflfllr.exe 1880 bbnbth.exe 3060 ppjpd.exe 2684 fxxxfrf.exe 2188 bbthht.exe 2836 bbntbh.exe 2664 vpjpd.exe 2144 rxrxxfl.exe 2456 3fflrrf.exe 2580 hbthnn.exe 2500 jpjpj.exe 264 5xrxlrl.exe 332 5lffflr.exe 2996 7tntbh.exe 2736 1pddd.exe 1860 jdddp.exe 1656 llrxffx.exe 2020 ttnthn.exe 1976 5ddjp.exe 1676 dvpvd.exe 1844 fxlllxr.exe 2756 btnbtn.exe 2916 thnnnh.exe 2968 pjpvd.exe 1728 dvjjp.exe 1552 3rffrxf.exe 2348 5nnthn.exe 2440 bthnbb.exe 1748 djvdp.exe 1248 rlfflrx.exe 2292 5btbnt.exe 1136 htbnnb.exe 1852 pdvvv.exe 2128 fxlflfl.exe -
resource yara_rule behavioral1/memory/2132-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-909-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflxxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3040 2132 94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe 28 PID 2132 wrote to memory of 3040 2132 94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe 28 PID 2132 wrote to memory of 3040 2132 94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe 28 PID 2132 wrote to memory of 3040 2132 94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe 28 PID 3040 wrote to memory of 2680 3040 hbntnn.exe 29 PID 3040 wrote to memory of 2680 3040 hbntnn.exe 29 PID 3040 wrote to memory of 2680 3040 hbntnn.exe 29 PID 3040 wrote to memory of 2680 3040 hbntnn.exe 29 PID 2680 wrote to memory of 2616 2680 dvjpd.exe 30 PID 2680 wrote to memory of 2616 2680 dvjpd.exe 30 PID 2680 wrote to memory of 2616 2680 dvjpd.exe 30 PID 2680 wrote to memory of 2616 2680 dvjpd.exe 30 PID 2616 wrote to memory of 2656 2616 nhhnhh.exe 31 PID 2616 wrote to memory of 2656 2616 nhhnhh.exe 31 PID 2616 wrote to memory of 2656 2616 nhhnhh.exe 31 PID 2616 wrote to memory of 2656 2616 nhhnhh.exe 31 PID 2656 wrote to memory of 2820 2656 dpvjj.exe 146 PID 2656 wrote to memory of 2820 2656 dpvjj.exe 146 PID 2656 wrote to memory of 2820 2656 dpvjj.exe 146 PID 2656 wrote to memory of 2820 2656 dpvjj.exe 146 PID 2820 wrote to memory of 2724 2820 llxfffr.exe 33 PID 2820 wrote to memory of 2724 2820 llxfffr.exe 33 PID 2820 wrote to memory of 2724 2820 llxfffr.exe 33 PID 2820 wrote to memory of 2724 2820 llxfffr.exe 33 PID 2724 wrote to memory of 2500 2724 lfrxflx.exe 68 PID 2724 wrote to memory of 2500 2724 lfrxflx.exe 68 PID 2724 wrote to memory of 2500 2724 lfrxflx.exe 68 PID 2724 wrote to memory of 2500 2724 lfrxflx.exe 68 PID 2500 wrote to memory of 2508 2500 btntbt.exe 35 PID 2500 wrote to memory of 2508 2500 btntbt.exe 35 PID 2500 wrote to memory of 2508 2500 btntbt.exe 35 PID 2500 wrote to memory of 2508 2500 btntbt.exe 35 PID 2508 wrote to memory of 536 2508 jdjpp.exe 36 PID 2508 wrote to memory of 536 2508 jdjpp.exe 36 PID 2508 wrote to memory of 536 2508 jdjpp.exe 36 PID 2508 wrote to memory of 536 2508 jdjpp.exe 36 PID 536 wrote to memory of 1296 536 fxrrxfr.exe 37 PID 536 wrote to memory of 1296 536 fxrrxfr.exe 37 PID 536 wrote to memory of 1296 536 fxrrxfr.exe 37 PID 536 wrote to memory of 1296 536 fxrrxfr.exe 37 PID 1296 wrote to memory of 2772 1296 nbtbhh.exe 38 PID 1296 wrote to memory of 2772 1296 nbtbhh.exe 38 PID 1296 wrote to memory of 2772 1296 nbtbhh.exe 38 PID 1296 wrote to memory of 2772 1296 nbtbhh.exe 38 PID 2772 wrote to memory of 2964 2772 pddpd.exe 39 PID 2772 wrote to memory of 2964 2772 pddpd.exe 39 PID 2772 wrote to memory of 2964 2772 pddpd.exe 39 PID 2772 wrote to memory of 2964 2772 pddpd.exe 39 PID 2964 wrote to memory of 2992 2964 rlfrfxl.exe 40 PID 2964 wrote to memory of 2992 2964 rlfrfxl.exe 40 PID 2964 wrote to memory of 2992 2964 rlfrfxl.exe 40 PID 2964 wrote to memory of 2992 2964 rlfrfxl.exe 40 PID 2992 wrote to memory of 2024 2992 hhbnbn.exe 41 PID 2992 wrote to memory of 2024 2992 hhbnbn.exe 41 PID 2992 wrote to memory of 2024 2992 hhbnbn.exe 41 PID 2992 wrote to memory of 2024 2992 hhbnbn.exe 41 PID 2024 wrote to memory of 1992 2024 ppjpd.exe 42 PID 2024 wrote to memory of 1992 2024 ppjpd.exe 42 PID 2024 wrote to memory of 1992 2024 ppjpd.exe 42 PID 2024 wrote to memory of 1992 2024 ppjpd.exe 42 PID 1992 wrote to memory of 2204 1992 xxllllr.exe 43 PID 1992 wrote to memory of 2204 1992 xxllllr.exe 43 PID 1992 wrote to memory of 2204 1992 xxllllr.exe 43 PID 1992 wrote to memory of 2204 1992 xxllllr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe"C:\Users\Admin\AppData\Local\Temp\94edf12a1654fdfe9543603faf716808128606c626e4bda5daaf0297abc2dae1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\hbntnn.exec:\hbntnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\dvjpd.exec:\dvjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nhhnhh.exec:\nhhnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dpvjj.exec:\dpvjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\llxfffr.exec:\llxfffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lfrxflx.exec:\lfrxflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\btntbt.exec:\btntbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jdjpp.exec:\jdjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nbtbhh.exec:\nbtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\pddpd.exec:\pddpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\hhbnbn.exec:\hhbnbn.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ppjpd.exec:\ppjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xxllllr.exec:\xxllllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\7ttbhn.exec:\7ttbhn.exe17⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1bnnnt.exec:\1bnnnt.exe18⤵
- Executes dropped EXE
PID:856 -
\??\c:\fxxfxfr.exec:\fxxfxfr.exe19⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hthnbb.exec:\hthnbb.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jvdpd.exec:\jvdpd.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2348 -
\??\c:\rrflxfr.exec:\rrflxfr.exe22⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbthbn.exec:\bbthbn.exe23⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dpvvj.exec:\dpvvj.exe24⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe25⤵
- Executes dropped EXE
PID:1140 -
\??\c:\1llxfxl.exec:\1llxfxl.exe26⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pjdpj.exec:\pjdpj.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vdpvj.exec:\vdpvj.exe28⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rrlrflf.exec:\rrlrflf.exe29⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9tthtb.exec:\9tthtb.exe30⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jvjdp.exec:\jvjdp.exe31⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lflfllr.exec:\lflfllr.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\bbnbth.exec:\bbnbth.exe33⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ppjpd.exec:\ppjpd.exe34⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fxxxfrf.exec:\fxxxfrf.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bbthht.exec:\bbthht.exe36⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bbntbh.exec:\bbntbh.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vpjpd.exec:\vpjpd.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rxrxxfl.exec:\rxrxxfl.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3fflrrf.exec:\3fflrrf.exe40⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbthnn.exec:\hbthnn.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jpjpj.exec:\jpjpj.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5xrxlrl.exec:\5xrxlrl.exe43⤵
- Executes dropped EXE
PID:264 -
\??\c:\5lffflr.exec:\5lffflr.exe44⤵
- Executes dropped EXE
PID:332 -
\??\c:\7tntbh.exec:\7tntbh.exe45⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1pddd.exec:\1pddd.exe46⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jdddp.exec:\jdddp.exe47⤵
- Executes dropped EXE
PID:1860 -
\??\c:\llrxffx.exec:\llrxffx.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ttnthn.exec:\ttnthn.exe49⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5ddjp.exec:\5ddjp.exe50⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvpvd.exec:\dvpvd.exe51⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxlllxr.exec:\fxlllxr.exe52⤵
- Executes dropped EXE
PID:1844 -
\??\c:\btnbtn.exec:\btnbtn.exe53⤵
- Executes dropped EXE
PID:2756 -
\??\c:\thnnnh.exec:\thnnnh.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjpvd.exec:\pjpvd.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dvjjp.exec:\dvjjp.exe56⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3rffrxf.exec:\3rffrxf.exe57⤵
- Executes dropped EXE
PID:1552 -
\??\c:\5nnthn.exec:\5nnthn.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bthnbb.exec:\bthnbb.exe59⤵
- Executes dropped EXE
PID:2440 -
\??\c:\djvdp.exec:\djvdp.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rlfflrx.exec:\rlfflrx.exe61⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5btbnt.exec:\5btbnt.exe62⤵
- Executes dropped EXE
PID:2292 -
\??\c:\htbnnb.exec:\htbnnb.exe63⤵
- Executes dropped EXE
PID:1136 -
\??\c:\pdvvv.exec:\pdvvv.exe64⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fxlflfl.exec:\fxlflfl.exe65⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xxrxrrf.exec:\xxrxrrf.exe66⤵PID:2816
-
\??\c:\tnhnbh.exec:\tnhnbh.exe67⤵PID:2152
-
\??\c:\9vddv.exec:\9vddv.exe68⤵PID:1596
-
\??\c:\jvjpp.exec:\jvjpp.exe69⤵PID:1436
-
\??\c:\xrrrffr.exec:\xrrrffr.exe70⤵PID:2252
-
\??\c:\hhhnbh.exec:\hhhnbh.exe71⤵PID:2708
-
\??\c:\1btbtt.exec:\1btbtt.exe72⤵PID:1880
-
\??\c:\pjjjp.exec:\pjjjp.exe73⤵PID:2720
-
\??\c:\xxfllrx.exec:\xxfllrx.exe74⤵PID:2892
-
\??\c:\fllffxx.exec:\fllffxx.exe75⤵PID:1988
-
\??\c:\nhbnbb.exec:\nhbnbb.exe76⤵PID:2832
-
\??\c:\pdpjd.exec:\pdpjd.exe77⤵PID:2848
-
\??\c:\rllrfxl.exec:\rllrfxl.exe78⤵PID:2652
-
\??\c:\lfllrxf.exec:\lfllrxf.exe79⤵PID:2144
-
\??\c:\9bntnb.exec:\9bntnb.exe80⤵PID:2488
-
\??\c:\djjvj.exec:\djjvj.exe81⤵PID:2516
-
\??\c:\vvppj.exec:\vvppj.exe82⤵PID:2372
-
\??\c:\rlfrrxx.exec:\rlfrrxx.exe83⤵PID:2508
-
\??\c:\1tntbh.exec:\1tntbh.exe84⤵PID:1408
-
\??\c:\bttttt.exec:\bttttt.exe85⤵PID:2800
-
\??\c:\1vvvd.exec:\1vvvd.exe86⤵PID:2804
-
\??\c:\1lrxrxl.exec:\1lrxrxl.exe87⤵PID:2656
-
\??\c:\xxrxllf.exec:\xxrxllf.exe88⤵PID:2928
-
\??\c:\5nhhbb.exec:\5nhhbb.exe89⤵PID:1968
-
\??\c:\ddpvd.exec:\ddpvd.exe90⤵PID:1656
-
\??\c:\vpvdj.exec:\vpvdj.exe91⤵PID:2136
-
\??\c:\xxrfrxx.exec:\xxrfrxx.exe92⤵PID:1960
-
\??\c:\rrllrrx.exec:\rrllrrx.exe93⤵PID:1840
-
\??\c:\ntntht.exec:\ntntht.exe94⤵PID:1940
-
\??\c:\vjdvd.exec:\vjdvd.exe95⤵PID:1400
-
\??\c:\vvjpj.exec:\vvjpj.exe96⤵PID:1712
-
\??\c:\ffxfllf.exec:\ffxfllf.exe97⤵PID:1628
-
\??\c:\thtttt.exec:\thtttt.exe98⤵PID:2052
-
\??\c:\tbhbnb.exec:\tbhbnb.exe99⤵PID:1716
-
\??\c:\dvjvp.exec:\dvjvp.exe100⤵PID:468
-
\??\c:\ddpjd.exec:\ddpjd.exe101⤵PID:844
-
\??\c:\9lfrlxl.exec:\9lfrlxl.exe102⤵PID:2120
-
\??\c:\1hthnt.exec:\1hthnt.exe103⤵PID:1404
-
\??\c:\thbbtn.exec:\thbbtn.exe104⤵PID:2748
-
\??\c:\ddvjd.exec:\ddvjd.exe105⤵PID:1188
-
\??\c:\llxxrxl.exec:\llxxrxl.exe106⤵PID:964
-
\??\c:\rlflrlx.exec:\rlflrlx.exe107⤵PID:2432
-
\??\c:\bbtntb.exec:\bbtntb.exe108⤵PID:316
-
\??\c:\hhtbnn.exec:\hhtbnn.exe109⤵PID:288
-
\??\c:\jjjvd.exec:\jjjvd.exe110⤵PID:1664
-
\??\c:\xxxllxr.exec:\xxxllxr.exe111⤵PID:1596
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe112⤵PID:3024
-
\??\c:\ntthbb.exec:\ntthbb.exe113⤵PID:1344
-
\??\c:\5jvpv.exec:\5jvpv.exe114⤵PID:1904
-
\??\c:\pdvjj.exec:\pdvjj.exe115⤵PID:2364
-
\??\c:\9xrfxrx.exec:\9xrfxrx.exe116⤵PID:2604
-
\??\c:\hbtbhh.exec:\hbtbhh.exe117⤵PID:2684
-
\??\c:\3hbhbh.exec:\3hbhbh.exe118⤵PID:2568
-
\??\c:\dvjdj.exec:\dvjdj.exe119⤵PID:2380
-
\??\c:\llfrffx.exec:\llfrffx.exe120⤵PID:2820
-
\??\c:\nhtbhh.exec:\nhtbhh.exe121⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-