Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe
-
Size
454KB
-
MD5
a74334ef8c767ce79ed97579ed904684
-
SHA1
e2349ca98206f8f38745962acbc310d9a9fd5ef4
-
SHA256
df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10
-
SHA512
00a9d4187139c1a839be53df0edb31ace00542a88aa234d9a27f0e635bc5c1d142bfecb4b202b2e223129b6e4b2eabb7ccaee1aa96a3a58a126bc6994d580bb1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2936-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-297-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2772-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-417-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/852-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-446-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2556-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-516-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1704-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-599-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1424-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-844-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-907-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/568-909-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2784 9dpdp.exe 2284 vppvd.exe 2828 3rfflrx.exe 2836 pvpjd.exe 2584 jjdpd.exe 3044 lfxfffx.exe 3016 hhhhtt.exe 1424 vdppj.exe 1792 nhbhbb.exe 2204 llxxlrf.exe 2212 hbttnt.exe 2884 9rflxrf.exe 2108 5nhhbb.exe 1264 ffrxrrl.exe 1880 9bnthn.exe 2768 vpjvd.exe 1940 lfrxxxl.exe 2956 5htthn.exe 2392 fxrfrrf.exe 2324 btntnt.exe 2268 lfrrrxl.exe 1056 3jddp.exe 2948 frlrllx.exe 2184 tntthn.exe 688 xrflfrf.exe 2492 tnbtnt.exe 1248 7rflxrf.exe 1448 7bbnhh.exe 464 rfxflrx.exe 1160 nhttnt.exe 2372 jjvdp.exe 2796 xxrxxlf.exe 2780 1bbnhn.exe 2580 fxfflxl.exe 2772 nnhbtb.exe 2712 vpdpj.exe 2572 3lfllrf.exe 2624 xrrfrxl.exe 2748 3bbthb.exe 2744 pdpvp.exe 3016 frfllrf.exe 636 thttbb.exe 2272 nhbhnh.exe 2160 jdjvv.exe 2156 fxlrrrf.exe 2176 bbhnhn.exe 1748 dvjpd.exe 1752 pjvdp.exe 2004 lrlrlrf.exe 1980 bthhtt.exe 852 dpjjp.exe 1576 ddvdp.exe 1760 xxxllxr.exe 1736 hbtbtb.exe 2556 3hbbhb.exe 2228 vvjvj.exe 2252 lrfrflf.exe 2076 nhtbhn.exe 2032 ttnbnt.exe 2964 jpdvp.exe 2424 1xlrxxf.exe 2092 ttthtt.exe 1316 bbthbh.exe 292 1vdjp.exe -
resource yara_rule behavioral1/memory/2936-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-417-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1980-419-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2556-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-530-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2516-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-856-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2784 2936 df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe 30 PID 2936 wrote to memory of 2784 2936 df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe 30 PID 2936 wrote to memory of 2784 2936 df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe 30 PID 2936 wrote to memory of 2784 2936 df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe 30 PID 2784 wrote to memory of 2284 2784 9dpdp.exe 31 PID 2784 wrote to memory of 2284 2784 9dpdp.exe 31 PID 2784 wrote to memory of 2284 2784 9dpdp.exe 31 PID 2784 wrote to memory of 2284 2784 9dpdp.exe 31 PID 2284 wrote to memory of 2828 2284 vppvd.exe 32 PID 2284 wrote to memory of 2828 2284 vppvd.exe 32 PID 2284 wrote to memory of 2828 2284 vppvd.exe 32 PID 2284 wrote to memory of 2828 2284 vppvd.exe 32 PID 2828 wrote to memory of 2836 2828 3rfflrx.exe 33 PID 2828 wrote to memory of 2836 2828 3rfflrx.exe 33 PID 2828 wrote to memory of 2836 2828 3rfflrx.exe 33 PID 2828 wrote to memory of 2836 2828 3rfflrx.exe 33 PID 2836 wrote to memory of 2584 2836 pvpjd.exe 34 PID 2836 wrote to memory of 2584 2836 pvpjd.exe 34 PID 2836 wrote to memory of 2584 2836 pvpjd.exe 34 PID 2836 wrote to memory of 2584 2836 pvpjd.exe 34 PID 2584 wrote to memory of 3044 2584 jjdpd.exe 35 PID 2584 wrote to memory of 3044 2584 jjdpd.exe 35 PID 2584 wrote to memory of 3044 2584 jjdpd.exe 35 PID 2584 wrote to memory of 3044 2584 jjdpd.exe 35 PID 3044 wrote to memory of 3016 3044 lfxfffx.exe 36 PID 3044 wrote to memory of 3016 3044 lfxfffx.exe 36 PID 3044 wrote to memory of 3016 3044 lfxfffx.exe 36 PID 3044 wrote to memory of 3016 3044 lfxfffx.exe 36 PID 3016 wrote to memory of 1424 3016 hhhhtt.exe 37 PID 3016 wrote to memory of 1424 3016 hhhhtt.exe 37 PID 3016 wrote to memory of 1424 3016 hhhhtt.exe 37 PID 3016 wrote to memory of 1424 3016 hhhhtt.exe 37 PID 1424 wrote to memory of 1792 1424 vdppj.exe 38 PID 1424 wrote to memory of 1792 1424 vdppj.exe 38 PID 1424 wrote to memory of 1792 1424 vdppj.exe 38 PID 1424 wrote to memory of 1792 1424 vdppj.exe 38 PID 1792 wrote to memory of 2204 1792 nhbhbb.exe 39 PID 1792 wrote to memory of 2204 1792 nhbhbb.exe 39 PID 1792 wrote to memory of 2204 1792 nhbhbb.exe 39 PID 1792 wrote to memory of 2204 1792 nhbhbb.exe 39 PID 2204 wrote to memory of 2212 2204 llxxlrf.exe 40 PID 2204 wrote to memory of 2212 2204 llxxlrf.exe 40 PID 2204 wrote to memory of 2212 2204 llxxlrf.exe 40 PID 2204 wrote to memory of 2212 2204 llxxlrf.exe 40 PID 2212 wrote to memory of 2884 2212 hbttnt.exe 41 PID 2212 wrote to memory of 2884 2212 hbttnt.exe 41 PID 2212 wrote to memory of 2884 2212 hbttnt.exe 41 PID 2212 wrote to memory of 2884 2212 hbttnt.exe 41 PID 2884 wrote to memory of 2108 2884 9rflxrf.exe 42 PID 2884 wrote to memory of 2108 2884 9rflxrf.exe 42 PID 2884 wrote to memory of 2108 2884 9rflxrf.exe 42 PID 2884 wrote to memory of 2108 2884 9rflxrf.exe 42 PID 2108 wrote to memory of 1264 2108 5nhhbb.exe 43 PID 2108 wrote to memory of 1264 2108 5nhhbb.exe 43 PID 2108 wrote to memory of 1264 2108 5nhhbb.exe 43 PID 2108 wrote to memory of 1264 2108 5nhhbb.exe 43 PID 1264 wrote to memory of 1880 1264 ffrxrrl.exe 44 PID 1264 wrote to memory of 1880 1264 ffrxrrl.exe 44 PID 1264 wrote to memory of 1880 1264 ffrxrrl.exe 44 PID 1264 wrote to memory of 1880 1264 ffrxrrl.exe 44 PID 1880 wrote to memory of 2768 1880 9bnthn.exe 45 PID 1880 wrote to memory of 2768 1880 9bnthn.exe 45 PID 1880 wrote to memory of 2768 1880 9bnthn.exe 45 PID 1880 wrote to memory of 2768 1880 9bnthn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe"C:\Users\Admin\AppData\Local\Temp\df91a8fcf7af4d9bb4f2d46a442184ac91505ebf1eedaaad3d6f897c42d8da10.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\9dpdp.exec:\9dpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vppvd.exec:\vppvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\3rfflrx.exec:\3rfflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\pvpjd.exec:\pvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jjdpd.exec:\jjdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\lfxfffx.exec:\lfxfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\hhhhtt.exec:\hhhhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\vdppj.exec:\vdppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\nhbhbb.exec:\nhbhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\llxxlrf.exec:\llxxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\hbttnt.exec:\hbttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\9rflxrf.exec:\9rflxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\5nhhbb.exec:\5nhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ffrxrrl.exec:\ffrxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\9bnthn.exec:\9bnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vpjvd.exec:\vpjvd.exe17⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lfrxxxl.exec:\lfrxxxl.exe18⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5htthn.exec:\5htthn.exe19⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\btntnt.exec:\btntnt.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3jddp.exec:\3jddp.exe23⤵
- Executes dropped EXE
PID:1056 -
\??\c:\frlrllx.exec:\frlrllx.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\tntthn.exec:\tntthn.exe25⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xrflfrf.exec:\xrflfrf.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\tnbtnt.exec:\tnbtnt.exe27⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7rflxrf.exec:\7rflxrf.exe28⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7bbnhh.exec:\7bbnhh.exe29⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rfxflrx.exec:\rfxflrx.exe30⤵
- Executes dropped EXE
PID:464 -
\??\c:\nhttnt.exec:\nhttnt.exe31⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jjvdp.exec:\jjvdp.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xxrxxlf.exec:\xxrxxlf.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1bbnhn.exec:\1bbnhn.exe34⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fxfflxl.exec:\fxfflxl.exe35⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nnhbtb.exec:\nnhbtb.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpdpj.exec:\vpdpj.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3lfllrf.exec:\3lfllrf.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3bbthb.exec:\3bbthb.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdpvp.exec:\pdpvp.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\frfllrf.exec:\frfllrf.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\thttbb.exec:\thttbb.exe43⤵
- Executes dropped EXE
PID:636 -
\??\c:\nhbhnh.exec:\nhbhnh.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\jdjvv.exec:\jdjvv.exe45⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe46⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bbhnhn.exec:\bbhnhn.exe47⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjpd.exec:\dvjpd.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pjvdp.exec:\pjvdp.exe49⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bthhtt.exec:\bthhtt.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dpjjp.exec:\dpjjp.exe52⤵
- Executes dropped EXE
PID:852 -
\??\c:\ddvdp.exec:\ddvdp.exe53⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xxxllxr.exec:\xxxllxr.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hbtbtb.exec:\hbtbtb.exe55⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3hbbhb.exec:\3hbbhb.exe56⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vvjvj.exec:\vvjvj.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lrfrflf.exec:\lrfrflf.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nhtbhn.exec:\nhtbhn.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ttnbnt.exec:\ttnbnt.exe60⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jpdvp.exec:\jpdvp.exe61⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1xlrxxf.exec:\1xlrxxf.exe62⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ttthtt.exec:\ttthtt.exe63⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bbthbh.exec:\bbthbh.exe64⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1vdjp.exec:\1vdjp.exe65⤵
- Executes dropped EXE
PID:292 -
\??\c:\3frlrxl.exec:\3frlrxl.exe66⤵PID:1704
-
\??\c:\rrrxlxl.exec:\rrrxlxl.exe67⤵PID:1604
-
\??\c:\tbnnbb.exec:\tbnnbb.exe68⤵PID:2516
-
\??\c:\7vvjp.exec:\7vvjp.exe69⤵PID:2292
-
\??\c:\7jvdp.exec:\7jvdp.exe70⤵PID:2388
-
\??\c:\lrlrflx.exec:\lrlrflx.exe71⤵PID:1160
-
\??\c:\hbtbhn.exec:\hbtbhn.exe72⤵PID:2792
-
\??\c:\ttnhbn.exec:\ttnhbn.exe73⤵PID:2844
-
\??\c:\3vpvp.exec:\3vpvp.exe74⤵PID:1496
-
\??\c:\lfllxxf.exec:\lfllxxf.exe75⤵PID:2780
-
\??\c:\llflxxf.exec:\llflxxf.exe76⤵PID:2444
-
\??\c:\nbnbtn.exec:\nbnbtn.exe77⤵PID:2904
-
\??\c:\3vjjj.exec:\3vjjj.exe78⤵PID:2836
-
\??\c:\3jdjv.exec:\3jdjv.exe79⤵PID:2572
-
\??\c:\rrlfllr.exec:\rrlfllr.exe80⤵PID:3012
-
\??\c:\9nbbnn.exec:\9nbbnn.exe81⤵PID:3008
-
\??\c:\ppdpv.exec:\ppdpv.exe82⤵PID:3020
-
\??\c:\vpjjv.exec:\vpjjv.exe83⤵PID:1108
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe84⤵PID:1424
-
\??\c:\xrrxllr.exec:\xrrxllr.exe85⤵PID:336
-
\??\c:\nhtbtt.exec:\nhtbtt.exe86⤵PID:2216
-
\??\c:\pjjvd.exec:\pjjvd.exe87⤵PID:1768
-
\??\c:\3rlfllr.exec:\3rlfllr.exe88⤵PID:1852
-
\??\c:\1fxrrxl.exec:\1fxrrxl.exe89⤵PID:2884
-
\??\c:\thhtbh.exec:\thhtbh.exe90⤵PID:1540
-
\??\c:\vpjjd.exec:\vpjjd.exe91⤵PID:1452
-
\??\c:\xrffffl.exec:\xrffffl.exe92⤵PID:2040
-
\??\c:\xrxlfxf.exec:\xrxlfxf.exe93⤵PID:2764
-
\??\c:\btnntn.exec:\btnntn.exe94⤵PID:1720
-
\??\c:\3tnbnt.exec:\3tnbnt.exe95⤵PID:1976
-
\??\c:\ppjpv.exec:\ppjpv.exe96⤵PID:3068
-
\??\c:\lfrxllr.exec:\lfrxllr.exe97⤵PID:1724
-
\??\c:\nhbthh.exec:\nhbthh.exe98⤵PID:2188
-
\??\c:\hbnnhb.exec:\hbnnhb.exe99⤵PID:2448
-
\??\c:\jpdjp.exec:\jpdjp.exe100⤵PID:2252
-
\??\c:\fxrxllf.exec:\fxrxllf.exe101⤵
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\9htbnt.exec:\9htbnt.exe102⤵PID:1932
-
\??\c:\bththn.exec:\bththn.exe103⤵PID:2168
-
\??\c:\vvppj.exec:\vvppj.exe104⤵PID:916
-
\??\c:\rfrflfl.exec:\rfrflfl.exe105⤵PID:1652
-
\??\c:\nthttt.exec:\nthttt.exe106⤵PID:1804
-
\??\c:\djpvp.exec:\djpvp.exe107⤵PID:292
-
\??\c:\jdpjp.exec:\jdpjp.exe108⤵PID:2380
-
\??\c:\rxllxfr.exec:\rxllxfr.exe109⤵PID:832
-
\??\c:\ttttbh.exec:\ttttbh.exe110⤵PID:2356
-
\??\c:\djjjj.exec:\djjjj.exe111⤵PID:1680
-
\??\c:\lflrrfx.exec:\lflrrfx.exe112⤵PID:2404
-
\??\c:\9xllrxf.exec:\9xllrxf.exe113⤵PID:1556
-
\??\c:\hbhhnn.exec:\hbhhnn.exe114⤵PID:2848
-
\??\c:\pjppd.exec:\pjppd.exe115⤵PID:2792
-
\??\c:\rxfrxxf.exec:\rxfrxxf.exe116⤵PID:1528
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe117⤵PID:2916
-
\??\c:\tnbnbb.exec:\tnbnbb.exe118⤵PID:2940
-
\??\c:\5hbhth.exec:\5hbhth.exe119⤵PID:2800
-
\??\c:\vvpdp.exec:\vvpdp.exe120⤵PID:2740
-
\??\c:\5bbnhn.exec:\5bbnhn.exe121⤵PID:2836
-
\??\c:\btnthn.exec:\btnthn.exe122⤵PID:1908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-