Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe
-
Size
455KB
-
MD5
1ef700550d015262c8212fde8a90d87f
-
SHA1
3e7532f98a6cdc94269989e8664cd73e31c69c82
-
SHA256
d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c
-
SHA512
fc3327a1bd16a2455c2a5a6e40771ce7cfb9e4fb009e86cb7a1ab9de265b2eb46a68053a97e23232540da8dad138770b7e6d3035442be6bc03cbce94b0cb115b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6gIW:q7Tc2NYHUrAwfMp3CD6tW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-67-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2884-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/912-235-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/912-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-257-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-636-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1096-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2828 rfxrrxl.exe 2716 jvjjv.exe 2960 5rllrrf.exe 2588 nbhhtn.exe 2672 vpjjp.exe 2608 9nnntb.exe 2884 5djjd.exe 1956 hbtthh.exe 2164 vpdjp.exe 628 3rfrrll.exe 1920 5bthhb.exe 2772 7frrxxf.exe 976 3nhthn.exe 2904 rfllllr.exe 2104 htbhbb.exe 572 5jjvd.exe 2188 ffrllfx.exe 1972 hntbtb.exe 2380 ddpdd.exe 956 bnhthh.exe 2220 vjpvd.exe 840 5frfllr.exe 1648 btnthh.exe 912 vpddj.exe 1552 9lffffx.exe 1504 hbnntt.exe 2488 dpvjj.exe 1128 nbnthb.exe 1752 1vjjj.exe 1740 nhthhb.exe 1596 nbntbb.exe 2684 3frlffl.exe 2856 5xrfffl.exe 2596 nnhnnt.exe 2584 vppdp.exe 2732 3rrxrxf.exe 2592 thtbnn.exe 2680 5jjdj.exe 3052 dpvvv.exe 2884 5rfrlfr.exe 3032 5bbhnn.exe 2236 tnbtbb.exe 1156 vjdjj.exe 944 3fxfffl.exe 788 7nbbhn.exe 988 pjvvv.exe 2792 jdjdv.exe 2548 rfxxxrr.exe 2024 bthbhh.exe 380 jjvvp.exe 2016 1jjdp.exe 2988 7flxlrl.exe 2992 htntnn.exe 2172 jdppd.exe 1616 1vjjp.exe 2264 7fxfrxl.exe 2232 7hbbhn.exe 1136 7pjpp.exe 1820 xlfxfxx.exe 2360 rrlrxxl.exe 704 3htbbb.exe 1544 jddjp.exe 2332 rlxrrxl.exe 2312 rxrlfrx.exe -
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-543-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1028-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-771-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2828 2708 d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe 31 PID 2708 wrote to memory of 2828 2708 d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe 31 PID 2708 wrote to memory of 2828 2708 d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe 31 PID 2708 wrote to memory of 2828 2708 d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe 31 PID 2828 wrote to memory of 2716 2828 rfxrrxl.exe 32 PID 2828 wrote to memory of 2716 2828 rfxrrxl.exe 32 PID 2828 wrote to memory of 2716 2828 rfxrrxl.exe 32 PID 2828 wrote to memory of 2716 2828 rfxrrxl.exe 32 PID 2716 wrote to memory of 2960 2716 jvjjv.exe 33 PID 2716 wrote to memory of 2960 2716 jvjjv.exe 33 PID 2716 wrote to memory of 2960 2716 jvjjv.exe 33 PID 2716 wrote to memory of 2960 2716 jvjjv.exe 33 PID 2960 wrote to memory of 2588 2960 5rllrrf.exe 34 PID 2960 wrote to memory of 2588 2960 5rllrrf.exe 34 PID 2960 wrote to memory of 2588 2960 5rllrrf.exe 34 PID 2960 wrote to memory of 2588 2960 5rllrrf.exe 34 PID 2588 wrote to memory of 2672 2588 nbhhtn.exe 35 PID 2588 wrote to memory of 2672 2588 nbhhtn.exe 35 PID 2588 wrote to memory of 2672 2588 nbhhtn.exe 35 PID 2588 wrote to memory of 2672 2588 nbhhtn.exe 35 PID 2672 wrote to memory of 2608 2672 vpjjp.exe 36 PID 2672 wrote to memory of 2608 2672 vpjjp.exe 36 PID 2672 wrote to memory of 2608 2672 vpjjp.exe 36 PID 2672 wrote to memory of 2608 2672 vpjjp.exe 36 PID 2608 wrote to memory of 2884 2608 9nnntb.exe 37 PID 2608 wrote to memory of 2884 2608 9nnntb.exe 37 PID 2608 wrote to memory of 2884 2608 9nnntb.exe 37 PID 2608 wrote to memory of 2884 2608 9nnntb.exe 37 PID 2884 wrote to memory of 1956 2884 5djjd.exe 38 PID 2884 wrote to memory of 1956 2884 5djjd.exe 38 PID 2884 wrote to memory of 1956 2884 5djjd.exe 38 PID 2884 wrote to memory of 1956 2884 5djjd.exe 38 PID 1956 wrote to memory of 2164 1956 hbtthh.exe 39 PID 1956 wrote to memory of 2164 1956 hbtthh.exe 39 PID 1956 wrote to memory of 2164 1956 hbtthh.exe 39 PID 1956 wrote to memory of 2164 1956 hbtthh.exe 39 PID 2164 wrote to memory of 628 2164 vpdjp.exe 40 PID 2164 wrote to memory of 628 2164 vpdjp.exe 40 PID 2164 wrote to memory of 628 2164 vpdjp.exe 40 PID 2164 wrote to memory of 628 2164 vpdjp.exe 40 PID 628 wrote to memory of 1920 628 3rfrrll.exe 41 PID 628 wrote to memory of 1920 628 3rfrrll.exe 41 PID 628 wrote to memory of 1920 628 3rfrrll.exe 41 PID 628 wrote to memory of 1920 628 3rfrrll.exe 41 PID 1920 wrote to memory of 2772 1920 5bthhb.exe 42 PID 1920 wrote to memory of 2772 1920 5bthhb.exe 42 PID 1920 wrote to memory of 2772 1920 5bthhb.exe 42 PID 1920 wrote to memory of 2772 1920 5bthhb.exe 42 PID 2772 wrote to memory of 976 2772 7frrxxf.exe 43 PID 2772 wrote to memory of 976 2772 7frrxxf.exe 43 PID 2772 wrote to memory of 976 2772 7frrxxf.exe 43 PID 2772 wrote to memory of 976 2772 7frrxxf.exe 43 PID 976 wrote to memory of 2904 976 3nhthn.exe 44 PID 976 wrote to memory of 2904 976 3nhthn.exe 44 PID 976 wrote to memory of 2904 976 3nhthn.exe 44 PID 976 wrote to memory of 2904 976 3nhthn.exe 44 PID 2904 wrote to memory of 2104 2904 rfllllr.exe 45 PID 2904 wrote to memory of 2104 2904 rfllllr.exe 45 PID 2904 wrote to memory of 2104 2904 rfllllr.exe 45 PID 2904 wrote to memory of 2104 2904 rfllllr.exe 45 PID 2104 wrote to memory of 572 2104 htbhbb.exe 46 PID 2104 wrote to memory of 572 2104 htbhbb.exe 46 PID 2104 wrote to memory of 572 2104 htbhbb.exe 46 PID 2104 wrote to memory of 572 2104 htbhbb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe"C:\Users\Admin\AppData\Local\Temp\d117255d1e4beeef7ea3de8a9748e583ac8be231a7b1dd5ca2c891e59df1555c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rfxrrxl.exec:\rfxrrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jvjjv.exec:\jvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5rllrrf.exec:\5rllrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nbhhtn.exec:\nbhhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vpjjp.exec:\vpjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9nnntb.exec:\9nnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\5djjd.exec:\5djjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hbtthh.exec:\hbtthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vpdjp.exec:\vpdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\3rfrrll.exec:\3rfrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\5bthhb.exec:\5bthhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\7frrxxf.exec:\7frrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3nhthn.exec:\3nhthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\rfllllr.exec:\rfllllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\htbhbb.exec:\htbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5jjvd.exec:\5jjvd.exe17⤵
- Executes dropped EXE
PID:572 -
\??\c:\ffrllfx.exec:\ffrllfx.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hntbtb.exec:\hntbtb.exe19⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ddpdd.exec:\ddpdd.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bnhthh.exec:\bnhthh.exe21⤵
- Executes dropped EXE
PID:956 -
\??\c:\vjpvd.exec:\vjpvd.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5frfllr.exec:\5frfllr.exe23⤵
- Executes dropped EXE
PID:840 -
\??\c:\btnthh.exec:\btnthh.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vpddj.exec:\vpddj.exe25⤵
- Executes dropped EXE
PID:912 -
\??\c:\9lffffx.exec:\9lffffx.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hbnntt.exec:\hbnntt.exe27⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dpvjj.exec:\dpvjj.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nbnthb.exec:\nbnthb.exe29⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1vjjj.exec:\1vjjj.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nhthhb.exec:\nhthhb.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nbntbb.exec:\nbntbb.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3frlffl.exec:\3frlffl.exe33⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5xrfffl.exec:\5xrfffl.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\nnhnnt.exec:\nnhnnt.exe35⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vppdp.exec:\vppdp.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3rrxrxf.exec:\3rrxrxf.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\thtbnn.exec:\thtbnn.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5jjdj.exec:\5jjdj.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dpvvv.exec:\dpvvv.exe40⤵
- Executes dropped EXE
PID:3052 -
\??\c:\5rfrlfr.exec:\5rfrlfr.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5bbhnn.exec:\5bbhnn.exe42⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnbtbb.exec:\tnbtbb.exe43⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vjdjj.exec:\vjdjj.exe44⤵
- Executes dropped EXE
PID:1156 -
\??\c:\3fxfffl.exec:\3fxfffl.exe45⤵
- Executes dropped EXE
PID:944 -
\??\c:\7nbbhn.exec:\7nbbhn.exe46⤵
- Executes dropped EXE
PID:788 -
\??\c:\pjvvv.exec:\pjvvv.exe47⤵
- Executes dropped EXE
PID:988 -
\??\c:\jdjdv.exec:\jdjdv.exe48⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rfxxxrr.exec:\rfxxxrr.exe49⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bthbhh.exec:\bthbhh.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jjvvp.exec:\jjvvp.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\1jjdp.exec:\1jjdp.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7flxlrl.exec:\7flxlrl.exe53⤵
- Executes dropped EXE
PID:2988 -
\??\c:\htntnn.exec:\htntnn.exe54⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jdppd.exec:\jdppd.exe55⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1vjjp.exec:\1vjjp.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\7fxfrxl.exec:\7fxfrxl.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7hbbhn.exec:\7hbbhn.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7pjpp.exec:\7pjpp.exe59⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xlfxfxx.exec:\xlfxfxx.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3htbbb.exec:\3htbbb.exe62⤵
- Executes dropped EXE
PID:704 -
\??\c:\jddjp.exec:\jddjp.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rlxrrxl.exec:\rlxrrxl.exe64⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rxrlfrx.exec:\rxrlfrx.exe65⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btnthh.exec:\btnthh.exe66⤵PID:2532
-
\??\c:\jvppv.exec:\jvppv.exe67⤵PID:3008
-
\??\c:\lxllrrf.exec:\lxllrrf.exe68⤵PID:2948
-
\??\c:\btbbhb.exec:\btbbhb.exe69⤵PID:1028
-
\??\c:\9bhhnn.exec:\9bhhnn.exe70⤵PID:1760
-
\??\c:\7pvpv.exec:\7pvpv.exe71⤵PID:2708
-
\??\c:\rfxxffl.exec:\rfxxffl.exe72⤵PID:1572
-
\??\c:\lxxxrfr.exec:\lxxxrfr.exe73⤵PID:2668
-
\??\c:\ntnbnt.exec:\ntnbnt.exe74⤵PID:1040
-
\??\c:\3vjdj.exec:\3vjdj.exe75⤵PID:2912
-
\??\c:\lxrrflx.exec:\lxrrflx.exe76⤵PID:2928
-
\??\c:\tnbbbb.exec:\tnbbbb.exe77⤵PID:2768
-
\??\c:\9jppd.exec:\9jppd.exe78⤵PID:2732
-
\??\c:\vpdjp.exec:\vpdjp.exe79⤵PID:2592
-
\??\c:\xxfxfxl.exec:\xxfxfxl.exe80⤵PID:2680
-
\??\c:\thbbbb.exec:\thbbbb.exe81⤵PID:3056
-
\??\c:\1jddp.exec:\1jddp.exe82⤵PID:2376
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe83⤵PID:1956
-
\??\c:\5lrlllr.exec:\5lrlllr.exe84⤵PID:2776
-
\??\c:\ttnntt.exec:\ttnntt.exe85⤵PID:1792
-
\??\c:\vpvdv.exec:\vpvdv.exe86⤵PID:944
-
\??\c:\dvddd.exec:\dvddd.exe87⤵PID:1252
-
\??\c:\xrxlrlx.exec:\xrxlrlx.exe88⤵
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\btbbbb.exec:\btbbbb.exe89⤵PID:3020
-
\??\c:\nhhbhb.exec:\nhhbhb.exe90⤵PID:2072
-
\??\c:\dvpvp.exec:\dvpvp.exe91⤵PID:2936
-
\??\c:\fxlllrr.exec:\fxlllrr.exe92⤵PID:1940
-
\??\c:\hbnttb.exec:\hbnttb.exe93⤵PID:2976
-
\??\c:\9tnnbh.exec:\9tnnbh.exe94⤵PID:2184
-
\??\c:\1vjpv.exec:\1vjpv.exe95⤵PID:2124
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe96⤵PID:2508
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe97⤵PID:1972
-
\??\c:\thbhth.exec:\thbhth.exe98⤵PID:2212
-
\??\c:\jpdpv.exec:\jpdpv.exe99⤵PID:1096
-
\??\c:\1djjj.exec:\1djjj.exe100⤵PID:1620
-
\??\c:\xrffllr.exec:\xrffllr.exe101⤵PID:2348
-
\??\c:\hbtthn.exec:\hbtthn.exe102⤵PID:1648
-
\??\c:\jvpjp.exec:\jvpjp.exe103⤵PID:596
-
\??\c:\vpdjp.exec:\vpdjp.exe104⤵PID:1544
-
\??\c:\7fxxxrf.exec:\7fxxxrf.exe105⤵PID:2244
-
\??\c:\1hbbhh.exec:\1hbbhh.exe106⤵PID:2516
-
\??\c:\nnthtn.exec:\nnthtn.exe107⤵
- System Location Discovery: System Language Discovery
PID:764 -
\??\c:\1vdvd.exec:\1vdvd.exe108⤵PID:2808
-
\??\c:\1rfxrrf.exec:\1rfxrrf.exe109⤵PID:2044
-
\??\c:\xrffrrf.exec:\xrffrrf.exe110⤵PID:2900
-
\??\c:\hbnhnh.exec:\hbnhnh.exe111⤵PID:1276
-
\??\c:\ntbnnh.exec:\ntbnnh.exe112⤵PID:2864
-
\??\c:\pjvpv.exec:\pjvpv.exe113⤵PID:2700
-
\??\c:\rlflrxr.exec:\rlflrxr.exe114⤵PID:2300
-
\??\c:\rfrrrfr.exec:\rfrrrfr.exe115⤵PID:2716
-
\??\c:\5thtbh.exec:\5thtbh.exe116⤵PID:2820
-
\??\c:\1vpjd.exec:\1vpjd.exe117⤵PID:2880
-
\??\c:\pvpjd.exec:\pvpjd.exe118⤵PID:2812
-
\??\c:\1frrxxf.exec:\1frrxxf.exe119⤵PID:2672
-
\??\c:\nhtbhn.exec:\nhtbhn.exe120⤵PID:2732
-
\??\c:\nhhthh.exec:\nhhthh.exe121⤵PID:692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-