Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe
-
Size
455KB
-
MD5
3e601458a051e0e762149455d3da8e80
-
SHA1
970977da830da4d80ee3fa72d0917b2c88bff33c
-
SHA256
db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475e
-
SHA512
6a6c586762b5888b8792811e674133765fddc4f1468b64bf97caf8daddb0612f57a9a65e8d55b42b49fee1ec56747415c891a88ddfe011b36b242fe789a2629b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2168-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-28-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/308-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-459-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2280-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-608-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2764-615-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-751-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/408-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-863-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/484-876-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2772-888-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2896-910-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2328-949-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-993-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 536 7rlrflr.exe 768 bhbbnt.exe 2240 jjdjj.exe 2708 jvpvd.exe 2812 djjvp.exe 2816 fxrrfrx.exe 2624 1nbnbh.exe 2960 xxlrffr.exe 2784 nbntbn.exe 2636 dpjpd.exe 2320 5lrxflx.exe 1484 9hbthn.exe 3000 3xffffl.exe 300 hbbbtt.exe 2716 ntnntt.exe 3016 xrrrffl.exe 308 btbhhh.exe 1772 ppvvd.exe 1792 rrffffl.exe 2348 hhbnnh.exe 1824 7jjpp.exe 2204 7bhtht.exe 2280 3bnnbb.exe 2248 frfflfl.exe 1944 bbnnnn.exe 924 9vjdj.exe 1140 9lxffff.exe 2496 nbnbhn.exe 2552 dvppv.exe 2564 xxllrrx.exe 1652 hhtnhh.exe 2344 jdpvd.exe 1608 rlxfllr.exe 2460 hthntt.exe 2920 1tbnhb.exe 2232 jdvvd.exe 2196 rrfllrx.exe 2724 lffrrlr.exe 2832 tthntb.exe 2820 pvddd.exe 2884 jdvvv.exe 2732 frxfrrf.exe 2112 3hhbbn.exe 2840 hbttbh.exe 2752 5dppv.exe 2680 jvjpd.exe 2692 llxrxxx.exe 1284 hthbbn.exe 2004 hbhntn.exe 2868 5jvvd.exe 3000 1pjjj.exe 2936 rlrrfrx.exe 2836 3nnhbh.exe 3024 hhtntt.exe 3036 vpvdj.exe 308 rlxfffl.exe 1128 btttnn.exe 2184 jvvdp.exe 2080 jjjpd.exe 1676 ffrrrrf.exe 2368 9tbntb.exe 856 nnhntb.exe 2504 5pjdp.exe 2280 rrrxllf.exe -
resource yara_rule behavioral1/memory/536-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-28-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/768-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-949-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-989-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 536 2168 db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe 30 PID 2168 wrote to memory of 536 2168 db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe 30 PID 2168 wrote to memory of 536 2168 db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe 30 PID 2168 wrote to memory of 536 2168 db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe 30 PID 536 wrote to memory of 768 536 7rlrflr.exe 31 PID 536 wrote to memory of 768 536 7rlrflr.exe 31 PID 536 wrote to memory of 768 536 7rlrflr.exe 31 PID 536 wrote to memory of 768 536 7rlrflr.exe 31 PID 768 wrote to memory of 2240 768 bhbbnt.exe 32 PID 768 wrote to memory of 2240 768 bhbbnt.exe 32 PID 768 wrote to memory of 2240 768 bhbbnt.exe 32 PID 768 wrote to memory of 2240 768 bhbbnt.exe 32 PID 2240 wrote to memory of 2708 2240 jjdjj.exe 33 PID 2240 wrote to memory of 2708 2240 jjdjj.exe 33 PID 2240 wrote to memory of 2708 2240 jjdjj.exe 33 PID 2240 wrote to memory of 2708 2240 jjdjj.exe 33 PID 2708 wrote to memory of 2812 2708 jvpvd.exe 34 PID 2708 wrote to memory of 2812 2708 jvpvd.exe 34 PID 2708 wrote to memory of 2812 2708 jvpvd.exe 34 PID 2708 wrote to memory of 2812 2708 jvpvd.exe 34 PID 2812 wrote to memory of 2816 2812 djjvp.exe 35 PID 2812 wrote to memory of 2816 2812 djjvp.exe 35 PID 2812 wrote to memory of 2816 2812 djjvp.exe 35 PID 2812 wrote to memory of 2816 2812 djjvp.exe 35 PID 2816 wrote to memory of 2624 2816 fxrrfrx.exe 36 PID 2816 wrote to memory of 2624 2816 fxrrfrx.exe 36 PID 2816 wrote to memory of 2624 2816 fxrrfrx.exe 36 PID 2816 wrote to memory of 2624 2816 fxrrfrx.exe 36 PID 2624 wrote to memory of 2960 2624 1nbnbh.exe 37 PID 2624 wrote to memory of 2960 2624 1nbnbh.exe 37 PID 2624 wrote to memory of 2960 2624 1nbnbh.exe 37 PID 2624 wrote to memory of 2960 2624 1nbnbh.exe 37 PID 2960 wrote to memory of 2784 2960 xxlrffr.exe 38 PID 2960 wrote to memory of 2784 2960 xxlrffr.exe 38 PID 2960 wrote to memory of 2784 2960 xxlrffr.exe 38 PID 2960 wrote to memory of 2784 2960 xxlrffr.exe 38 PID 2784 wrote to memory of 2636 2784 nbntbn.exe 39 PID 2784 wrote to memory of 2636 2784 nbntbn.exe 39 PID 2784 wrote to memory of 2636 2784 nbntbn.exe 39 PID 2784 wrote to memory of 2636 2784 nbntbn.exe 39 PID 2636 wrote to memory of 2320 2636 dpjpd.exe 40 PID 2636 wrote to memory of 2320 2636 dpjpd.exe 40 PID 2636 wrote to memory of 2320 2636 dpjpd.exe 40 PID 2636 wrote to memory of 2320 2636 dpjpd.exe 40 PID 2320 wrote to memory of 1484 2320 5lrxflx.exe 41 PID 2320 wrote to memory of 1484 2320 5lrxflx.exe 41 PID 2320 wrote to memory of 1484 2320 5lrxflx.exe 41 PID 2320 wrote to memory of 1484 2320 5lrxflx.exe 41 PID 1484 wrote to memory of 3000 1484 9hbthn.exe 42 PID 1484 wrote to memory of 3000 1484 9hbthn.exe 42 PID 1484 wrote to memory of 3000 1484 9hbthn.exe 42 PID 1484 wrote to memory of 3000 1484 9hbthn.exe 42 PID 3000 wrote to memory of 300 3000 3xffffl.exe 43 PID 3000 wrote to memory of 300 3000 3xffffl.exe 43 PID 3000 wrote to memory of 300 3000 3xffffl.exe 43 PID 3000 wrote to memory of 300 3000 3xffffl.exe 43 PID 300 wrote to memory of 2716 300 hbbbtt.exe 44 PID 300 wrote to memory of 2716 300 hbbbtt.exe 44 PID 300 wrote to memory of 2716 300 hbbbtt.exe 44 PID 300 wrote to memory of 2716 300 hbbbtt.exe 44 PID 2716 wrote to memory of 3016 2716 ntnntt.exe 45 PID 2716 wrote to memory of 3016 2716 ntnntt.exe 45 PID 2716 wrote to memory of 3016 2716 ntnntt.exe 45 PID 2716 wrote to memory of 3016 2716 ntnntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe"C:\Users\Admin\AppData\Local\Temp\db5b9db31d9ed42f360f157d17c53c7ac34274f3411e622082345222f199475eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\7rlrflr.exec:\7rlrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\bhbbnt.exec:\bhbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\jjdjj.exec:\jjdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jvpvd.exec:\jvpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\djjvp.exec:\djjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\fxrrfrx.exec:\fxrrfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1nbnbh.exec:\1nbnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xxlrffr.exec:\xxlrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nbntbn.exec:\nbntbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\dpjpd.exec:\dpjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5lrxflx.exec:\5lrxflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\9hbthn.exec:\9hbthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\3xffffl.exec:\3xffffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hbbbtt.exec:\hbbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\ntnntt.exec:\ntnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xrrrffl.exec:\xrrrffl.exe17⤵
- Executes dropped EXE
PID:3016 -
\??\c:\btbhhh.exec:\btbhhh.exe18⤵
- Executes dropped EXE
PID:308 -
\??\c:\ppvvd.exec:\ppvvd.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rrffffl.exec:\rrffffl.exe20⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hhbnnh.exec:\hhbnnh.exe21⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7jjpp.exec:\7jjpp.exe22⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7bhtht.exec:\7bhtht.exe23⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3bnnbb.exec:\3bnnbb.exe24⤵
- Executes dropped EXE
PID:2280 -
\??\c:\frfflfl.exec:\frfflfl.exe25⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bbnnnn.exec:\bbnnnn.exe26⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9vjdj.exec:\9vjdj.exe27⤵
- Executes dropped EXE
PID:924 -
\??\c:\9lxffff.exec:\9lxffff.exe28⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nbnbhn.exec:\nbnbhn.exe29⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dvppv.exec:\dvppv.exe30⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xxllrrx.exec:\xxllrrx.exe31⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hhtnhh.exec:\hhtnhh.exe32⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jdpvd.exec:\jdpvd.exe33⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rlxfllr.exec:\rlxfllr.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hthntt.exec:\hthntt.exe35⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1tbnhb.exec:\1tbnhb.exe36⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jdvvd.exec:\jdvvd.exe37⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rrfllrx.exec:\rrfllrx.exe38⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lffrrlr.exec:\lffrrlr.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tthntb.exec:\tthntb.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pvddd.exec:\pvddd.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\jdvvv.exec:\jdvvv.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\frxfrrf.exec:\frxfrrf.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3hhbbn.exec:\3hhbbn.exe44⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hbttbh.exec:\hbttbh.exe45⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5dppv.exec:\5dppv.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jvjpd.exec:\jvjpd.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\llxrxxx.exec:\llxrxxx.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hthbbn.exec:\hthbbn.exe49⤵
- Executes dropped EXE
PID:1284 -
\??\c:\hbhntn.exec:\hbhntn.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5jvvd.exec:\5jvvd.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1pjjj.exec:\1pjjj.exe52⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rlrrfrx.exec:\rlrrfrx.exe53⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3nnhbh.exec:\3nnhbh.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hhtntt.exec:\hhtntt.exe55⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vpvdj.exec:\vpvdj.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\rlxfffl.exec:\rlxfffl.exe57⤵
- Executes dropped EXE
PID:308 -
\??\c:\btttnn.exec:\btttnn.exe58⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jvvdp.exec:\jvvdp.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jjjpd.exec:\jjjpd.exe60⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ffrrrrf.exec:\ffrrrrf.exe61⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9tbntb.exec:\9tbntb.exe62⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nnhntb.exec:\nnhntb.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\5pjdp.exec:\5pjdp.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rrrxllf.exec:\rrrxllf.exe65⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7lfxlrf.exec:\7lfxlrf.exe66⤵PID:1828
-
\??\c:\nnbnhn.exec:\nnbnhn.exe67⤵PID:892
-
\??\c:\vvppv.exec:\vvppv.exe68⤵PID:1736
-
\??\c:\vpdpv.exec:\vpdpv.exe69⤵PID:1332
-
\??\c:\xxlfxlx.exec:\xxlfxlx.exe70⤵PID:1140
-
\??\c:\htnnbb.exec:\htnnbb.exe71⤵PID:1996
-
\??\c:\tbnbtt.exec:\tbnbtt.exe72⤵PID:1936
-
\??\c:\jdvvj.exec:\jdvvj.exe73⤵PID:2564
-
\??\c:\lrrxrfx.exec:\lrrxrfx.exe74⤵PID:1512
-
\??\c:\rxrxrxl.exec:\rxrxrxl.exe75⤵PID:1640
-
\??\c:\ttnthb.exec:\ttnthb.exe76⤵PID:1620
-
\??\c:\nnhntb.exec:\nnhntb.exe77⤵PID:2152
-
\??\c:\jdvjp.exec:\jdvjp.exe78⤵PID:1820
-
\??\c:\rxrlrxf.exec:\rxrlrxf.exe79⤵PID:2244
-
\??\c:\lxfxlfr.exec:\lxfxlfr.exe80⤵PID:2796
-
\??\c:\5tntnt.exec:\5tntnt.exe81⤵PID:2192
-
\??\c:\9jjjv.exec:\9jjjv.exe82⤵PID:2764
-
\??\c:\rxlrffl.exec:\rxlrffl.exe83⤵PID:2888
-
\??\c:\ntnhth.exec:\ntnhth.exe84⤵PID:2480
-
\??\c:\ttbntt.exec:\ttbntt.exe85⤵PID:2652
-
\??\c:\ppjvj.exec:\ppjvj.exe86⤵PID:2640
-
\??\c:\llflxxf.exec:\llflxxf.exe87⤵PID:2588
-
\??\c:\hbntbh.exec:\hbntbh.exe88⤵PID:2648
-
\??\c:\1btbbh.exec:\1btbbh.exe89⤵PID:2636
-
\??\c:\9vjpp.exec:\9vjpp.exe90⤵PID:2328
-
\??\c:\9xrxffr.exec:\9xrxffr.exe91⤵PID:2320
-
\??\c:\hbtbhn.exec:\hbtbhn.exe92⤵PID:1484
-
\??\c:\ttnbth.exec:\ttnbth.exe93⤵PID:3020
-
\??\c:\1dvdj.exec:\1dvdj.exe94⤵PID:2684
-
\??\c:\lllfxff.exec:\lllfxff.exe95⤵PID:2952
-
\??\c:\3xfrxxf.exec:\3xfrxxf.exe96⤵PID:1028
-
\??\c:\nnhnhb.exec:\nnhnhb.exe97⤵PID:2792
-
\??\c:\dvpvd.exec:\dvpvd.exe98⤵PID:1592
-
\??\c:\frflllr.exec:\frflllr.exe99⤵PID:1840
-
\??\c:\nbnhnn.exec:\nbnhnn.exe100⤵PID:900
-
\??\c:\9nhhnt.exec:\9nhhnt.exe101⤵PID:1128
-
\??\c:\jjjvp.exec:\jjjvp.exe102⤵PID:2408
-
\??\c:\pppjj.exec:\pppjj.exe103⤵PID:784
-
\??\c:\rfxxlrf.exec:\rfxxlrf.exe104⤵PID:1892
-
\??\c:\hbtthn.exec:\hbtthn.exe105⤵PID:408
-
\??\c:\pjvdv.exec:\pjvdv.exe106⤵PID:2364
-
\??\c:\jjddp.exec:\jjddp.exe107⤵PID:676
-
\??\c:\9frrrxf.exec:\9frrrxf.exe108⤵PID:2104
-
\??\c:\5thhnt.exec:\5thhnt.exe109⤵PID:1944
-
\??\c:\7jdpv.exec:\7jdpv.exe110⤵PID:2440
-
\??\c:\vddjp.exec:\vddjp.exe111⤵PID:2304
-
\??\c:\fflrlrr.exec:\fflrlrr.exe112⤵PID:1532
-
\??\c:\9bbtbh.exec:\9bbtbh.exe113⤵PID:1672
-
\??\c:\9bhnhh.exec:\9bhnhh.exe114⤵PID:1696
-
\??\c:\jpjpv.exec:\jpjpv.exe115⤵PID:1936
-
\??\c:\llflrxl.exec:\llflrxl.exe116⤵PID:1540
-
\??\c:\rrlrflx.exec:\rrlrflx.exe117⤵PID:1928
-
\??\c:\7bthhn.exec:\7bthhn.exe118⤵PID:600
-
\??\c:\pvpjv.exec:\pvpjv.exe119⤵PID:2296
-
\??\c:\9djjj.exec:\9djjj.exe120⤵PID:2700
-
\??\c:\3rrrxlx.exec:\3rrrxlx.exe121⤵PID:320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-