Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 08:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe
-
Size
454KB
-
MD5
93f7a68d88f5780fe0c485e99709a38e
-
SHA1
af128f6dbfdb01b7f7947a57a15b78abe17d8278
-
SHA256
d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e
-
SHA512
7ddc5965457d25aa8cc432def7365744df439f4489eb1c68b9755904cb2a662fc0eade5ee8cea7cc586245a687b83e61eb9916c2b5323a37803b0147e3728ad4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-25-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2508-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-37-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2680-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-211-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/740-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-358-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2644-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-539-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1548-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-617-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2608-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-661-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1636-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-875-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-883-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1976-961-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-991-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2884-993-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-1018-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1440-1094-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-1113-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3064-1131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-1135-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2996-1185-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1984 3nntth.exe 2508 9pddp.exe 1944 5xrxxxf.exe 2680 3vvvd.exe 2684 bhnbnn.exe 2816 jvjpj.exe 2560 ttnnhn.exe 1748 3vddj.exe 2564 3nhntt.exe 2716 5rlxllx.exe 872 hhbnbn.exe 2632 5vppd.exe 1668 thbbnn.exe 1248 7fxfxff.exe 2344 djpjv.exe 636 1xlfrrf.exe 1780 pjdjd.exe 2880 3rflxxl.exe 2028 thntnt.exe 964 djddj.exe 1664 tnbnbb.exe 1060 jdjpd.exe 1236 rlxlxxf.exe 2268 tnthnn.exe 740 9hnntn.exe 1284 ffxxrfr.exe 568 hbbbtt.exe 544 pjjvd.exe 2204 tbttnb.exe 1696 vjvvp.exe 2896 nnhnhh.exe 1736 1dddp.exe 280 hhbntt.exe 2728 jjjvd.exe 3044 jjdpd.exe 2756 7lxrflr.exe 2920 hbnbhn.exe 2688 hbbnhh.exe 2648 3vdpd.exe 2816 lrrlfrl.exe 2644 frxfllx.exe 2536 hbthnn.exe 2652 vvjpj.exe 1960 xfxfxfr.exe 888 hhhthn.exe 1848 jddpj.exe 2620 ffxfllx.exe 896 nhhnnh.exe 2520 1bthnn.exe 852 jdvdp.exe 2784 7xlflrx.exe 2876 xrflrxl.exe 1272 1htbnn.exe 1768 vvjpd.exe 1996 3llrffr.exe 2888 3rrxrxx.exe 2340 7bhtnn.exe 2212 pjvpv.exe 2940 vpdpv.exe 2868 lfxxfxf.exe 1060 5hnnhn.exe 844 vvddj.exe 2720 vdvjv.exe 2268 rllrxfl.exe -
resource yara_rule behavioral1/memory/1984-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-213-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/740-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-455-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2940-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-925-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-961-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2884-991-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2884-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-1094-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2156-1114-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1984 2016 d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe 31 PID 2016 wrote to memory of 1984 2016 d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe 31 PID 2016 wrote to memory of 1984 2016 d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe 31 PID 2016 wrote to memory of 1984 2016 d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe 31 PID 1984 wrote to memory of 2508 1984 3nntth.exe 32 PID 1984 wrote to memory of 2508 1984 3nntth.exe 32 PID 1984 wrote to memory of 2508 1984 3nntth.exe 32 PID 1984 wrote to memory of 2508 1984 3nntth.exe 32 PID 2508 wrote to memory of 1944 2508 9pddp.exe 33 PID 2508 wrote to memory of 1944 2508 9pddp.exe 33 PID 2508 wrote to memory of 1944 2508 9pddp.exe 33 PID 2508 wrote to memory of 1944 2508 9pddp.exe 33 PID 1944 wrote to memory of 2680 1944 5xrxxxf.exe 34 PID 1944 wrote to memory of 2680 1944 5xrxxxf.exe 34 PID 1944 wrote to memory of 2680 1944 5xrxxxf.exe 34 PID 1944 wrote to memory of 2680 1944 5xrxxxf.exe 34 PID 2680 wrote to memory of 2684 2680 3vvvd.exe 35 PID 2680 wrote to memory of 2684 2680 3vvvd.exe 35 PID 2680 wrote to memory of 2684 2680 3vvvd.exe 35 PID 2680 wrote to memory of 2684 2680 3vvvd.exe 35 PID 2684 wrote to memory of 2816 2684 bhnbnn.exe 36 PID 2684 wrote to memory of 2816 2684 bhnbnn.exe 36 PID 2684 wrote to memory of 2816 2684 bhnbnn.exe 36 PID 2684 wrote to memory of 2816 2684 bhnbnn.exe 36 PID 2816 wrote to memory of 2560 2816 jvjpj.exe 37 PID 2816 wrote to memory of 2560 2816 jvjpj.exe 37 PID 2816 wrote to memory of 2560 2816 jvjpj.exe 37 PID 2816 wrote to memory of 2560 2816 jvjpj.exe 37 PID 2560 wrote to memory of 1748 2560 ttnnhn.exe 38 PID 2560 wrote to memory of 1748 2560 ttnnhn.exe 38 PID 2560 wrote to memory of 1748 2560 ttnnhn.exe 38 PID 2560 wrote to memory of 1748 2560 ttnnhn.exe 38 PID 1748 wrote to memory of 2564 1748 3vddj.exe 39 PID 1748 wrote to memory of 2564 1748 3vddj.exe 39 PID 1748 wrote to memory of 2564 1748 3vddj.exe 39 PID 1748 wrote to memory of 2564 1748 3vddj.exe 39 PID 2564 wrote to memory of 2716 2564 3nhntt.exe 40 PID 2564 wrote to memory of 2716 2564 3nhntt.exe 40 PID 2564 wrote to memory of 2716 2564 3nhntt.exe 40 PID 2564 wrote to memory of 2716 2564 3nhntt.exe 40 PID 2716 wrote to memory of 872 2716 5rlxllx.exe 41 PID 2716 wrote to memory of 872 2716 5rlxllx.exe 41 PID 2716 wrote to memory of 872 2716 5rlxllx.exe 41 PID 2716 wrote to memory of 872 2716 5rlxllx.exe 41 PID 872 wrote to memory of 2632 872 hhbnbn.exe 42 PID 872 wrote to memory of 2632 872 hhbnbn.exe 42 PID 872 wrote to memory of 2632 872 hhbnbn.exe 42 PID 872 wrote to memory of 2632 872 hhbnbn.exe 42 PID 2632 wrote to memory of 1668 2632 5vppd.exe 43 PID 2632 wrote to memory of 1668 2632 5vppd.exe 43 PID 2632 wrote to memory of 1668 2632 5vppd.exe 43 PID 2632 wrote to memory of 1668 2632 5vppd.exe 43 PID 1668 wrote to memory of 1248 1668 thbbnn.exe 44 PID 1668 wrote to memory of 1248 1668 thbbnn.exe 44 PID 1668 wrote to memory of 1248 1668 thbbnn.exe 44 PID 1668 wrote to memory of 1248 1668 thbbnn.exe 44 PID 1248 wrote to memory of 2344 1248 7fxfxff.exe 45 PID 1248 wrote to memory of 2344 1248 7fxfxff.exe 45 PID 1248 wrote to memory of 2344 1248 7fxfxff.exe 45 PID 1248 wrote to memory of 2344 1248 7fxfxff.exe 45 PID 2344 wrote to memory of 636 2344 djpjv.exe 46 PID 2344 wrote to memory of 636 2344 djpjv.exe 46 PID 2344 wrote to memory of 636 2344 djpjv.exe 46 PID 2344 wrote to memory of 636 2344 djpjv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe"C:\Users\Admin\AppData\Local\Temp\d71442e46be50f2e10867f0461bb2c74f0a903bbe1744c4364dfa973fafa645e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\3nntth.exec:\3nntth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\9pddp.exec:\9pddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\5xrxxxf.exec:\5xrxxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\3vvvd.exec:\3vvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bhnbnn.exec:\bhnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\jvjpj.exec:\jvjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ttnnhn.exec:\ttnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\3vddj.exec:\3vddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\3nhntt.exec:\3nhntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5rlxllx.exec:\5rlxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hhbnbn.exec:\hhbnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\5vppd.exec:\5vppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\thbbnn.exec:\thbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\7fxfxff.exec:\7fxfxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\djpjv.exec:\djpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\1xlfrrf.exec:\1xlfrrf.exe17⤵
- Executes dropped EXE
PID:636 -
\??\c:\pjdjd.exec:\pjdjd.exe18⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3rflxxl.exec:\3rflxxl.exe19⤵
- Executes dropped EXE
PID:2880 -
\??\c:\thntnt.exec:\thntnt.exe20⤵
- Executes dropped EXE
PID:2028 -
\??\c:\djddj.exec:\djddj.exe21⤵
- Executes dropped EXE
PID:964 -
\??\c:\tnbnbb.exec:\tnbnbb.exe22⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jdjpd.exec:\jdjpd.exe23⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rlxlxxf.exec:\rlxlxxf.exe24⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tnthnn.exec:\tnthnn.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9hnntn.exec:\9hnntn.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740 -
\??\c:\ffxxrfr.exec:\ffxxrfr.exe27⤵
- Executes dropped EXE
PID:1284 -
\??\c:\hbbbtt.exec:\hbbbtt.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\pjjvd.exec:\pjjvd.exe29⤵
- Executes dropped EXE
PID:544 -
\??\c:\tbttnb.exec:\tbttnb.exe30⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vjvvp.exec:\vjvvp.exe31⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nnhnhh.exec:\nnhnhh.exe32⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1dddp.exec:\1dddp.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hhbntt.exec:\hhbntt.exe34⤵
- Executes dropped EXE
PID:280 -
\??\c:\jjjvd.exec:\jjjvd.exe35⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjdpd.exec:\jjdpd.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044 -
\??\c:\7lxrflr.exec:\7lxrflr.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hbnbhn.exec:\hbnbhn.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hbbnhh.exec:\hbbnhh.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3vdpd.exec:\3vdpd.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lrrlfrl.exec:\lrrlfrl.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frxfllx.exec:\frxfllx.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbthnn.exec:\hbthnn.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vvjpj.exec:\vvjpj.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xfxfxfr.exec:\xfxfxfr.exe45⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhhthn.exec:\hhhthn.exe46⤵
- Executes dropped EXE
PID:888 -
\??\c:\jddpj.exec:\jddpj.exe47⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ffxfllx.exec:\ffxfllx.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nhhnnh.exec:\nhhnnh.exe49⤵
- Executes dropped EXE
PID:896 -
\??\c:\1bthnn.exec:\1bthnn.exe50⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jdvdp.exec:\jdvdp.exe51⤵
- Executes dropped EXE
PID:852 -
\??\c:\7xlflrx.exec:\7xlflrx.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\xrflrxl.exec:\xrflrxl.exe53⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1htbnn.exec:\1htbnn.exe54⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vvjpd.exec:\vvjpd.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\3llrffr.exec:\3llrffr.exe56⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3rrxrxx.exec:\3rrxrxx.exe57⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7bhtnn.exec:\7bhtnn.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pjvpv.exec:\pjvpv.exe59⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vpdpv.exec:\vpdpv.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe61⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5hnnhn.exec:\5hnnhn.exe62⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vvddj.exec:\vvddj.exe63⤵
- Executes dropped EXE
PID:844 -
\??\c:\vdvjv.exec:\vdvjv.exe64⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rllrxfl.exec:\rllrxfl.exe65⤵
- Executes dropped EXE
PID:2268 -
\??\c:\tbtnnt.exec:\tbtnnt.exe66⤵PID:2140
-
\??\c:\9jvvv.exec:\9jvvv.exe67⤵PID:2952
-
\??\c:\ppdjv.exec:\ppdjv.exe68⤵PID:992
-
\??\c:\lfxrffr.exec:\lfxrffr.exe69⤵PID:1900
-
\??\c:\hbnntn.exec:\hbnntn.exe70⤵PID:3040
-
\??\c:\hhbthn.exec:\hhbthn.exe71⤵PID:1928
-
\??\c:\9jjjp.exec:\9jjjp.exe72⤵PID:1548
-
\??\c:\xxfxffr.exec:\xxfxffr.exe73⤵PID:1440
-
\??\c:\1tnhnt.exec:\1tnhnt.exe74⤵PID:2128
-
\??\c:\9hhnhn.exec:\9hhnhn.exe75⤵PID:1052
-
\??\c:\jdvdj.exec:\jdvdj.exe76⤵PID:2992
-
\??\c:\rrfxflx.exec:\rrfxflx.exe77⤵PID:2740
-
\??\c:\3hbbnt.exec:\3hbbnt.exe78⤵PID:3064
-
\??\c:\nbnbhh.exec:\nbnbhh.exe79⤵PID:2788
-
\??\c:\dvvjv.exec:\dvvjv.exe80⤵PID:2920
-
\??\c:\frxxxfl.exec:\frxxxfl.exe81⤵PID:2664
-
\??\c:\9hntbb.exec:\9hntbb.exe82⤵PID:2872
-
\??\c:\bbhnbt.exec:\bbhnbt.exe83⤵
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\3vvdj.exec:\3vvdj.exe84⤵PID:2644
-
\??\c:\fxfflrf.exec:\fxfflrf.exe85⤵PID:2544
-
\??\c:\tnhhnn.exec:\tnhhnn.exe86⤵PID:2608
-
\??\c:\3bhnnt.exec:\3bhnnt.exe87⤵PID:2420
-
\??\c:\vvpvp.exec:\vvpvp.exe88⤵PID:1800
-
\??\c:\lrlfxlf.exec:\lrlfxlf.exe89⤵PID:2064
-
\??\c:\xxrrllx.exec:\xxrrllx.exe90⤵PID:2848
-
\??\c:\7btbnh.exec:\7btbnh.exe91⤵PID:1000
-
\??\c:\9pjdp.exec:\9pjdp.exe92⤵PID:704
-
\??\c:\ddppv.exec:\ddppv.exe93⤵PID:1248
-
\??\c:\ffffllr.exec:\ffffllr.exe94⤵PID:264
-
\??\c:\nnhtht.exec:\nnhtht.exe95⤵PID:1764
-
\??\c:\bthhhh.exec:\bthhhh.exe96⤵PID:2856
-
\??\c:\jjjpd.exec:\jjjpd.exe97⤵PID:1164
-
\??\c:\xrxflfl.exec:\xrxflfl.exe98⤵PID:2884
-
\??\c:\xlfxffr.exec:\xlfxffr.exe99⤵PID:2100
-
\??\c:\nhtthn.exec:\nhtthn.exe100⤵PID:2104
-
\??\c:\3pjpj.exec:\3pjpj.exe101⤵PID:2160
-
\??\c:\rxflrlr.exec:\rxflrlr.exe102⤵PID:1016
-
\??\c:\bbbnbn.exec:\bbbnbn.exe103⤵PID:1140
-
\??\c:\tbthtn.exec:\tbthtn.exe104⤵PID:1608
-
\??\c:\7pdjp.exec:\7pdjp.exe105⤵PID:1636
-
\??\c:\llxfflx.exec:\llxfflx.exe106⤵PID:572
-
\??\c:\tnhntt.exec:\tnhntt.exe107⤵PID:2060
-
\??\c:\9jddd.exec:\9jddd.exe108⤵PID:740
-
\??\c:\ppjvv.exec:\ppjvv.exe109⤵PID:2976
-
\??\c:\fxlxrxl.exec:\fxlxrxl.exe110⤵PID:1904
-
\??\c:\bbbnbn.exec:\bbbnbn.exe111⤵PID:876
-
\??\c:\pjvjv.exec:\pjvjv.exe112⤵PID:3068
-
\??\c:\xfxfxxx.exec:\xfxfxxx.exe113⤵PID:3040
-
\??\c:\xxrxxrf.exec:\xxrxxrf.exe114⤵PID:584
-
\??\c:\hhbhtt.exec:\hhbhtt.exe115⤵PID:1564
-
\??\c:\rrrfrff.exec:\rrrfrff.exe116⤵PID:2004
-
\??\c:\tbtttb.exec:\tbtttb.exe117⤵PID:1736
-
\??\c:\jdpvd.exec:\jdpvd.exe118⤵PID:2168
-
\??\c:\rrfrllf.exec:\rrfrllf.exe119⤵PID:2624
-
\??\c:\nhtbhn.exec:\nhtbhn.exe120⤵PID:2740
-
\??\c:\dvjpv.exec:\dvjpv.exe121⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-