Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe
-
Size
537KB
-
MD5
0749445988759d8b3693298fd02fab91
-
SHA1
1ab7795ed9c6fdd0c470257a35b23aab62642ce7
-
SHA256
370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873
-
SHA512
dbbe0178b1a2b6bfad93fccacfa245766258f553f92569e4f377db55c4a663d09fc07cfc011399b326569b504f94d330e21ad442ae61705130f9a818406b91f5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwT+aZKl7pIBT9HyLeyiPDm28fAe:q7Tc2NYHUrAwT+OKLmTCjiPK2de
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/1580-12-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2216-8-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2216-7-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2160-32-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2340-29-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1580-19-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2160-39-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/560-49-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2844-58-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2600-67-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2708-70-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2708-78-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2620-89-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/648-102-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2592-99-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/648-109-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1352-140-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1844-136-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1352-146-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1352-145-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1844-130-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1228-127-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2836-156-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1560-164-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2932-183-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2932-182-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2468-193-0x00000000004D0000-0x0000000000594000-memory.dmp family_blackmoon behavioral1/memory/2088-196-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2468-192-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2804-205-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2088-203-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1128-214-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/548-223-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1788-227-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/548-224-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1872-235-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/760-246-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1872-243-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/536-255-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/536-262-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1184-265-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2164-283-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/576-281-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/576-279-0x0000000001CF0000-0x0000000001DB4000-memory.dmp family_blackmoon behavioral1/memory/2164-291-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1976-300-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2972-311-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2972-319-0x00000000002B0000-0x0000000000374000-memory.dmp family_blackmoon behavioral1/memory/2972-318-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1524-329-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1580-328-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1524-336-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2332-343-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2332-350-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2748-357-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2732-370-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2628-377-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2728-384-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/376-408-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2800-420-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2500-450-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/624-462-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1992-468-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2688-474-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1580 pjvjv.exe 2340 flrfrrl.exe 2160 9btthn.exe 560 thbbnn.exe 2844 httttb.exe 2600 5pddp.exe 2708 rlxfrfx.exe 2620 nhhnnn.exe 2592 bbhnht.exe 648 vpjvj.exe 1912 xrllffx.exe 1228 bbhbtt.exe 1844 hhthtb.exe 1352 pjpvp.exe 2836 ffrrflx.exe 1560 9hbhbn.exe 2804 3pvjv.exe 2932 vvvjv.exe 2468 ffffxlx.exe 2088 9bhnbn.exe 1128 bbntht.exe 548 rllrrfr.exe 1788 9btbth.exe 1872 vpjpd.exe 760 xxrfxxl.exe 536 ffxlrff.exe 1184 nttttn.exe 576 tbbbtb.exe 2164 5bnhnn.exe 1976 3nbhth.exe 2548 pdvvv.exe 2972 1dvjv.exe 1580 fxflfll.exe 1524 5vjpj.exe 2188 ffxfrxl.exe 2332 1btbbt.exe 2908 vvvdd.exe 2748 hnbtth.exe 2732 pjpvp.exe 2628 rrffrfr.exe 2940 7lrlrll.exe 2728 vvpvj.exe 2704 jjddp.exe 2640 lffrllf.exe 376 1ttnbt.exe 2812 5pppp.exe 2800 dvpvj.exe 2824 xrlxrxf.exe 2504 hbthtn.exe 1456 nnhnht.exe 1512 5jjpp.exe 2500 llfrrlr.exe 2692 lxrfrfr.exe 624 jpdvv.exe 1992 jdvjd.exe 2688 hbnbtb.exe 2932 9nnbtb.exe 2280 jdvdj.exe 1836 rlrfrrf.exe 276 nnntht.exe 1180 dvpdp.exe 1316 xfrfrrf.exe 2248 tbhtnt.exe 840 xxllfrx.exe -
resource yara_rule behavioral1/memory/1580-12-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2216-8-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2340-22-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2160-32-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2340-29-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1580-19-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2160-39-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/560-49-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2844-58-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2600-67-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2708-70-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2620-80-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2708-78-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2592-90-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2620-89-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/648-102-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2592-99-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/648-109-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1352-140-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1352-146-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1844-130-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1228-127-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2836-156-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1560-164-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2932-176-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2932-183-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2468-193-0x00000000004D0000-0x0000000000594000-memory.dmp upx behavioral1/memory/2088-196-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2468-192-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2804-205-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2088-203-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/548-217-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1128-214-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1788-227-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/548-224-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1872-235-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/760-246-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1872-243-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/536-255-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/536-262-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1184-265-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/576-281-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/576-279-0x0000000001CF0000-0x0000000001DB4000-memory.dmp upx behavioral1/memory/2164-291-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1976-300-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2972-311-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1580-320-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2972-319-0x00000000002B0000-0x0000000000374000-memory.dmp upx behavioral1/memory/2972-318-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1524-329-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1580-328-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1524-336-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2332-350-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2748-357-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2732-370-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2628-377-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2728-384-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/376-408-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2800-420-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2500-450-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1992-468-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2248-516-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2804-2371-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1580 2216 370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe 30 PID 2216 wrote to memory of 1580 2216 370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe 30 PID 2216 wrote to memory of 1580 2216 370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe 30 PID 2216 wrote to memory of 1580 2216 370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe 30 PID 1580 wrote to memory of 2340 1580 pjvjv.exe 31 PID 1580 wrote to memory of 2340 1580 pjvjv.exe 31 PID 1580 wrote to memory of 2340 1580 pjvjv.exe 31 PID 1580 wrote to memory of 2340 1580 pjvjv.exe 31 PID 2340 wrote to memory of 2160 2340 flrfrrl.exe 32 PID 2340 wrote to memory of 2160 2340 flrfrrl.exe 32 PID 2340 wrote to memory of 2160 2340 flrfrrl.exe 32 PID 2340 wrote to memory of 2160 2340 flrfrrl.exe 32 PID 2160 wrote to memory of 560 2160 9btthn.exe 33 PID 2160 wrote to memory of 560 2160 9btthn.exe 33 PID 2160 wrote to memory of 560 2160 9btthn.exe 33 PID 2160 wrote to memory of 560 2160 9btthn.exe 33 PID 560 wrote to memory of 2844 560 thbbnn.exe 34 PID 560 wrote to memory of 2844 560 thbbnn.exe 34 PID 560 wrote to memory of 2844 560 thbbnn.exe 34 PID 560 wrote to memory of 2844 560 thbbnn.exe 34 PID 2844 wrote to memory of 2600 2844 httttb.exe 35 PID 2844 wrote to memory of 2600 2844 httttb.exe 35 PID 2844 wrote to memory of 2600 2844 httttb.exe 35 PID 2844 wrote to memory of 2600 2844 httttb.exe 35 PID 2600 wrote to memory of 2708 2600 5pddp.exe 36 PID 2600 wrote to memory of 2708 2600 5pddp.exe 36 PID 2600 wrote to memory of 2708 2600 5pddp.exe 36 PID 2600 wrote to memory of 2708 2600 5pddp.exe 36 PID 2708 wrote to memory of 2620 2708 rlxfrfx.exe 37 PID 2708 wrote to memory of 2620 2708 rlxfrfx.exe 37 PID 2708 wrote to memory of 2620 2708 rlxfrfx.exe 37 PID 2708 wrote to memory of 2620 2708 rlxfrfx.exe 37 PID 2620 wrote to memory of 2592 2620 nhhnnn.exe 38 PID 2620 wrote to memory of 2592 2620 nhhnnn.exe 38 PID 2620 wrote to memory of 2592 2620 nhhnnn.exe 38 PID 2620 wrote to memory of 2592 2620 nhhnnn.exe 38 PID 2592 wrote to memory of 648 2592 bbhnht.exe 39 PID 2592 wrote to memory of 648 2592 bbhnht.exe 39 PID 2592 wrote to memory of 648 2592 bbhnht.exe 39 PID 2592 wrote to memory of 648 2592 bbhnht.exe 39 PID 648 wrote to memory of 1912 648 vpjvj.exe 40 PID 648 wrote to memory of 1912 648 vpjvj.exe 40 PID 648 wrote to memory of 1912 648 vpjvj.exe 40 PID 648 wrote to memory of 1912 648 vpjvj.exe 40 PID 1912 wrote to memory of 1228 1912 xrllffx.exe 41 PID 1912 wrote to memory of 1228 1912 xrllffx.exe 41 PID 1912 wrote to memory of 1228 1912 xrllffx.exe 41 PID 1912 wrote to memory of 1228 1912 xrllffx.exe 41 PID 1228 wrote to memory of 1844 1228 bbhbtt.exe 42 PID 1228 wrote to memory of 1844 1228 bbhbtt.exe 42 PID 1228 wrote to memory of 1844 1228 bbhbtt.exe 42 PID 1228 wrote to memory of 1844 1228 bbhbtt.exe 42 PID 1844 wrote to memory of 1352 1844 hhthtb.exe 43 PID 1844 wrote to memory of 1352 1844 hhthtb.exe 43 PID 1844 wrote to memory of 1352 1844 hhthtb.exe 43 PID 1844 wrote to memory of 1352 1844 hhthtb.exe 43 PID 1352 wrote to memory of 2836 1352 pjpvp.exe 44 PID 1352 wrote to memory of 2836 1352 pjpvp.exe 44 PID 1352 wrote to memory of 2836 1352 pjpvp.exe 44 PID 1352 wrote to memory of 2836 1352 pjpvp.exe 44 PID 2836 wrote to memory of 1560 2836 ffrrflx.exe 45 PID 2836 wrote to memory of 1560 2836 ffrrflx.exe 45 PID 2836 wrote to memory of 1560 2836 ffrrflx.exe 45 PID 2836 wrote to memory of 1560 2836 ffrrflx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe"C:\Users\Admin\AppData\Local\Temp\370058c4db217e46f1ca1fe35ebe080dddc8dd5ddf19e744c6ed13db217b2873.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\pjvjv.exec:\pjvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\flrfrrl.exec:\flrfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\9btthn.exec:\9btthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\thbbnn.exec:\thbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\httttb.exec:\httttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5pddp.exec:\5pddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rlxfrfx.exec:\rlxfrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\nhhnnn.exec:\nhhnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bbhnht.exec:\bbhnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vpjvj.exec:\vpjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\xrllffx.exec:\xrllffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\bbhbtt.exec:\bbhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\hhthtb.exec:\hhthtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\pjpvp.exec:\pjpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\ffrrflx.exec:\ffrrflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\9hbhbn.exec:\9hbhbn.exe17⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3pvjv.exec:\3pvjv.exe18⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vvvjv.exec:\vvvjv.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ffffxlx.exec:\ffffxlx.exe20⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9bhnbn.exec:\9bhnbn.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bbntht.exec:\bbntht.exe22⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rllrrfr.exec:\rllrrfr.exe23⤵
- Executes dropped EXE
PID:548 -
\??\c:\9btbth.exec:\9btbth.exe24⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vpjpd.exec:\vpjpd.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xxrfxxl.exec:\xxrfxxl.exe26⤵
- Executes dropped EXE
PID:760 -
\??\c:\ffxlrff.exec:\ffxlrff.exe27⤵
- Executes dropped EXE
PID:536 -
\??\c:\nttttn.exec:\nttttn.exe28⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tbbbtb.exec:\tbbbtb.exe29⤵
- Executes dropped EXE
PID:576 -
\??\c:\5bnhnn.exec:\5bnhnn.exe30⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3nbhth.exec:\3nbhth.exe31⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pdvvv.exec:\pdvvv.exe32⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1dvjv.exec:\1dvjv.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fxflfll.exec:\fxflfll.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5vjpj.exec:\5vjpj.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe36⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1btbbt.exec:\1btbbt.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vvvdd.exec:\vvvdd.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hnbtth.exec:\hnbtth.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pjpvp.exec:\pjpvp.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rrffrfr.exec:\rrffrfr.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7lrlrll.exec:\7lrlrll.exe42⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vvpvj.exec:\vvpvj.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjddp.exec:\jjddp.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lffrllf.exec:\lffrllf.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1ttnbt.exec:\1ttnbt.exe46⤵
- Executes dropped EXE
PID:376 -
\??\c:\5pppp.exec:\5pppp.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dvpvj.exec:\dvpvj.exe48⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xrlxrxf.exec:\xrlxrxf.exe49⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hbthtn.exec:\hbthtn.exe50⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nnhnht.exec:\nnhnht.exe51⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5jjpp.exec:\5jjpp.exe52⤵
- Executes dropped EXE
PID:1512 -
\??\c:\llfrrlr.exec:\llfrrlr.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe54⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jpdvv.exec:\jpdvv.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\jdvjd.exec:\jdvjd.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hbnbtb.exec:\hbnbtb.exe57⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9nnbtb.exec:\9nnbtb.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jdvdj.exec:\jdvdj.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rlrfrrf.exec:\rlrfrrf.exe60⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nnntht.exec:\nnntht.exe61⤵
- Executes dropped EXE
PID:276 -
\??\c:\dvpdp.exec:\dvpdp.exe62⤵
- Executes dropped EXE
PID:1180 -
\??\c:\xfrfrrf.exec:\xfrfrrf.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\tbhtnt.exec:\tbhtnt.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xxllfrx.exec:\xxllfrx.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe66⤵PID:1788
-
\??\c:\5hbhtb.exec:\5hbhtb.exe67⤵PID:1772
-
\??\c:\7pppv.exec:\7pppv.exe68⤵PID:944
-
\??\c:\pppvj.exec:\pppvj.exe69⤵PID:2448
-
\??\c:\rfxfrlf.exec:\rfxfrlf.exe70⤵PID:2064
-
\??\c:\btnthn.exec:\btnthn.exe71⤵PID:2112
-
\??\c:\hbhbnh.exec:\hbhbnh.exe72⤵PID:1704
-
\??\c:\vpdjp.exec:\vpdjp.exe73⤵PID:1664
-
\??\c:\9fxfrfl.exec:\9fxfrfl.exe74⤵PID:2444
-
\??\c:\xrxfflx.exec:\xrxfflx.exe75⤵PID:880
-
\??\c:\tbttbt.exec:\tbttbt.exe76⤵PID:2520
-
\??\c:\jvjvd.exec:\jvjvd.exe77⤵PID:2396
-
\??\c:\lllxllx.exec:\lllxllx.exe78⤵PID:1424
-
\??\c:\btnthn.exec:\btnthn.exe79⤵PID:2020
-
\??\c:\vpjdp.exec:\vpjdp.exe80⤵PID:2408
-
\??\c:\lrlffxx.exec:\lrlffxx.exe81⤵PID:1500
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe82⤵PID:2092
-
\??\c:\thbthn.exec:\thbthn.exe83⤵PID:2160
-
\??\c:\vjvjj.exec:\vjvjj.exe84⤵PID:2892
-
\??\c:\pvdpj.exec:\pvdpj.exe85⤵PID:2860
-
\??\c:\fxlxrrx.exec:\fxlxrrx.exe86⤵PID:2748
-
\??\c:\9hthnb.exec:\9hthnb.exe87⤵PID:2884
-
\??\c:\jdvdp.exec:\jdvdp.exe88⤵PID:2292
-
\??\c:\ppvjd.exec:\ppvjd.exe89⤵PID:2764
-
\??\c:\fxrrxlx.exec:\fxrrxlx.exe90⤵PID:2588
-
\??\c:\hthnnt.exec:\hthnnt.exe91⤵PID:2624
-
\??\c:\dppvd.exec:\dppvd.exe92⤵PID:2592
-
\??\c:\vdpjv.exec:\vdpjv.exe93⤵PID:648
-
\??\c:\3xfxlxx.exec:\3xfxlxx.exe94⤵PID:1980
-
\??\c:\5nthbb.exec:\5nthbb.exe95⤵PID:1912
-
\??\c:\dddvd.exec:\dddvd.exe96⤵PID:1228
-
\??\c:\pjddv.exec:\pjddv.exe97⤵PID:1676
-
\??\c:\xlxflrf.exec:\xlxflrf.exe98⤵PID:1972
-
\??\c:\tbbnhn.exec:\tbbnhn.exe99⤵PID:1456
-
\??\c:\ddjdp.exec:\ddjdp.exe100⤵PID:1060
-
\??\c:\7ppvp.exec:\7ppvp.exe101⤵PID:2916
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe102⤵PID:2960
-
\??\c:\thbbnb.exec:\thbbnb.exe103⤵PID:2964
-
\??\c:\hbbhbh.exec:\hbbhbh.exe104⤵PID:2236
-
\??\c:\pjpjp.exec:\pjpjp.exe105⤵PID:2288
-
\??\c:\fxxfxxl.exec:\fxxfxxl.exe106⤵PID:2372
-
\??\c:\rrfxlff.exec:\rrfxlff.exe107⤵PID:940
-
\??\c:\thnthn.exec:\thnthn.exe108⤵PID:1828
-
\??\c:\vpvdp.exec:\vpvdp.exe109⤵PID:556
-
\??\c:\vjpdv.exec:\vjpdv.exe110⤵PID:672
-
\??\c:\lxllrrf.exec:\lxllrrf.exe111⤵PID:1792
-
\??\c:\nnhbtb.exec:\nnhbtb.exe112⤵PID:1900
-
\??\c:\hthhhn.exec:\hthhhn.exe113⤵PID:3008
-
\??\c:\dvjjv.exec:\dvjjv.exe114⤵PID:1208
-
\??\c:\5xflrxl.exec:\5xflrxl.exe115⤵PID:1520
-
\??\c:\fllxlfl.exec:\fllxlfl.exe116⤵PID:684
-
\??\c:\htbntb.exec:\htbntb.exe117⤵PID:2572
-
\??\c:\jjdpp.exec:\jjdpp.exe118⤵PID:1768
-
\??\c:\5llrxrx.exec:\5llrxrx.exe119⤵PID:576
-
\??\c:\lflxrxf.exec:\lflxrxf.exe120⤵PID:888
-
\??\c:\bthnnt.exec:\bthnnt.exe121⤵PID:1436
-
\??\c:\jdpdj.exec:\jdpdj.exe122⤵PID:2532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-