Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe
-
Size
454KB
-
MD5
cce11e888e24fb2b5fcad09d624f10d0
-
SHA1
4dd12cc2a9e7b20e687f490889b02e3d1d15014b
-
SHA256
87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7
-
SHA512
80ea6af43a410ca0d19063ddba57b1aef0247280c7929f7beab22c6d0a305bad8adc01ff5e373d9fa81b965c81f339964d2b964e716b98643e25a37ee551d525
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2228-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-22-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2812-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/776-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-585-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2944-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-730-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-737-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-752-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2484-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-799-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-807-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-865-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3032-910-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-967-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2732 rlfflrr.exe 2812 nbttbn.exe 2240 vjvvd.exe 2780 bttbhh.exe 2760 fxlrlrx.exe 2620 thbtbb.exe 3044 vpddj.exe 1876 bthnnt.exe 3064 1jdpv.exe 2144 lrrxlxl.exe 776 7ttntt.exe 2000 5pjvd.exe 1872 5nbhbh.exe 1212 frfrrxl.exe 1604 9htntt.exe 2900 pjddd.exe 1688 7lxfrrx.exe 1248 5pddv.exe 1560 bbnntn.exe 2220 dvpvd.exe 1916 9lxxfrx.exe 664 thtbhh.exe 2480 3rfrxfr.exe 940 vpdjp.exe 1816 lllrxrf.exe 2376 5ntbnn.exe 2016 lllxlxr.exe 2084 ffrrrrx.exe 1736 dppdd.exe 2500 1rrrffl.exe 1708 vdvvj.exe 2808 1rlrxfl.exe 2804 dddpj.exe 2864 3jddj.exe 2960 fxlxflx.exe 2452 hhbntb.exe 2840 ppppv.exe 2700 ffxxlrf.exe 2708 rrlrflx.exe 3048 hthntb.exe 3056 xrlrffx.exe 2936 nbtthh.exe 3020 3btthn.exe 532 dvjjp.exe 2628 xxllxxf.exe 2884 tnbhtt.exe 2496 ppvvd.exe 2832 vjjpj.exe 756 lfrrflx.exe 2028 nnbnht.exe 1212 jpvjp.exe 2932 rlrxlxf.exe 1684 bthhnn.exe 840 bthtnn.exe 1288 vpjpv.exe 2412 xxxrlrl.exe 2256 bntttb.exe 1912 hbthbh.exe 1920 vvppv.exe 1916 fxlrxxl.exe 832 5hhnth.exe 680 pjddj.exe 1352 vpjpd.exe 1396 5fxfrxx.exe -
resource yara_rule behavioral1/memory/2732-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-752-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2216-758-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2484-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-834-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2596-865-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1432-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-980-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2732 2228 87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe 30 PID 2228 wrote to memory of 2732 2228 87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe 30 PID 2228 wrote to memory of 2732 2228 87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe 30 PID 2228 wrote to memory of 2732 2228 87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe 30 PID 2732 wrote to memory of 2812 2732 rlfflrr.exe 31 PID 2732 wrote to memory of 2812 2732 rlfflrr.exe 31 PID 2732 wrote to memory of 2812 2732 rlfflrr.exe 31 PID 2732 wrote to memory of 2812 2732 rlfflrr.exe 31 PID 2812 wrote to memory of 2240 2812 nbttbn.exe 32 PID 2812 wrote to memory of 2240 2812 nbttbn.exe 32 PID 2812 wrote to memory of 2240 2812 nbttbn.exe 32 PID 2812 wrote to memory of 2240 2812 nbttbn.exe 32 PID 2240 wrote to memory of 2780 2240 vjvvd.exe 33 PID 2240 wrote to memory of 2780 2240 vjvvd.exe 33 PID 2240 wrote to memory of 2780 2240 vjvvd.exe 33 PID 2240 wrote to memory of 2780 2240 vjvvd.exe 33 PID 2780 wrote to memory of 2760 2780 bttbhh.exe 34 PID 2780 wrote to memory of 2760 2780 bttbhh.exe 34 PID 2780 wrote to memory of 2760 2780 bttbhh.exe 34 PID 2780 wrote to memory of 2760 2780 bttbhh.exe 34 PID 2760 wrote to memory of 2620 2760 fxlrlrx.exe 35 PID 2760 wrote to memory of 2620 2760 fxlrlrx.exe 35 PID 2760 wrote to memory of 2620 2760 fxlrlrx.exe 35 PID 2760 wrote to memory of 2620 2760 fxlrlrx.exe 35 PID 2620 wrote to memory of 3044 2620 thbtbb.exe 36 PID 2620 wrote to memory of 3044 2620 thbtbb.exe 36 PID 2620 wrote to memory of 3044 2620 thbtbb.exe 36 PID 2620 wrote to memory of 3044 2620 thbtbb.exe 36 PID 3044 wrote to memory of 1876 3044 vpddj.exe 37 PID 3044 wrote to memory of 1876 3044 vpddj.exe 37 PID 3044 wrote to memory of 1876 3044 vpddj.exe 37 PID 3044 wrote to memory of 1876 3044 vpddj.exe 37 PID 1876 wrote to memory of 3064 1876 bthnnt.exe 38 PID 1876 wrote to memory of 3064 1876 bthnnt.exe 38 PID 1876 wrote to memory of 3064 1876 bthnnt.exe 38 PID 1876 wrote to memory of 3064 1876 bthnnt.exe 38 PID 3064 wrote to memory of 2144 3064 1jdpv.exe 39 PID 3064 wrote to memory of 2144 3064 1jdpv.exe 39 PID 3064 wrote to memory of 2144 3064 1jdpv.exe 39 PID 3064 wrote to memory of 2144 3064 1jdpv.exe 39 PID 2144 wrote to memory of 776 2144 lrrxlxl.exe 40 PID 2144 wrote to memory of 776 2144 lrrxlxl.exe 40 PID 2144 wrote to memory of 776 2144 lrrxlxl.exe 40 PID 2144 wrote to memory of 776 2144 lrrxlxl.exe 40 PID 776 wrote to memory of 2000 776 7ttntt.exe 41 PID 776 wrote to memory of 2000 776 7ttntt.exe 41 PID 776 wrote to memory of 2000 776 7ttntt.exe 41 PID 776 wrote to memory of 2000 776 7ttntt.exe 41 PID 2000 wrote to memory of 1872 2000 5pjvd.exe 42 PID 2000 wrote to memory of 1872 2000 5pjvd.exe 42 PID 2000 wrote to memory of 1872 2000 5pjvd.exe 42 PID 2000 wrote to memory of 1872 2000 5pjvd.exe 42 PID 1872 wrote to memory of 1212 1872 5nbhbh.exe 43 PID 1872 wrote to memory of 1212 1872 5nbhbh.exe 43 PID 1872 wrote to memory of 1212 1872 5nbhbh.exe 43 PID 1872 wrote to memory of 1212 1872 5nbhbh.exe 43 PID 1212 wrote to memory of 1604 1212 frfrrxl.exe 44 PID 1212 wrote to memory of 1604 1212 frfrrxl.exe 44 PID 1212 wrote to memory of 1604 1212 frfrrxl.exe 44 PID 1212 wrote to memory of 1604 1212 frfrrxl.exe 44 PID 1604 wrote to memory of 2900 1604 9htntt.exe 45 PID 1604 wrote to memory of 2900 1604 9htntt.exe 45 PID 1604 wrote to memory of 2900 1604 9htntt.exe 45 PID 1604 wrote to memory of 2900 1604 9htntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe"C:\Users\Admin\AppData\Local\Temp\87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rlfflrr.exec:\rlfflrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nbttbn.exec:\nbttbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vjvvd.exec:\vjvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bttbhh.exec:\bttbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\fxlrlrx.exec:\fxlrlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\thbtbb.exec:\thbtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vpddj.exec:\vpddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\bthnnt.exec:\bthnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\1jdpv.exec:\1jdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lrrxlxl.exec:\lrrxlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\7ttntt.exec:\7ttntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\5pjvd.exec:\5pjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\5nbhbh.exec:\5nbhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\frfrrxl.exec:\frfrrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\9htntt.exec:\9htntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\pjddd.exec:\pjddd.exe17⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7lxfrrx.exec:\7lxfrrx.exe18⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5pddv.exec:\5pddv.exe19⤵
- Executes dropped EXE
PID:1248 -
\??\c:\bbnntn.exec:\bbnntn.exe20⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dvpvd.exec:\dvpvd.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9lxxfrx.exec:\9lxxfrx.exe22⤵
- Executes dropped EXE
PID:1916 -
\??\c:\thtbhh.exec:\thtbhh.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\3rfrxfr.exec:\3rfrxfr.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vpdjp.exec:\vpdjp.exe25⤵
- Executes dropped EXE
PID:940 -
\??\c:\lllrxrf.exec:\lllrxrf.exe26⤵
- Executes dropped EXE
PID:1816 -
\??\c:\5ntbnn.exec:\5ntbnn.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lllxlxr.exec:\lllxlxr.exe28⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe29⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dppdd.exec:\dppdd.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1rrrffl.exec:\1rrrffl.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vdvvj.exec:\vdvvj.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1rlrxfl.exec:\1rlrxfl.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dddpj.exec:\dddpj.exe34⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3jddj.exec:\3jddj.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\fxlxflx.exec:\fxlxflx.exe36⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hhbntb.exec:\hhbntb.exe37⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ppppv.exec:\ppppv.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rrlrflx.exec:\rrlrflx.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hthntb.exec:\hthntb.exe41⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrlrffx.exec:\xrlrffx.exe42⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nbtthh.exec:\nbtthh.exe43⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3btthn.exec:\3btthn.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dvjjp.exec:\dvjjp.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\xxllxxf.exec:\xxllxxf.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnbhtt.exec:\tnbhtt.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ppvvd.exec:\ppvvd.exe48⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vjjpj.exec:\vjjpj.exe49⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lfrrflx.exec:\lfrrflx.exe50⤵
- Executes dropped EXE
PID:756 -
\??\c:\nnbnht.exec:\nnbnht.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jpvjp.exec:\jpvjp.exe52⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rlrxlxf.exec:\rlrxlxf.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bthhnn.exec:\bthhnn.exe54⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bthtnn.exec:\bthtnn.exe55⤵
- Executes dropped EXE
PID:840 -
\??\c:\vpjpv.exec:\vpjpv.exe56⤵
- Executes dropped EXE
PID:1288 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bntttb.exec:\bntttb.exe58⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbthbh.exec:\hbthbh.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vvppv.exec:\vvppv.exe60⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe61⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5hhnth.exec:\5hhnth.exe62⤵
- Executes dropped EXE
PID:832 -
\??\c:\pjddj.exec:\pjddj.exe63⤵
- Executes dropped EXE
PID:680 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5fxfrxx.exec:\5fxfrxx.exe65⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bnhhnt.exec:\bnhhnt.exe66⤵PID:1616
-
\??\c:\jdvdp.exec:\jdvdp.exe67⤵PID:2400
-
\??\c:\vvddj.exec:\vvddj.exe68⤵PID:1628
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe69⤵PID:2016
-
\??\c:\3tnbbh.exec:\3tnbbh.exe70⤵PID:2060
-
\??\c:\tththh.exec:\tththh.exe71⤵PID:2252
-
\??\c:\vvddj.exec:\vvddj.exe72⤵PID:884
-
\??\c:\5lxffrf.exec:\5lxffrf.exe73⤵PID:2136
-
\??\c:\llfrffx.exec:\llfrffx.exe74⤵PID:2116
-
\??\c:\nbnnnn.exec:\nbnnnn.exe75⤵PID:2696
-
\??\c:\ddpvj.exec:\ddpvj.exe76⤵PID:2808
-
\??\c:\pjvvj.exec:\pjvvj.exe77⤵PID:2868
-
\??\c:\3frrxfr.exec:\3frrxfr.exe78⤵
- System Location Discovery: System Language Discovery
PID:2800 -
\??\c:\tbntnt.exec:\tbntnt.exe79⤵PID:2852
-
\??\c:\9pddp.exec:\9pddp.exe80⤵PID:2924
-
\??\c:\ppdjp.exec:\ppdjp.exe81⤵PID:2588
-
\??\c:\xrlxxrf.exec:\xrlxxrf.exe82⤵PID:2644
-
\??\c:\ttbhbh.exec:\ttbhbh.exe83⤵PID:2708
-
\??\c:\jjjjd.exec:\jjjjd.exe84⤵PID:1948
-
\??\c:\rxllrxf.exec:\rxllrxf.exe85⤵PID:2944
-
\??\c:\rlffxlr.exec:\rlffxlr.exe86⤵PID:2936
-
\??\c:\bttthn.exec:\bttthn.exe87⤵PID:768
-
\??\c:\5jvvd.exec:\5jvvd.exe88⤵PID:2144
-
\??\c:\fxrflrf.exec:\fxrflrf.exe89⤵PID:2628
-
\??\c:\xfxfrrf.exec:\xfxfrrf.exe90⤵PID:1432
-
\??\c:\hhbnbh.exec:\hhbnbh.exe91⤵PID:1856
-
\??\c:\pjjdp.exec:\pjjdp.exe92⤵PID:1712
-
\??\c:\5rxlrxr.exec:\5rxlrxr.exe93⤵PID:2040
-
\??\c:\hhhtbb.exec:\hhhtbb.exe94⤵PID:2108
-
\??\c:\3jdjv.exec:\3jdjv.exe95⤵PID:1724
-
\??\c:\ppjvd.exec:\ppjvd.exe96⤵PID:1260
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe97⤵PID:2460
-
\??\c:\bbbbht.exec:\bbbbht.exe98⤵PID:2988
-
\??\c:\9vpdj.exec:\9vpdj.exe99⤵
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\7lllxxx.exec:\7lllxxx.exe100⤵PID:2272
-
\??\c:\5lrxlrx.exec:\5lrxlrx.exe101⤵PID:1660
-
\??\c:\tnhbhh.exec:\tnhbhh.exe102⤵PID:2420
-
\??\c:\1jvpp.exec:\1jvpp.exe103⤵PID:2216
-
\??\c:\xrllrlf.exec:\xrllrlf.exe104⤵PID:752
-
\??\c:\5rffrrf.exec:\5rffrrf.exe105⤵PID:2484
-
\??\c:\7btttt.exec:\7btttt.exe106⤵PID:1352
-
\??\c:\vvpdj.exec:\vvpdj.exe107⤵PID:1396
-
\??\c:\rrlxflf.exec:\rrlxflf.exe108⤵PID:1616
-
\??\c:\thhttb.exec:\thhttb.exe109⤵PID:1944
-
\??\c:\nntbhn.exec:\nntbhn.exe110⤵PID:1628
-
\??\c:\1jdjp.exec:\1jdjp.exe111⤵PID:3012
-
\??\c:\fxxflrf.exec:\fxxflrf.exe112⤵PID:1976
-
\??\c:\htnbnt.exec:\htnbnt.exe113⤵PID:2876
-
\??\c:\jjdjp.exec:\jjdjp.exe114⤵PID:2120
-
\??\c:\pppvv.exec:\pppvv.exe115⤵PID:2824
-
\??\c:\llxfrrr.exec:\llxfrrr.exe116⤵PID:2712
-
\??\c:\9thhtt.exec:\9thhtt.exe117⤵PID:2720
-
\??\c:\1pjpd.exec:\1pjpd.exe118⤵PID:2792
-
\??\c:\3xlllrx.exec:\3xlllrx.exe119⤵PID:2596
-
\??\c:\1nhbnh.exec:\1nhbnh.exe120⤵PID:2612
-
\??\c:\7vvjd.exec:\7vvjd.exe121⤵PID:2752
-
\??\c:\pjdjj.exec:\pjdjj.exe122⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-