Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 08:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe
-
Size
456KB
-
MD5
9a65aae4fa9eac71cae2710f281e08c6
-
SHA1
a24dac08a2860bc9a1a134248b2fbc9a10b1e7c3
-
SHA256
ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e
-
SHA512
54c91ef3e420a449692556f35d2d04f9da79850442c17bb267216614eb58971182fe59ee9969cd0525170bece10934d3562f660562d9e3788d47c57216b17efb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRZ:q7Tc2NYHUrAwfMp3CDRZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2560-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-33-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2940-35-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2940-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-55-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2996-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-66-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2944-79-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2944-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-88-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-97-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-125-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1712-156-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1712-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/640-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-214-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1608-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-273-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1204-282-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1604-299-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1692-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-349-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2656-356-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2176-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-490-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1956-498-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1956-517-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1512-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-527-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2240-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-722-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2264-741-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1148 5rlrflf.exe 2540 vdvvd.exe 2940 1ddpv.exe 1692 nhbhtt.exe 2996 hbttnt.exe 2904 bthnbh.exe 2944 3nhhnt.exe 2800 xrlrflx.exe 2660 btbbhn.exe 2312 1rlrxxl.exe 1928 xrxfrrx.exe 2888 9xrrlrr.exe 1100 nhntth.exe 2692 pjddp.exe 1712 fllrrxr.exe 640 vpjpd.exe 2808 dvjjp.exe 2504 7hhnnb.exe 3004 dppdv.exe 2728 rrllllf.exe 1004 bthhbb.exe 1608 pdpdj.exe 2180 9lrrffr.exe 1572 btbbhh.exe 3044 fxlrffr.exe 2480 9hbhbb.exe 3036 jjdjj.exe 848 nhbhtb.exe 1204 7bnbth.exe 2584 3xlrrxl.exe 1604 fxrrxxf.exe 2428 bnttnt.exe 2444 nhnttb.exe 1704 7tthnn.exe 2836 vdpvj.exe 1692 9djjp.exe 2788 rllllrr.exe 2748 nhnhhh.exe 2656 ppvvd.exe 2176 9pvvj.exe 2856 lfxfrrf.exe 3068 btnnbb.exe 2660 dpjjj.exe 1948 fxrxffl.exe 852 1btttt.exe 2872 pvjpv.exe 1180 vpddp.exe 2012 xrfllfr.exe 1980 tntthh.exe 400 btnhhh.exe 1920 jjjjv.exe 2020 5rffllx.exe 2668 5lllrxf.exe 2860 nnbhtb.exe 316 pdppv.exe 1292 pjdpv.exe 1792 rxlxrrf.exe 1380 3hbhnt.exe 1592 tntthh.exe 1956 dvpvd.exe 1856 rrflxfr.exe 2228 llxflrf.exe 1512 nbhhtt.exe 2520 vdvdp.exe -
resource yara_rule behavioral1/memory/2560-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-97-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2312-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-542-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2240-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-831-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 1148 2560 ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe 30 PID 2560 wrote to memory of 1148 2560 ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe 30 PID 2560 wrote to memory of 1148 2560 ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe 30 PID 2560 wrote to memory of 1148 2560 ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe 30 PID 1148 wrote to memory of 2540 1148 5rlrflf.exe 31 PID 1148 wrote to memory of 2540 1148 5rlrflf.exe 31 PID 1148 wrote to memory of 2540 1148 5rlrflf.exe 31 PID 1148 wrote to memory of 2540 1148 5rlrflf.exe 31 PID 2540 wrote to memory of 2940 2540 vdvvd.exe 32 PID 2540 wrote to memory of 2940 2540 vdvvd.exe 32 PID 2540 wrote to memory of 2940 2540 vdvvd.exe 32 PID 2540 wrote to memory of 2940 2540 vdvvd.exe 32 PID 2940 wrote to memory of 1692 2940 1ddpv.exe 33 PID 2940 wrote to memory of 1692 2940 1ddpv.exe 33 PID 2940 wrote to memory of 1692 2940 1ddpv.exe 33 PID 2940 wrote to memory of 1692 2940 1ddpv.exe 33 PID 1692 wrote to memory of 2996 1692 nhbhtt.exe 34 PID 1692 wrote to memory of 2996 1692 nhbhtt.exe 34 PID 1692 wrote to memory of 2996 1692 nhbhtt.exe 34 PID 1692 wrote to memory of 2996 1692 nhbhtt.exe 34 PID 2996 wrote to memory of 2904 2996 hbttnt.exe 35 PID 2996 wrote to memory of 2904 2996 hbttnt.exe 35 PID 2996 wrote to memory of 2904 2996 hbttnt.exe 35 PID 2996 wrote to memory of 2904 2996 hbttnt.exe 35 PID 2904 wrote to memory of 2944 2904 bthnbh.exe 36 PID 2904 wrote to memory of 2944 2904 bthnbh.exe 36 PID 2904 wrote to memory of 2944 2904 bthnbh.exe 36 PID 2904 wrote to memory of 2944 2904 bthnbh.exe 36 PID 2944 wrote to memory of 2800 2944 3nhhnt.exe 37 PID 2944 wrote to memory of 2800 2944 3nhhnt.exe 37 PID 2944 wrote to memory of 2800 2944 3nhhnt.exe 37 PID 2944 wrote to memory of 2800 2944 3nhhnt.exe 37 PID 2800 wrote to memory of 2660 2800 xrlrflx.exe 38 PID 2800 wrote to memory of 2660 2800 xrlrflx.exe 38 PID 2800 wrote to memory of 2660 2800 xrlrflx.exe 38 PID 2800 wrote to memory of 2660 2800 xrlrflx.exe 38 PID 2660 wrote to memory of 2312 2660 btbbhn.exe 39 PID 2660 wrote to memory of 2312 2660 btbbhn.exe 39 PID 2660 wrote to memory of 2312 2660 btbbhn.exe 39 PID 2660 wrote to memory of 2312 2660 btbbhn.exe 39 PID 2312 wrote to memory of 1928 2312 1rlrxxl.exe 40 PID 2312 wrote to memory of 1928 2312 1rlrxxl.exe 40 PID 2312 wrote to memory of 1928 2312 1rlrxxl.exe 40 PID 2312 wrote to memory of 1928 2312 1rlrxxl.exe 40 PID 1928 wrote to memory of 2888 1928 xrxfrrx.exe 41 PID 1928 wrote to memory of 2888 1928 xrxfrrx.exe 41 PID 1928 wrote to memory of 2888 1928 xrxfrrx.exe 41 PID 1928 wrote to memory of 2888 1928 xrxfrrx.exe 41 PID 2888 wrote to memory of 1100 2888 9xrrlrr.exe 42 PID 2888 wrote to memory of 1100 2888 9xrrlrr.exe 42 PID 2888 wrote to memory of 1100 2888 9xrrlrr.exe 42 PID 2888 wrote to memory of 1100 2888 9xrrlrr.exe 42 PID 1100 wrote to memory of 2692 1100 nhntth.exe 43 PID 1100 wrote to memory of 2692 1100 nhntth.exe 43 PID 1100 wrote to memory of 2692 1100 nhntth.exe 43 PID 1100 wrote to memory of 2692 1100 nhntth.exe 43 PID 2692 wrote to memory of 1712 2692 pjddp.exe 44 PID 2692 wrote to memory of 1712 2692 pjddp.exe 44 PID 2692 wrote to memory of 1712 2692 pjddp.exe 44 PID 2692 wrote to memory of 1712 2692 pjddp.exe 44 PID 1712 wrote to memory of 640 1712 fllrrxr.exe 45 PID 1712 wrote to memory of 640 1712 fllrrxr.exe 45 PID 1712 wrote to memory of 640 1712 fllrrxr.exe 45 PID 1712 wrote to memory of 640 1712 fllrrxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe"C:\Users\Admin\AppData\Local\Temp\ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5rlrflf.exec:\5rlrflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\vdvvd.exec:\vdvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\1ddpv.exec:\1ddpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nhbhtt.exec:\nhbhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\hbttnt.exec:\hbttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bthnbh.exec:\bthnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3nhhnt.exec:\3nhhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xrlrflx.exec:\xrlrflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\btbbhn.exec:\btbbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1rlrxxl.exec:\1rlrxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\9xrrlrr.exec:\9xrrlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nhntth.exec:\nhntth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\pjddp.exec:\pjddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\fllrrxr.exec:\fllrrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vpjpd.exec:\vpjpd.exe17⤵
- Executes dropped EXE
PID:640 -
\??\c:\dvjjp.exec:\dvjjp.exe18⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7hhnnb.exec:\7hhnnb.exe19⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dppdv.exec:\dppdv.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrllllf.exec:\rrllllf.exe21⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bthhbb.exec:\bthhbb.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004 -
\??\c:\pdpdj.exec:\pdpdj.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9lrrffr.exec:\9lrrffr.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\btbbhh.exec:\btbbhh.exe25⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxlrffr.exec:\fxlrffr.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9hbhbb.exec:\9hbhbb.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jjdjj.exec:\jjdjj.exe28⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhbhtb.exec:\nhbhtb.exe29⤵
- Executes dropped EXE
PID:848 -
\??\c:\7bnbth.exec:\7bnbth.exe30⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3xlrrxl.exec:\3xlrrxl.exe31⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe32⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bnttnt.exec:\bnttnt.exe33⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nhnttb.exec:\nhnttb.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7tthnn.exec:\7tthnn.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vdpvj.exec:\vdpvj.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\9djjp.exec:\9djjp.exe37⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rllllrr.exec:\rllllrr.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nhnhhh.exec:\nhnhhh.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ppvvd.exec:\ppvvd.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9pvvj.exec:\9pvvj.exe41⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe42⤵
- Executes dropped EXE
PID:2856 -
\??\c:\btnnbb.exec:\btnnbb.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dpjjj.exec:\dpjjj.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\fxrxffl.exec:\fxrxffl.exe45⤵
- Executes dropped EXE
PID:1948 -
\??\c:\1btttt.exec:\1btttt.exe46⤵
- Executes dropped EXE
PID:852 -
\??\c:\pvjpv.exec:\pvjpv.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vpddp.exec:\vpddp.exe48⤵
- Executes dropped EXE
PID:1180 -
\??\c:\xrfllfr.exec:\xrfllfr.exe49⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tntthh.exec:\tntthh.exe50⤵
- Executes dropped EXE
PID:1980 -
\??\c:\btnhhh.exec:\btnhhh.exe51⤵
- Executes dropped EXE
PID:400 -
\??\c:\jjjjv.exec:\jjjjv.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5rffllx.exec:\5rffllx.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5lllrxf.exec:\5lllrxf.exe54⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nnbhtb.exec:\nnbhtb.exe55⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pdppv.exec:\pdppv.exe56⤵
- Executes dropped EXE
PID:316 -
\??\c:\pjdpv.exec:\pjdpv.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1292 -
\??\c:\rxlxrrf.exec:\rxlxrrf.exe58⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3hbhnt.exec:\3hbhnt.exe59⤵
- Executes dropped EXE
PID:1380 -
\??\c:\tntthh.exec:\tntthh.exe60⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dvpvd.exec:\dvpvd.exe61⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rrflxfr.exec:\rrflxfr.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\llxflrf.exec:\llxflrf.exe63⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nbhhtt.exec:\nbhhtt.exe64⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vdvdp.exec:\vdvdp.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\pvpvj.exec:\pvpvj.exe66⤵PID:2068
-
\??\c:\5xrxxfl.exec:\5xrxxfl.exe67⤵PID:2256
-
\??\c:\bthhnn.exec:\bthhnn.exe68⤵PID:2240
-
\??\c:\pjdjv.exec:\pjdjv.exe69⤵PID:2456
-
\??\c:\3jdvd.exec:\3jdvd.exe70⤵PID:1408
-
\??\c:\llxxllr.exec:\llxxllr.exe71⤵PID:2468
-
\??\c:\hbnbnn.exec:\hbnbnn.exe72⤵PID:1604
-
\??\c:\nntbnt.exec:\nntbnt.exe73⤵PID:1624
-
\??\c:\dpjjj.exec:\dpjjj.exe74⤵PID:2724
-
\??\c:\pdvdj.exec:\pdvdj.exe75⤵PID:2460
-
\??\c:\lxlrxxl.exec:\lxlrxxl.exe76⤵PID:2784
-
\??\c:\nbnhnn.exec:\nbnhnn.exe77⤵PID:2836
-
\??\c:\nhtbbh.exec:\nhtbbh.exe78⤵PID:2764
-
\??\c:\vpjvj.exec:\vpjvj.exe79⤵PID:2832
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe80⤵PID:2904
-
\??\c:\xffrflx.exec:\xffrflx.exe81⤵PID:2796
-
\??\c:\tnbbhh.exec:\tnbbhh.exe82⤵PID:2744
-
\??\c:\dvjvj.exec:\dvjvj.exe83⤵PID:2684
-
\??\c:\9vjjd.exec:\9vjjd.exe84⤵PID:2672
-
\??\c:\rfxlflx.exec:\rfxlflx.exe85⤵PID:2680
-
\??\c:\nhbhhn.exec:\nhbhhn.exe86⤵PID:2496
-
\??\c:\1bnntt.exec:\1bnntt.exe87⤵PID:596
-
\??\c:\1vppd.exec:\1vppd.exe88⤵PID:2896
-
\??\c:\ffrxllx.exec:\ffrxllx.exe89⤵PID:2040
-
\??\c:\nnhnbb.exec:\nnhnbb.exe90⤵PID:2448
-
\??\c:\pdpjv.exec:\pdpjv.exe91⤵PID:1044
-
\??\c:\ppjpd.exec:\ppjpd.exe92⤵PID:2452
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe93⤵PID:2884
-
\??\c:\bntttt.exec:\bntttt.exe94⤵PID:2028
-
\??\c:\nnhnhh.exec:\nnhnhh.exe95⤵PID:1076
-
\??\c:\pjppj.exec:\pjppj.exe96⤵PID:2168
-
\??\c:\xfrxffl.exec:\xfrxffl.exe97⤵PID:2092
-
\??\c:\5fxrxxl.exec:\5fxrxxl.exe98⤵PID:2264
-
\??\c:\tbtnhn.exec:\tbtnhn.exe99⤵PID:1904
-
\??\c:\vpvdv.exec:\vpvdv.exe100⤵PID:772
-
\??\c:\pjvvd.exec:\pjvvd.exe101⤵PID:1672
-
\??\c:\xxffrxl.exec:\xxffrxl.exe102⤵PID:700
-
\??\c:\tnhthh.exec:\tnhthh.exe103⤵PID:1240
-
\??\c:\1hhhht.exec:\1hhhht.exe104⤵PID:2180
-
\??\c:\jvjvp.exec:\jvjvp.exe105⤵PID:956
-
\??\c:\xrlflrl.exec:\xrlflrl.exe106⤵PID:3048
-
\??\c:\fxxfrrx.exec:\fxxfrrx.exe107⤵PID:2480
-
\??\c:\ttthhh.exec:\ttthhh.exe108⤵PID:2388
-
\??\c:\vvjvp.exec:\vvjvp.exe109⤵PID:1676
-
\??\c:\jpdjj.exec:\jpdjj.exe110⤵PID:848
-
\??\c:\fxlrffx.exec:\fxlrffx.exe111⤵PID:284
-
\??\c:\tnbhtb.exec:\tnbhtb.exe112⤵PID:1628
-
\??\c:\pdjpd.exec:\pdjpd.exe113⤵
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\pjppj.exec:\pjppj.exe114⤵PID:1148
-
\??\c:\rllxrlx.exec:\rllxrlx.exe115⤵
- System Location Discovery: System Language Discovery
PID:2604 -
\??\c:\bbnbtt.exec:\bbnbtt.exe116⤵PID:2100
-
\??\c:\ppdvd.exec:\ppdvd.exe117⤵PID:2160
-
\??\c:\1vvdp.exec:\1vvdp.exe118⤵PID:2736
-
\??\c:\rrxlxxf.exec:\rrxlxxf.exe119⤵PID:2912
-
\??\c:\nnbntb.exec:\nnbntb.exe120⤵PID:2984
-
\??\c:\tnntnn.exec:\tnntnn.exe121⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-