Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe
-
Size
456KB
-
MD5
a0556a6fe30d03855a4a054ddd183b10
-
SHA1
c78d8c659a1d7bbc2e8e2fcb0b221dd98413ef0a
-
SHA256
0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cab
-
SHA512
8075b21bbc03ab331a7f8adb3a46ec1a38f72b02609203139e879b2e9abd516b554cccbb5e6bef21e972b62f49b30ff0e0552279f68fb58e488bf74b3d1fde8b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2828-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-169-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-582-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2640-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-671-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2028-704-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-769-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2404-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-809-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-920-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2496-1054-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-1233-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2868 ntbhth.exe 2964 7xrxxfx.exe 2324 bnbbnt.exe 2704 rrxxllf.exe 2584 tnbhth.exe 3064 7pjjp.exe 1460 7lxxxxf.exe 3024 djvdj.exe 2332 flxrxff.exe 2628 3nbhnt.exe 580 jdpvd.exe 1420 5bbhtb.exe 840 nhhhtb.exe 908 rrffxff.exe 2076 nnhbtt.exe 692 9jdpv.exe 2292 rlxxffl.exe 1264 5jjpv.exe 2972 3pdvd.exe 2456 tbtnhh.exe 2180 jvvvj.exe 956 3rflrxl.exe 1448 bbhnnh.exe 2540 pjddj.exe 1360 xfxlxxl.exe 2896 1dpjj.exe 1740 lfrlrlr.exe 892 pjvvd.exe 2676 jvpdd.exe 2884 nnhhhh.exe 1552 pppvj.exe 2712 9llflll.exe 2856 nhnntt.exe 2324 jvjjj.exe 2632 rlxxllx.exe 1884 xrxrxrx.exe 2888 hnbbhh.exe 1780 3dvpv.exe 1636 1jdjj.exe 1792 5xrfffl.exe 1588 lfffllr.exe 1992 3ttnth.exe 1948 vdpjj.exe 2548 frfxffl.exe 1404 lxffffx.exe 2784 5nbhhh.exe 2448 5pdpp.exe 2744 jvppd.exe 2772 1lxfllx.exe 532 5tbtnb.exe 2072 vdjdd.exe 2028 dvjdd.exe 2216 fxrfflr.exe 2512 5thhnh.exe 444 5nhnnt.exe 1848 vpjpj.exe 3016 7xrlllr.exe 1212 rfxxflx.exe 1300 hhbbhh.exe 1856 5vppv.exe 1256 vjjpv.exe 2420 9rrlxxr.exe 2044 hbtthn.exe 2100 tnnnnn.exe -
resource yara_rule behavioral1/memory/2868-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-1054-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-1212-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2868 2828 0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe 30 PID 2828 wrote to memory of 2868 2828 0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe 30 PID 2828 wrote to memory of 2868 2828 0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe 30 PID 2828 wrote to memory of 2868 2828 0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe 30 PID 2868 wrote to memory of 2964 2868 ntbhth.exe 31 PID 2868 wrote to memory of 2964 2868 ntbhth.exe 31 PID 2868 wrote to memory of 2964 2868 ntbhth.exe 31 PID 2868 wrote to memory of 2964 2868 ntbhth.exe 31 PID 2964 wrote to memory of 2324 2964 7xrxxfx.exe 32 PID 2964 wrote to memory of 2324 2964 7xrxxfx.exe 32 PID 2964 wrote to memory of 2324 2964 7xrxxfx.exe 32 PID 2964 wrote to memory of 2324 2964 7xrxxfx.exe 32 PID 2324 wrote to memory of 2704 2324 bnbbnt.exe 33 PID 2324 wrote to memory of 2704 2324 bnbbnt.exe 33 PID 2324 wrote to memory of 2704 2324 bnbbnt.exe 33 PID 2324 wrote to memory of 2704 2324 bnbbnt.exe 33 PID 2704 wrote to memory of 2584 2704 rrxxllf.exe 34 PID 2704 wrote to memory of 2584 2704 rrxxllf.exe 34 PID 2704 wrote to memory of 2584 2704 rrxxllf.exe 34 PID 2704 wrote to memory of 2584 2704 rrxxllf.exe 34 PID 2584 wrote to memory of 3064 2584 tnbhth.exe 35 PID 2584 wrote to memory of 3064 2584 tnbhth.exe 35 PID 2584 wrote to memory of 3064 2584 tnbhth.exe 35 PID 2584 wrote to memory of 3064 2584 tnbhth.exe 35 PID 3064 wrote to memory of 1460 3064 7pjjp.exe 36 PID 3064 wrote to memory of 1460 3064 7pjjp.exe 36 PID 3064 wrote to memory of 1460 3064 7pjjp.exe 36 PID 3064 wrote to memory of 1460 3064 7pjjp.exe 36 PID 1460 wrote to memory of 3024 1460 7lxxxxf.exe 37 PID 1460 wrote to memory of 3024 1460 7lxxxxf.exe 37 PID 1460 wrote to memory of 3024 1460 7lxxxxf.exe 37 PID 1460 wrote to memory of 3024 1460 7lxxxxf.exe 37 PID 3024 wrote to memory of 2332 3024 djvdj.exe 38 PID 3024 wrote to memory of 2332 3024 djvdj.exe 38 PID 3024 wrote to memory of 2332 3024 djvdj.exe 38 PID 3024 wrote to memory of 2332 3024 djvdj.exe 38 PID 2332 wrote to memory of 2628 2332 flxrxff.exe 39 PID 2332 wrote to memory of 2628 2332 flxrxff.exe 39 PID 2332 wrote to memory of 2628 2332 flxrxff.exe 39 PID 2332 wrote to memory of 2628 2332 flxrxff.exe 39 PID 2628 wrote to memory of 580 2628 3nbhnt.exe 40 PID 2628 wrote to memory of 580 2628 3nbhnt.exe 40 PID 2628 wrote to memory of 580 2628 3nbhnt.exe 40 PID 2628 wrote to memory of 580 2628 3nbhnt.exe 40 PID 580 wrote to memory of 1420 580 jdpvd.exe 41 PID 580 wrote to memory of 1420 580 jdpvd.exe 41 PID 580 wrote to memory of 1420 580 jdpvd.exe 41 PID 580 wrote to memory of 1420 580 jdpvd.exe 41 PID 1420 wrote to memory of 840 1420 5bbhtb.exe 42 PID 1420 wrote to memory of 840 1420 5bbhtb.exe 42 PID 1420 wrote to memory of 840 1420 5bbhtb.exe 42 PID 1420 wrote to memory of 840 1420 5bbhtb.exe 42 PID 840 wrote to memory of 908 840 nhhhtb.exe 43 PID 840 wrote to memory of 908 840 nhhhtb.exe 43 PID 840 wrote to memory of 908 840 nhhhtb.exe 43 PID 840 wrote to memory of 908 840 nhhhtb.exe 43 PID 908 wrote to memory of 2076 908 rrffxff.exe 44 PID 908 wrote to memory of 2076 908 rrffxff.exe 44 PID 908 wrote to memory of 2076 908 rrffxff.exe 44 PID 908 wrote to memory of 2076 908 rrffxff.exe 44 PID 2076 wrote to memory of 692 2076 nnhbtt.exe 45 PID 2076 wrote to memory of 692 2076 nnhbtt.exe 45 PID 2076 wrote to memory of 692 2076 nnhbtt.exe 45 PID 2076 wrote to memory of 692 2076 nnhbtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe"C:\Users\Admin\AppData\Local\Temp\0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ntbhth.exec:\ntbhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7xrxxfx.exec:\7xrxxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bnbbnt.exec:\bnbbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rrxxllf.exec:\rrxxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tnbhth.exec:\tnbhth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\7pjjp.exec:\7pjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\7lxxxxf.exec:\7lxxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\djvdj.exec:\djvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\flxrxff.exec:\flxrxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\3nbhnt.exec:\3nbhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jdpvd.exec:\jdpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\5bbhtb.exec:\5bbhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\nhhhtb.exec:\nhhhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\rrffxff.exec:\rrffxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\nnhbtt.exec:\nnhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\9jdpv.exec:\9jdpv.exe17⤵
- Executes dropped EXE
PID:692 -
\??\c:\rlxxffl.exec:\rlxxffl.exe18⤵
- Executes dropped EXE
PID:2292 -
\??\c:\5jjpv.exec:\5jjpv.exe19⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3pdvd.exec:\3pdvd.exe20⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tbtnhh.exec:\tbtnhh.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jvvvj.exec:\jvvvj.exe22⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3rflrxl.exec:\3rflrxl.exe23⤵
- Executes dropped EXE
PID:956 -
\??\c:\bbhnnh.exec:\bbhnnh.exe24⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pjddj.exec:\pjddj.exe25⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xfxlxxl.exec:\xfxlxxl.exe26⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1dpjj.exec:\1dpjj.exe27⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pjvvd.exec:\pjvvd.exe29⤵
- Executes dropped EXE
PID:892 -
\??\c:\jvpdd.exec:\jvpdd.exe30⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nnhhhh.exec:\nnhhhh.exe31⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pppvj.exec:\pppvj.exe32⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9llflll.exec:\9llflll.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhnntt.exec:\nhnntt.exe34⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jvjjj.exec:\jvjjj.exe35⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rlxxllx.exec:\rlxxllx.exe36⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe37⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hnbbhh.exec:\hnbbhh.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3dvpv.exec:\3dvpv.exe39⤵
- Executes dropped EXE
PID:1780 -
\??\c:\1jdjj.exec:\1jdjj.exe40⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5xrfffl.exec:\5xrfffl.exe41⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lfffllr.exec:\lfffllr.exe42⤵
- Executes dropped EXE
PID:1588 -
\??\c:\3ttnth.exec:\3ttnth.exe43⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vdpjj.exec:\vdpjj.exe44⤵
- Executes dropped EXE
PID:1948 -
\??\c:\frfxffl.exec:\frfxffl.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lxffffx.exec:\lxffffx.exe46⤵
- Executes dropped EXE
PID:1404 -
\??\c:\5nbhhh.exec:\5nbhhh.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5pdpp.exec:\5pdpp.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jvppd.exec:\jvppd.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1lxfllx.exec:\1lxfllx.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5tbtnb.exec:\5tbtnb.exe51⤵
- Executes dropped EXE
PID:532 -
\??\c:\vdjdd.exec:\vdjdd.exe52⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dvjdd.exec:\dvjdd.exe53⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxrfflr.exec:\fxrfflr.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5thhnh.exec:\5thhnh.exe55⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5nhnnt.exec:\5nhnnt.exe56⤵
- Executes dropped EXE
PID:444 -
\??\c:\vpjpj.exec:\vpjpj.exe57⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7xrlllr.exec:\7xrlllr.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rfxxflx.exec:\rfxxflx.exe59⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hhbbhh.exec:\hhbbhh.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5vppv.exec:\5vppv.exe61⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vjjpv.exec:\vjjpv.exe62⤵
- Executes dropped EXE
PID:1256 -
\??\c:\9rrlxxr.exec:\9rrlxxr.exe63⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbtthn.exec:\hbtthn.exe64⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tnnnnn.exec:\tnnnnn.exe65⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jdvvv.exec:\jdvvv.exe66⤵PID:996
-
\??\c:\frxrrrr.exec:\frxrrrr.exe67⤵PID:1740
-
\??\c:\7nnhnh.exec:\7nnhnh.exe68⤵PID:2452
-
\??\c:\pjddj.exec:\pjddj.exe69⤵PID:2040
-
\??\c:\pjvdj.exec:\pjvdj.exe70⤵PID:2576
-
\??\c:\7xxxlfl.exec:\7xxxlfl.exe71⤵PID:2884
-
\??\c:\htnbnn.exec:\htnbnn.exe72⤵PID:1520
-
\??\c:\dpddj.exec:\dpddj.exe73⤵PID:2604
-
\??\c:\vvjpd.exec:\vvjpd.exe74⤵PID:2592
-
\??\c:\xrlrxxr.exec:\xrlrxxr.exe75⤵PID:2736
-
\??\c:\hbtthh.exec:\hbtthh.exe76⤵PID:2644
-
\??\c:\vjvvd.exec:\vjvvd.exe77⤵PID:2640
-
\??\c:\vvpvj.exec:\vvpvj.exe78⤵PID:2112
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe79⤵
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\3tbttt.exec:\3tbttt.exe80⤵PID:2236
-
\??\c:\btnntb.exec:\btnntb.exe81⤵PID:2912
-
\??\c:\ddjjj.exec:\ddjjj.exe82⤵PID:2664
-
\??\c:\5ffrfxr.exec:\5ffrfxr.exe83⤵PID:812
-
\??\c:\ttnbnt.exec:\ttnbnt.exe84⤵PID:2628
-
\??\c:\1pjpd.exec:\1pjpd.exe85⤵PID:2768
-
\??\c:\5pjpj.exec:\5pjpj.exe86⤵PID:2812
-
\??\c:\flrrrlx.exec:\flrrrlx.exe87⤵PID:2760
-
\??\c:\hhnnth.exec:\hhnnth.exe88⤵PID:804
-
\??\c:\hbhnnt.exec:\hbhnnt.exe89⤵PID:2668
-
\??\c:\jdpvd.exec:\jdpvd.exe90⤵PID:776
-
\??\c:\9lxfllr.exec:\9lxfllr.exe91⤵PID:1232
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe92⤵PID:2076
-
\??\c:\nbntbh.exec:\nbntbh.exe93⤵PID:2008
-
\??\c:\vppvj.exec:\vppvj.exe94⤵PID:2308
-
\??\c:\ffllrxl.exec:\ffllrxl.exe95⤵PID:2028
-
\??\c:\rrrxflf.exec:\rrrxflf.exe96⤵PID:1680
-
\??\c:\nntbnb.exec:\nntbnb.exe97⤵PID:2512
-
\??\c:\ppjvj.exec:\ppjvj.exe98⤵PID:3028
-
\??\c:\1rrxlrf.exec:\1rrxlrf.exe99⤵
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\lfxflrf.exec:\lfxflrf.exe100⤵PID:2536
-
\??\c:\3bntbh.exec:\3bntbh.exe101⤵PID:952
-
\??\c:\jpdvp.exec:\jpdvp.exe102⤵PID:2528
-
\??\c:\dvpdp.exec:\dvpdp.exe103⤵PID:2004
-
\??\c:\9fxxflx.exec:\9fxxflx.exe104⤵PID:1472
-
\??\c:\rlffllr.exec:\rlffllr.exe105⤵PID:2540
-
\??\c:\3htttn.exec:\3htttn.exe106⤵PID:2140
-
\??\c:\pjppd.exec:\pjppd.exe107⤵PID:2320
-
\??\c:\1rlffxf.exec:\1rlffxf.exe108⤵PID:2496
-
\??\c:\xlfllrx.exec:\xlfllrx.exe109⤵PID:2404
-
\??\c:\3htntt.exec:\3htntt.exe110⤵PID:1744
-
\??\c:\vjvpp.exec:\vjvpp.exe111⤵PID:2676
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe112⤵PID:1492
-
\??\c:\bnhbnh.exec:\bnhbnh.exe113⤵PID:2884
-
\??\c:\nhbbhh.exec:\nhbbhh.exe114⤵PID:2820
-
\??\c:\7vddp.exec:\7vddp.exe115⤵PID:2604
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe116⤵PID:2816
-
\??\c:\hnnbtb.exec:\hnnbtb.exe117⤵PID:2736
-
\??\c:\ttbhnt.exec:\ttbhnt.exe118⤵PID:2572
-
\??\c:\dpjvv.exec:\dpjvv.exe119⤵PID:2632
-
\??\c:\1lflfrf.exec:\1lflfrf.exe120⤵PID:1708
-
\??\c:\rrrflrx.exec:\rrrflrx.exe121⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-