Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe
-
Size
453KB
-
MD5
5a12c3490b86f357604b846e61123670
-
SHA1
ffc478383b3966864e9999f72e4617f4b14d62d5
-
SHA256
68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238
-
SHA512
6628f4c28c441b27ccc07e08bb9224a11f13749ce44f3be99a8c9dc346ed19eb8b58e09e64d9bceb9b49b023a4320d12c34c72c8239eb8bb03a584b4300138aa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-92-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2764-90-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2236-110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-995-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-1095-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2576 9vvdj.exe 2680 xxrfflr.exe 2164 fflllxf.exe 2924 7pddj.exe 2880 rfrrfll.exe 2292 rfrfflx.exe 3016 pvdvd.exe 2688 bbnbhn.exe 2764 vvdjd.exe 2616 5rllllr.exe 2236 jppvd.exe 1156 thbhth.exe 2816 dpjpd.exe 284 nththn.exe 1340 hntnth.exe 1356 pvdjv.exe 2104 bbnnbb.exe 1528 hnttnb.exe 2972 xxrxflf.exe 1960 flflrxf.exe 2116 lrfflrx.exe 2988 tbntbn.exe 2544 pjpvj.exe 1784 pvddp.exe 904 5jvdp.exe 2456 nnbbhn.exe 1728 jjvdp.exe 3052 xfflxfr.exe 2416 bhtbhn.exe 1732 rxrlrxf.exe 2324 bnnnhn.exe 1828 3hbbhn.exe 1592 ffllrxf.exe 2684 pvjpd.exe 2796 ddpvv.exe 2728 1lxfrxf.exe 2908 nhhhtb.exe 2184 7nhnnb.exe 2732 ppdjj.exe 2888 fflflfl.exe 2624 btnnnt.exe 2628 9thntt.exe 2772 jjjpv.exe 2652 lfxrlrx.exe 2644 bntthh.exe 2768 bhthnt.exe 772 1vppp.exe 320 llxflxx.exe 380 3rfxxxf.exe 2828 ntnbnb.exe 2420 jjjjd.exe 1340 7rfxffl.exe 1744 3xfflff.exe 576 5thnth.exe 1080 vdjjj.exe 2936 ddpvv.exe 2992 llllfxx.exe 2092 1rlllrr.exe 2380 hhtthn.exe 1872 ppddd.exe 688 1lxxxff.exe 2100 fxflxfl.exe 308 nhhntt.exe 1692 tttbht.exe -
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-1123-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2576 2504 68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe 30 PID 2504 wrote to memory of 2576 2504 68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe 30 PID 2504 wrote to memory of 2576 2504 68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe 30 PID 2504 wrote to memory of 2576 2504 68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe 30 PID 2576 wrote to memory of 2680 2576 9vvdj.exe 31 PID 2576 wrote to memory of 2680 2576 9vvdj.exe 31 PID 2576 wrote to memory of 2680 2576 9vvdj.exe 31 PID 2576 wrote to memory of 2680 2576 9vvdj.exe 31 PID 2680 wrote to memory of 2164 2680 xxrfflr.exe 32 PID 2680 wrote to memory of 2164 2680 xxrfflr.exe 32 PID 2680 wrote to memory of 2164 2680 xxrfflr.exe 32 PID 2680 wrote to memory of 2164 2680 xxrfflr.exe 32 PID 2164 wrote to memory of 2924 2164 fflllxf.exe 33 PID 2164 wrote to memory of 2924 2164 fflllxf.exe 33 PID 2164 wrote to memory of 2924 2164 fflllxf.exe 33 PID 2164 wrote to memory of 2924 2164 fflllxf.exe 33 PID 2924 wrote to memory of 2880 2924 7pddj.exe 34 PID 2924 wrote to memory of 2880 2924 7pddj.exe 34 PID 2924 wrote to memory of 2880 2924 7pddj.exe 34 PID 2924 wrote to memory of 2880 2924 7pddj.exe 34 PID 2880 wrote to memory of 2292 2880 rfrrfll.exe 35 PID 2880 wrote to memory of 2292 2880 rfrrfll.exe 35 PID 2880 wrote to memory of 2292 2880 rfrrfll.exe 35 PID 2880 wrote to memory of 2292 2880 rfrrfll.exe 35 PID 2292 wrote to memory of 3016 2292 rfrfflx.exe 36 PID 2292 wrote to memory of 3016 2292 rfrfflx.exe 36 PID 2292 wrote to memory of 3016 2292 rfrfflx.exe 36 PID 2292 wrote to memory of 3016 2292 rfrfflx.exe 36 PID 3016 wrote to memory of 2688 3016 pvdvd.exe 37 PID 3016 wrote to memory of 2688 3016 pvdvd.exe 37 PID 3016 wrote to memory of 2688 3016 pvdvd.exe 37 PID 3016 wrote to memory of 2688 3016 pvdvd.exe 37 PID 2688 wrote to memory of 2764 2688 bbnbhn.exe 38 PID 2688 wrote to memory of 2764 2688 bbnbhn.exe 38 PID 2688 wrote to memory of 2764 2688 bbnbhn.exe 38 PID 2688 wrote to memory of 2764 2688 bbnbhn.exe 38 PID 2764 wrote to memory of 2616 2764 vvdjd.exe 39 PID 2764 wrote to memory of 2616 2764 vvdjd.exe 39 PID 2764 wrote to memory of 2616 2764 vvdjd.exe 39 PID 2764 wrote to memory of 2616 2764 vvdjd.exe 39 PID 2616 wrote to memory of 2236 2616 5rllllr.exe 40 PID 2616 wrote to memory of 2236 2616 5rllllr.exe 40 PID 2616 wrote to memory of 2236 2616 5rllllr.exe 40 PID 2616 wrote to memory of 2236 2616 5rllllr.exe 40 PID 2236 wrote to memory of 1156 2236 jppvd.exe 41 PID 2236 wrote to memory of 1156 2236 jppvd.exe 41 PID 2236 wrote to memory of 1156 2236 jppvd.exe 41 PID 2236 wrote to memory of 1156 2236 jppvd.exe 41 PID 1156 wrote to memory of 2816 1156 thbhth.exe 42 PID 1156 wrote to memory of 2816 1156 thbhth.exe 42 PID 1156 wrote to memory of 2816 1156 thbhth.exe 42 PID 1156 wrote to memory of 2816 1156 thbhth.exe 42 PID 2816 wrote to memory of 284 2816 dpjpd.exe 43 PID 2816 wrote to memory of 284 2816 dpjpd.exe 43 PID 2816 wrote to memory of 284 2816 dpjpd.exe 43 PID 2816 wrote to memory of 284 2816 dpjpd.exe 43 PID 284 wrote to memory of 1340 284 nththn.exe 44 PID 284 wrote to memory of 1340 284 nththn.exe 44 PID 284 wrote to memory of 1340 284 nththn.exe 44 PID 284 wrote to memory of 1340 284 nththn.exe 44 PID 1340 wrote to memory of 1356 1340 hntnth.exe 45 PID 1340 wrote to memory of 1356 1340 hntnth.exe 45 PID 1340 wrote to memory of 1356 1340 hntnth.exe 45 PID 1340 wrote to memory of 1356 1340 hntnth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe"C:\Users\Admin\AppData\Local\Temp\68289eacb30dd7d55724dceca8bab010681fa67c81740c781ddd49a44ec6e238N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9vvdj.exec:\9vvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\xxrfflr.exec:\xxrfflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fflllxf.exec:\fflllxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\7pddj.exec:\7pddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rfrrfll.exec:\rfrrfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rfrfflx.exec:\rfrfflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pvdvd.exec:\pvdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bbnbhn.exec:\bbnbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\vvdjd.exec:\vvdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5rllllr.exec:\5rllllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jppvd.exec:\jppvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\thbhth.exec:\thbhth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\dpjpd.exec:\dpjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nththn.exec:\nththn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\hntnth.exec:\hntnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\pvdjv.exec:\pvdjv.exe17⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bbnnbb.exec:\bbnnbb.exe18⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hnttnb.exec:\hnttnb.exe19⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xxrxflf.exec:\xxrxflf.exe20⤵
- Executes dropped EXE
PID:2972 -
\??\c:\flflrxf.exec:\flflrxf.exe21⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lrfflrx.exec:\lrfflrx.exe22⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tbntbn.exec:\tbntbn.exe23⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pjpvj.exec:\pjpvj.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\pvddp.exec:\pvddp.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5jvdp.exec:\5jvdp.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\nnbbhn.exec:\nnbbhn.exe27⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jjvdp.exec:\jjvdp.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xfflxfr.exec:\xfflxfr.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bhtbhn.exec:\bhtbhn.exe30⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rxrlrxf.exec:\rxrlrxf.exe31⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bnnnhn.exec:\bnnnhn.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3hbbhn.exec:\3hbbhn.exe33⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ffllrxf.exec:\ffllrxf.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pvjpd.exec:\pvjpd.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ddpvv.exec:\ddpvv.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1lxfrxf.exec:\1lxfrxf.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nhhhtb.exec:\nhhhtb.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7nhnnb.exec:\7nhnnb.exe39⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ppdjj.exec:\ppdjj.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fflflfl.exec:\fflflfl.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\btnnnt.exec:\btnnnt.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9thntt.exec:\9thntt.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jjjpv.exec:\jjjpv.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfxrlrx.exec:\lfxrlrx.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bntthh.exec:\bntthh.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bhthnt.exec:\bhthnt.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\1vppp.exec:\1vppp.exe48⤵
- Executes dropped EXE
PID:772 -
\??\c:\llxflxx.exec:\llxflxx.exe49⤵
- Executes dropped EXE
PID:320 -
\??\c:\3rfxxxf.exec:\3rfxxxf.exe50⤵
- Executes dropped EXE
PID:380 -
\??\c:\ntnbnb.exec:\ntnbnb.exe51⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jjjjd.exec:\jjjjd.exe52⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7rfxffl.exec:\7rfxffl.exe53⤵
- Executes dropped EXE
PID:1340 -
\??\c:\3xfflff.exec:\3xfflff.exe54⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5thnth.exec:\5thnth.exe55⤵
- Executes dropped EXE
PID:576 -
\??\c:\vdjjj.exec:\vdjjj.exe56⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ddpvv.exec:\ddpvv.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\llllfxx.exec:\llllfxx.exe58⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1rlllrr.exec:\1rlllrr.exe59⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hhtthn.exec:\hhtthn.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ppddd.exec:\ppddd.exe61⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1lxxxff.exec:\1lxxxff.exe62⤵
- Executes dropped EXE
PID:688 -
\??\c:\fxflxfl.exec:\fxflxfl.exe63⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nhhntt.exec:\nhhntt.exe64⤵
- Executes dropped EXE
PID:308 -
\??\c:\tttbht.exec:\tttbht.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5vjdd.exec:\5vjdd.exe66⤵PID:1924
-
\??\c:\5xrxflr.exec:\5xrxflr.exe67⤵PID:2208
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe68⤵PID:304
-
\??\c:\ttntbb.exec:\ttntbb.exe69⤵PID:1900
-
\??\c:\9pjjj.exec:\9pjjj.exe70⤵PID:1628
-
\??\c:\xflflrf.exec:\xflflrf.exe71⤵PID:1088
-
\??\c:\1xrxffl.exec:\1xrxffl.exe72⤵PID:2416
-
\??\c:\hnhntb.exec:\hnhntb.exe73⤵PID:2368
-
\??\c:\dpjpv.exec:\dpjpv.exe74⤵PID:2324
-
\??\c:\3pjpv.exec:\3pjpv.exe75⤵PID:2920
-
\??\c:\ffxrllr.exec:\ffxrllr.exe76⤵PID:1604
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe77⤵PID:2000
-
\??\c:\9hbthh.exec:\9hbthh.exe78⤵PID:792
-
\??\c:\1pdjj.exec:\1pdjj.exe79⤵PID:2924
-
\??\c:\pjvdj.exec:\pjvdj.exe80⤵PID:2848
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe81⤵PID:2860
-
\??\c:\7thhnt.exec:\7thhnt.exe82⤵PID:1932
-
\??\c:\tbntbb.exec:\tbntbb.exe83⤵PID:2732
-
\??\c:\pdpvd.exec:\pdpvd.exe84⤵PID:2888
-
\??\c:\9rrrffl.exec:\9rrrffl.exe85⤵PID:2964
-
\??\c:\xxllrxf.exec:\xxllrxf.exe86⤵PID:2764
-
\??\c:\3dvjp.exec:\3dvjp.exe87⤵PID:2240
-
\??\c:\vvjjv.exec:\vvjjv.exe88⤵PID:2720
-
\??\c:\lrllffr.exec:\lrllffr.exe89⤵PID:2236
-
\??\c:\xxfllrx.exec:\xxfllrx.exe90⤵PID:536
-
\??\c:\bbnthn.exec:\bbnthn.exe91⤵PID:1132
-
\??\c:\9vvvv.exec:\9vvvv.exe92⤵PID:1284
-
\??\c:\llrfllr.exec:\llrfllr.exe93⤵PID:1112
-
\??\c:\llrxffl.exec:\llrxffl.exe94⤵PID:1448
-
\??\c:\bttttt.exec:\bttttt.exe95⤵PID:1168
-
\??\c:\jpjpj.exec:\jpjpj.exe96⤵PID:1868
-
\??\c:\7ppvj.exec:\7ppvj.exe97⤵PID:1520
-
\??\c:\5xffrxx.exec:\5xffrxx.exe98⤵PID:2932
-
\??\c:\1nttbb.exec:\1nttbb.exe99⤵PID:2952
-
\??\c:\bhhhhh.exec:\bhhhhh.exe100⤵PID:1456
-
\??\c:\ppppp.exec:\ppppp.exe101⤵PID:2132
-
\??\c:\fxxlxfl.exec:\fxxlxfl.exe102⤵PID:956
-
\??\c:\9xxrrrr.exec:\9xxrrrr.exe103⤵PID:1124
-
\??\c:\bbhntt.exec:\bbhntt.exe104⤵PID:2096
-
\??\c:\jvjpv.exec:\jvjpv.exe105⤵PID:1676
-
\??\c:\dddjp.exec:\dddjp.exe106⤵PID:592
-
\??\c:\rllxffx.exec:\rllxffx.exe107⤵PID:1008
-
\??\c:\bbhnhh.exec:\bbhnhh.exe108⤵PID:936
-
\??\c:\nntthh.exec:\nntthh.exe109⤵PID:1752
-
\??\c:\ddvvv.exec:\ddvvv.exe110⤵PID:304
-
\??\c:\rrfxflx.exec:\rrfxflx.exe111⤵PID:2528
-
\??\c:\fflxlll.exec:\fflxlll.exe112⤵PID:1760
-
\??\c:\3bhbtt.exec:\3bhbtt.exe113⤵PID:2400
-
\??\c:\5bhbbb.exec:\5bhbbb.exe114⤵PID:2416
-
\??\c:\3pvpv.exec:\3pvpv.exe115⤵PID:2332
-
\??\c:\llrxllr.exec:\llrxllr.exe116⤵PID:1828
-
\??\c:\fllrrxf.exec:\fllrrxf.exe117⤵PID:2920
-
\??\c:\7thhhh.exec:\7thhhh.exe118⤵PID:1604
-
\??\c:\jppjv.exec:\jppjv.exe119⤵PID:2164
-
\??\c:\jjddp.exec:\jjddp.exe120⤵PID:792
-
\??\c:\xlxflxf.exec:\xlxflxf.exe121⤵PID:2708
-
\??\c:\bhtntb.exec:\bhtntb.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-