Analysis
- max time kernel
150s - max time network
119s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
- Target 0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe
- Size 454KB
- Sample250108-ran7wasmf1
- SHA256 0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b
- MD5 a5d0b66b40e987ba56d292988f342d9a
- SHA1 919316614eaf90be9c440fec7face18f2fa49e57
- SHA512 7da79714867779bdf1a1b5fcc0b0eee9ff7ed554fe6357fb2de9db49fd13ea91f100c645c471399850f3c4d73054d33a81ae46aa5221c5277a4245b60d90f03e
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1640-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-73-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/780-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-333-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2484-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-462-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/280-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/476-640-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-653-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/760-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-980-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-1079-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-1140-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1528-1148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-1275-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1644 jdjjj.exe 2536 lfrrxxl.exe 2720 hbnntt.exe 2832 xxxffxr.exe 2620 lxllrrl.exe 2864 5hntbn.exe 2828 1nthhb.exe 2624 btbhnn.exe 2348 nbbbnn.exe 780 xlxxffl.exe 1396 7btntn.exe 3016 tntbbb.exe 1004 hthhtt.exe 2912 rxxlfrf.exe 2972 nhtthn.exe 1552 dvjjj.exe 2108 7tbhhh.exe 2124 lfrflrf.exe 2104 bthntt.exe 2580 3vvvd.exe 2380 xrlrffr.exe 944 rlxfxfx.exe 112 lflllfx.exe 1652 jjdpj.exe 2132 ddvjd.exe 1476 xxrxlrx.exe 1124 7jjdp.exe 2144 1bbntt.exe 2080 ppjpp.exe 2076 xfxrflx.exe 348 fxxlrfr.exe 2256 7nhtth.exe 1636 3xrxlrx.exe 2060 hbntbb.exe 2136 pvvvj.exe 1520 fxfxxxr.exe 2808 xrfxflx.exe 2812 nhbhtt.exe 2484 vvjdp.exe 2884 rlxxfxl.exe 2748 hbtbnt.exe 2036 jpdjv.exe 2628 jpvvd.exe 2664 rlrlfrf.exe 1776 hnhnbb.exe 2932 thtttt.exe 1956 pjvdp.exe 2904 fxrrrrf.exe 3048 frflfff.exe 1404 7hnttt.exe 2968 pvpvj.exe 3044 ffxxlrl.exe 1344 llxfrxx.exe 2116 9hhnbb.exe 2164 1jvvj.exe 2372 dppdp.exe 2344 xlfxxxr.exe 1612 btntht.exe 836 bbtbnn.exe 2508 dvpjp.exe 1268 rfxxxfr.exe 280 5rxlfff.exe 1704 bbtbnb.exe 1880 vjvvd.exe -
resource yara_rule behavioral1/memory/1640-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-55-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2828-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-333-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2484-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-584-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/476-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-640-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/760-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-833-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3052-980-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-1119-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2888-1140-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2056-1268-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxflf.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1644 1640 0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe 30 PID 1640 wrote to memory of 1644 1640 0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe 30 PID 1640 wrote to memory of 1644 1640 0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe 30 PID 1640 wrote to memory of 1644 1640 0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe 30 PID 1644 wrote to memory of 2536 1644 jdjjj.exe 31 PID 1644 wrote to memory of 2536 1644 jdjjj.exe 31 PID 1644 wrote to memory of 2536 1644 jdjjj.exe 31 PID 1644 wrote to memory of 2536 1644 jdjjj.exe 31 PID 2536 wrote to memory of 2720 2536 lfrrxxl.exe 32 PID 2536 wrote to memory of 2720 2536 lfrrxxl.exe 32 PID 2536 wrote to memory of 2720 2536 lfrrxxl.exe 32 PID 2536 wrote to memory of 2720 2536 lfrrxxl.exe 32 PID 2720 wrote to memory of 2832 2720 hbnntt.exe 33 PID 2720 wrote to memory of 2832 2720 hbnntt.exe 33 PID 2720 wrote to memory of 2832 2720 hbnntt.exe 33 PID 2720 wrote to memory of 2832 2720 hbnntt.exe 33 PID 2832 wrote to memory of 2620 2832 xxxffxr.exe 34 PID 2832 wrote to memory of 2620 2832 xxxffxr.exe 34 PID 2832 wrote to memory of 2620 2832 xxxffxr.exe 34 PID 2832 wrote to memory of 2620 2832 xxxffxr.exe 34 PID 2620 wrote to memory of 2864 2620 lxllrrl.exe 35 PID 2620 wrote to memory of 2864 2620 lxllrrl.exe 35 PID 2620 wrote to memory of 2864 2620 lxllrrl.exe 35 PID 2620 wrote to memory of 2864 2620 lxllrrl.exe 35 PID 2864 wrote to memory of 2828 2864 5hntbn.exe 36 PID 2864 wrote to memory of 2828 2864 5hntbn.exe 36 PID 2864 wrote to memory of 2828 2864 5hntbn.exe 36 PID 2864 wrote to memory of 2828 2864 5hntbn.exe 36 PID 2828 wrote to memory of 2624 2828 1nthhb.exe 37 PID 2828 wrote to memory of 2624 2828 1nthhb.exe 37 PID 2828 wrote to memory of 2624 2828 1nthhb.exe 37 PID 2828 wrote to memory of 2624 2828 1nthhb.exe 37 PID 2624 wrote to memory of 2348 2624 btbhnn.exe 38 PID 2624 wrote to memory of 2348 2624 btbhnn.exe 38 PID 2624 wrote to memory of 2348 2624 btbhnn.exe 38 PID 2624 wrote to memory of 2348 2624 btbhnn.exe 38 PID 2348 wrote to memory of 780 2348 nbbbnn.exe 39 PID 2348 wrote to memory of 780 2348 nbbbnn.exe 39 PID 2348 wrote to memory of 780 2348 nbbbnn.exe 39 PID 2348 wrote to memory of 780 2348 nbbbnn.exe 39 PID 780 wrote to memory of 1396 780 xlxxffl.exe 40 PID 780 wrote to memory of 1396 780 xlxxffl.exe 40 PID 780 wrote to memory of 1396 780 xlxxffl.exe 40 PID 780 wrote to memory of 1396 780 xlxxffl.exe 40 PID 1396 wrote to memory of 3016 1396 7btntn.exe 41 PID 1396 wrote to memory of 3016 1396 7btntn.exe 41 PID 1396 wrote to memory of 3016 1396 7btntn.exe 41 PID 1396 wrote to memory of 3016 1396 7btntn.exe 41 PID 3016 wrote to memory of 1004 3016 tntbbb.exe 42 PID 3016 wrote to memory of 1004 3016 tntbbb.exe 42 PID 3016 wrote to memory of 1004 3016 tntbbb.exe 42 PID 3016 wrote to memory of 1004 3016 tntbbb.exe 42 PID 1004 wrote to memory of 2912 1004 hthhtt.exe 43 PID 1004 wrote to memory of 2912 1004 hthhtt.exe 43 PID 1004 wrote to memory of 2912 1004 hthhtt.exe 43 PID 1004 wrote to memory of 2912 1004 hthhtt.exe 43 PID 2912 wrote to memory of 2972 2912 rxxlfrf.exe 44 PID 2912 wrote to memory of 2972 2912 rxxlfrf.exe 44 PID 2912 wrote to memory of 2972 2912 rxxlfrf.exe 44 PID 2912 wrote to memory of 2972 2912 rxxlfrf.exe 44 PID 2972 wrote to memory of 1552 2972 nhtthn.exe 45 PID 2972 wrote to memory of 1552 2972 nhtthn.exe 45 PID 2972 wrote to memory of 1552 2972 nhtthn.exe 45 PID 2972 wrote to memory of 1552 2972 nhtthn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe"C:\Users\Admin\AppData\Local\Temp\0f20d61b7e1d2729aa9d94de19f986409b606262fed05aaec525fa182320480b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\jdjjj.exec:\jdjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\hbnntt.exec:\hbnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xxxffxr.exec:\xxxffxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lxllrrl.exec:\lxllrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\5hntbn.exec:\5hntbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\1nthhb.exec:\1nthhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\btbhnn.exec:\btbhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nbbbnn.exec:\nbbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xlxxffl.exec:\xlxxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\7btntn.exec:\7btntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\tntbbb.exec:\tntbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hthhtt.exec:\hthhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\rxxlfrf.exec:\rxxlfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nhtthn.exec:\nhtthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\dvjjj.exec:\dvjjj.exe17⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7tbhhh.exec:\7tbhhh.exe18⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lfrflrf.exec:\lfrflrf.exe19⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bthntt.exec:\bthntt.exe20⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3vvvd.exec:\3vvvd.exe21⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xrlrffr.exec:\xrlrffr.exe22⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rlxfxfx.exec:\rlxfxfx.exe23⤵
- Executes dropped EXE
PID:944 -
\??\c:\lflllfx.exec:\lflllfx.exe24⤵
- Executes dropped EXE
PID:112 -
\??\c:\jjdpj.exec:\jjdpj.exe25⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ddvjd.exec:\ddvjd.exe26⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe27⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7jjdp.exec:\7jjdp.exe28⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1bbntt.exec:\1bbntt.exe29⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ppjpp.exec:\ppjpp.exe30⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xfxrflx.exec:\xfxrflx.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxxlrfr.exec:\fxxlrfr.exe32⤵
- Executes dropped EXE
PID:348 -
\??\c:\7nhtth.exec:\7nhtth.exe33⤵
- Executes dropped EXE
PID:2256 -
\??\c:\3xrxlrx.exec:\3xrxlrx.exe34⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbntbb.exec:\hbntbb.exe35⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pvvvj.exec:\pvvvj.exe36⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe37⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xrfxflx.exec:\xrfxflx.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhbhtt.exec:\nhbhtt.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vvjdp.exec:\vvjdp.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rlxxfxl.exec:\rlxxfxl.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbtbnt.exec:\hbtbnt.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jpdjv.exec:\jpdjv.exe43⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jpvvd.exec:\jpvvd.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlrlfrf.exec:\rlrlfrf.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hnhnbb.exec:\hnhnbb.exe46⤵
- Executes dropped EXE
PID:1776 -
\??\c:\thtttt.exec:\thtttt.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjvdp.exec:\pjvdp.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\fxrrrrf.exec:\fxrrrrf.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\frflfff.exec:\frflfff.exe50⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7hnttt.exec:\7hnttt.exe51⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pvpvj.exec:\pvpvj.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ffxxlrl.exec:\ffxxlrl.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\llxfrxx.exec:\llxfrxx.exe54⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9hhnbb.exec:\9hhnbb.exe55⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1jvvj.exec:\1jvvj.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dppdp.exec:\dppdp.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\btntht.exec:\btntht.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\bbtbnn.exec:\bbtbnn.exe60⤵
- Executes dropped EXE
PID:836 -
\??\c:\dvpjp.exec:\dvpjp.exe61⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rfxxxfr.exec:\rfxxxfr.exe62⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5rxlfff.exec:\5rxlfff.exe63⤵
- Executes dropped EXE
PID:280 -
\??\c:\bbtbnb.exec:\bbtbnb.exe64⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vjvvd.exec:\vjvvd.exe65⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jddjp.exec:\jddjp.exe66⤵PID:1860
-
\??\c:\xxrxlxl.exec:\xxrxlxl.exe67⤵PID:876
-
\??\c:\tnhnht.exec:\tnhnht.exe68⤵PID:552
-
\??\c:\tntthh.exec:\tntthh.exe69⤵PID:380
-
\??\c:\9dvdj.exec:\9dvdj.exe70⤵PID:1124
-
\??\c:\xxxfrxx.exec:\xxxfrxx.exe71⤵PID:2000
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe72⤵PID:624
-
\??\c:\bthhtt.exec:\bthhtt.exe73⤵PID:1688
-
\??\c:\pppjj.exec:\pppjj.exe74⤵PID:872
-
\??\c:\7lrrrrx.exec:\7lrrrrx.exe75⤵PID:348
-
\??\c:\flfrffr.exec:\flfrffr.exe76⤵PID:2308
-
\??\c:\hbtbhh.exec:\hbtbhh.exe77⤵PID:2544
-
\??\c:\3jjvj.exec:\3jjvj.exe78⤵PID:3060
-
\??\c:\rrrrxfr.exec:\rrrrxfr.exe79⤵PID:2860
-
\??\c:\7xxlrfr.exec:\7xxlrfr.exe80⤵PID:1524
-
\??\c:\nhthnt.exec:\nhthnt.exe81⤵
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\dvpdj.exec:\dvpdj.exe82⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\5vpvd.exec:\5vpvd.exe83⤵PID:2816
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe84⤵PID:2620
-
\??\c:\rrlfrfr.exec:\rrlfrfr.exe85⤵PID:2864
-
\??\c:\hhthtt.exec:\hhthtt.exe86⤵PID:2892
-
\??\c:\vvvjd.exec:\vvvjd.exe87⤵PID:476
-
\??\c:\xrflxfr.exec:\xrflxfr.exe88⤵PID:1508
-
\??\c:\rrlfrxf.exec:\rrlfrxf.exe89⤵PID:2732
-
\??\c:\thtthn.exec:\thtthn.exe90⤵PID:1960
-
\??\c:\jdvvp.exec:\jdvvp.exe91⤵PID:760
-
\??\c:\frffrrr.exec:\frffrrr.exe92⤵PID:2924
-
\??\c:\llxlrfr.exec:\llxlrfr.exe93⤵PID:1420
-
\??\c:\ttnbnt.exec:\ttnbnt.exe94⤵PID:3028
-
\??\c:\7dddp.exec:\7dddp.exe95⤵PID:2848
-
\??\c:\vpvvd.exec:\vpvvd.exe96⤵PID:2912
-
\??\c:\rlxxfxx.exec:\rlxxfxx.exe97⤵PID:1212
-
\??\c:\nhbbht.exec:\nhbbht.exe98⤵PID:1348
-
\??\c:\5jjvd.exec:\5jjvd.exe99⤵PID:1344
-
\??\c:\3dddv.exec:\3dddv.exe100⤵PID:2056
-
\??\c:\fxfxrxf.exec:\fxfxrxf.exe101⤵PID:2388
-
\??\c:\3hbbnt.exec:\3hbbnt.exe102⤵PID:2112
-
\??\c:\3thhnt.exec:\3thhnt.exe103⤵PID:2120
-
\??\c:\pjvdp.exec:\pjvdp.exe104⤵PID:2580
-
\??\c:\3fxxffl.exec:\3fxxffl.exe105⤵PID:836
-
\??\c:\xxlrfxl.exec:\xxlrfxl.exe106⤵PID:2140
-
\??\c:\bthntn.exec:\bthntn.exe107⤵PID:2332
-
\??\c:\djvvd.exec:\djvvd.exe108⤵PID:2596
-
\??\c:\1xlrxxf.exec:\1xlrxxf.exe109⤵PID:108
-
\??\c:\xrxxflx.exec:\xrxxflx.exe110⤵PID:2984
-
\??\c:\hntttt.exec:\hntttt.exe111⤵PID:1860
-
\??\c:\thhhtt.exec:\thhhtt.exe112⤵PID:876
-
\??\c:\ddvjv.exec:\ddvjv.exe113⤵PID:1020
-
\??\c:\7flrxxl.exec:\7flrxxl.exe114⤵PID:328
-
\??\c:\rlllllx.exec:\rlllllx.exe115⤵PID:1124
-
\??\c:\tbhbbb.exec:\tbhbbb.exe116⤵PID:2000
-
\??\c:\jdpjp.exec:\jdpjp.exe117⤵PID:1452
-
\??\c:\5pppj.exec:\5pppj.exe118⤵PID:2492
-
\??\c:\fffxllf.exec:\fffxllf.exe119⤵PID:872
-
\??\c:\hntnth.exec:\hntnth.exe120⤵PID:320
-
\??\c:\pjppd.exec:\pjppd.exe121⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-