Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe
-
Size
332KB
-
MD5
457d0c38bcfda459a43e0336ee95b4cf
-
SHA1
9065d904f68ad5bf21e0a427e94c6684d6e46a34
-
SHA256
bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527
-
SHA512
2484d2419b0023795d14e7e1c99ce4f840e50d5fe1347fc28665ee1b2f90610bf530351dc786d70ad212aaf987cfa4998f6a81065017d14f49fa46db70d5fa57
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhp:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTZ
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2912-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1184-119-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1364-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-225-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-280-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-375-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2124-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-408-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1392-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-435-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-530-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-634-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1760-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-946-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2064-1039-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2672-1138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-1151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2912 dppdv.exe 2988 tntbbb.exe 2916 dpdvd.exe 2704 nhhtbt.exe 2804 jdjpd.exe 2444 vpvdj.exe 2628 nhnbhh.exe 2840 1jpdv.exe 2592 1vvjj.exe 2764 bnhnhh.exe 3012 fxrxffr.exe 1184 tnhntt.exe 2352 9pddd.exe 1336 fxrlxrr.exe 2016 xlrrrrr.exe 1924 9ntbhn.exe 748 xxfxxlf.exe 1364 bthhnn.exe 2664 lfrrfrf.exe 2184 hbhhtn.exe 1856 dvpvd.exe 2572 llrrxrf.exe 1036 tnbbhh.exe 2948 pjdjv.exe 1708 lfxfffl.exe 2288 bthhbt.exe 2064 3rxfllr.exe 2428 thnhhb.exe 2284 djjvp.exe 2936 1lxfxlr.exe 1588 xxxlxfr.exe 3036 5httbh.exe 2968 rrrlflf.exe 2096 btnthh.exe 2740 vvvvd.exe 2704 1djpp.exe 2804 rxfxrrr.exe 2752 xrfrxfl.exe 2904 ttnthn.exe 2776 9dvdv.exe 2768 fxxrfrl.exe 2640 lfrrfrf.exe 3056 bbbnbb.exe 2556 7jvdd.exe 1920 jdpdj.exe 1236 xxrlffl.exe 2124 lfrxffr.exe 1336 hhbbtb.exe 2016 5nhhnt.exe 1392 vpddj.exe 1972 9lrrrrx.exe 1696 xrflllx.exe 748 nnbtht.exe 2052 pjpvp.exe 1364 1ddpv.exe 2488 3rllllf.exe 2308 btnnbh.exe 1948 1hnttb.exe 2380 vpvjv.exe 2572 1vpvp.exe 1036 3rlxfrf.exe 1600 5ntbht.exe 2984 nhnntb.exe 1980 5dpdd.exe -
resource yara_rule behavioral1/memory/2912-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-838-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2804-852-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2760-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-1138-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2024-1151-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2912 2560 bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe 30 PID 2560 wrote to memory of 2912 2560 bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe 30 PID 2560 wrote to memory of 2912 2560 bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe 30 PID 2560 wrote to memory of 2912 2560 bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe 30 PID 2912 wrote to memory of 2988 2912 dppdv.exe 31 PID 2912 wrote to memory of 2988 2912 dppdv.exe 31 PID 2912 wrote to memory of 2988 2912 dppdv.exe 31 PID 2912 wrote to memory of 2988 2912 dppdv.exe 31 PID 2988 wrote to memory of 2916 2988 tntbbb.exe 32 PID 2988 wrote to memory of 2916 2988 tntbbb.exe 32 PID 2988 wrote to memory of 2916 2988 tntbbb.exe 32 PID 2988 wrote to memory of 2916 2988 tntbbb.exe 32 PID 2916 wrote to memory of 2704 2916 dpdvd.exe 33 PID 2916 wrote to memory of 2704 2916 dpdvd.exe 33 PID 2916 wrote to memory of 2704 2916 dpdvd.exe 33 PID 2916 wrote to memory of 2704 2916 dpdvd.exe 33 PID 2704 wrote to memory of 2804 2704 nhhtbt.exe 34 PID 2704 wrote to memory of 2804 2704 nhhtbt.exe 34 PID 2704 wrote to memory of 2804 2704 nhhtbt.exe 34 PID 2704 wrote to memory of 2804 2704 nhhtbt.exe 34 PID 2804 wrote to memory of 2444 2804 jdjpd.exe 35 PID 2804 wrote to memory of 2444 2804 jdjpd.exe 35 PID 2804 wrote to memory of 2444 2804 jdjpd.exe 35 PID 2804 wrote to memory of 2444 2804 jdjpd.exe 35 PID 2444 wrote to memory of 2628 2444 vpvdj.exe 36 PID 2444 wrote to memory of 2628 2444 vpvdj.exe 36 PID 2444 wrote to memory of 2628 2444 vpvdj.exe 36 PID 2444 wrote to memory of 2628 2444 vpvdj.exe 36 PID 2628 wrote to memory of 2840 2628 nhnbhh.exe 37 PID 2628 wrote to memory of 2840 2628 nhnbhh.exe 37 PID 2628 wrote to memory of 2840 2628 nhnbhh.exe 37 PID 2628 wrote to memory of 2840 2628 nhnbhh.exe 37 PID 2840 wrote to memory of 2592 2840 1jpdv.exe 38 PID 2840 wrote to memory of 2592 2840 1jpdv.exe 38 PID 2840 wrote to memory of 2592 2840 1jpdv.exe 38 PID 2840 wrote to memory of 2592 2840 1jpdv.exe 38 PID 2592 wrote to memory of 2764 2592 1vvjj.exe 39 PID 2592 wrote to memory of 2764 2592 1vvjj.exe 39 PID 2592 wrote to memory of 2764 2592 1vvjj.exe 39 PID 2592 wrote to memory of 2764 2592 1vvjj.exe 39 PID 2764 wrote to memory of 3012 2764 bnhnhh.exe 40 PID 2764 wrote to memory of 3012 2764 bnhnhh.exe 40 PID 2764 wrote to memory of 3012 2764 bnhnhh.exe 40 PID 2764 wrote to memory of 3012 2764 bnhnhh.exe 40 PID 3012 wrote to memory of 1184 3012 fxrxffr.exe 41 PID 3012 wrote to memory of 1184 3012 fxrxffr.exe 41 PID 3012 wrote to memory of 1184 3012 fxrxffr.exe 41 PID 3012 wrote to memory of 1184 3012 fxrxffr.exe 41 PID 1184 wrote to memory of 2352 1184 tnhntt.exe 42 PID 1184 wrote to memory of 2352 1184 tnhntt.exe 42 PID 1184 wrote to memory of 2352 1184 tnhntt.exe 42 PID 1184 wrote to memory of 2352 1184 tnhntt.exe 42 PID 2352 wrote to memory of 1336 2352 9pddd.exe 43 PID 2352 wrote to memory of 1336 2352 9pddd.exe 43 PID 2352 wrote to memory of 1336 2352 9pddd.exe 43 PID 2352 wrote to memory of 1336 2352 9pddd.exe 43 PID 1336 wrote to memory of 2016 1336 fxrlxrr.exe 44 PID 1336 wrote to memory of 2016 1336 fxrlxrr.exe 44 PID 1336 wrote to memory of 2016 1336 fxrlxrr.exe 44 PID 1336 wrote to memory of 2016 1336 fxrlxrr.exe 44 PID 2016 wrote to memory of 1924 2016 xlrrrrr.exe 45 PID 2016 wrote to memory of 1924 2016 xlrrrrr.exe 45 PID 2016 wrote to memory of 1924 2016 xlrrrrr.exe 45 PID 2016 wrote to memory of 1924 2016 xlrrrrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe"C:\Users\Admin\AppData\Local\Temp\bfec8c9f7db1d90a0bc59b96e065a2acd56732c1256145d08bcdc689950d1527.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\dppdv.exec:\dppdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\tntbbb.exec:\tntbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dpdvd.exec:\dpdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\nhhtbt.exec:\nhhtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jdjpd.exec:\jdjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vpvdj.exec:\vpvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\nhnbhh.exec:\nhnbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\1jpdv.exec:\1jpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1vvjj.exec:\1vvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bnhnhh.exec:\bnhnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fxrxffr.exec:\fxrxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\tnhntt.exec:\tnhntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\9pddd.exec:\9pddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\fxrlxrr.exec:\fxrlxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\9ntbhn.exec:\9ntbhn.exe17⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xxfxxlf.exec:\xxfxxlf.exe18⤵
- Executes dropped EXE
PID:748 -
\??\c:\bthhnn.exec:\bthhnn.exe19⤵
- Executes dropped EXE
PID:1364 -
\??\c:\lfrrfrf.exec:\lfrrfrf.exe20⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbhhtn.exec:\hbhhtn.exe21⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvpvd.exec:\dvpvd.exe22⤵
- Executes dropped EXE
PID:1856 -
\??\c:\llrrxrf.exec:\llrrxrf.exe23⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tnbbhh.exec:\tnbbhh.exe24⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjdjv.exec:\pjdjv.exe25⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lfxfffl.exec:\lfxfffl.exe26⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bthhbt.exec:\bthhbt.exe27⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3rxfllr.exec:\3rxfllr.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\thnhhb.exec:\thnhhb.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\djjvp.exec:\djjvp.exe30⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1lxfxlr.exec:\1lxfxlr.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xxxlxfr.exec:\xxxlxfr.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5httbh.exec:\5httbh.exe33⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rrrlflf.exec:\rrrlflf.exe34⤵
- Executes dropped EXE
PID:2968 -
\??\c:\btnthh.exec:\btnthh.exe35⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vvvvd.exec:\vvvvd.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1djpp.exec:\1djpp.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ttnthn.exec:\ttnthn.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9dvdv.exec:\9dvdv.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxxrfrl.exec:\fxxrfrl.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lfrrfrf.exec:\lfrrfrf.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bbbnbb.exec:\bbbnbb.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7jvdd.exec:\7jvdd.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdpdj.exec:\jdpdj.exe46⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xxrlffl.exec:\xxrlffl.exe47⤵
- Executes dropped EXE
PID:1236 -
\??\c:\lfrxffr.exec:\lfrxffr.exe48⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hhbbtb.exec:\hhbbtb.exe49⤵
- Executes dropped EXE
PID:1336 -
\??\c:\5nhhnt.exec:\5nhhnt.exe50⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vpddj.exec:\vpddj.exe51⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9lrrrrx.exec:\9lrrrrx.exe52⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xrflllx.exec:\xrflllx.exe53⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nnbtht.exec:\nnbtht.exe54⤵
- Executes dropped EXE
PID:748 -
\??\c:\pjpvp.exec:\pjpvp.exe55⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1ddpv.exec:\1ddpv.exe56⤵
- Executes dropped EXE
PID:1364 -
\??\c:\3rllllf.exec:\3rllllf.exe57⤵
- Executes dropped EXE
PID:2488 -
\??\c:\btnnbh.exec:\btnnbh.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1hnttb.exec:\1hnttb.exe59⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpvjv.exec:\vpvjv.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1vpvp.exec:\1vpvp.exe61⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3rlxfrf.exec:\3rlxfrf.exe62⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5ntbht.exec:\5ntbht.exe63⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nhnntb.exec:\nhnntb.exe64⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5dpdd.exec:\5dpdd.exe65⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lfrrfrx.exec:\lfrrfrx.exe66⤵PID:2056
-
\??\c:\rlxrxlr.exec:\rlxrxlr.exe67⤵PID:2064
-
\??\c:\ntntbh.exec:\ntntbh.exe68⤵PID:1716
-
\??\c:\1hbtht.exec:\1hbtht.exe69⤵PID:2384
-
\??\c:\5vpdj.exec:\5vpdj.exe70⤵PID:2676
-
\??\c:\lfxfxrf.exec:\lfxfxrf.exe71⤵PID:1580
-
\??\c:\lfxxxlx.exec:\lfxxxlx.exe72⤵PID:3048
-
\??\c:\nbnbhb.exec:\nbnbhb.exe73⤵PID:2144
-
\??\c:\btnttn.exec:\btnttn.exe74⤵PID:2224
-
\??\c:\9vvdd.exec:\9vvdd.exe75⤵PID:2968
-
\??\c:\dvpvd.exec:\dvpvd.exe76⤵PID:2264
-
\??\c:\9rllxfl.exec:\9rllxfl.exe77⤵PID:2348
-
\??\c:\nhtthn.exec:\nhtthn.exe78⤵PID:2836
-
\??\c:\thbhhh.exec:\thbhhh.exe79⤵PID:2756
-
\??\c:\5vpvp.exec:\5vpvp.exe80⤵PID:2160
-
\??\c:\jjdjd.exec:\jjdjd.exe81⤵PID:2820
-
\??\c:\1ffxfrl.exec:\1ffxfrl.exe82⤵PID:2648
-
\??\c:\xrffrxl.exec:\xrffrxl.exe83⤵PID:2592
-
\??\c:\1nhhnt.exec:\1nhhnt.exe84⤵PID:2620
-
\??\c:\vvjjv.exec:\vvjjv.exe85⤵PID:2624
-
\??\c:\rfrllff.exec:\rfrllff.exe86⤵PID:1376
-
\??\c:\7rxxffl.exec:\7rxxffl.exe87⤵PID:1760
-
\??\c:\thtntt.exec:\thtntt.exe88⤵PID:1184
-
\??\c:\vdjdp.exec:\vdjdp.exe89⤵PID:1776
-
\??\c:\pdvvj.exec:\pdvvj.exe90⤵PID:1452
-
\??\c:\9xlflff.exec:\9xlflff.exe91⤵PID:1560
-
\??\c:\fxffrxf.exec:\fxffrxf.exe92⤵PID:2364
-
\??\c:\nbnntn.exec:\nbnntn.exe93⤵PID:1232
-
\??\c:\9jjjp.exec:\9jjjp.exe94⤵PID:1688
-
\??\c:\pjdjp.exec:\pjdjp.exe95⤵PID:744
-
\??\c:\xxfflfr.exec:\xxfflfr.exe96⤵PID:2888
-
\??\c:\hhtbbb.exec:\hhtbbb.exe97⤵PID:2168
-
\??\c:\hnhbbb.exec:\hnhbbb.exe98⤵PID:2076
-
\??\c:\vvjjv.exec:\vvjjv.exe99⤵PID:2184
-
\??\c:\7pjpv.exec:\7pjpv.exe100⤵PID:800
-
\??\c:\1llrrrx.exec:\1llrrrx.exe101⤵PID:1128
-
\??\c:\fllxrxl.exec:\fllxrxl.exe102⤵PID:1072
-
\??\c:\bbnntt.exec:\bbnntt.exe103⤵PID:1084
-
\??\c:\jdvvp.exec:\jdvvp.exe104⤵PID:1308
-
\??\c:\1pdjv.exec:\1pdjv.exe105⤵PID:2272
-
\??\c:\rllxlfx.exec:\rllxlfx.exe106⤵PID:588
-
\??\c:\tntttn.exec:\tntttn.exe107⤵PID:2152
-
\??\c:\thtbnn.exec:\thtbnn.exe108⤵PID:1864
-
\??\c:\pjvvd.exec:\pjvvd.exe109⤵PID:1792
-
\??\c:\pjjjv.exec:\pjjjv.exe110⤵PID:2480
-
\??\c:\lrrlxfr.exec:\lrrlxfr.exe111⤵PID:2936
-
\??\c:\bbtbhh.exec:\bbtbhh.exe112⤵PID:2992
-
\??\c:\thnthh.exec:\thnthh.exe113⤵PID:2920
-
\??\c:\jvpvv.exec:\jvpvv.exe114⤵PID:2988
-
\??\c:\xrllrrf.exec:\xrllrrf.exe115⤵PID:2980
-
\??\c:\tnthth.exec:\tnthth.exe116⤵PID:304
-
\??\c:\hthhtt.exec:\hthhtt.exe117⤵PID:2832
-
\??\c:\5pdpd.exec:\5pdpd.exe118⤵PID:2812
-
\??\c:\vpvdj.exec:\vpvdj.exe119⤵PID:2804
-
\??\c:\lflrxfl.exec:\lflrxfl.exe120⤵PID:2756
-
\??\c:\bnbnhh.exec:\bnbnhh.exe121⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-