Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe
-
Size
455KB
-
MD5
df722c42c6876bad99492aa2f44902f0
-
SHA1
008d771f81dc3fe27a4330b3897c5389da0e423e
-
SHA256
cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6
-
SHA512
011e6cb796bb0ca94ffad1ce9f785f03e4848bafa4035f07868fb298ed6eeda5265246ef867a088dfabb3024429b40c006f6db6d730656abe01c3d84b299755d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2684-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-689-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/588-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-765-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-917-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 9frrxlx.exe 2820 htbhht.exe 2340 btntbh.exe 2548 9thhtb.exe 2672 7dvpp.exe 2468 1lxxllx.exe 2864 hbnhtt.exe 2208 3jdvv.exe 2144 fxxxlxl.exe 1472 nnnnbh.exe 2024 xfxflrx.exe 2012 fxrxflr.exe 1952 jvpvj.exe 848 rrlrlrr.exe 600 tnbhnb.exe 1600 xxrxflx.exe 2364 bthbnn.exe 3056 5jddj.exe 1888 bthnbb.exe 2284 vpjdj.exe 2128 1xxxrlf.exe 2336 tbtnnh.exe 952 pdpvv.exe 2516 rxlrxfx.exe 1224 9pppv.exe 2236 lfxfrrr.exe 1680 5pvvd.exe 2328 rfxfllr.exe 1792 nhhtnt.exe 3004 3jvdd.exe 1440 3frrxfl.exe 2884 jdpdp.exe 1528 frlrxxl.exe 2952 bnhhnn.exe 2712 hthhnn.exe 2784 dpddp.exe 2556 9llllfr.exe 2592 5nhhhn.exe 3012 bthhnt.exe 1920 dvvvp.exe 2584 htnttb.exe 2860 7vvvp.exe 2124 jvpvd.exe 2360 xxfflxr.exe 2604 nntbbb.exe 1948 1dpvj.exe 1428 lxxxffl.exe 1056 tnnbht.exe 1092 5jpdp.exe 2832 fxrrxrx.exe 2772 5tnnbt.exe 296 9jppp.exe 480 vpjpv.exe 2152 nhtbhh.exe 2196 vpjpv.exe 2892 fxrrflf.exe 1888 5btbhn.exe 2344 5dvvj.exe 2060 rxrrrfx.exe 1868 hthntt.exe 2412 btntbb.exe 2504 jddjv.exe 2312 xlflxxx.exe 2516 btntbh.exe -
resource yara_rule behavioral1/memory/2684-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-526-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1776-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-831-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1276-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-911-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/568-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-939-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxrxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2684 2704 cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe 30 PID 2704 wrote to memory of 2684 2704 cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe 30 PID 2704 wrote to memory of 2684 2704 cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe 30 PID 2704 wrote to memory of 2684 2704 cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe 30 PID 2684 wrote to memory of 2820 2684 9frrxlx.exe 31 PID 2684 wrote to memory of 2820 2684 9frrxlx.exe 31 PID 2684 wrote to memory of 2820 2684 9frrxlx.exe 31 PID 2684 wrote to memory of 2820 2684 9frrxlx.exe 31 PID 2820 wrote to memory of 2340 2820 htbhht.exe 32 PID 2820 wrote to memory of 2340 2820 htbhht.exe 32 PID 2820 wrote to memory of 2340 2820 htbhht.exe 32 PID 2820 wrote to memory of 2340 2820 htbhht.exe 32 PID 2340 wrote to memory of 2548 2340 btntbh.exe 33 PID 2340 wrote to memory of 2548 2340 btntbh.exe 33 PID 2340 wrote to memory of 2548 2340 btntbh.exe 33 PID 2340 wrote to memory of 2548 2340 btntbh.exe 33 PID 2548 wrote to memory of 2672 2548 9thhtb.exe 34 PID 2548 wrote to memory of 2672 2548 9thhtb.exe 34 PID 2548 wrote to memory of 2672 2548 9thhtb.exe 34 PID 2548 wrote to memory of 2672 2548 9thhtb.exe 34 PID 2672 wrote to memory of 2468 2672 7dvpp.exe 35 PID 2672 wrote to memory of 2468 2672 7dvpp.exe 35 PID 2672 wrote to memory of 2468 2672 7dvpp.exe 35 PID 2672 wrote to memory of 2468 2672 7dvpp.exe 35 PID 2468 wrote to memory of 2864 2468 1lxxllx.exe 36 PID 2468 wrote to memory of 2864 2468 1lxxllx.exe 36 PID 2468 wrote to memory of 2864 2468 1lxxllx.exe 36 PID 2468 wrote to memory of 2864 2468 1lxxllx.exe 36 PID 2864 wrote to memory of 2208 2864 hbnhtt.exe 37 PID 2864 wrote to memory of 2208 2864 hbnhtt.exe 37 PID 2864 wrote to memory of 2208 2864 hbnhtt.exe 37 PID 2864 wrote to memory of 2208 2864 hbnhtt.exe 37 PID 2208 wrote to memory of 2144 2208 3jdvv.exe 38 PID 2208 wrote to memory of 2144 2208 3jdvv.exe 38 PID 2208 wrote to memory of 2144 2208 3jdvv.exe 38 PID 2208 wrote to memory of 2144 2208 3jdvv.exe 38 PID 2144 wrote to memory of 1472 2144 fxxxlxl.exe 39 PID 2144 wrote to memory of 1472 2144 fxxxlxl.exe 39 PID 2144 wrote to memory of 1472 2144 fxxxlxl.exe 39 PID 2144 wrote to memory of 1472 2144 fxxxlxl.exe 39 PID 1472 wrote to memory of 2024 1472 nnnnbh.exe 40 PID 1472 wrote to memory of 2024 1472 nnnnbh.exe 40 PID 1472 wrote to memory of 2024 1472 nnnnbh.exe 40 PID 1472 wrote to memory of 2024 1472 nnnnbh.exe 40 PID 2024 wrote to memory of 2012 2024 xfxflrx.exe 41 PID 2024 wrote to memory of 2012 2024 xfxflrx.exe 41 PID 2024 wrote to memory of 2012 2024 xfxflrx.exe 41 PID 2024 wrote to memory of 2012 2024 xfxflrx.exe 41 PID 2012 wrote to memory of 1952 2012 fxrxflr.exe 42 PID 2012 wrote to memory of 1952 2012 fxrxflr.exe 42 PID 2012 wrote to memory of 1952 2012 fxrxflr.exe 42 PID 2012 wrote to memory of 1952 2012 fxrxflr.exe 42 PID 1952 wrote to memory of 848 1952 jvpvj.exe 43 PID 1952 wrote to memory of 848 1952 jvpvj.exe 43 PID 1952 wrote to memory of 848 1952 jvpvj.exe 43 PID 1952 wrote to memory of 848 1952 jvpvj.exe 43 PID 848 wrote to memory of 600 848 rrlrlrr.exe 44 PID 848 wrote to memory of 600 848 rrlrlrr.exe 44 PID 848 wrote to memory of 600 848 rrlrlrr.exe 44 PID 848 wrote to memory of 600 848 rrlrlrr.exe 44 PID 600 wrote to memory of 1600 600 tnbhnb.exe 45 PID 600 wrote to memory of 1600 600 tnbhnb.exe 45 PID 600 wrote to memory of 1600 600 tnbhnb.exe 45 PID 600 wrote to memory of 1600 600 tnbhnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe"C:\Users\Admin\AppData\Local\Temp\cc114f4ee21868c5e1806422ac0ee93fc38233fab7544b33b77aafbb609434e6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\9frrxlx.exec:\9frrxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\htbhht.exec:\htbhht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\btntbh.exec:\btntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\9thhtb.exec:\9thhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\7dvpp.exec:\7dvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\1lxxllx.exec:\1lxxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\hbnhtt.exec:\hbnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\3jdvv.exec:\3jdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\fxxxlxl.exec:\fxxxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nnnnbh.exec:\nnnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\xfxflrx.exec:\xfxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\fxrxflr.exec:\fxrxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jvpvj.exec:\jvpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rrlrlrr.exec:\rrlrlrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\tnbhnb.exec:\tnbhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\xxrxflx.exec:\xxrxflx.exe17⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bthbnn.exec:\bthbnn.exe18⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5jddj.exec:\5jddj.exe19⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bthnbb.exec:\bthnbb.exe20⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vpjdj.exec:\vpjdj.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1xxxrlf.exec:\1xxxrlf.exe22⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tbtnnh.exec:\tbtnnh.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pdpvv.exec:\pdpvv.exe24⤵
- Executes dropped EXE
PID:952 -
\??\c:\rxlrxfx.exec:\rxlrxfx.exe25⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9pppv.exec:\9pppv.exe26⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lfxfrrr.exec:\lfxfrrr.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236 -
\??\c:\5pvvd.exec:\5pvvd.exe28⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rfxfllr.exec:\rfxfllr.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nhhtnt.exec:\nhhtnt.exe30⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3jvdd.exec:\3jvdd.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3frrxfl.exec:\3frrxfl.exe32⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jdpdp.exec:\jdpdp.exe33⤵
- Executes dropped EXE
PID:2884 -
\??\c:\frlrxxl.exec:\frlrxxl.exe34⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bnhhnn.exec:\bnhhnn.exe35⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hthhnn.exec:\hthhnn.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\dpddp.exec:\dpddp.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9llllfr.exec:\9llllfr.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\5nhhhn.exec:\5nhhhn.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bthhnt.exec:\bthhnt.exe40⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dvvvp.exec:\dvvvp.exe41⤵
- Executes dropped EXE
PID:1920 -
\??\c:\htnttb.exec:\htnttb.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7vvvp.exec:\7vvvp.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jvpvd.exec:\jvpvd.exe44⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xxfflxr.exec:\xxfflxr.exe45⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nntbbb.exec:\nntbbb.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1dpvj.exec:\1dpvj.exe47⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lxxxffl.exec:\lxxxffl.exe48⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tnnbht.exec:\tnnbht.exe49⤵
- Executes dropped EXE
PID:1056 -
\??\c:\5jpdp.exec:\5jpdp.exe50⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxrrxrx.exec:\fxrrxrx.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5tnnbt.exec:\5tnnbt.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9jppp.exec:\9jppp.exe53⤵
- Executes dropped EXE
PID:296 -
\??\c:\vpjpv.exec:\vpjpv.exe54⤵
- Executes dropped EXE
PID:480 -
\??\c:\nhtbhh.exec:\nhtbhh.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vpjpv.exec:\vpjpv.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxrrflf.exec:\fxrrflf.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\5btbhn.exec:\5btbhn.exe58⤵
- Executes dropped EXE
PID:1888 -
\??\c:\5dvvj.exec:\5dvvj.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rxrrrfx.exec:\rxrrrfx.exe60⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hthntt.exec:\hthntt.exe61⤵
- Executes dropped EXE
PID:1868 -
\??\c:\btntbb.exec:\btntbb.exe62⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jddjv.exec:\jddjv.exe63⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xlflxxx.exec:\xlflxxx.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btntbh.exec:\btntbh.exe65⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vvjdv.exec:\vvjdv.exe66⤵PID:2888
-
\??\c:\lxlrflx.exec:\lxlrflx.exe67⤵PID:2988
-
\??\c:\9bnttb.exec:\9bnttb.exe68⤵PID:1980
-
\??\c:\tnhnbh.exec:\tnhnbh.exe69⤵PID:1876
-
\??\c:\1jpjv.exec:\1jpjv.exe70⤵PID:1720
-
\??\c:\ttthnt.exec:\ttthnt.exe71⤵PID:1424
-
\??\c:\vvdpv.exec:\vvdpv.exe72⤵PID:2104
-
\??\c:\jvjjd.exec:\jvjjd.exe73⤵PID:1776
-
\??\c:\ffxxfrf.exec:\ffxxfrf.exe74⤵PID:3020
-
\??\c:\hbbhth.exec:\hbbhth.exe75⤵PID:2228
-
\??\c:\jdvdj.exec:\jdvdj.exe76⤵PID:2980
-
\??\c:\ffxlxll.exec:\ffxlxll.exe77⤵PID:2836
-
\??\c:\bbbhbn.exec:\bbbhbn.exe78⤵PID:2588
-
\??\c:\ddvdv.exec:\ddvdv.exe79⤵PID:2796
-
\??\c:\vppjp.exec:\vppjp.exe80⤵PID:2612
-
\??\c:\xrflffr.exec:\xrflffr.exe81⤵PID:2340
-
\??\c:\hbttbb.exec:\hbttbb.exe82⤵PID:2256
-
\??\c:\jdjpd.exec:\jdjpd.exe83⤵PID:2768
-
\??\c:\1rlxflr.exec:\1rlxflr.exe84⤵PID:2384
-
\??\c:\nbttnb.exec:\nbttnb.exe85⤵PID:2416
-
\??\c:\bbtbth.exec:\bbtbth.exe86⤵PID:1672
-
\??\c:\dvpdj.exec:\dvpdj.exe87⤵PID:2144
-
\??\c:\xrllffr.exec:\xrllffr.exe88⤵PID:1996
-
\??\c:\ttnthn.exec:\ttnthn.exe89⤵PID:552
-
\??\c:\nhnntt.exec:\nhnntt.exe90⤵PID:1520
-
\??\c:\5vpvd.exec:\5vpvd.exe91⤵PID:2012
-
\??\c:\9rxxfll.exec:\9rxxfll.exe92⤵PID:680
-
\??\c:\tnhtbt.exec:\tnhtbt.exe93⤵PID:1852
-
\??\c:\pjjpj.exec:\pjjpj.exe94⤵PID:588
-
\??\c:\vvvpd.exec:\vvvpd.exe95⤵PID:2252
-
\??\c:\xrlfllr.exec:\xrlfllr.exe96⤵PID:1600
-
\??\c:\1tnhnn.exec:\1tnhnn.exe97⤵PID:2168
-
\??\c:\ppddv.exec:\ppddv.exe98⤵PID:2196
-
\??\c:\xlxxfxl.exec:\xlxxfxl.exe99⤵PID:2224
-
\??\c:\5xfxxrx.exec:\5xfxxrx.exe100⤵PID:2180
-
\??\c:\3tnttb.exec:\3tnttb.exe101⤵PID:1896
-
\??\c:\1ppdv.exec:\1ppdv.exe102⤵PID:2232
-
\??\c:\xrffrxr.exec:\xrffrxr.exe103⤵PID:1316
-
\??\c:\flxlflx.exec:\flxlflx.exe104⤵PID:2336
-
\??\c:\hbbbnn.exec:\hbbbnn.exe105⤵PID:912
-
\??\c:\vdvpp.exec:\vdvpp.exe106⤵PID:1732
-
\??\c:\xlrxfxx.exec:\xlrxfxx.exe107⤵PID:1664
-
\??\c:\bhbnbn.exec:\bhbnbn.exe108⤵PID:2928
-
\??\c:\jdddv.exec:\jdddv.exe109⤵PID:2448
-
\??\c:\ffxxrxf.exec:\ffxxrxf.exe110⤵PID:2872
-
\??\c:\3btbbt.exec:\3btbbt.exe111⤵PID:2508
-
\??\c:\vvddd.exec:\vvddd.exe112⤵PID:904
-
\??\c:\rlflllx.exec:\rlflllx.exe113⤵PID:2660
-
\??\c:\3hbhhn.exec:\3hbhhn.exe114⤵PID:1548
-
\??\c:\3ttttb.exec:\3ttttb.exe115⤵PID:1532
-
\??\c:\pjvdp.exec:\pjvdp.exe116⤵PID:2824
-
\??\c:\xrxxlll.exec:\xrxxlll.exe117⤵PID:1656
-
\??\c:\bbhbbh.exec:\bbhbbh.exe118⤵PID:1508
-
\??\c:\jpdjv.exec:\jpdjv.exe119⤵PID:3008
-
\??\c:\1fxrxxr.exec:\1fxrxxr.exe120⤵PID:2560
-
\??\c:\9nbbhn.exec:\9nbbhn.exe121⤵PID:2556
-
\??\c:\jdpdp.exec:\jdpdp.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-