Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe
-
Size
456KB
-
MD5
ae1f2923021b0174404ccb041ad8b6a0
-
SHA1
ef7d89b7da61987fe922fd8f153c57bc90396cc9
-
SHA256
bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497b
-
SHA512
5c8719c5a48908a8a34abfca3704af365443fa76e5927ff0a39772eb4d8201a5cbbce47a802f99595fef1c723d2bd9c117d85c2b79c85eee85160eebda601185
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRp:q7Tc2NYHUrAwfMp3CDRp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-420-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/664-435-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1732-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-534-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1856-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-582-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2432-677-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1544-723-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1000-832-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1000-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-858-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-996-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-1034-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-1146-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2784 hbbbhh.exe 2692 pjdjp.exe 2760 tbnbhh.exe 2756 frlrrrx.exe 2716 tnnbhb.exe 2556 bthhtt.exe 3032 3thhhh.exe 556 tbthtb.exe 2892 9jdvp.exe 2916 rrffffx.exe 2164 7btbnn.exe 756 fllxfrx.exe 2284 pppdp.exe 1888 fxlrllx.exe 1056 tnhthn.exe 2808 ddjpd.exe 1848 llxfffr.exe 2976 ddpdj.exe 2452 llflxrl.exe 1764 nnhnth.exe 2172 jddjd.exe 440 9hbnbh.exe 1620 vjddd.exe 2332 hhbthn.exe 1648 jjjpd.exe 1564 bhbntb.exe 2468 jjvjd.exe 2136 hhhbtt.exe 2464 1djjv.exe 1004 xrrfxxr.exe 1000 nnbhtb.exe 2672 ffxlrxl.exe 2764 llffrxr.exe 2852 3djjp.exe 2700 vpjvd.exe 2248 xxrxxfr.exe 2760 hhthnt.exe 2756 pjppd.exe 2820 7ffrlxl.exe 2712 lrlrxfr.exe 2664 ttnntt.exe 3056 3ppvv.exe 1724 llffrxf.exe 2860 rrlrffx.exe 2908 btbhtt.exe 3048 1pjjv.exe 1708 ffffxxl.exe 2164 xrfxffl.exe 1220 5nbntb.exe 2632 ddvdp.exe 2292 xxrlflf.exe 2352 ttnbhn.exe 664 tnnnbb.exe 1632 3jdjv.exe 1544 lrfxrrf.exe 1848 lfrxflr.exe 2988 nhbnbb.exe 1732 dvddp.exe 1884 fxrrxxl.exe 904 5hntbn.exe 2412 tnhtnt.exe 2348 pdjpv.exe 2980 3xllxxx.exe 2476 nhbnbh.exe -
resource yara_rule behavioral1/memory/2684-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-35-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2756-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/440-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-371-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1708-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-420-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1732-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-582-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2108-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-677-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1544-723-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/1000-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-996-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-1146-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2784 2684 bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe 31 PID 2684 wrote to memory of 2784 2684 bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe 31 PID 2684 wrote to memory of 2784 2684 bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe 31 PID 2684 wrote to memory of 2784 2684 bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe 31 PID 2784 wrote to memory of 2692 2784 hbbbhh.exe 32 PID 2784 wrote to memory of 2692 2784 hbbbhh.exe 32 PID 2784 wrote to memory of 2692 2784 hbbbhh.exe 32 PID 2784 wrote to memory of 2692 2784 hbbbhh.exe 32 PID 2692 wrote to memory of 2760 2692 pjdjp.exe 33 PID 2692 wrote to memory of 2760 2692 pjdjp.exe 33 PID 2692 wrote to memory of 2760 2692 pjdjp.exe 33 PID 2692 wrote to memory of 2760 2692 pjdjp.exe 33 PID 2760 wrote to memory of 2756 2760 tbnbhh.exe 34 PID 2760 wrote to memory of 2756 2760 tbnbhh.exe 34 PID 2760 wrote to memory of 2756 2760 tbnbhh.exe 34 PID 2760 wrote to memory of 2756 2760 tbnbhh.exe 34 PID 2756 wrote to memory of 2716 2756 frlrrrx.exe 35 PID 2756 wrote to memory of 2716 2756 frlrrrx.exe 35 PID 2756 wrote to memory of 2716 2756 frlrrrx.exe 35 PID 2756 wrote to memory of 2716 2756 frlrrrx.exe 35 PID 2716 wrote to memory of 2556 2716 tnnbhb.exe 36 PID 2716 wrote to memory of 2556 2716 tnnbhb.exe 36 PID 2716 wrote to memory of 2556 2716 tnnbhb.exe 36 PID 2716 wrote to memory of 2556 2716 tnnbhb.exe 36 PID 2556 wrote to memory of 3032 2556 bthhtt.exe 37 PID 2556 wrote to memory of 3032 2556 bthhtt.exe 37 PID 2556 wrote to memory of 3032 2556 bthhtt.exe 37 PID 2556 wrote to memory of 3032 2556 bthhtt.exe 37 PID 3032 wrote to memory of 556 3032 3thhhh.exe 38 PID 3032 wrote to memory of 556 3032 3thhhh.exe 38 PID 3032 wrote to memory of 556 3032 3thhhh.exe 38 PID 3032 wrote to memory of 556 3032 3thhhh.exe 38 PID 556 wrote to memory of 2892 556 tbthtb.exe 39 PID 556 wrote to memory of 2892 556 tbthtb.exe 39 PID 556 wrote to memory of 2892 556 tbthtb.exe 39 PID 556 wrote to memory of 2892 556 tbthtb.exe 39 PID 2892 wrote to memory of 2916 2892 9jdvp.exe 40 PID 2892 wrote to memory of 2916 2892 9jdvp.exe 40 PID 2892 wrote to memory of 2916 2892 9jdvp.exe 40 PID 2892 wrote to memory of 2916 2892 9jdvp.exe 40 PID 2916 wrote to memory of 2164 2916 rrffffx.exe 41 PID 2916 wrote to memory of 2164 2916 rrffffx.exe 41 PID 2916 wrote to memory of 2164 2916 rrffffx.exe 41 PID 2916 wrote to memory of 2164 2916 rrffffx.exe 41 PID 2164 wrote to memory of 756 2164 7btbnn.exe 42 PID 2164 wrote to memory of 756 2164 7btbnn.exe 42 PID 2164 wrote to memory of 756 2164 7btbnn.exe 42 PID 2164 wrote to memory of 756 2164 7btbnn.exe 42 PID 756 wrote to memory of 2284 756 fllxfrx.exe 43 PID 756 wrote to memory of 2284 756 fllxfrx.exe 43 PID 756 wrote to memory of 2284 756 fllxfrx.exe 43 PID 756 wrote to memory of 2284 756 fllxfrx.exe 43 PID 2284 wrote to memory of 1888 2284 pppdp.exe 44 PID 2284 wrote to memory of 1888 2284 pppdp.exe 44 PID 2284 wrote to memory of 1888 2284 pppdp.exe 44 PID 2284 wrote to memory of 1888 2284 pppdp.exe 44 PID 1888 wrote to memory of 1056 1888 fxlrllx.exe 45 PID 1888 wrote to memory of 1056 1888 fxlrllx.exe 45 PID 1888 wrote to memory of 1056 1888 fxlrllx.exe 45 PID 1888 wrote to memory of 1056 1888 fxlrllx.exe 45 PID 1056 wrote to memory of 2808 1056 tnhthn.exe 46 PID 1056 wrote to memory of 2808 1056 tnhthn.exe 46 PID 1056 wrote to memory of 2808 1056 tnhthn.exe 46 PID 1056 wrote to memory of 2808 1056 tnhthn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe"C:\Users\Admin\AppData\Local\Temp\bcd245407e7de930f2f59ba81d7ecf227ac5d26778dfeb7e6a65ba17fe6a497bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hbbbhh.exec:\hbbbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjdjp.exec:\pjdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\tbnbhh.exec:\tbnbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\frlrrrx.exec:\frlrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnnbhb.exec:\tnnbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bthhtt.exec:\bthhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3thhhh.exec:\3thhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tbthtb.exec:\tbthtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\9jdvp.exec:\9jdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rrffffx.exec:\rrffffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\7btbnn.exec:\7btbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\fllxfrx.exec:\fllxfrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\pppdp.exec:\pppdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\fxlrllx.exec:\fxlrllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\tnhthn.exec:\tnhthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\ddjpd.exec:\ddjpd.exe17⤵
- Executes dropped EXE
PID:2808 -
\??\c:\llxfffr.exec:\llxfffr.exe18⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ddpdj.exec:\ddpdj.exe19⤵
- Executes dropped EXE
PID:2976 -
\??\c:\llflxrl.exec:\llflxrl.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nnhnth.exec:\nnhnth.exe21⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jddjd.exec:\jddjd.exe22⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9hbnbh.exec:\9hbnbh.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\vjddd.exec:\vjddd.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hhbthn.exec:\hhbthn.exe25⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jjjpd.exec:\jjjpd.exe26⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bhbntb.exec:\bhbntb.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jjvjd.exec:\jjvjd.exe28⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hhhbtt.exec:\hhhbtt.exe29⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1djjv.exec:\1djjv.exe30⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe31⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nnbhtb.exec:\nnbhtb.exe32⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe33⤵
- Executes dropped EXE
PID:2672 -
\??\c:\llffrxr.exec:\llffrxr.exe34⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3djjp.exec:\3djjp.exe35⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vpjvd.exec:\vpjvd.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xxrxxfr.exec:\xxrxxfr.exe37⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hhthnt.exec:\hhthnt.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pjppd.exec:\pjppd.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7ffrlxl.exec:\7ffrlxl.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lrlrxfr.exec:\lrlrxfr.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\ttnntt.exec:\ttnntt.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3ppvv.exec:\3ppvv.exe43⤵
- Executes dropped EXE
PID:3056 -
\??\c:\llffrxf.exec:\llffrxf.exe44⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrlrffx.exec:\rrlrffx.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\btbhtt.exec:\btbhtt.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1pjjv.exec:\1pjjv.exe47⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ffffxxl.exec:\ffffxxl.exe48⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xrfxffl.exec:\xrfxffl.exe49⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5nbntb.exec:\5nbntb.exe50⤵
- Executes dropped EXE
PID:1220 -
\??\c:\ddvdp.exec:\ddvdp.exe51⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xxrlflf.exec:\xxrlflf.exe52⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ttnbhn.exec:\ttnbhn.exe53⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tnnnbb.exec:\tnnnbb.exe54⤵
- Executes dropped EXE
PID:664 -
\??\c:\3jdjv.exec:\3jdjv.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lrfxrrf.exec:\lrfxrrf.exe56⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lfrxflr.exec:\lfrxflr.exe57⤵
- Executes dropped EXE
PID:1848 -
\??\c:\nhbnbb.exec:\nhbnbb.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dvddp.exec:\dvddp.exe59⤵
- Executes dropped EXE
PID:1732 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe60⤵
- Executes dropped EXE
PID:1884 -
\??\c:\5hntbn.exec:\5hntbn.exe61⤵
- Executes dropped EXE
PID:904 -
\??\c:\tnhtnt.exec:\tnhtnt.exe62⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pdjpv.exec:\pdjpv.exe63⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3xllxxx.exec:\3xllxxx.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nhbnbh.exec:\nhbnbh.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bbtbnt.exec:\bbtbnt.exe66⤵PID:1624
-
\??\c:\jjddj.exec:\jjddj.exe67⤵PID:1648
-
\??\c:\xxlxflx.exec:\xxlxflx.exe68⤵PID:564
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe69⤵PID:3060
-
\??\c:\tbnhhn.exec:\tbnhhn.exe70⤵PID:2480
-
\??\c:\7vpvj.exec:\7vpvj.exe71⤵PID:1856
-
\??\c:\llffrrf.exec:\llffrrf.exe72⤵
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\fxrxxfr.exec:\fxrxxfr.exe73⤵PID:1016
-
\??\c:\9tntnn.exec:\9tntnn.exe74⤵PID:1988
-
\??\c:\dvdjp.exec:\dvdjp.exe75⤵PID:2672
-
\??\c:\lfxxlfr.exec:\lfxxlfr.exe76⤵PID:1512
-
\??\c:\1lffrxf.exec:\1lffrxf.exe77⤵PID:2380
-
\??\c:\tnhhtt.exec:\tnhhtt.exe78⤵PID:2692
-
\??\c:\jdjjv.exec:\jdjjv.exe79⤵PID:2960
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe80⤵PID:2900
-
\??\c:\5rllxfl.exec:\5rllxfl.exe81⤵PID:2108
-
\??\c:\bbbbbh.exec:\bbbbbh.exe82⤵PID:2544
-
\??\c:\dvppd.exec:\dvppd.exe83⤵PID:2656
-
\??\c:\xlrxlfl.exec:\xlrxlfl.exe84⤵PID:2360
-
\??\c:\thbbhh.exec:\thbbhh.exe85⤵PID:2664
-
\??\c:\5bnntb.exec:\5bnntb.exe86⤵PID:2276
-
\??\c:\vvpvj.exec:\vvpvj.exe87⤵PID:828
-
\??\c:\rlffflr.exec:\rlffflr.exe88⤵PID:2928
-
\??\c:\rllfrxl.exec:\rllfrxl.exe89⤵PID:2940
-
\??\c:\tnnthn.exec:\tnnthn.exe90⤵PID:2376
-
\??\c:\7ddjd.exec:\7ddjd.exe91⤵PID:1644
-
\??\c:\fxllxfx.exec:\fxllxfx.exe92⤵PID:2288
-
\??\c:\lxlrffr.exec:\lxlrffr.exe93⤵PID:2432
-
\??\c:\9tnntt.exec:\9tnntt.exe94⤵PID:2284
-
\??\c:\jjvjd.exec:\jjvjd.exe95⤵PID:2644
-
\??\c:\dpjjv.exec:\dpjjv.exe96⤵PID:2816
-
\??\c:\lllfllr.exec:\lllfllr.exe97⤵PID:1892
-
\??\c:\9ttnhn.exec:\9ttnhn.exe98⤵PID:1588
-
\??\c:\nnnhtb.exec:\nnnhtb.exe99⤵PID:1232
-
\??\c:\1ppdj.exec:\1ppdj.exe100⤵PID:1544
-
\??\c:\3xxlrxl.exec:\3xxlrxl.exe101⤵PID:2144
-
\??\c:\lllxfxr.exec:\lllxfxr.exe102⤵
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\hhthtb.exec:\hhthtb.exe103⤵PID:1704
-
\??\c:\vdvdp.exec:\vdvdp.exe104⤵PID:1884
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe105⤵PID:904
-
\??\c:\7xrlflx.exec:\7xrlflx.exe106⤵PID:1536
-
\??\c:\9thntt.exec:\9thntt.exe107⤵PID:2200
-
\??\c:\vvvjd.exec:\vvvjd.exe108⤵PID:1684
-
\??\c:\jdpdp.exec:\jdpdp.exe109⤵PID:1720
-
\??\c:\9rlrffx.exec:\9rlrffx.exe110⤵PID:680
-
\??\c:\1btbtb.exec:\1btbtb.exe111⤵PID:600
-
\??\c:\ppjpd.exec:\ppjpd.exe112⤵PID:236
-
\??\c:\dvjvj.exec:\dvjvj.exe113⤵PID:3004
-
\??\c:\rlffxxl.exec:\rlffxxl.exe114⤵PID:2500
-
\??\c:\9rffrxf.exec:\9rffrxf.exe115⤵PID:2464
-
\??\c:\1nbhbb.exec:\1nbhbb.exe116⤵PID:2052
-
\??\c:\dvddv.exec:\dvddv.exe117⤵PID:1000
-
\??\c:\vpjjv.exec:\vpjjv.exe118⤵PID:1500
-
\??\c:\5ttbnt.exec:\5ttbnt.exe119⤵PID:2764
-
\??\c:\1htnbn.exec:\1htnbn.exe120⤵PID:2772
-
\??\c:\3jpvd.exec:\3jpvd.exe121⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-