Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 20:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe
-
Size
456KB
-
MD5
403bc20881046249e8ae7dd489de5ee0
-
SHA1
e144f116da9ac6d84affb50203ed6c36c7f6be86
-
SHA256
280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c
-
SHA512
77f608c4c8ffa713b6011f4372fe3e5cd237054a73a5b8b4902af131fc3f635deb7d089196280bc8c5212cb2bb5942859068b81fbc3e1ad43f62f3caffa8a743
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRm:q7Tc2NYHUrAwfMp3CDRm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral1/memory/2676-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-70-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-83-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2832-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-103-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2648-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-179-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1304-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-197-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2220-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-208-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1160-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-298-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2176-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-321-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2104-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-341-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-363-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2688-364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-424-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2664-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-445-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1576-520-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1732-533-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2576-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-636-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-673-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2872-688-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/976-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-773-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-881-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2640-897-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1632-895-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2732-904-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2928-935-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2928-937-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 frrffxf.exe 2264 tnthbt.exe 2500 lfrrxxx.exe 2864 nhnhbb.exe 2724 5pjpp.exe 2956 7hhbbt.exe 2432 dvdjj.exe 2832 vpdjp.exe 2924 lxlfrll.exe 2644 9ntnnn.exe 2648 9dppp.exe 940 3xlllff.exe 2928 hbnttt.exe 1848 rrfxxxr.exe 1432 jpvpp.exe 820 xrfffff.exe 3020 7vdvd.exe 1304 jvjpp.exe 3068 9htnnn.exe 2220 1bnhnh.exe 1796 lxffrrx.exe 1160 3bttnn.exe 1104 vjppv.exe 2080 jvjjj.exe 1040 hbtnhb.exe 1784 5nttbt.exe 2520 lxlfrrf.exe 2344 bnbnhb.exe 2016 jdjjj.exe 2412 5xrlllr.exe 996 hnhbbn.exe 2176 dpppj.exe 2352 9nttbb.exe 1488 jjpvd.exe 2104 lfrxfxx.exe 2864 9thbhh.exe 2688 5jvpj.exe 2408 jdvdd.exe 2728 rlxrxxf.exe 2272 7nbbhb.exe 2012 pjpvd.exe 2596 3vddd.exe 2816 rlxxfff.exe 3048 hnnntn.exe 2464 ntbbbn.exe 2888 pdvdj.exe 1956 3rlffxx.exe 2876 3frlffl.exe 2664 nbnhnn.exe 1856 pjpjp.exe 1608 jddjp.exe 1764 fxlrfff.exe 896 bhtnbn.exe 2260 7tbbhb.exe 2120 djvvd.exe 2396 rlrxfxx.exe 1520 tnbhtt.exe 556 vjppp.exe 2480 pjvdp.exe 1616 xlrxfxx.exe 2108 7rrflxr.exe 2456 bnhttn.exe 2028 pdpvd.exe 1576 jvpjp.exe -
resource yara_rule behavioral1/memory/2264-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-141-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1432-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-166-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1304-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-203-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1796-208-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1160-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-445-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2456-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-520-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1732-533-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1824-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-636-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1916-673-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2872-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-688-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/976-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-757-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rffxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2676 2156 280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe 30 PID 2156 wrote to memory of 2676 2156 280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe 30 PID 2156 wrote to memory of 2676 2156 280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe 30 PID 2156 wrote to memory of 2676 2156 280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe 30 PID 2676 wrote to memory of 2264 2676 frrffxf.exe 31 PID 2676 wrote to memory of 2264 2676 frrffxf.exe 31 PID 2676 wrote to memory of 2264 2676 frrffxf.exe 31 PID 2676 wrote to memory of 2264 2676 frrffxf.exe 31 PID 2264 wrote to memory of 2500 2264 tnthbt.exe 32 PID 2264 wrote to memory of 2500 2264 tnthbt.exe 32 PID 2264 wrote to memory of 2500 2264 tnthbt.exe 32 PID 2264 wrote to memory of 2500 2264 tnthbt.exe 32 PID 2500 wrote to memory of 2864 2500 lfrrxxx.exe 33 PID 2500 wrote to memory of 2864 2500 lfrrxxx.exe 33 PID 2500 wrote to memory of 2864 2500 lfrrxxx.exe 33 PID 2500 wrote to memory of 2864 2500 lfrrxxx.exe 33 PID 2864 wrote to memory of 2724 2864 nhnhbb.exe 34 PID 2864 wrote to memory of 2724 2864 nhnhbb.exe 34 PID 2864 wrote to memory of 2724 2864 nhnhbb.exe 34 PID 2864 wrote to memory of 2724 2864 nhnhbb.exe 34 PID 2724 wrote to memory of 2956 2724 5pjpp.exe 35 PID 2724 wrote to memory of 2956 2724 5pjpp.exe 35 PID 2724 wrote to memory of 2956 2724 5pjpp.exe 35 PID 2724 wrote to memory of 2956 2724 5pjpp.exe 35 PID 2956 wrote to memory of 2432 2956 7hhbbt.exe 36 PID 2956 wrote to memory of 2432 2956 7hhbbt.exe 36 PID 2956 wrote to memory of 2432 2956 7hhbbt.exe 36 PID 2956 wrote to memory of 2432 2956 7hhbbt.exe 36 PID 2432 wrote to memory of 2832 2432 dvdjj.exe 37 PID 2432 wrote to memory of 2832 2432 dvdjj.exe 37 PID 2432 wrote to memory of 2832 2432 dvdjj.exe 37 PID 2432 wrote to memory of 2832 2432 dvdjj.exe 37 PID 2832 wrote to memory of 2924 2832 vpdjp.exe 38 PID 2832 wrote to memory of 2924 2832 vpdjp.exe 38 PID 2832 wrote to memory of 2924 2832 vpdjp.exe 38 PID 2832 wrote to memory of 2924 2832 vpdjp.exe 38 PID 2924 wrote to memory of 2644 2924 lxlfrll.exe 39 PID 2924 wrote to memory of 2644 2924 lxlfrll.exe 39 PID 2924 wrote to memory of 2644 2924 lxlfrll.exe 39 PID 2924 wrote to memory of 2644 2924 lxlfrll.exe 39 PID 2644 wrote to memory of 2648 2644 9ntnnn.exe 40 PID 2644 wrote to memory of 2648 2644 9ntnnn.exe 40 PID 2644 wrote to memory of 2648 2644 9ntnnn.exe 40 PID 2644 wrote to memory of 2648 2644 9ntnnn.exe 40 PID 2648 wrote to memory of 940 2648 9dppp.exe 41 PID 2648 wrote to memory of 940 2648 9dppp.exe 41 PID 2648 wrote to memory of 940 2648 9dppp.exe 41 PID 2648 wrote to memory of 940 2648 9dppp.exe 41 PID 940 wrote to memory of 2928 940 3xlllff.exe 42 PID 940 wrote to memory of 2928 940 3xlllff.exe 42 PID 940 wrote to memory of 2928 940 3xlllff.exe 42 PID 940 wrote to memory of 2928 940 3xlllff.exe 42 PID 2928 wrote to memory of 1848 2928 hbnttt.exe 43 PID 2928 wrote to memory of 1848 2928 hbnttt.exe 43 PID 2928 wrote to memory of 1848 2928 hbnttt.exe 43 PID 2928 wrote to memory of 1848 2928 hbnttt.exe 43 PID 1848 wrote to memory of 1432 1848 rrfxxxr.exe 44 PID 1848 wrote to memory of 1432 1848 rrfxxxr.exe 44 PID 1848 wrote to memory of 1432 1848 rrfxxxr.exe 44 PID 1848 wrote to memory of 1432 1848 rrfxxxr.exe 44 PID 1432 wrote to memory of 820 1432 jpvpp.exe 45 PID 1432 wrote to memory of 820 1432 jpvpp.exe 45 PID 1432 wrote to memory of 820 1432 jpvpp.exe 45 PID 1432 wrote to memory of 820 1432 jpvpp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe"C:\Users\Admin\AppData\Local\Temp\280c70f2fd22e21349e4a5ae01548fbb18c4a0c1a4ee7ad5021f55b21282699c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\frrffxf.exec:\frrffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnthbt.exec:\tnthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nhnhbb.exec:\nhnhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\5pjpp.exec:\5pjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\7hhbbt.exec:\7hhbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\dvdjj.exec:\dvdjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\vpdjp.exec:\vpdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lxlfrll.exec:\lxlfrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\9ntnnn.exec:\9ntnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9dppp.exec:\9dppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\3xlllff.exec:\3xlllff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\hbnttt.exec:\hbnttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\jpvpp.exec:\jpvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\xrfffff.exec:\xrfffff.exe17⤵
- Executes dropped EXE
PID:820 -
\??\c:\7vdvd.exec:\7vdvd.exe18⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jvjpp.exec:\jvjpp.exe19⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9htnnn.exec:\9htnnn.exe20⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1bnhnh.exec:\1bnhnh.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lxffrrx.exec:\lxffrrx.exe22⤵
- Executes dropped EXE
PID:1796 -
\??\c:\3bttnn.exec:\3bttnn.exe23⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vjppv.exec:\vjppv.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jvjjj.exec:\jvjjj.exe25⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hbtnhb.exec:\hbtnhb.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5nttbt.exec:\5nttbt.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lxlfrrf.exec:\lxlfrrf.exe28⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bnbnhb.exec:\bnbnhb.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jdjjj.exec:\jdjjj.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\5xrlllr.exec:\5xrlllr.exe31⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hnhbbn.exec:\hnhbbn.exe32⤵
- Executes dropped EXE
PID:996 -
\??\c:\dpppj.exec:\dpppj.exe33⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9nttbb.exec:\9nttbb.exe34⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jjpvd.exec:\jjpvd.exe35⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lfrxfxx.exec:\lfrxfxx.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9thbhh.exec:\9thbhh.exe37⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5jvpj.exec:\5jvpj.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdvdd.exec:\jdvdd.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7nbbhb.exec:\7nbbhb.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pjpvd.exec:\pjpvd.exe42⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3vddd.exec:\3vddd.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rlxxfff.exec:\rlxxfff.exe44⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hnnntn.exec:\hnnntn.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ntbbbn.exec:\ntbbbn.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pdvdj.exec:\pdvdj.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3rlffxx.exec:\3rlffxx.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3frlffl.exec:\3frlffl.exe49⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nbnhnn.exec:\nbnhnn.exe50⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjpjp.exec:\pjpjp.exe51⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jddjp.exec:\jddjp.exe52⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxlrfff.exec:\fxlrfff.exe53⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bhtnbn.exec:\bhtnbn.exe54⤵
- Executes dropped EXE
PID:896 -
\??\c:\7tbbhb.exec:\7tbbhb.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\djvvd.exec:\djvvd.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rlrxfxx.exec:\rlrxfxx.exe57⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tnbhtt.exec:\tnbhtt.exe58⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vjppp.exec:\vjppp.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\pjvdp.exec:\pjvdp.exe60⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xlrxfxx.exec:\xlrxfxx.exe61⤵
- Executes dropped EXE
PID:1616 -
\??\c:\7rrflxr.exec:\7rrflxr.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bnhttn.exec:\bnhttn.exe63⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pdpvd.exec:\pdpvd.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jvpjp.exec:\jvpjp.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7fllxxx.exec:\7fllxxx.exe66⤵PID:2216
-
\??\c:\hbnhnh.exec:\hbnhnh.exe67⤵PID:1732
-
\??\c:\9thnnh.exec:\9thnnh.exe68⤵PID:1752
-
\??\c:\vdjdj.exec:\vdjdj.exe69⤵PID:2576
-
\??\c:\rxlrfll.exec:\rxlrfll.exe70⤵PID:1824
-
\??\c:\7flrrrr.exec:\7flrrrr.exe71⤵PID:2244
-
\??\c:\1bnhhh.exec:\1bnhhh.exe72⤵PID:2340
-
\??\c:\9jvvv.exec:\9jvvv.exe73⤵PID:2176
-
\??\c:\pdvvv.exec:\pdvvv.exe74⤵PID:2276
-
\??\c:\frlffff.exec:\frlffff.exe75⤵PID:2404
-
\??\c:\7htnhh.exec:\7htnhh.exe76⤵PID:2360
-
\??\c:\vpjjp.exec:\vpjjp.exe77⤵PID:2932
-
\??\c:\1vjjj.exec:\1vjjj.exe78⤵PID:2724
-
\??\c:\rfllrrl.exec:\rfllrrl.exe79⤵PID:2836
-
\??\c:\1nhbhn.exec:\1nhbhn.exe80⤵PID:2848
-
\??\c:\bnthhb.exec:\bnthhb.exe81⤵PID:2432
-
\??\c:\jvpjp.exec:\jvpjp.exe82⤵PID:2704
-
\??\c:\dpdvp.exec:\dpdvp.exe83⤵PID:2592
-
\??\c:\rlfffff.exec:\rlfffff.exe84⤵PID:2304
-
\??\c:\bnnbnn.exec:\bnnbnn.exe85⤵
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\nhbbnh.exec:\nhbbnh.exe86⤵PID:2660
-
\??\c:\vpdjp.exec:\vpdjp.exe87⤵PID:636
-
\??\c:\rxxrfff.exec:\rxxrfff.exe88⤵PID:2064
-
\??\c:\lrrlrrr.exec:\lrrlrrr.exe89⤵PID:1916
-
\??\c:\thttnn.exec:\thttnn.exe90⤵PID:2468
-
\??\c:\1pvpj.exec:\1pvpj.exe91⤵PID:2872
-
\??\c:\ppjpv.exec:\ppjpv.exe92⤵PID:1612
-
\??\c:\5frlxxx.exec:\5frlxxx.exe93⤵PID:1596
-
\??\c:\nhntnn.exec:\nhntnn.exe94⤵PID:1964
-
\??\c:\pvddj.exec:\pvddj.exe95⤵PID:1304
-
\??\c:\5vjpj.exec:\5vjpj.exe96⤵PID:2212
-
\??\c:\rflflfl.exec:\rflflfl.exe97⤵PID:2252
-
\??\c:\3bnbbt.exec:\3bnbbt.exe98⤵PID:1440
-
\??\c:\dpdpp.exec:\dpdpp.exe99⤵PID:1796
-
\??\c:\7jvjd.exec:\7jvjd.exe100⤵PID:1536
-
\??\c:\lflllfl.exec:\lflllfl.exe101⤵PID:1032
-
\??\c:\thttbb.exec:\thttbb.exe102⤵PID:448
-
\??\c:\5bhbtn.exec:\5bhbtn.exe103⤵PID:976
-
\??\c:\jvvdj.exec:\jvvdj.exe104⤵PID:1028
-
\??\c:\lxfflll.exec:\lxfflll.exe105⤵PID:2424
-
\??\c:\lfrxffx.exec:\lfrxffx.exe106⤵PID:704
-
\??\c:\bntnnh.exec:\bntnnh.exe107⤵PID:2324
-
\??\c:\hbtbnh.exec:\hbtbnh.exe108⤵PID:292
-
\??\c:\vjjjv.exec:\vjjjv.exe109⤵PID:1744
-
\??\c:\xrfflrx.exec:\xrfflrx.exe110⤵PID:2148
-
\??\c:\7rxrxrr.exec:\7rxrxrr.exe111⤵PID:1668
-
\??\c:\nhbhnn.exec:\nhbhnn.exe112⤵PID:1688
-
\??\c:\dpdvv.exec:\dpdvv.exe113⤵PID:2184
-
\??\c:\xrlrfxl.exec:\xrlrfxl.exe114⤵PID:2340
-
\??\c:\xxrlxfx.exec:\xxrlxfx.exe115⤵
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\5nbbhh.exec:\5nbbhh.exe116⤵PID:2096
-
\??\c:\vvjpd.exec:\vvjpd.exe117⤵PID:2348
-
\??\c:\xrffxxl.exec:\xrffxxl.exe118⤵PID:2752
-
\??\c:\rfrrlfl.exec:\rfrrlfl.exe119⤵PID:2820
-
\??\c:\ntbbbt.exec:\ntbbbt.exe120⤵PID:2956
-
\??\c:\5vppv.exec:\5vppv.exe121⤵PID:1632
-
\??\c:\5pjpv.exec:\5pjpv.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-