Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe
-
Size
454KB
-
MD5
5a4c339e50b726872c6ad1500982877a
-
SHA1
ce61bb9657ee9642239eea4a85ec85963bedcbd6
-
SHA256
926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf
-
SHA512
01d3ce3416d602122e9661a13315a9c2f400d76ed71262e09222f2d1cbc4c14205e1f7ac52f4f58931bb3275bfdf60f894675e6c56a82e3c0b583f70089114ed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2536-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-53-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2752-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-71-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1196-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-162-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-202-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2792-200-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2316-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-220-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-239-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1828-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-289-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-626-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1880-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-794-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1740-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-1115-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2700-1134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-1163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-1161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2668-1205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-1249-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1944-1250-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2948-1288-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2032-1310-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3064 1xxxlrx.exe 1436 3htthh.exe 2472 rlflxll.exe 1932 rrxflrf.exe 2720 tnnnbh.exe 3020 tnbntb.exe 2932 nbttbb.exe 2752 hbtbhh.exe 2764 btbtbb.exe 2608 9pjpv.exe 2308 ppjjd.exe 2388 vvpdj.exe 1668 rrffrxl.exe 1220 5pjjv.exe 2652 7jdvj.exe 1196 xxffrrf.exe 872 3jvpv.exe 1908 lrlrfrx.exe 2916 dvjpp.exe 2680 xrffrfr.exe 2792 hnbhnn.exe 832 3pjdd.exe 2316 nhbhbb.exe 2920 tnbntb.exe 916 nntbhh.exe 780 ffxfllx.exe 688 pjdpj.exe 2024 5bbhnt.exe 2104 ddvvp.exe 1828 rlxxlrf.exe 2360 hnntnn.exe 2520 pjpjp.exe 1664 rfxfflx.exe 1900 7hbbnt.exe 2500 1pvvj.exe 484 rrxrxxx.exe 2428 nhtthb.exe 532 3nbbbt.exe 2888 3pdvd.exe 2532 xxrfrxr.exe 2876 lfrxflr.exe 2724 3tbhnn.exe 2188 5dpjp.exe 2648 dpjdp.exe 2624 9fxllrf.exe 2608 9thnbh.exe 2180 9thhtb.exe 992 jjdpv.exe 692 fxrrrrx.exe 1668 lfxxlrf.exe 1220 tnhnth.exe 2148 3dvvj.exe 1968 3lfrffl.exe 2660 bbhthn.exe 1948 bntnbh.exe 1964 dvvdp.exe 2916 fxxrrxf.exe 1672 xrlxlxf.exe 2984 ttnnbh.exe 1412 3jdvj.exe 2448 pjjdj.exe 1832 xxlfflx.exe 1256 lllxxxr.exe 2064 nnhnnt.exe -
resource yara_rule behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-162-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1908-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-200-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2316-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-738-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2632-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-1147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-1176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-1205-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1944-1242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-1288-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2032-1303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-1323-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 3064 2536 926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe 30 PID 2536 wrote to memory of 3064 2536 926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe 30 PID 2536 wrote to memory of 3064 2536 926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe 30 PID 2536 wrote to memory of 3064 2536 926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe 30 PID 3064 wrote to memory of 1436 3064 1xxxlrx.exe 31 PID 3064 wrote to memory of 1436 3064 1xxxlrx.exe 31 PID 3064 wrote to memory of 1436 3064 1xxxlrx.exe 31 PID 3064 wrote to memory of 1436 3064 1xxxlrx.exe 31 PID 1436 wrote to memory of 2472 1436 3htthh.exe 32 PID 1436 wrote to memory of 2472 1436 3htthh.exe 32 PID 1436 wrote to memory of 2472 1436 3htthh.exe 32 PID 1436 wrote to memory of 2472 1436 3htthh.exe 32 PID 2472 wrote to memory of 1932 2472 rlflxll.exe 33 PID 2472 wrote to memory of 1932 2472 rlflxll.exe 33 PID 2472 wrote to memory of 1932 2472 rlflxll.exe 33 PID 2472 wrote to memory of 1932 2472 rlflxll.exe 33 PID 1932 wrote to memory of 2720 1932 rrxflrf.exe 34 PID 1932 wrote to memory of 2720 1932 rrxflrf.exe 34 PID 1932 wrote to memory of 2720 1932 rrxflrf.exe 34 PID 1932 wrote to memory of 2720 1932 rrxflrf.exe 34 PID 2720 wrote to memory of 3020 2720 tnnnbh.exe 35 PID 2720 wrote to memory of 3020 2720 tnnnbh.exe 35 PID 2720 wrote to memory of 3020 2720 tnnnbh.exe 35 PID 2720 wrote to memory of 3020 2720 tnnnbh.exe 35 PID 3020 wrote to memory of 2932 3020 tnbntb.exe 36 PID 3020 wrote to memory of 2932 3020 tnbntb.exe 36 PID 3020 wrote to memory of 2932 3020 tnbntb.exe 36 PID 3020 wrote to memory of 2932 3020 tnbntb.exe 36 PID 2932 wrote to memory of 2752 2932 nbttbb.exe 37 PID 2932 wrote to memory of 2752 2932 nbttbb.exe 37 PID 2932 wrote to memory of 2752 2932 nbttbb.exe 37 PID 2932 wrote to memory of 2752 2932 nbttbb.exe 37 PID 2752 wrote to memory of 2764 2752 hbtbhh.exe 38 PID 2752 wrote to memory of 2764 2752 hbtbhh.exe 38 PID 2752 wrote to memory of 2764 2752 hbtbhh.exe 38 PID 2752 wrote to memory of 2764 2752 hbtbhh.exe 38 PID 2764 wrote to memory of 2608 2764 btbtbb.exe 39 PID 2764 wrote to memory of 2608 2764 btbtbb.exe 39 PID 2764 wrote to memory of 2608 2764 btbtbb.exe 39 PID 2764 wrote to memory of 2608 2764 btbtbb.exe 39 PID 2608 wrote to memory of 2308 2608 9pjpv.exe 40 PID 2608 wrote to memory of 2308 2608 9pjpv.exe 40 PID 2608 wrote to memory of 2308 2608 9pjpv.exe 40 PID 2608 wrote to memory of 2308 2608 9pjpv.exe 40 PID 2308 wrote to memory of 2388 2308 ppjjd.exe 41 PID 2308 wrote to memory of 2388 2308 ppjjd.exe 41 PID 2308 wrote to memory of 2388 2308 ppjjd.exe 41 PID 2308 wrote to memory of 2388 2308 ppjjd.exe 41 PID 2388 wrote to memory of 1668 2388 vvpdj.exe 42 PID 2388 wrote to memory of 1668 2388 vvpdj.exe 42 PID 2388 wrote to memory of 1668 2388 vvpdj.exe 42 PID 2388 wrote to memory of 1668 2388 vvpdj.exe 42 PID 1668 wrote to memory of 1220 1668 rrffrxl.exe 43 PID 1668 wrote to memory of 1220 1668 rrffrxl.exe 43 PID 1668 wrote to memory of 1220 1668 rrffrxl.exe 43 PID 1668 wrote to memory of 1220 1668 rrffrxl.exe 43 PID 1220 wrote to memory of 2652 1220 5pjjv.exe 44 PID 1220 wrote to memory of 2652 1220 5pjjv.exe 44 PID 1220 wrote to memory of 2652 1220 5pjjv.exe 44 PID 1220 wrote to memory of 2652 1220 5pjjv.exe 44 PID 2652 wrote to memory of 1196 2652 7jdvj.exe 45 PID 2652 wrote to memory of 1196 2652 7jdvj.exe 45 PID 2652 wrote to memory of 1196 2652 7jdvj.exe 45 PID 2652 wrote to memory of 1196 2652 7jdvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe"C:\Users\Admin\AppData\Local\Temp\926786eee1ee959512027b39f85f34eb60a6492a5bfd1022b11da3fb25ce1fcf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1xxxlrx.exec:\1xxxlrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\3htthh.exec:\3htthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\rlflxll.exec:\rlflxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\rrxflrf.exec:\rrxflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tnnnbh.exec:\tnnnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tnbntb.exec:\tnbntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nbttbb.exec:\nbttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hbtbhh.exec:\hbtbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\btbtbb.exec:\btbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\9pjpv.exec:\9pjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\ppjjd.exec:\ppjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\vvpdj.exec:\vvpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rrffrxl.exec:\rrffrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\5pjjv.exec:\5pjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\7jdvj.exec:\7jdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xxffrrf.exec:\xxffrrf.exe17⤵
- Executes dropped EXE
PID:1196 -
\??\c:\3jvpv.exec:\3jvpv.exe18⤵
- Executes dropped EXE
PID:872 -
\??\c:\lrlrfrx.exec:\lrlrfrx.exe19⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvjpp.exec:\dvjpp.exe20⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrffrfr.exec:\xrffrfr.exe21⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hnbhnn.exec:\hnbhnn.exe22⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3pjdd.exec:\3pjdd.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\nhbhbb.exec:\nhbhbb.exe24⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tnbntb.exec:\tnbntb.exe25⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nntbhh.exec:\nntbhh.exe26⤵
- Executes dropped EXE
PID:916 -
\??\c:\ffxfllx.exec:\ffxfllx.exe27⤵
- Executes dropped EXE
PID:780 -
\??\c:\pjdpj.exec:\pjdpj.exe28⤵
- Executes dropped EXE
PID:688 -
\??\c:\5bbhnt.exec:\5bbhnt.exe29⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ddvvp.exec:\ddvvp.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe31⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hnntnn.exec:\hnntnn.exe32⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pjpjp.exec:\pjpjp.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rfxfflx.exec:\rfxfflx.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7hbbnt.exec:\7hbbnt.exe35⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1pvvj.exec:\1pvvj.exe36⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rrxrxxx.exec:\rrxrxxx.exe37⤵
- Executes dropped EXE
PID:484 -
\??\c:\nhtthb.exec:\nhtthb.exe38⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3nbbbt.exec:\3nbbbt.exe39⤵
- Executes dropped EXE
PID:532 -
\??\c:\3pdvd.exec:\3pdvd.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xxrfrxr.exec:\xxrfrxr.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfrxflr.exec:\lfrxflr.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3tbhnn.exec:\3tbhnn.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5dpjp.exec:\5dpjp.exe44⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dpjdp.exec:\dpjdp.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9fxllrf.exec:\9fxllrf.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9thnbh.exec:\9thnbh.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9thhtb.exec:\9thhtb.exe48⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jjdpv.exec:\jjdpv.exe49⤵
- Executes dropped EXE
PID:992 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe50⤵
- Executes dropped EXE
PID:692 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tnhnth.exec:\tnhnth.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\3dvvj.exec:\3dvvj.exe53⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3lfrffl.exec:\3lfrffl.exe54⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bbhthn.exec:\bbhthn.exe55⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bntnbh.exec:\bntnbh.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvvdp.exec:\dvvdp.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fxxrrxf.exec:\fxxrrxf.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrlxlxf.exec:\xrlxlxf.exe59⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ttnnbh.exec:\ttnnbh.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\3jdvj.exec:\3jdvj.exe61⤵
- Executes dropped EXE
PID:1412 -
\??\c:\pjjdj.exec:\pjjdj.exe62⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xxlfflx.exec:\xxlfflx.exe63⤵
- Executes dropped EXE
PID:1832 -
\??\c:\lllxxxr.exec:\lllxxxr.exe64⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nnhnnt.exec:\nnhnnt.exe65⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jdvpd.exec:\jdvpd.exe66⤵PID:1464
-
\??\c:\pdvvd.exec:\pdvvd.exe67⤵PID:1684
-
\??\c:\lfrrflr.exec:\lfrrflr.exe68⤵PID:780
-
\??\c:\ttnttb.exec:\ttnttb.exe69⤵PID:2000
-
\??\c:\bnbbtt.exec:\bnbbtt.exe70⤵PID:1468
-
\??\c:\pvpvd.exec:\pvpvd.exe71⤵PID:2312
-
\??\c:\rlxflrx.exec:\rlxflrx.exe72⤵PID:344
-
\??\c:\ffxxrxr.exec:\ffxxrxr.exe73⤵PID:1812
-
\??\c:\btnhtn.exec:\btnhtn.exe74⤵PID:2080
-
\??\c:\pjdvj.exec:\pjdvj.exe75⤵PID:880
-
\??\c:\jdvvd.exec:\jdvvd.exe76⤵PID:1704
-
\??\c:\rlxxflr.exec:\rlxxflr.exe77⤵PID:2060
-
\??\c:\9btbbh.exec:\9btbbh.exe78⤵PID:1516
-
\??\c:\btnthn.exec:\btnthn.exe79⤵PID:1912
-
\??\c:\dvdjj.exec:\dvdjj.exe80⤵PID:2292
-
\??\c:\1lxrxfl.exec:\1lxrxfl.exe81⤵PID:2848
-
\??\c:\rfxrrfr.exec:\rfxrrfr.exe82⤵PID:2328
-
\??\c:\hthnbb.exec:\hthnbb.exe83⤵PID:3020
-
\??\c:\ppjvd.exec:\ppjvd.exe84⤵PID:2780
-
\??\c:\jjdjv.exec:\jjdjv.exe85⤵PID:2856
-
\??\c:\flxrflx.exec:\flxrflx.exe86⤵PID:2692
-
\??\c:\5nhhhh.exec:\5nhhhh.exe87⤵PID:1952
-
\??\c:\tntbnn.exec:\tntbnn.exe88⤵PID:2528
-
\??\c:\dpdjj.exec:\dpdjj.exe89⤵PID:2656
-
\??\c:\rlrxffl.exec:\rlrxffl.exe90⤵PID:2568
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe91⤵PID:2152
-
\??\c:\hnnhhn.exec:\hnnhhn.exe92⤵PID:568
-
\??\c:\7djjd.exec:\7djjd.exe93⤵PID:2120
-
\??\c:\pdvdj.exec:\pdvdj.exe94⤵PID:2872
-
\??\c:\7xrxlrl.exec:\7xrxlrl.exe95⤵
- System Location Discovery: System Language Discovery
PID:1896 -
\??\c:\nnhbnt.exec:\nnhbnt.exe96⤵PID:1880
-
\??\c:\9jdjv.exec:\9jdjv.exe97⤵PID:2012
-
\??\c:\vpppv.exec:\vpppv.exe98⤵PID:1192
-
\??\c:\llfxffl.exec:\llfxffl.exe99⤵PID:1588
-
\??\c:\3rxrrll.exec:\3rxrrll.exe100⤵PID:1948
-
\??\c:\bbbbbb.exec:\bbbbbb.exe101⤵PID:2824
-
\??\c:\ppjpp.exec:\ppjpp.exe102⤵PID:2076
-
\??\c:\9djjj.exec:\9djjj.exe103⤵PID:1716
-
\??\c:\5llxxrx.exec:\5llxxrx.exe104⤵PID:2632
-
\??\c:\bhnhnn.exec:\bhnhnn.exe105⤵PID:1412
-
\??\c:\7hbnnh.exec:\7hbnnh.exe106⤵PID:2448
-
\??\c:\jdppp.exec:\jdppp.exe107⤵PID:2432
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe108⤵PID:1256
-
\??\c:\9xffxxl.exec:\9xffxxl.exe109⤵PID:2064
-
\??\c:\nhnhnb.exec:\nhnhnb.exe110⤵PID:1688
-
\??\c:\9vjjd.exec:\9vjjd.exe111⤵PID:1992
-
\??\c:\jdjjp.exec:\jdjjp.exe112⤵PID:320
-
\??\c:\lrxxxrx.exec:\lrxxxrx.exe113⤵PID:2000
-
\??\c:\1tbtnh.exec:\1tbtnh.exe114⤵PID:688
-
\??\c:\htbbnh.exec:\htbbnh.exe115⤵PID:2052
-
\??\c:\jdvvp.exec:\jdvvp.exe116⤵PID:1936
-
\??\c:\fxxfxxf.exec:\fxxfxxf.exe117⤵PID:1812
-
\??\c:\xrflxfr.exec:\xrflxfr.exe118⤵PID:1788
-
\??\c:\bnhhnn.exec:\bnhhnn.exe119⤵PID:2360
-
\??\c:\hbnthb.exec:\hbnthb.exe120⤵PID:3064
-
\??\c:\jvjdv.exec:\jvjdv.exe121⤵PID:1628
-
\??\c:\7xrrrfr.exec:\7xrrrfr.exe122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-