Analysis
- max time kernel
120s - max time network
119s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
- Target 719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe
- Size 454KB
- Sample250108-e9pw8swrem
- SHA256 719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607
- MD5 004b666e16e39a56f71de2f4c7eaeef2
- SHA1 9fa2ef8493ec383afd92712e4cf2242fcb49011f
- SHA512 776fb216d4ea57bcab309b2921df69bbdbb82080ba1ab8d2e8cf6b9a5883dbe2ffe8010994a5a99fd4811598cfdab7b10f3ac66ae7f31b6d195e7a4b531cd7d5
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTi:q7Tc2NYHUrAwfMp3CDO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2448-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-200-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2812-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-410-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2160-429-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-500-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1784-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-510-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-549-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-551-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2300-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-548-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-600-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2976-637-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2728-644-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/3068-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-666-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1376-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-714-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-771-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-810-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2620-940-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-964-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2624-966-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1556-973-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2816-980-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/920-1041-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-1102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1880 u244602.exe 2376 nbnbhh.exe 1732 dvppd.exe 3060 82402.exe 2700 xfxfxxl.exe 2880 hhttbb.exe 2912 lfxrxlf.exe 2976 hhntbn.exe 2812 608062.exe 2892 3hhbth.exe 2664 9vjpv.exe 2896 2080624.exe 1816 264604.exe 2816 jvpjj.exe 1556 6400006.exe 1836 rxxfrfl.exe 2580 24802.exe 1408 4868062.exe 2768 046866.exe 2848 rxxfrrx.exe 2204 q86800.exe 2156 2028006.exe 536 i806284.exe 1164 c404044.exe 3016 fxrffrl.exe 1716 020000.exe 1684 q62888.exe 604 6606666.exe 2300 c800666.exe 1924 428222.exe 2560 flxrxrx.exe 1444 42440.exe 904 q02848.exe 1540 jvddj.exe 2124 s4884.exe 2388 06646.exe 1732 ppvjp.exe 2736 dvjpp.exe 2700 bthntb.exe 2880 7jdjv.exe 2912 ffrrflx.exe 2760 hhhtbb.exe 2812 nnhhtb.exe 2588 thttbb.exe 2796 s4624.exe 2668 44846.exe 2644 820662.exe 2284 9jddj.exe 2028 xrlrffr.exe 748 9hbhtb.exe 1512 0428002.exe 2160 484066.exe 1768 82028.exe 1408 q60688.exe 1264 xrfrxlr.exe 1584 bhhhbb.exe 1612 7nbhbh.exe 2208 8268028.exe 1544 rrxlxff.exe 2936 48006.exe 2156 dddvv.exe 2956 xffxfxx.exe 1308 2080226.exe 1784 q60266.exe -
resource yara_rule behavioral1/memory/2448-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-409-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1584-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-514-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2476-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-714-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2940-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-940-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-980-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/920-1041-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2000044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2022828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8020662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6800006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8646828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8026262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2628802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2640880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8026828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1880 2448 719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe 30 PID 2448 wrote to memory of 1880 2448 719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe 30 PID 2448 wrote to memory of 1880 2448 719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe 30 PID 2448 wrote to memory of 1880 2448 719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe 30 PID 1880 wrote to memory of 2376 1880 u244602.exe 31 PID 1880 wrote to memory of 2376 1880 u244602.exe 31 PID 1880 wrote to memory of 2376 1880 u244602.exe 31 PID 1880 wrote to memory of 2376 1880 u244602.exe 31 PID 2376 wrote to memory of 1732 2376 nbnbhh.exe 32 PID 2376 wrote to memory of 1732 2376 nbnbhh.exe 32 PID 2376 wrote to memory of 1732 2376 nbnbhh.exe 32 PID 2376 wrote to memory of 1732 2376 nbnbhh.exe 32 PID 1732 wrote to memory of 3060 1732 dvppd.exe 33 PID 1732 wrote to memory of 3060 1732 dvppd.exe 33 PID 1732 wrote to memory of 3060 1732 dvppd.exe 33 PID 1732 wrote to memory of 3060 1732 dvppd.exe 33 PID 3060 wrote to memory of 2700 3060 82402.exe 68 PID 3060 wrote to memory of 2700 3060 82402.exe 68 PID 3060 wrote to memory of 2700 3060 82402.exe 68 PID 3060 wrote to memory of 2700 3060 82402.exe 68 PID 2700 wrote to memory of 2880 2700 xfxfxxl.exe 35 PID 2700 wrote to memory of 2880 2700 xfxfxxl.exe 35 PID 2700 wrote to memory of 2880 2700 xfxfxxl.exe 35 PID 2700 wrote to memory of 2880 2700 xfxfxxl.exe 35 PID 2880 wrote to memory of 2912 2880 hhttbb.exe 36 PID 2880 wrote to memory of 2912 2880 hhttbb.exe 36 PID 2880 wrote to memory of 2912 2880 hhttbb.exe 36 PID 2880 wrote to memory of 2912 2880 hhttbb.exe 36 PID 2912 wrote to memory of 2976 2912 lfxrxlf.exe 37 PID 2912 wrote to memory of 2976 2912 lfxrxlf.exe 37 PID 2912 wrote to memory of 2976 2912 lfxrxlf.exe 37 PID 2912 wrote to memory of 2976 2912 lfxrxlf.exe 37 PID 2976 wrote to memory of 2812 2976 hhntbn.exe 38 PID 2976 wrote to memory of 2812 2976 hhntbn.exe 38 PID 2976 wrote to memory of 2812 2976 hhntbn.exe 38 PID 2976 wrote to memory of 2812 2976 hhntbn.exe 38 PID 2812 wrote to memory of 2892 2812 608062.exe 39 PID 2812 wrote to memory of 2892 2812 608062.exe 39 PID 2812 wrote to memory of 2892 2812 608062.exe 39 PID 2812 wrote to memory of 2892 2812 608062.exe 39 PID 2892 wrote to memory of 2664 2892 3hhbth.exe 40 PID 2892 wrote to memory of 2664 2892 3hhbth.exe 40 PID 2892 wrote to memory of 2664 2892 3hhbth.exe 40 PID 2892 wrote to memory of 2664 2892 3hhbth.exe 40 PID 2664 wrote to memory of 2896 2664 9vjpv.exe 41 PID 2664 wrote to memory of 2896 2664 9vjpv.exe 41 PID 2664 wrote to memory of 2896 2664 9vjpv.exe 41 PID 2664 wrote to memory of 2896 2664 9vjpv.exe 41 PID 2896 wrote to memory of 1816 2896 2080624.exe 42 PID 2896 wrote to memory of 1816 2896 2080624.exe 42 PID 2896 wrote to memory of 1816 2896 2080624.exe 42 PID 2896 wrote to memory of 1816 2896 2080624.exe 42 PID 1816 wrote to memory of 2816 1816 264604.exe 43 PID 1816 wrote to memory of 2816 1816 264604.exe 43 PID 1816 wrote to memory of 2816 1816 264604.exe 43 PID 1816 wrote to memory of 2816 1816 264604.exe 43 PID 2816 wrote to memory of 1556 2816 jvpjj.exe 44 PID 2816 wrote to memory of 1556 2816 jvpjj.exe 44 PID 2816 wrote to memory of 1556 2816 jvpjj.exe 44 PID 2816 wrote to memory of 1556 2816 jvpjj.exe 44 PID 1556 wrote to memory of 1836 1556 6400006.exe 45 PID 1556 wrote to memory of 1836 1556 6400006.exe 45 PID 1556 wrote to memory of 1836 1556 6400006.exe 45 PID 1556 wrote to memory of 1836 1556 6400006.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe"C:\Users\Admin\AppData\Local\Temp\719f299931f655025333acf8f1072c05ed54741822134f6479d9ad889ba4a607.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\u244602.exec:\u244602.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\nbnbhh.exec:\nbnbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\dvppd.exec:\dvppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\82402.exec:\82402.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xfxfxxl.exec:\xfxfxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hhttbb.exec:\hhttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\lfxrxlf.exec:\lfxrxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hhntbn.exec:\hhntbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\608062.exec:\608062.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\3hhbth.exec:\3hhbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9vjpv.exec:\9vjpv.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\2080624.exec:\2080624.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\264604.exec:\264604.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jvpjj.exec:\jvpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\6400006.exec:\6400006.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\rxxfrfl.exec:\rxxfrfl.exe17⤵
- Executes dropped EXE
PID:1836 -
\??\c:\24802.exec:\24802.exe18⤵
- Executes dropped EXE
PID:2580 -
\??\c:\4868062.exec:\4868062.exe19⤵
- Executes dropped EXE
PID:1408 -
\??\c:\046866.exec:\046866.exe20⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rxxfrrx.exec:\rxxfrrx.exe21⤵
- Executes dropped EXE
PID:2848 -
\??\c:\q86800.exec:\q86800.exe22⤵
- Executes dropped EXE
PID:2204 -
\??\c:\2028006.exec:\2028006.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\i806284.exec:\i806284.exe24⤵
- Executes dropped EXE
PID:536 -
\??\c:\c404044.exec:\c404044.exe25⤵
- Executes dropped EXE
PID:1164 -
\??\c:\fxrffrl.exec:\fxrffrl.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\020000.exec:\020000.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\q62888.exec:\q62888.exe28⤵
- Executes dropped EXE
PID:1684 -
\??\c:\6606666.exec:\6606666.exe29⤵
- Executes dropped EXE
PID:604 -
\??\c:\c800666.exec:\c800666.exe30⤵
- Executes dropped EXE
PID:2300 -
\??\c:\428222.exec:\428222.exe31⤵
- Executes dropped EXE
PID:1924 -
\??\c:\flxrxrx.exec:\flxrxrx.exe32⤵
- Executes dropped EXE
PID:2560 -
\??\c:\42440.exec:\42440.exe33⤵
- Executes dropped EXE
PID:1444 -
\??\c:\q02848.exec:\q02848.exe34⤵
- Executes dropped EXE
PID:904 -
\??\c:\jvddj.exec:\jvddj.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\s4884.exec:\s4884.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\06646.exec:\06646.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ppvjp.exec:\ppvjp.exe38⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvjpp.exec:\dvjpp.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bthntb.exec:\bthntb.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7jdjv.exec:\7jdjv.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ffrrflx.exec:\ffrrflx.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hhhtbb.exec:\hhhtbb.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnhhtb.exec:\nnhhtb.exe44⤵
- Executes dropped EXE
PID:2812 -
\??\c:\thttbb.exec:\thttbb.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\s4624.exec:\s4624.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\44846.exec:\44846.exe47⤵
- Executes dropped EXE
PID:2668 -
\??\c:\820662.exec:\820662.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9jddj.exec:\9jddj.exe49⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xrlrffr.exec:\xrlrffr.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9hbhtb.exec:\9hbhtb.exe51⤵
- Executes dropped EXE
PID:748 -
\??\c:\0428002.exec:\0428002.exe52⤵
- Executes dropped EXE
PID:1512 -
\??\c:\484066.exec:\484066.exe53⤵
- Executes dropped EXE
PID:2160 -
\??\c:\82028.exec:\82028.exe54⤵
- Executes dropped EXE
PID:1768 -
\??\c:\q60688.exec:\q60688.exe55⤵
- Executes dropped EXE
PID:1408 -
\??\c:\xrfrxlr.exec:\xrfrxlr.exe56⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bhhhbb.exec:\bhhhbb.exe57⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7nbhbh.exec:\7nbhbh.exe58⤵
- Executes dropped EXE
PID:1612 -
\??\c:\8268028.exec:\8268028.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rrxlxff.exec:\rrxlxff.exe60⤵
- Executes dropped EXE
PID:1544 -
\??\c:\48006.exec:\48006.exe61⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dddvv.exec:\dddvv.exe62⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xffxfxx.exec:\xffxfxx.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\2080226.exec:\2080226.exe64⤵
- Executes dropped EXE
PID:1308 -
\??\c:\q60266.exec:\q60266.exe65⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5htbbn.exec:\5htbbn.exe66⤵PID:344
-
\??\c:\9rlllrf.exec:\9rlllrf.exe67⤵PID:2568
-
\??\c:\5hbhtb.exec:\5hbhtb.exe68⤵PID:828
-
\??\c:\26402.exec:\26402.exe69⤵PID:2476
-
\??\c:\i480280.exec:\i480280.exe70⤵PID:1988
-
\??\c:\w08088.exec:\w08088.exe71⤵PID:2300
-
\??\c:\44286.exec:\44286.exe72⤵
- System Location Discovery: System Language Discovery
PID:348 -
\??\c:\8268026.exec:\8268026.exe73⤵PID:1976
-
\??\c:\2060688.exec:\2060688.exe74⤵PID:3044
-
\??\c:\1vjpv.exec:\1vjpv.exe75⤵PID:1972
-
\??\c:\o444220.exec:\o444220.exe76⤵PID:2312
-
\??\c:\rlflflx.exec:\rlflflx.exe77⤵PID:2484
-
\??\c:\660240.exec:\660240.exe78⤵PID:2376
-
\??\c:\6420868.exec:\6420868.exe79⤵PID:2508
-
\??\c:\g0462.exec:\g0462.exe80⤵PID:2788
-
\??\c:\tnhtbb.exec:\tnhtbb.exe81⤵PID:2736
-
\??\c:\60840.exec:\60840.exe82⤵PID:2368
-
\??\c:\a6446.exec:\a6446.exe83⤵PID:2716
-
\??\c:\c602060.exec:\c602060.exe84⤵PID:2800
-
\??\c:\04080.exec:\04080.exe85⤵PID:2976
-
\??\c:\k48424.exec:\k48424.exe86⤵PID:2728
-
\??\c:\42028.exec:\42028.exe87⤵PID:1756
-
\??\c:\60228.exec:\60228.exe88⤵PID:3056
-
\??\c:\ppdjv.exec:\ppdjv.exe89⤵PID:3068
-
\??\c:\e26222.exec:\e26222.exe90⤵PID:2296
-
\??\c:\1rxlrlr.exec:\1rxlrlr.exe91⤵PID:2272
-
\??\c:\9xxxlrl.exec:\9xxxlrl.exe92⤵PID:1588
-
\??\c:\pvppv.exec:\pvppv.exe93⤵PID:1984
-
\??\c:\1htttb.exec:\1htttb.exe94⤵PID:2496
-
\??\c:\5jvdd.exec:\5jvdd.exe95⤵PID:1512
-
\??\c:\08668.exec:\08668.exe96⤵PID:1376
-
\??\c:\042866.exec:\042866.exe97⤵PID:1768
-
\??\c:\btttnn.exec:\btttnn.exe98⤵PID:2688
-
\??\c:\3ddvv.exec:\3ddvv.exe99⤵PID:2940
-
\??\c:\bbhbhb.exec:\bbhbhb.exe100⤵PID:2116
-
\??\c:\e04084.exec:\e04084.exe101⤵PID:2412
-
\??\c:\7nhbhh.exec:\7nhbhh.exe102⤵PID:2852
-
\??\c:\7nbhht.exec:\7nbhht.exe103⤵PID:788
-
\??\c:\vpjjd.exec:\vpjjd.exe104⤵PID:1412
-
\??\c:\pdpvv.exec:\pdpvv.exe105⤵PID:3004
-
\??\c:\xllrlrl.exec:\xllrlrl.exe106⤵PID:752
-
\??\c:\dpvpv.exec:\dpvpv.exe107⤵PID:948
-
\??\c:\48488.exec:\48488.exe108⤵PID:564
-
\??\c:\rllxfrr.exec:\rllxfrr.exe109⤵PID:888
-
\??\c:\e80666.exec:\e80666.exe110⤵PID:2568
-
\??\c:\w46288.exec:\w46288.exe111⤵PID:828
-
\??\c:\820060.exec:\820060.exe112⤵PID:2476
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe113⤵PID:1988
-
\??\c:\jdjpp.exec:\jdjpp.exe114⤵PID:1572
-
\??\c:\0800046.exec:\0800046.exe115⤵PID:348
-
\??\c:\htttht.exec:\htttht.exe116⤵PID:1600
-
\??\c:\608026.exec:\608026.exe117⤵PID:2488
-
\??\c:\7lxrrrx.exec:\7lxrrrx.exe118⤵PID:2468
-
\??\c:\04280.exec:\04280.exe119⤵PID:1800
-
\??\c:\nhnbtb.exec:\nhnbtb.exe120⤵PID:1880
-
\??\c:\0468002.exec:\0468002.exe121⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-