Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02-09-2024 10:34
Behavioral task
behavioral1
Sample
5b4c36d9085bc4991b4d95cebdd31340N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
5b4c36d9085bc4991b4d95cebdd31340N.exe
-
Size
93KB
-
MD5
5b4c36d9085bc4991b4d95cebdd31340
-
SHA1
f864d662ee9a95aa620687cc852fd200d9522531
-
SHA256
168dfcbf78c4d945c31b5f890b3551a7a725ed61e32a366080d50414cb3ab81b
-
SHA512
6dcb2332c20bc792a09ee8987fde52eb5a222855579586ea7833af1d68b841af1c07d286da8e93b0c08c031fc2b087db814b3d9eb9a4e44852c7cb69d4f41ddc
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQkPvA3qrEvO7C87FLoT:khOmTsF93UYfwC6GIoutpYcvrqrE6dkT
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/1680-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-63-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2680-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-82-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/284-156-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1652-167-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1652-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1832-230-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/684-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-282-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1676-301-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1676-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-309-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1392-316-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2936-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-384-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2224-391-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/700-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-411-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2676-419-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1496-430-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2016-446-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-467-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1352-485-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2552-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-532-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1708-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-587-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2356-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-607-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2824-622-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-682-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-686-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/284-703-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1640-752-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/684-774-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1568-840-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-897-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/352-927-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1660-1014-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/444-1020-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/2928-1028-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1680 9bbhtb.exe 3028 vpddd.exe 2656 ffrlflx.exe 2168 hbnnbn.exe 2784 3pjpj.exe 2680 lllrffr.exe 2736 rrlxrfx.exe 2804 tbtnnn.exe 1840 pppvp.exe 2648 lllxrxl.exe 2296 bhtbnb.exe 1312 5bnhtt.exe 2900 9jjjd.exe 1472 pjdjv.exe 532 hhhnbh.exe 284 3hhntt.exe 1652 ppvpv.exe 2136 rrlflxl.exe 2124 3hhnbh.exe 2484 7btbnb.exe 2344 vvvdd.exe 2068 pjpvd.exe 1052 tbnthh.exe 1832 hhthtt.exe 684 jdvvv.exe 1048 frfrxfr.exe 1624 rrflflx.exe 2496 nhhnbh.exe 2396 pjdjd.exe 1700 fflxflx.exe 3016 fxrxlrf.exe 1676 nhbhbt.exe 2156 vpddp.exe 1392 3vppv.exe 2668 lfxfllr.exe 2964 5nhtbn.exe 2852 bbbtbn.exe 2976 jjvdd.exe 1152 pddpp.exe 2936 lfffrrf.exe 2896 xfxfxfl.exe 2580 tnttnn.exe 2744 tnhthh.exe 2620 9jjvv.exe 2224 lrlxrxx.exe 2296 9ntbhn.exe 700 vpjjd.exe 2664 dvjpp.exe 2676 xxrxllf.exe 348 5xrxllx.exe 1496 hbbnht.exe 2012 pjppd.exe 2016 dvpvv.exe 1740 rfxlrxx.exe 1060 rrfrlrx.exe 2468 bbnbnn.exe 1988 hhthnn.exe 1588 5jdjj.exe 1352 ffxlfxr.exe 2068 5llxrxl.exe 1052 tthbtt.exe 1324 1pjdp.exe 2552 jdddj.exe 2148 xrrfrxl.exe -
resource yara_rule behavioral1/memory/2516-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001227f-5.dat upx behavioral1/memory/1680-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016859-18.dat upx behavioral1/memory/3028-25-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2656-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c80-26.dat upx behavioral1/files/0x0007000000016cc8-37.dat upx behavioral1/memory/2656-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cf5-44.dat upx behavioral1/memory/2784-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d21-55.dat upx behavioral1/files/0x0007000000016d32-64.dat upx behavioral1/memory/2680-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3a-74.dat upx behavioral1/memory/2736-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d42-83.dat upx behavioral1/memory/2804-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1840-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175d2-93.dat upx behavioral1/files/0x00060000000175e4-104.dat upx behavioral1/memory/2296-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018716-113.dat upx behavioral1/files/0x0005000000018718-122.dat upx behavioral1/memory/1312-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018728-131.dat upx behavioral1/files/0x0006000000018b7d-140.dat upx behavioral1/files/0x0006000000018ba5-149.dat upx behavioral1/memory/532-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bb8-158.dat upx behavioral1/files/0x0006000000018bbc-168.dat upx behavioral1/memory/1652-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bc1-178.dat upx behavioral1/files/0x0006000000018bc7-185.dat upx behavioral1/files/0x0006000000018bf2-204.dat upx behavioral1/memory/2344-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018be0-196.dat upx behavioral1/memory/2484-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c16-213.dat upx behavioral1/files/0x0006000000018c3b-222.dat upx behavioral1/files/0x0006000000018c44-231.dat upx behavioral1/memory/684-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019209-241.dat upx behavioral1/memory/1624-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b7-249.dat upx behavioral1/files/0x00050000000193e6-257.dat upx behavioral1/memory/2496-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001940f-267.dat upx behavioral1/files/0x0005000000019419-274.dat upx behavioral1/files/0x00050000000194cc-283.dat upx behavioral1/memory/1700-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d4-293.dat upx behavioral1/memory/1676-301-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/memory/1676-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-342-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2936-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/700-404-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-412-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btnth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1680 2516 5b4c36d9085bc4991b4d95cebdd31340N.exe 30 PID 2516 wrote to memory of 1680 2516 5b4c36d9085bc4991b4d95cebdd31340N.exe 30 PID 2516 wrote to memory of 1680 2516 5b4c36d9085bc4991b4d95cebdd31340N.exe 30 PID 2516 wrote to memory of 1680 2516 5b4c36d9085bc4991b4d95cebdd31340N.exe 30 PID 1680 wrote to memory of 3028 1680 9bbhtb.exe 31 PID 1680 wrote to memory of 3028 1680 9bbhtb.exe 31 PID 1680 wrote to memory of 3028 1680 9bbhtb.exe 31 PID 1680 wrote to memory of 3028 1680 9bbhtb.exe 31 PID 3028 wrote to memory of 2656 3028 vpddd.exe 32 PID 3028 wrote to memory of 2656 3028 vpddd.exe 32 PID 3028 wrote to memory of 2656 3028 vpddd.exe 32 PID 3028 wrote to memory of 2656 3028 vpddd.exe 32 PID 2656 wrote to memory of 2168 2656 ffrlflx.exe 33 PID 2656 wrote to memory of 2168 2656 ffrlflx.exe 33 PID 2656 wrote to memory of 2168 2656 ffrlflx.exe 33 PID 2656 wrote to memory of 2168 2656 ffrlflx.exe 33 PID 2168 wrote to memory of 2784 2168 hbnnbn.exe 34 PID 2168 wrote to memory of 2784 2168 hbnnbn.exe 34 PID 2168 wrote to memory of 2784 2168 hbnnbn.exe 34 PID 2168 wrote to memory of 2784 2168 hbnnbn.exe 34 PID 2784 wrote to memory of 2680 2784 3pjpj.exe 35 PID 2784 wrote to memory of 2680 2784 3pjpj.exe 35 PID 2784 wrote to memory of 2680 2784 3pjpj.exe 35 PID 2784 wrote to memory of 2680 2784 3pjpj.exe 35 PID 2680 wrote to memory of 2736 2680 lllrffr.exe 36 PID 2680 wrote to memory of 2736 2680 lllrffr.exe 36 PID 2680 wrote to memory of 2736 2680 lllrffr.exe 36 PID 2680 wrote to memory of 2736 2680 lllrffr.exe 36 PID 2736 wrote to memory of 2804 2736 rrlxrfx.exe 37 PID 2736 wrote to memory of 2804 2736 rrlxrfx.exe 37 PID 2736 wrote to memory of 2804 2736 rrlxrfx.exe 37 PID 2736 wrote to memory of 2804 2736 rrlxrfx.exe 37 PID 2804 wrote to memory of 1840 2804 tbtnnn.exe 38 PID 2804 wrote to memory of 1840 2804 tbtnnn.exe 38 PID 2804 wrote to memory of 1840 2804 tbtnnn.exe 38 PID 2804 wrote to memory of 1840 2804 tbtnnn.exe 38 PID 1840 wrote to memory of 2648 1840 pppvp.exe 39 PID 1840 wrote to memory of 2648 1840 pppvp.exe 39 PID 1840 wrote to memory of 2648 1840 pppvp.exe 39 PID 1840 wrote to memory of 2648 1840 pppvp.exe 39 PID 2648 wrote to memory of 2296 2648 lllxrxl.exe 40 PID 2648 wrote to memory of 2296 2648 lllxrxl.exe 40 PID 2648 wrote to memory of 2296 2648 lllxrxl.exe 40 PID 2648 wrote to memory of 2296 2648 lllxrxl.exe 40 PID 2296 wrote to memory of 1312 2296 bhtbnb.exe 41 PID 2296 wrote to memory of 1312 2296 bhtbnb.exe 41 PID 2296 wrote to memory of 1312 2296 bhtbnb.exe 41 PID 2296 wrote to memory of 1312 2296 bhtbnb.exe 41 PID 1312 wrote to memory of 2900 1312 5bnhtt.exe 42 PID 1312 wrote to memory of 2900 1312 5bnhtt.exe 42 PID 1312 wrote to memory of 2900 1312 5bnhtt.exe 42 PID 1312 wrote to memory of 2900 1312 5bnhtt.exe 42 PID 2900 wrote to memory of 1472 2900 9jjjd.exe 43 PID 2900 wrote to memory of 1472 2900 9jjjd.exe 43 PID 2900 wrote to memory of 1472 2900 9jjjd.exe 43 PID 2900 wrote to memory of 1472 2900 9jjjd.exe 43 PID 1472 wrote to memory of 532 1472 pjdjv.exe 44 PID 1472 wrote to memory of 532 1472 pjdjv.exe 44 PID 1472 wrote to memory of 532 1472 pjdjv.exe 44 PID 1472 wrote to memory of 532 1472 pjdjv.exe 44 PID 532 wrote to memory of 284 532 hhhnbh.exe 45 PID 532 wrote to memory of 284 532 hhhnbh.exe 45 PID 532 wrote to memory of 284 532 hhhnbh.exe 45 PID 532 wrote to memory of 284 532 hhhnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b4c36d9085bc4991b4d95cebdd31340N.exe"C:\Users\Admin\AppData\Local\Temp\5b4c36d9085bc4991b4d95cebdd31340N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9bbhtb.exec:\9bbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\vpddd.exec:\vpddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\ffrlflx.exec:\ffrlflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\hbnnbn.exec:\hbnnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\3pjpj.exec:\3pjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lllrffr.exec:\lllrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tbtnnn.exec:\tbtnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\pppvp.exec:\pppvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\lllxrxl.exec:\lllxrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bhtbnb.exec:\bhtbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\5bnhtt.exec:\5bnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\9jjjd.exec:\9jjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pjdjv.exec:\pjdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\hhhnbh.exec:\hhhnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\3hhntt.exec:\3hhntt.exe17⤵
- Executes dropped EXE
PID:284 -
\??\c:\ppvpv.exec:\ppvpv.exe18⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrlflxl.exec:\rrlflxl.exe19⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3hhnbh.exec:\3hhnbh.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7btbnb.exec:\7btbnb.exe21⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vvvdd.exec:\vvvdd.exe22⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjpvd.exec:\pjpvd.exe23⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tbnthh.exec:\tbnthh.exe24⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hhthtt.exec:\hhthtt.exe25⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jdvvv.exec:\jdvvv.exe26⤵
- Executes dropped EXE
PID:684 -
\??\c:\frfrxfr.exec:\frfrxfr.exe27⤵
- Executes dropped EXE
PID:1048 -
\??\c:\rrflflx.exec:\rrflflx.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhhnbh.exec:\nhhnbh.exe29⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjdjd.exec:\pjdjd.exe30⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fflxflx.exec:\fflxflx.exe31⤵
- Executes dropped EXE
PID:1700 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nhbhbt.exec:\nhbhbt.exe33⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vpddp.exec:\vpddp.exe34⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3vppv.exec:\3vppv.exe35⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lfxfllr.exec:\lfxfllr.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5nhtbn.exec:\5nhtbn.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bbbtbn.exec:\bbbtbn.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jjvdd.exec:\jjvdd.exe39⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pddpp.exec:\pddpp.exe40⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lfffrrf.exec:\lfffrrf.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xfxfxfl.exec:\xfxfxfl.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tnttnn.exec:\tnttnn.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnhthh.exec:\tnhthh.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9jjvv.exec:\9jjvv.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lrlxrxx.exec:\lrlxrxx.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9ntbhn.exec:\9ntbhn.exe47⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vpjjd.exec:\vpjjd.exe48⤵
- Executes dropped EXE
PID:700 -
\??\c:\dvjpp.exec:\dvjpp.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xxrxllf.exec:\xxrxllf.exe50⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5xrxllx.exec:\5xrxllx.exe51⤵
- Executes dropped EXE
PID:348 -
\??\c:\hbbnht.exec:\hbbnht.exe52⤵
- Executes dropped EXE
PID:1496 -
\??\c:\pjppd.exec:\pjppd.exe53⤵
- Executes dropped EXE
PID:2012 -
\??\c:\dvpvv.exec:\dvpvv.exe54⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rfxlrxx.exec:\rfxlrxx.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rrfrlrx.exec:\rrfrlrx.exe56⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bbnbnn.exec:\bbnbnn.exe57⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hhthnn.exec:\hhthnn.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5jdjj.exec:\5jdjj.exe59⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ffxlfxr.exec:\ffxlfxr.exe60⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5llxrxl.exec:\5llxrxl.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tthbtt.exec:\tthbtt.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\1pjdp.exec:\1pjdp.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jdddj.exec:\jdddj.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe65⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5xlfrxf.exec:\5xlfrxf.exe66⤵PID:1624
-
\??\c:\9bbhth.exec:\9bbhth.exe67⤵PID:1468
-
\??\c:\3jvdd.exec:\3jvdd.exe68⤵PID:1772
-
\??\c:\jppjv.exec:\jppjv.exe69⤵PID:1708
-
\??\c:\9rlxlrf.exec:\9rlxlrf.exe70⤵PID:1964
-
\??\c:\lxfxlxl.exec:\lxfxlxl.exe71⤵PID:1700
-
\??\c:\tthbnn.exec:\tthbnn.exe72⤵PID:1672
-
\??\c:\jvjjv.exec:\jvjjv.exe73⤵PID:1576
-
\??\c:\3dpjp.exec:\3dpjp.exe74⤵PID:1676
-
\??\c:\xxxlrrf.exec:\xxxlrrf.exe75⤵PID:2276
-
\??\c:\7bnhtt.exec:\7bnhtt.exe76⤵PID:3048
-
\??\c:\bthnth.exec:\bthnth.exe77⤵PID:2304
-
\??\c:\jdvdv.exec:\jdvdv.exe78⤵PID:2356
-
\??\c:\1jjdv.exec:\1jjdv.exe79⤵PID:2700
-
\??\c:\rxllxrf.exec:\rxllxrf.exe80⤵PID:2732
-
\??\c:\bnttth.exec:\bnttth.exe81⤵PID:2800
-
\??\c:\nhbnth.exec:\nhbnth.exe82⤵PID:2824
-
\??\c:\3pdjd.exec:\3pdjd.exe83⤵PID:2740
-
\??\c:\7ffxllx.exec:\7ffxllx.exe84⤵PID:2640
-
\??\c:\3lxlfxf.exec:\3lxlfxf.exe85⤵PID:2608
-
\??\c:\7hhtbn.exec:\7hhtbn.exe86⤵PID:2652
-
\??\c:\hbhbnn.exec:\hbhbnn.exe87⤵PID:2592
-
\??\c:\9pdjp.exec:\9pdjp.exe88⤵PID:1312
-
\??\c:\pppvd.exec:\pppvd.exe89⤵PID:2636
-
\??\c:\fxlxrff.exec:\fxlxrff.exe90⤵PID:2832
-
\??\c:\hbthnt.exec:\hbthnt.exe91⤵PID:2664
-
\??\c:\bbnbtb.exec:\bbnbtb.exe92⤵PID:2752
-
\??\c:\3nnthh.exec:\3nnthh.exe93⤵PID:2000
-
\??\c:\jdjpj.exec:\jdjpj.exe94⤵PID:284
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe95⤵PID:2672
-
\??\c:\5llrlrf.exec:\5llrlrf.exe96⤵PID:3052
-
\??\c:\tnbbnn.exec:\tnbbnn.exe97⤵PID:1896
-
\??\c:\ppdjv.exec:\ppdjv.exe98⤵PID:1928
-
\??\c:\ddjvp.exec:\ddjvp.exe99⤵PID:1892
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe100⤵PID:2088
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe101⤵PID:1284
-
\??\c:\tbnthh.exec:\tbnthh.exe102⤵PID:1640
-
\??\c:\ttthhh.exec:\ttthhh.exe103⤵PID:2560
-
\??\c:\ppvjp.exec:\ppvjp.exe104⤵PID:1548
-
\??\c:\3jddj.exec:\3jddj.exe105⤵
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\lxrxrrf.exec:\lxrxrrf.exe106⤵PID:684
-
\??\c:\5lxxlrf.exec:\5lxxlrf.exe107⤵PID:2352
-
\??\c:\hnbhtb.exec:\hnbhtb.exe108⤵PID:944
-
\??\c:\pjdpd.exec:\pjdpd.exe109⤵PID:2916
-
\??\c:\pdpvd.exec:\pdpvd.exe110⤵
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\5rrlxlf.exec:\5rrlxlf.exe111⤵PID:2376
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe112⤵PID:1808
-
\??\c:\5nnbnn.exec:\5nnbnn.exe113⤵
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\vvjpj.exec:\vvjpj.exe114⤵PID:1700
-
\??\c:\3djjv.exec:\3djjv.exe115⤵PID:1672
-
\??\c:\llflffx.exec:\llflffx.exe116⤵PID:1568
-
\??\c:\rlllllf.exec:\rlllllf.exe117⤵PID:3020
-
\??\c:\bthbbh.exec:\bthbbh.exe118⤵PID:1064
-
\??\c:\jjjvv.exec:\jjjvv.exe119⤵PID:2704
-
\??\c:\5rlxlxl.exec:\5rlxlxl.exe120⤵PID:2304
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe121⤵PID:2356
-
\??\c:\btbhbh.exec:\btbhbh.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-