Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 06:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe
-
Size
455KB
-
MD5
03ea91904e473929c7743d63eb64520b
-
SHA1
df9bdb8e0683ee1d9f4eee6050889b8f28acfa87
-
SHA256
d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b
-
SHA512
ce0a63308ee51106587ffd92d94a54030c79f40b7e137019cf83a2ed479746e2a35a3478a01efb95a066ce45e734ce4aa250eaa6f677fbe9678a4fb8288f6c97
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2156-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-70-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-292-0x0000000076D20000-0x0000000076E3F000-memory.dmp family_blackmoon behavioral1/memory/1844-293-0x0000000076E40000-0x0000000076F3A000-memory.dmp family_blackmoon behavioral1/memory/2692-296-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-633-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2952-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-832-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1844-836-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1844-835-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-975-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2132-1013-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-1322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 nnbhnb.exe 2980 vjvdp.exe 1924 9lfxxfl.exe 2588 pjjvd.exe 2824 xrrxllr.exe 2572 hhbhbh.exe 3060 hbtnbh.exe 620 9vpjv.exe 2656 pvpdv.exe 2260 nnttnn.exe 2436 jdvjj.exe 1380 xfrlxxl.exe 2664 nnbhbb.exe 1740 ddddj.exe 1052 nnnhhn.exe 3048 jppjp.exe 1480 ttnthn.exe 1532 7pppj.exe 2504 bbbnhn.exe 2152 1jjpp.exe 2364 7nbhnb.exe 1768 pjvjd.exe 2996 hbnbnt.exe 1520 rlxlffl.exe 1772 nnhbtt.exe 1588 flfrlrx.exe 2464 ttthnb.exe 3040 llflllf.exe 884 xxrxrxf.exe 2452 ppjvd.exe 1748 lfxxxfl.exe 1844 dvppd.exe 2816 ddvdv.exe 2568 fxlxrxf.exe 2964 hbtnbb.exe 2952 vvppj.exe 2616 3fxfrlr.exe 2564 lfxflxx.exe 2228 bnhnhh.exe 2556 5ppvp.exe 776 rllflrf.exe 620 hbtbbh.exe 2184 3hbbnt.exe 2012 pvjvv.exe 2808 xrxffrx.exe 2992 7nbnbn.exe 2448 9jvjv.exe 1284 jjddd.exe 2804 lfxfffr.exe 1364 1ntthh.exe 2192 vvpvp.exe 1052 1lllrxf.exe 1132 ttnhth.exe 1500 7bntnt.exe 1128 pjvpp.exe 1712 llxfrrx.exe 2380 rrxfrxr.exe 2220 1tnttb.exe 2376 pjddj.exe 2356 9jvpv.exe 560 ffxfxxf.exe 2416 9ntnbn.exe 2996 jpjvj.exe 1520 3rrxxxl.exe -
resource yara_rule behavioral1/memory/2156-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-145-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1480-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-832-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2824-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-1138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-1309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-1322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-1362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-1375-0x00000000005C0000-0x00000000005EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2692 2156 d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe 30 PID 2156 wrote to memory of 2692 2156 d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe 30 PID 2156 wrote to memory of 2692 2156 d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe 30 PID 2156 wrote to memory of 2692 2156 d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe 30 PID 2692 wrote to memory of 2980 2692 nnbhnb.exe 31 PID 2692 wrote to memory of 2980 2692 nnbhnb.exe 31 PID 2692 wrote to memory of 2980 2692 nnbhnb.exe 31 PID 2692 wrote to memory of 2980 2692 nnbhnb.exe 31 PID 2980 wrote to memory of 1924 2980 vjvdp.exe 32 PID 2980 wrote to memory of 1924 2980 vjvdp.exe 32 PID 2980 wrote to memory of 1924 2980 vjvdp.exe 32 PID 2980 wrote to memory of 1924 2980 vjvdp.exe 32 PID 1924 wrote to memory of 2588 1924 9lfxxfl.exe 33 PID 1924 wrote to memory of 2588 1924 9lfxxfl.exe 33 PID 1924 wrote to memory of 2588 1924 9lfxxfl.exe 33 PID 1924 wrote to memory of 2588 1924 9lfxxfl.exe 33 PID 2588 wrote to memory of 2824 2588 pjjvd.exe 34 PID 2588 wrote to memory of 2824 2588 pjjvd.exe 34 PID 2588 wrote to memory of 2824 2588 pjjvd.exe 34 PID 2588 wrote to memory of 2824 2588 pjjvd.exe 34 PID 2824 wrote to memory of 2572 2824 xrrxllr.exe 35 PID 2824 wrote to memory of 2572 2824 xrrxllr.exe 35 PID 2824 wrote to memory of 2572 2824 xrrxllr.exe 35 PID 2824 wrote to memory of 2572 2824 xrrxllr.exe 35 PID 2572 wrote to memory of 3060 2572 hhbhbh.exe 36 PID 2572 wrote to memory of 3060 2572 hhbhbh.exe 36 PID 2572 wrote to memory of 3060 2572 hhbhbh.exe 36 PID 2572 wrote to memory of 3060 2572 hhbhbh.exe 36 PID 3060 wrote to memory of 620 3060 hbtnbh.exe 37 PID 3060 wrote to memory of 620 3060 hbtnbh.exe 37 PID 3060 wrote to memory of 620 3060 hbtnbh.exe 37 PID 3060 wrote to memory of 620 3060 hbtnbh.exe 37 PID 620 wrote to memory of 2656 620 9vpjv.exe 38 PID 620 wrote to memory of 2656 620 9vpjv.exe 38 PID 620 wrote to memory of 2656 620 9vpjv.exe 38 PID 620 wrote to memory of 2656 620 9vpjv.exe 38 PID 2656 wrote to memory of 2260 2656 pvpdv.exe 39 PID 2656 wrote to memory of 2260 2656 pvpdv.exe 39 PID 2656 wrote to memory of 2260 2656 pvpdv.exe 39 PID 2656 wrote to memory of 2260 2656 pvpdv.exe 39 PID 2260 wrote to memory of 2436 2260 nnttnn.exe 40 PID 2260 wrote to memory of 2436 2260 nnttnn.exe 40 PID 2260 wrote to memory of 2436 2260 nnttnn.exe 40 PID 2260 wrote to memory of 2436 2260 nnttnn.exe 40 PID 2436 wrote to memory of 1380 2436 jdvjj.exe 41 PID 2436 wrote to memory of 1380 2436 jdvjj.exe 41 PID 2436 wrote to memory of 1380 2436 jdvjj.exe 41 PID 2436 wrote to memory of 1380 2436 jdvjj.exe 41 PID 1380 wrote to memory of 2664 1380 xfrlxxl.exe 42 PID 1380 wrote to memory of 2664 1380 xfrlxxl.exe 42 PID 1380 wrote to memory of 2664 1380 xfrlxxl.exe 42 PID 1380 wrote to memory of 2664 1380 xfrlxxl.exe 42 PID 2664 wrote to memory of 1740 2664 nnbhbb.exe 43 PID 2664 wrote to memory of 1740 2664 nnbhbb.exe 43 PID 2664 wrote to memory of 1740 2664 nnbhbb.exe 43 PID 2664 wrote to memory of 1740 2664 nnbhbb.exe 43 PID 1740 wrote to memory of 1052 1740 ddddj.exe 44 PID 1740 wrote to memory of 1052 1740 ddddj.exe 44 PID 1740 wrote to memory of 1052 1740 ddddj.exe 44 PID 1740 wrote to memory of 1052 1740 ddddj.exe 44 PID 1052 wrote to memory of 3048 1052 nnnhhn.exe 45 PID 1052 wrote to memory of 3048 1052 nnnhhn.exe 45 PID 1052 wrote to memory of 3048 1052 nnnhhn.exe 45 PID 1052 wrote to memory of 3048 1052 nnnhhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe"C:\Users\Admin\AppData\Local\Temp\d15b7cd78e3307f1b65754a04dc23530114f80d5f7c7d59aa96afa440251a60b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\nnbhnb.exec:\nnbhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vjvdp.exec:\vjvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\9lfxxfl.exec:\9lfxxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\pjjvd.exec:\pjjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xrrxllr.exec:\xrrxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hhbhbh.exec:\hhbhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hbtnbh.exec:\hbtnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\9vpjv.exec:\9vpjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\pvpdv.exec:\pvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\nnttnn.exec:\nnttnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\jdvjj.exec:\jdvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\xfrlxxl.exec:\xfrlxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\nnbhbb.exec:\nnbhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ddddj.exec:\ddddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\nnnhhn.exec:\nnnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jppjp.exec:\jppjp.exe17⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ttnthn.exec:\ttnthn.exe18⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7pppj.exec:\7pppj.exe19⤵
- Executes dropped EXE
PID:1532 -
\??\c:\bbbnhn.exec:\bbbnhn.exe20⤵
- Executes dropped EXE
PID:2504 -
\??\c:\1jjpp.exec:\1jjpp.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7nbhnb.exec:\7nbhnb.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pjvjd.exec:\pjvjd.exe23⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hbnbnt.exec:\hbnbnt.exe24⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rlxlffl.exec:\rlxlffl.exe25⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nnhbtt.exec:\nnhbtt.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\flfrlrx.exec:\flfrlrx.exe27⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ttthnb.exec:\ttthnb.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\llflllf.exec:\llflllf.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xxrxrxf.exec:\xxrxrxf.exe30⤵
- Executes dropped EXE
PID:884 -
\??\c:\ppjvd.exec:\ppjvd.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\lfxxxfl.exec:\lfxxxfl.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvppd.exec:\dvppd.exe33⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vdvjd.exec:\vdvjd.exe34⤵PID:2692
-
\??\c:\ddvdv.exec:\ddvdv.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxlxrxf.exec:\fxlxrxf.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbtnbb.exec:\hbtnbb.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vvppj.exec:\vvppj.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3fxfrlr.exec:\3fxfrlr.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lfxflxx.exec:\lfxflxx.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bnhnhh.exec:\bnhnhh.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5ppvp.exec:\5ppvp.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rllflrf.exec:\rllflrf.exe43⤵
- Executes dropped EXE
PID:776 -
\??\c:\hbtbbh.exec:\hbtbbh.exe44⤵
- Executes dropped EXE
PID:620 -
\??\c:\3hbbnt.exec:\3hbbnt.exe45⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pvjvv.exec:\pvjvv.exe46⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xrxffrx.exec:\xrxffrx.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7nbnbn.exec:\7nbnbn.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9jvjv.exec:\9jvjv.exe49⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jjddd.exec:\jjddd.exe50⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lfxfffr.exec:\lfxfffr.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1ntthh.exec:\1ntthh.exe52⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vvpvp.exec:\vvpvp.exe53⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1lllrxf.exec:\1lllrxf.exe54⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ttnhth.exec:\ttnhth.exe55⤵
- Executes dropped EXE
PID:1132 -
\??\c:\7bntnt.exec:\7bntnt.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\pjvpp.exec:\pjvpp.exe57⤵
- Executes dropped EXE
PID:1128 -
\??\c:\llxfrrx.exec:\llxfrrx.exe58⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rrxfrxr.exec:\rrxfrxr.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1tnttb.exec:\1tnttb.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pjddj.exec:\pjddj.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9jvpv.exec:\9jvpv.exe62⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ffxfxxf.exec:\ffxfxxf.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\9ntnbn.exec:\9ntnbn.exe64⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jpjvj.exec:\jpjvj.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3rrxxxl.exec:\3rrxxxl.exe66⤵
- Executes dropped EXE
PID:1520 -
\??\c:\btnthn.exec:\btnthn.exe67⤵PID:1692
-
\??\c:\5vppd.exec:\5vppd.exe68⤵PID:464
-
\??\c:\jdddp.exec:\jdddp.exe69⤵PID:2456
-
\??\c:\5lllfxl.exec:\5lllfxl.exe70⤵PID:3012
-
\??\c:\3nnnbh.exec:\3nnnbh.exe71⤵PID:3004
-
\??\c:\1pjvj.exec:\1pjvj.exe72⤵PID:2344
-
\??\c:\rlfrffr.exec:\rlfrffr.exe73⤵PID:344
-
\??\c:\rrfrfrx.exec:\rrfrfrx.exe74⤵PID:2128
-
\??\c:\hbtntb.exec:\hbtntb.exe75⤵PID:1596
-
\??\c:\ddjpj.exec:\ddjpj.exe76⤵PID:2712
-
\??\c:\xfrlfxf.exec:\xfrlfxf.exe77⤵PID:1932
-
\??\c:\bbtntb.exec:\bbtntb.exe78⤵PID:2780
-
\??\c:\bhtttn.exec:\bhtttn.exe79⤵PID:2840
-
\??\c:\7pjjd.exec:\7pjjd.exe80⤵PID:2568
-
\??\c:\3xlrrrx.exec:\3xlrrrx.exe81⤵PID:2688
-
\??\c:\nnbbtt.exec:\nnbbtt.exe82⤵PID:2952
-
\??\c:\pvvdv.exec:\pvvdv.exe83⤵PID:2828
-
\??\c:\9pddp.exec:\9pddp.exe84⤵PID:3064
-
\??\c:\hhtbnb.exec:\hhtbnb.exe85⤵PID:2604
-
\??\c:\3bnttb.exec:\3bnttb.exe86⤵PID:1484
-
\??\c:\pdvdj.exec:\pdvdj.exe87⤵PID:2432
-
\??\c:\rfxfxfl.exec:\rfxfxfl.exe88⤵PID:2184
-
\??\c:\nthnbt.exec:\nthnbt.exe89⤵PID:648
-
\??\c:\jdvjj.exec:\jdvjj.exe90⤵PID:2860
-
\??\c:\5pjjv.exec:\5pjjv.exe91⤵PID:1380
-
\??\c:\9xxlflf.exec:\9xxlflf.exe92⤵PID:2448
-
\??\c:\thttbh.exec:\thttbh.exe93⤵PID:704
-
\??\c:\hbtbbh.exec:\hbtbbh.exe94⤵PID:2664
-
\??\c:\vvpjp.exec:\vvpjp.exe95⤵PID:2620
-
\??\c:\xxxrlrx.exec:\xxxrlrx.exe96⤵PID:1040
-
\??\c:\bbnbth.exec:\bbnbth.exe97⤵PID:1052
-
\??\c:\ddvdd.exec:\ddvdd.exe98⤵PID:2040
-
\??\c:\jvjpp.exec:\jvjpp.exe99⤵PID:2372
-
\??\c:\rlllxff.exec:\rlllxff.exe100⤵PID:1128
-
\??\c:\5bthtb.exec:\5bthtb.exe101⤵PID:1796
-
\??\c:\ttnttt.exec:\ttnttt.exe102⤵PID:2380
-
\??\c:\9vjjp.exec:\9vjjp.exe103⤵PID:1960
-
\??\c:\lfxxrlx.exec:\lfxxrlx.exe104⤵PID:964
-
\??\c:\thtnhh.exec:\thtnhh.exe105⤵PID:2356
-
\??\c:\9nbnbb.exec:\9nbnbb.exe106⤵PID:1836
-
\??\c:\7vdjj.exec:\7vdjj.exe107⤵PID:2416
-
\??\c:\lxrxlfl.exec:\lxrxlfl.exe108⤵PID:2036
-
\??\c:\lfrlfff.exec:\lfrlfff.exe109⤵PID:1520
-
\??\c:\1tttbb.exec:\1tttbb.exe110⤵PID:2480
-
\??\c:\jdpvd.exec:\jdpvd.exe111⤵PID:2324
-
\??\c:\nhthnn.exec:\nhthnn.exe112⤵PID:2464
-
\??\c:\jjvdv.exec:\jjvdv.exe113⤵PID:1240
-
\??\c:\xlxxllx.exec:\xlxxllx.exe114⤵PID:2284
-
\??\c:\frlrflx.exec:\frlrflx.exe115⤵PID:2344
-
\??\c:\1httbh.exec:\1httbh.exe116⤵PID:2264
-
\??\c:\vpdvj.exec:\vpdvj.exe117⤵PID:2128
-
\??\c:\jdppd.exec:\jdppd.exe118⤵PID:1844
-
\??\c:\xrxxlfl.exec:\xrxxlfl.exe119⤵PID:2716
-
\??\c:\7thnth.exec:\7thnth.exe120⤵PID:2468
-
\??\c:\vppvd.exec:\vppvd.exe121⤵PID:1904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-