Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-01-2025 23:56
Behavioral task
behavioral1
Sample
fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe
-
Size
3.7MB
-
MD5
791dcaac2e4fdcdeebe66a3fb363173c
-
SHA1
7f56c44a71ede39cd132adb87864ec827f5b42b4
-
SHA256
fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130
-
SHA512
bfd4c89d9602562e5f393a1685c58ce52dafb8c3a0473cb47ce40dddd5be125045b2584d91db1fe4c0b95439d07de1ebb57a5f2c53ea261a95dbdbf5bdb13446
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98u:U6XLq/qPPslzKx/dJg1ErmNP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1592-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-48-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2756-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/600-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1384-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-280-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2292-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-409-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2076-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/912-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-597-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1948-610-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2884-680-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1508-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-735-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3036-816-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/828-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-912-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-949-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2136-974-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2136-996-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-1008-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-1035-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2024-1033-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1672-1082-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-1134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2340 xxflxlf.exe 1788 tntbnb.exe 1592 fffxrfl.exe 2692 bthnnh.exe 2760 hbhtbt.exe 2756 jjdpd.exe 1632 btttbb.exe 2836 xrfxllx.exe 2656 bthhnn.exe 2424 7nhbnt.exe 1572 hhtbtt.exe 2848 1vjpv.exe 264 jdppd.exe 600 hhbntb.exe 2028 tnbbth.exe 2904 hhbbht.exe 1660 btnbhn.exe 2936 5xffllf.exe 2196 3rrfflx.exe 2064 pppdp.exe 1852 1rfxfxx.exe 444 vpddp.exe 2992 9jjpj.exe 1784 vpddp.exe 1524 btnthn.exe 1284 bntbbt.exe 1384 7rfflfl.exe 2248 vvjdj.exe 2244 pjvdj.exe 2148 5pjjv.exe 1004 7bhhnn.exe 1064 tbbhtt.exe 2292 thnnbh.exe 1584 thtbnn.exe 2552 5rllrxf.exe 2524 7bntth.exe 2088 hhtthn.exe 2408 xrffxfr.exe 2752 pdppv.exe 2532 tnbbnt.exe 2736 llffrxf.exe 2628 nntntn.exe 2624 llllxlr.exe 2776 pjvpv.exe 2596 hnttbb.exe 2656 tnnbbt.exe 1144 xlrrrrx.exe 1052 9jddj.exe 2720 3thhth.exe 1048 lxxxxxl.exe 264 lfllrrx.exe 1748 dvdvj.exe 1924 5tbbnt.exe 2440 rlrrxxx.exe 1768 ffrrxxl.exe 2928 pjdpv.exe 2924 btbbhn.exe 2076 9frxflr.exe 2064 jdppp.exe 2996 pjvdd.exe 2584 7thnbh.exe 1628 fxrlflr.exe 1672 vvdpd.exe 1524 5jvdj.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2340-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-8.dat upx behavioral1/memory/1788-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2340-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c47-16.dat upx behavioral1/files/0x0008000000016c53-28.dat upx behavioral1/memory/1788-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ccb-37.dat upx behavioral1/memory/2692-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d02-49.dat upx behavioral1/files/0x0007000000016d0c-60.dat upx behavioral1/memory/2756-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000167ea-68.dat upx behavioral1/files/0x0007000000016d15-79.dat upx behavioral1/memory/1632-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d1f-85.dat upx behavioral1/memory/2424-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d27-96.dat upx behavioral1/memory/1572-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d4-104.dat upx behavioral1/files/0x00050000000193ec-116.dat upx behavioral1/memory/1572-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019417-125.dat upx behavioral1/memory/2848-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941a-134.dat upx behavioral1/memory/600-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019436-143.dat upx behavioral1/files/0x0005000000019441-150.dat upx behavioral1/files/0x00050000000194bd-160.dat upx behavioral1/memory/2904-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f3-167.dat upx behavioral1/memory/2196-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019537-176.dat upx behavioral1/files/0x00050000000195d9-184.dat upx behavioral1/files/0x000500000001960a-194.dat upx behavioral1/memory/2064-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-203.dat upx behavioral1/memory/444-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960d-211.dat upx behavioral1/memory/444-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1784-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1784-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960e-230.dat upx behavioral1/files/0x0005000000019610-237.dat upx behavioral1/files/0x0005000000019612-245.dat upx behavioral1/files/0x0005000000019614-256.dat upx behavioral1/memory/2248-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1384-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019616-264.dat upx behavioral1/memory/2248-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019618-272.dat upx behavioral1/files/0x000500000001962a-282.dat upx behavioral1/memory/2148-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001966c-291.dat upx behavioral1/memory/2292-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-331-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2340 2100 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2100 wrote to memory of 2340 2100 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2100 wrote to memory of 2340 2100 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2100 wrote to memory of 2340 2100 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2340 wrote to memory of 1788 2340 xxflxlf.exe 31 PID 2340 wrote to memory of 1788 2340 xxflxlf.exe 31 PID 2340 wrote to memory of 1788 2340 xxflxlf.exe 31 PID 2340 wrote to memory of 1788 2340 xxflxlf.exe 31 PID 1788 wrote to memory of 1592 1788 tntbnb.exe 32 PID 1788 wrote to memory of 1592 1788 tntbnb.exe 32 PID 1788 wrote to memory of 1592 1788 tntbnb.exe 32 PID 1788 wrote to memory of 1592 1788 tntbnb.exe 32 PID 1592 wrote to memory of 2692 1592 fffxrfl.exe 33 PID 1592 wrote to memory of 2692 1592 fffxrfl.exe 33 PID 1592 wrote to memory of 2692 1592 fffxrfl.exe 33 PID 1592 wrote to memory of 2692 1592 fffxrfl.exe 33 PID 2692 wrote to memory of 2760 2692 bthnnh.exe 34 PID 2692 wrote to memory of 2760 2692 bthnnh.exe 34 PID 2692 wrote to memory of 2760 2692 bthnnh.exe 34 PID 2692 wrote to memory of 2760 2692 bthnnh.exe 34 PID 2760 wrote to memory of 2756 2760 hbhtbt.exe 35 PID 2760 wrote to memory of 2756 2760 hbhtbt.exe 35 PID 2760 wrote to memory of 2756 2760 hbhtbt.exe 35 PID 2760 wrote to memory of 2756 2760 hbhtbt.exe 35 PID 2756 wrote to memory of 1632 2756 jjdpd.exe 36 PID 2756 wrote to memory of 1632 2756 jjdpd.exe 36 PID 2756 wrote to memory of 1632 2756 jjdpd.exe 36 PID 2756 wrote to memory of 1632 2756 jjdpd.exe 36 PID 1632 wrote to memory of 2836 1632 btttbb.exe 37 PID 1632 wrote to memory of 2836 1632 btttbb.exe 37 PID 1632 wrote to memory of 2836 1632 btttbb.exe 37 PID 1632 wrote to memory of 2836 1632 btttbb.exe 37 PID 2836 wrote to memory of 2656 2836 xrfxllx.exe 75 PID 2836 wrote to memory of 2656 2836 xrfxllx.exe 75 PID 2836 wrote to memory of 2656 2836 xrfxllx.exe 75 PID 2836 wrote to memory of 2656 2836 xrfxllx.exe 75 PID 2656 wrote to memory of 2424 2656 bthhnn.exe 39 PID 2656 wrote to memory of 2424 2656 bthhnn.exe 39 PID 2656 wrote to memory of 2424 2656 bthhnn.exe 39 PID 2656 wrote to memory of 2424 2656 bthhnn.exe 39 PID 2424 wrote to memory of 1572 2424 7nhbnt.exe 40 PID 2424 wrote to memory of 1572 2424 7nhbnt.exe 40 PID 2424 wrote to memory of 1572 2424 7nhbnt.exe 40 PID 2424 wrote to memory of 1572 2424 7nhbnt.exe 40 PID 1572 wrote to memory of 2848 1572 hhtbtt.exe 41 PID 1572 wrote to memory of 2848 1572 hhtbtt.exe 41 PID 1572 wrote to memory of 2848 1572 hhtbtt.exe 41 PID 1572 wrote to memory of 2848 1572 hhtbtt.exe 41 PID 2848 wrote to memory of 264 2848 1vjpv.exe 80 PID 2848 wrote to memory of 264 2848 1vjpv.exe 80 PID 2848 wrote to memory of 264 2848 1vjpv.exe 80 PID 2848 wrote to memory of 264 2848 1vjpv.exe 80 PID 264 wrote to memory of 600 264 jdppd.exe 43 PID 264 wrote to memory of 600 264 jdppd.exe 43 PID 264 wrote to memory of 600 264 jdppd.exe 43 PID 264 wrote to memory of 600 264 jdppd.exe 43 PID 600 wrote to memory of 2028 600 hhbntb.exe 44 PID 600 wrote to memory of 2028 600 hhbntb.exe 44 PID 600 wrote to memory of 2028 600 hhbntb.exe 44 PID 600 wrote to memory of 2028 600 hhbntb.exe 44 PID 2028 wrote to memory of 2904 2028 tnbbth.exe 45 PID 2028 wrote to memory of 2904 2028 tnbbth.exe 45 PID 2028 wrote to memory of 2904 2028 tnbbth.exe 45 PID 2028 wrote to memory of 2904 2028 tnbbth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe"C:\Users\Admin\AppData\Local\Temp\fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\xxflxlf.exec:\xxflxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\tntbnb.exec:\tntbnb.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\fffxrfl.exec:\fffxrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\bthnnh.exec:\bthnnh.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hbhtbt.exec:\hbhtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jjdpd.exec:\jjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\btttbb.exec:\btttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\xrfxllx.exec:\xrfxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bthhnn.exec:\bthhnn.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7nhbnt.exec:\7nhbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\hhtbtt.exec:\hhtbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\1vjpv.exec:\1vjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jdppd.exec:\jdppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\hhbntb.exec:\hhbntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\tnbbth.exec:\tnbbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\hhbbht.exec:\hhbbht.exe17⤵
- Executes dropped EXE
PID:2904 -
\??\c:\btnbhn.exec:\btnbhn.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5xffllf.exec:\5xffllf.exe19⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3rrfflx.exec:\3rrfflx.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pppdp.exec:\pppdp.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1rfxfxx.exec:\1rfxfxx.exe22⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vpddp.exec:\vpddp.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\9jjpj.exec:\9jjpj.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpddp.exec:\vpddp.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\btnthn.exec:\btnthn.exe26⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bntbbt.exec:\bntbbt.exe27⤵
- Executes dropped EXE
PID:1284 -
\??\c:\7rfflfl.exec:\7rfflfl.exe28⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vvjdj.exec:\vvjdj.exe29⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pjvdj.exec:\pjvdj.exe30⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5pjjv.exec:\5pjjv.exe31⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7bhhnn.exec:\7bhhnn.exe32⤵
- Executes dropped EXE
PID:1004 -
\??\c:\tbbhtt.exec:\tbbhtt.exe33⤵
- Executes dropped EXE
PID:1064 -
\??\c:\thnnbh.exec:\thnnbh.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\thtbnn.exec:\thtbnn.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1584 -
\??\c:\5rllrxf.exec:\5rllrxf.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7bntth.exec:\7bntth.exe37⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhtthn.exec:\hhtthn.exe38⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xrffxfr.exec:\xrffxfr.exe39⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pdppv.exec:\pdppv.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tnbbnt.exec:\tnbbnt.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\llffrxf.exec:\llffrxf.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nntntn.exec:\nntntn.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\llllxlr.exec:\llllxlr.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjvpv.exec:\pjvpv.exe45⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hnttbb.exec:\hnttbb.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tnnbbt.exec:\tnnbbt.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe48⤵
- Executes dropped EXE
PID:1144 -
\??\c:\9jddj.exec:\9jddj.exe49⤵
- Executes dropped EXE
PID:1052 -
\??\c:\3thhth.exec:\3thhth.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lxxxxxl.exec:\lxxxxxl.exe51⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lfllrrx.exec:\lfllrrx.exe52⤵
- Executes dropped EXE
PID:264 -
\??\c:\dvdvj.exec:\dvdvj.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5tbbnt.exec:\5tbbnt.exe54⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe55⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pjdpv.exec:\pjdpv.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\btbbhn.exec:\btbbhn.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9frxflr.exec:\9frxflr.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jdppp.exec:\jdppp.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjvdd.exec:\pjvdd.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\7thnbh.exec:\7thnbh.exe62⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxrlflr.exec:\fxrlflr.exe63⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvdpd.exec:\vvdpd.exe64⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5jvdj.exec:\5jvdj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1524 -
\??\c:\bbtbhn.exec:\bbtbhn.exe66⤵PID:1284
-
\??\c:\5lflrxf.exec:\5lflrxf.exe67⤵PID:912
-
\??\c:\ppvvj.exec:\ppvvj.exe68⤵PID:1932
-
\??\c:\7httbn.exec:\7httbn.exe69⤵PID:1988
-
\??\c:\nnnbnn.exec:\nnnbnn.exe70⤵
- System Location Discovery: System Language Discovery
PID:3032 -
\??\c:\fxllrrl.exec:\fxllrrl.exe71⤵PID:2444
-
\??\c:\jdpvj.exec:\jdpvj.exe72⤵PID:1032
-
\??\c:\tnbhhn.exec:\tnbhhn.exe73⤵PID:884
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe74⤵PID:2280
-
\??\c:\rrflxfr.exec:\rrflxfr.exe75⤵PID:1616
-
\??\c:\lflrlfr.exec:\lflrlfr.exe76⤵PID:2400
-
\??\c:\pdvjj.exec:\pdvjj.exe77⤵PID:2340
-
\??\c:\pvjvv.exec:\pvjvv.exe78⤵PID:2336
-
\??\c:\7hhhht.exec:\7hhhht.exe79⤵PID:1960
-
\??\c:\bthtbn.exec:\bthtbn.exe80⤵PID:2708
-
\??\c:\thbhbb.exec:\thbhbb.exe81⤵PID:1948
-
\??\c:\rlffrfl.exec:\rlffrfl.exe82⤵PID:2800
-
\??\c:\ffxrlfl.exec:\ffxrlfl.exe83⤵PID:2608
-
\??\c:\9jjjp.exec:\9jjjp.exe84⤵PID:2756
-
\??\c:\tthhhh.exec:\tthhhh.exe85⤵PID:1868
-
\??\c:\nnbhhn.exec:\nnbhhn.exe86⤵PID:696
-
\??\c:\1lrlrxx.exec:\1lrlrxx.exe87⤵PID:1316
-
\??\c:\jdppd.exec:\jdppd.exe88⤵PID:2060
-
\??\c:\htbnbb.exec:\htbnbb.exe89⤵PID:2180
-
\??\c:\hnhhnh.exec:\hnhhnh.exe90⤵PID:2656
-
\??\c:\lfllrxf.exec:\lfllrxf.exe91⤵PID:932
-
\??\c:\dvjdj.exec:\dvjdj.exe92⤵PID:2884
-
\??\c:\nnntbh.exec:\nnntbh.exe93⤵PID:1508
-
\??\c:\nbhhbb.exec:\nbhhbb.exe94⤵PID:1984
-
\??\c:\5llfllr.exec:\5llfllr.exe95⤵PID:588
-
\??\c:\pjdjj.exec:\pjdjj.exe96⤵PID:2008
-
\??\c:\bnnbbb.exec:\bnnbbb.exe97⤵PID:2896
-
\??\c:\nbhnnn.exec:\nbhnnn.exe98⤵PID:1924
-
\??\c:\3lxflxl.exec:\3lxflxl.exe99⤵PID:2916
-
\??\c:\fxflrfr.exec:\fxflrfr.exe100⤵PID:2372
-
\??\c:\7vvjd.exec:\7vvjd.exe101⤵PID:2412
-
\??\c:\bhbnht.exec:\bhbnht.exe102⤵PID:1404
-
\??\c:\5xrrflr.exec:\5xrrflr.exe103⤵PID:1760
-
\??\c:\7fflflx.exec:\7fflflx.exe104⤵PID:2064
-
\??\c:\dvjjj.exec:\dvjjj.exe105⤵PID:648
-
\??\c:\jdjvj.exec:\jdjvj.exe106⤵PID:2052
-
\??\c:\nhbnbb.exec:\nhbnbb.exe107⤵PID:1628
-
\??\c:\5rrrrrf.exec:\5rrrrrf.exe108⤵PID:1672
-
\??\c:\fxrxffr.exec:\fxrxffr.exe109⤵PID:2420
-
\??\c:\pvddj.exec:\pvddj.exe110⤵PID:1380
-
\??\c:\bbnhnh.exec:\bbnhnh.exe111⤵PID:912
-
\??\c:\rfffrrr.exec:\rfffrrr.exe112⤵PID:2572
-
\??\c:\fxrxfxf.exec:\fxrxfxf.exe113⤵PID:3020
-
\??\c:\jvdjd.exec:\jvdjd.exe114⤵PID:3036
-
\??\c:\hhbnbn.exec:\hhbnbn.exe115⤵PID:892
-
\??\c:\3llrrxl.exec:\3llrrxl.exe116⤵PID:1668
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe117⤵PID:2228
-
\??\c:\pjjjp.exec:\pjjjp.exe118⤵PID:1724
-
\??\c:\tnbntn.exec:\tnbntn.exe119⤵PID:2988
-
\??\c:\xrlxxlr.exec:\xrlxxlr.exe120⤵PID:1584
-
\??\c:\jjvdd.exec:\jjvdd.exe121⤵PID:828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-