Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
-
Size
454KB
-
MD5
54cfbe2a1c7bd739fd53a7066ba9c02e
-
SHA1
7eb9ea5d7d2df34c520702a33d1f2a8ea908562c
-
SHA256
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be
-
SHA512
70810c39f33e86dea480580f5aec356edb6c4882e0249581a7b7e4af8ac13d458a09c92b02bd9f03573f8ad2804841a9873f15b2b62337c9b5843ecb9dd91945
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-92-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2748-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-110-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2600-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-128-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2332-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-157-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1208-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-166-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/884-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-186-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-532-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2524-551-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1588-573-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-621-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1620-666-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2140-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-867-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2804-876-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3032-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-923-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1844-934-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1192-986-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1616-1017-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 hbbtbh.exe 2144 jdpvj.exe 1668 hhbhnn.exe 2664 3vjjp.exe 2016 llllfrf.exe 2800 rrffllx.exe 2736 1dvvj.exe 2160 nhbhhn.exe 2892 httnht.exe 2748 7lllfxx.exe 2600 thttbn.exe 2872 llxfrxf.exe 1708 1xrrxxr.exe 2332 bnhnbh.exe 884 jvvvd.exe 1208 nhhthh.exe 828 nnbhth.exe 1936 rrlrfll.exe 1672 tbhhtb.exe 2648 rxlfrrl.exe 1800 rrrfxfx.exe 1048 ttnhtb.exe 1704 rrfflrf.exe 908 5vpvj.exe 776 rllxflx.exe 2092 jvvvv.exe 2268 jdppd.exe 2324 hnbtbb.exe 1868 3btbhb.exe 2436 rllrrrf.exe 2516 tbtbhb.exe 2232 dvdjj.exe 2528 jvppp.exe 2348 fxllxrl.exe 1980 3bnbhn.exe 2924 vpdjj.exe 2688 3jdjp.exe 2016 3xlrxfl.exe 2820 hbhhtt.exe 2788 bbtbhh.exe 2936 1pvvj.exe 2160 5xxfrlr.exe 2460 bbhbbb.exe 2892 5hbbbh.exe 2644 7jvvv.exe 3020 lxxrlrr.exe 768 flffrrr.exe 648 nhtthn.exe 1860 7jpvv.exe 2488 5fxrxxf.exe 1824 lxfxxxf.exe 1684 hthhnh.exe 1208 nbtntt.exe 840 vpjdd.exe 2840 lxffxff.exe 2832 rlxlrxf.exe 1672 tnnnnn.exe 2188 vppvj.exe 2472 vjvpv.exe 2184 ffxxfrr.exe 2316 tttbtt.exe 1884 7hbhhn.exe 1252 jjvvd.exe 2312 pvvvj.exe -
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-110-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2600-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-318-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2788-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-973-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2544 2504 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 2504 wrote to memory of 2544 2504 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 2504 wrote to memory of 2544 2504 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 2504 wrote to memory of 2544 2504 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 2544 wrote to memory of 2144 2544 hbbtbh.exe 31 PID 2544 wrote to memory of 2144 2544 hbbtbh.exe 31 PID 2544 wrote to memory of 2144 2544 hbbtbh.exe 31 PID 2544 wrote to memory of 2144 2544 hbbtbh.exe 31 PID 2144 wrote to memory of 1668 2144 jdpvj.exe 32 PID 2144 wrote to memory of 1668 2144 jdpvj.exe 32 PID 2144 wrote to memory of 1668 2144 jdpvj.exe 32 PID 2144 wrote to memory of 1668 2144 jdpvj.exe 32 PID 1668 wrote to memory of 2664 1668 hhbhnn.exe 33 PID 1668 wrote to memory of 2664 1668 hhbhnn.exe 33 PID 1668 wrote to memory of 2664 1668 hhbhnn.exe 33 PID 1668 wrote to memory of 2664 1668 hhbhnn.exe 33 PID 2664 wrote to memory of 2016 2664 3vjjp.exe 34 PID 2664 wrote to memory of 2016 2664 3vjjp.exe 34 PID 2664 wrote to memory of 2016 2664 3vjjp.exe 34 PID 2664 wrote to memory of 2016 2664 3vjjp.exe 34 PID 2016 wrote to memory of 2800 2016 llllfrf.exe 35 PID 2016 wrote to memory of 2800 2016 llllfrf.exe 35 PID 2016 wrote to memory of 2800 2016 llllfrf.exe 35 PID 2016 wrote to memory of 2800 2016 llllfrf.exe 35 PID 2800 wrote to memory of 2736 2800 rrffllx.exe 36 PID 2800 wrote to memory of 2736 2800 rrffllx.exe 36 PID 2800 wrote to memory of 2736 2800 rrffllx.exe 36 PID 2800 wrote to memory of 2736 2800 rrffllx.exe 36 PID 2736 wrote to memory of 2160 2736 1dvvj.exe 37 PID 2736 wrote to memory of 2160 2736 1dvvj.exe 37 PID 2736 wrote to memory of 2160 2736 1dvvj.exe 37 PID 2736 wrote to memory of 2160 2736 1dvvj.exe 37 PID 2160 wrote to memory of 2892 2160 nhbhhn.exe 38 PID 2160 wrote to memory of 2892 2160 nhbhhn.exe 38 PID 2160 wrote to memory of 2892 2160 nhbhhn.exe 38 PID 2160 wrote to memory of 2892 2160 nhbhhn.exe 38 PID 2892 wrote to memory of 2748 2892 httnht.exe 39 PID 2892 wrote to memory of 2748 2892 httnht.exe 39 PID 2892 wrote to memory of 2748 2892 httnht.exe 39 PID 2892 wrote to memory of 2748 2892 httnht.exe 39 PID 2748 wrote to memory of 2600 2748 7lllfxx.exe 40 PID 2748 wrote to memory of 2600 2748 7lllfxx.exe 40 PID 2748 wrote to memory of 2600 2748 7lllfxx.exe 40 PID 2748 wrote to memory of 2600 2748 7lllfxx.exe 40 PID 2600 wrote to memory of 2872 2600 thttbn.exe 41 PID 2600 wrote to memory of 2872 2600 thttbn.exe 41 PID 2600 wrote to memory of 2872 2600 thttbn.exe 41 PID 2600 wrote to memory of 2872 2600 thttbn.exe 41 PID 2872 wrote to memory of 1708 2872 llxfrxf.exe 42 PID 2872 wrote to memory of 1708 2872 llxfrxf.exe 42 PID 2872 wrote to memory of 1708 2872 llxfrxf.exe 42 PID 2872 wrote to memory of 1708 2872 llxfrxf.exe 42 PID 1708 wrote to memory of 2332 1708 1xrrxxr.exe 43 PID 1708 wrote to memory of 2332 1708 1xrrxxr.exe 43 PID 1708 wrote to memory of 2332 1708 1xrrxxr.exe 43 PID 1708 wrote to memory of 2332 1708 1xrrxxr.exe 43 PID 2332 wrote to memory of 884 2332 bnhnbh.exe 44 PID 2332 wrote to memory of 884 2332 bnhnbh.exe 44 PID 2332 wrote to memory of 884 2332 bnhnbh.exe 44 PID 2332 wrote to memory of 884 2332 bnhnbh.exe 44 PID 884 wrote to memory of 1208 884 jvvvd.exe 45 PID 884 wrote to memory of 1208 884 jvvvd.exe 45 PID 884 wrote to memory of 1208 884 jvvvd.exe 45 PID 884 wrote to memory of 1208 884 jvvvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\hbbtbh.exec:\hbbtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jdpvj.exec:\jdpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\hhbhnn.exec:\hhbhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3vjjp.exec:\3vjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\llllfrf.exec:\llllfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\rrffllx.exec:\rrffllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1dvvj.exec:\1dvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nhbhhn.exec:\nhbhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\httnht.exec:\httnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7lllfxx.exec:\7lllfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\thttbn.exec:\thttbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\llxfrxf.exec:\llxfrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1xrrxxr.exec:\1xrrxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\bnhnbh.exec:\bnhnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\jvvvd.exec:\jvvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\nhhthh.exec:\nhhthh.exe17⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nnbhth.exec:\nnbhth.exe18⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrlrfll.exec:\rrlrfll.exe19⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tbhhtb.exec:\tbhhtb.exe20⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe21⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rrrfxfx.exec:\rrrfxfx.exe22⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ttnhtb.exec:\ttnhtb.exe23⤵
- Executes dropped EXE
PID:1048 -
\??\c:\rrfflrf.exec:\rrfflrf.exe24⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5vpvj.exec:\5vpvj.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\rllxflx.exec:\rllxflx.exe26⤵
- Executes dropped EXE
PID:776 -
\??\c:\jvvvv.exec:\jvvvv.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jdppd.exec:\jdppd.exe28⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hnbtbb.exec:\hnbtbb.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3btbhb.exec:\3btbhb.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rllrrrf.exec:\rllrrrf.exe31⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tbtbhb.exec:\tbtbhb.exe32⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dvdjj.exec:\dvdjj.exe33⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jvppp.exec:\jvppp.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxllxrl.exec:\fxllxrl.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3bnbhn.exec:\3bnbhn.exe36⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vpdjj.exec:\vpdjj.exe37⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3jdjp.exec:\3jdjp.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3xlrxfl.exec:\3xlrxfl.exe39⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hbhhtt.exec:\hbhhtt.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\bbtbhh.exec:\bbtbhh.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1pvvj.exec:\1pvvj.exe42⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5xxfrlr.exec:\5xxfrlr.exe43⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bbhbbb.exec:\bbhbbb.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5hbbbh.exec:\5hbbbh.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7jvvv.exec:\7jvvv.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\lxxrlrr.exec:\lxxrlrr.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\flffrrr.exec:\flffrrr.exe48⤵
- Executes dropped EXE
PID:768 -
\??\c:\nhtthn.exec:\nhtthn.exe49⤵
- Executes dropped EXE
PID:648 -
\??\c:\7jpvv.exec:\7jpvv.exe50⤵
- Executes dropped EXE
PID:1860 -
\??\c:\5fxrxxf.exec:\5fxrxxf.exe51⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hthhnh.exec:\hthhnh.exe53⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nbtntt.exec:\nbtntt.exe54⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vpjdd.exec:\vpjdd.exe55⤵
- Executes dropped EXE
PID:840 -
\??\c:\lxffxff.exec:\lxffxff.exe56⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe57⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tnnnnn.exec:\tnnnnn.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vppvj.exec:\vppvj.exe59⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vjvpv.exec:\vjvpv.exe60⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ffxxfrr.exec:\ffxxfrr.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tttbtt.exec:\tttbtt.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\7hbhhn.exec:\7hbhhn.exe63⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jjvvd.exec:\jjvvd.exe64⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pvvvj.exec:\pvvvj.exe65⤵
- Executes dropped EXE
PID:2312 -
\??\c:\llllrxf.exec:\llllrxf.exe66⤵PID:904
-
\??\c:\7hnnbb.exec:\7hnnbb.exe67⤵PID:2452
-
\??\c:\vpjjp.exec:\vpjjp.exe68⤵PID:2272
-
\??\c:\3rllllr.exec:\3rllllr.exe69⤵PID:1304
-
\??\c:\llxflrf.exec:\llxflrf.exe70⤵PID:1848
-
\??\c:\bthnnn.exec:\bthnnn.exe71⤵PID:1868
-
\??\c:\ddvvd.exec:\ddvvd.exe72⤵PID:2524
-
\??\c:\ppjjv.exec:\ppjjv.exe73⤵PID:2064
-
\??\c:\lrffflr.exec:\lrffflr.exe74⤵PID:1628
-
\??\c:\bbnnnn.exec:\bbnnnn.exe75⤵PID:1588
-
\??\c:\hhhnbh.exec:\hhhnbh.exe76⤵PID:2248
-
\??\c:\pjvjp.exec:\pjvjp.exe77⤵PID:1520
-
\??\c:\9xrxlrf.exec:\9xrxlrf.exe78⤵PID:2148
-
\??\c:\9hhntb.exec:\9hhntb.exe79⤵PID:2164
-
\??\c:\jppdj.exec:\jppdj.exe80⤵PID:2704
-
\??\c:\xrrrllr.exec:\xrrrllr.exe81⤵PID:2684
-
\??\c:\ffxxllr.exec:\ffxxllr.exe82⤵PID:2952
-
\??\c:\hhnnbt.exec:\hhnnbt.exe83⤵PID:2876
-
\??\c:\jdpvj.exec:\jdpvj.exe84⤵PID:2604
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe85⤵PID:2744
-
\??\c:\rfxxflr.exec:\rfxxflr.exe86⤵PID:2024
-
\??\c:\tnhntb.exec:\tnhntb.exe87⤵PID:3012
-
\??\c:\3pppj.exec:\3pppj.exe88⤵PID:1160
-
\??\c:\jpddp.exec:\jpddp.exe89⤵PID:1620
-
\??\c:\llllrrx.exec:\llllrrx.exe90⤵PID:1540
-
\??\c:\9thntt.exec:\9thntt.exe91⤵PID:1436
-
\??\c:\djppv.exec:\djppv.exe92⤵PID:1988
-
\??\c:\dvdjj.exec:\dvdjj.exe93⤵PID:2140
-
\??\c:\5xrlrxf.exec:\5xrlrxf.exe94⤵PID:1796
-
\??\c:\5lflxxr.exec:\5lflxxr.exe95⤵PID:1196
-
\??\c:\hhthth.exec:\hhthth.exe96⤵PID:840
-
\??\c:\djpjj.exec:\djpjj.exe97⤵PID:2032
-
\??\c:\jjvvd.exec:\jjvvd.exe98⤵PID:2464
-
\??\c:\lxrxrxf.exec:\lxrxrxf.exe99⤵PID:2680
-
\??\c:\nthhtb.exec:\nthhtb.exe100⤵PID:300
-
\??\c:\vppjj.exec:\vppjj.exe101⤵PID:1828
-
\??\c:\vpdjj.exec:\vpdjj.exe102⤵PID:2432
-
\??\c:\xxlrrlr.exec:\xxlrrlr.exe103⤵PID:856
-
\??\c:\5xrrxxl.exec:\5xrrxxl.exe104⤵PID:1832
-
\??\c:\ntntbh.exec:\ntntbh.exe105⤵PID:2900
-
\??\c:\pjddj.exec:\pjddj.exe106⤵PID:2284
-
\??\c:\dvvdv.exec:\dvvdv.exe107⤵PID:2280
-
\??\c:\7xxlxfr.exec:\7xxlxfr.exe108⤵PID:2092
-
\??\c:\1bbntt.exec:\1bbntt.exe109⤵PID:2120
-
\??\c:\hhbbhh.exec:\hhbbhh.exe110⤵PID:1872
-
\??\c:\djvjd.exec:\djvjd.exe111⤵PID:1896
-
\??\c:\rlllxfr.exec:\rlllxfr.exe112⤵PID:2296
-
\??\c:\xlfrrxx.exec:\xlfrrxx.exe113⤵PID:2504
-
\??\c:\tbnbnt.exec:\tbnbnt.exe114⤵PID:2192
-
\??\c:\ppppj.exec:\ppppj.exe115⤵PID:1228
-
\??\c:\dddjv.exec:\dddjv.exe116⤵PID:2080
-
\??\c:\llxflrf.exec:\llxflrf.exe117⤵PID:2348
-
\??\c:\bhbhnt.exec:\bhbhnt.exe118⤵PID:844
-
\??\c:\1bnnnt.exec:\1bnnnt.exe119⤵PID:956
-
\??\c:\pvdjj.exec:\pvdjj.exe120⤵PID:2728
-
\??\c:\3vpjp.exec:\3vpjp.exe121⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-