Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f05b0c52180f69ff68b152297abda5f0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
f05b0c52180f69ff68b152297abda5f0N.exe
-
Size
453KB
-
MD5
f05b0c52180f69ff68b152297abda5f0
-
SHA1
837beda544983a1cdbff250959e41fb277839e19
-
SHA256
675ecc33f649ba80ce46bfb190d068ef42f9ad97f659aabdf0a2cdff090c7e90
-
SHA512
7efbeb20047aed7561f1b6a38e02a8255ce4bcaa4fd555be7fe08a2575bc32efeba4638d9aca08dbeef6c1068cb2594460360cc49c536f30092dbcd63af2d07f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2748-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2668-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-64-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/784-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-294-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-350-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/484-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/468-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-507-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-596-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2784-608-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2148-659-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2656-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-853-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-890-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2384-1039-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1788-1066-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-1115-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2364-1325-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1652-1340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2904 vvddj.exe 2644 tbtnhh.exe 2860 xxfxfxx.exe 2648 nnbtbt.exe 2668 frffllx.exe 784 rflllll.exe 1500 pvpdd.exe 1868 rfllxxx.exe 2132 vjpjj.exe 1276 frffffl.exe 3040 btbbht.exe 1824 9jjdd.exe 2808 nthbhb.exe 1968 tnhhtn.exe 2448 7lxxfxl.exe 1164 3rrrlfl.exe 1600 1vvjv.exe 3008 rrflrlr.exe 1952 vpdvd.exe 1648 5fxxfxf.exe 2004 dvdvv.exe 2580 9xffrxr.exe 1632 nbtbbb.exe 1720 5pppd.exe 1652 xlxffxx.exe 2000 7vddv.exe 1920 7rrfxrl.exe 2556 tnbhhn.exe 2276 5vvjp.exe 2548 xlffxxl.exe 2292 nbnhht.exe 2320 rlrrxrr.exe 2300 nbnnnn.exe 1624 bbnntb.exe 2804 pjvdj.exe 2284 xlxrrlr.exe 2664 hhbbhb.exe 2680 vppjp.exe 2648 5frxxrx.exe 2668 rrfflrf.exe 484 3bhbhh.exe 1488 1jppd.exe 1500 3lflffr.exe 2088 btbtnn.exe 2404 djpjj.exe 2988 7djjj.exe 1276 xrflllr.exe 1976 bhhtnb.exe 1324 pjppj.exe 2944 1lllflr.exe 2712 thttbt.exe 2056 djdvd.exe 1312 lxlllrl.exe 1740 bntttb.exe 1164 thnhnt.exe 1288 5jvpp.exe 1932 lxlflrx.exe 2172 hnbhnb.exe 1484 3bbbnt.exe 1096 pdddd.exe 1300 1rlxffr.exe 468 nhhnhh.exe 1204 jdpjp.exe 1788 vjvdj.exe -
resource yara_rule behavioral1/memory/2748-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-1066-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2920-1184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-1312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-1340-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2904 2748 f05b0c52180f69ff68b152297abda5f0N.exe 30 PID 2748 wrote to memory of 2904 2748 f05b0c52180f69ff68b152297abda5f0N.exe 30 PID 2748 wrote to memory of 2904 2748 f05b0c52180f69ff68b152297abda5f0N.exe 30 PID 2748 wrote to memory of 2904 2748 f05b0c52180f69ff68b152297abda5f0N.exe 30 PID 2904 wrote to memory of 2644 2904 vvddj.exe 31 PID 2904 wrote to memory of 2644 2904 vvddj.exe 31 PID 2904 wrote to memory of 2644 2904 vvddj.exe 31 PID 2904 wrote to memory of 2644 2904 vvddj.exe 31 PID 2644 wrote to memory of 2860 2644 tbtnhh.exe 32 PID 2644 wrote to memory of 2860 2644 tbtnhh.exe 32 PID 2644 wrote to memory of 2860 2644 tbtnhh.exe 32 PID 2644 wrote to memory of 2860 2644 tbtnhh.exe 32 PID 2860 wrote to memory of 2648 2860 xxfxfxx.exe 33 PID 2860 wrote to memory of 2648 2860 xxfxfxx.exe 33 PID 2860 wrote to memory of 2648 2860 xxfxfxx.exe 33 PID 2860 wrote to memory of 2648 2860 xxfxfxx.exe 33 PID 2648 wrote to memory of 2668 2648 nnbtbt.exe 34 PID 2648 wrote to memory of 2668 2648 nnbtbt.exe 34 PID 2648 wrote to memory of 2668 2648 nnbtbt.exe 34 PID 2648 wrote to memory of 2668 2648 nnbtbt.exe 34 PID 2668 wrote to memory of 784 2668 frffllx.exe 35 PID 2668 wrote to memory of 784 2668 frffllx.exe 35 PID 2668 wrote to memory of 784 2668 frffllx.exe 35 PID 2668 wrote to memory of 784 2668 frffllx.exe 35 PID 784 wrote to memory of 1500 784 rflllll.exe 36 PID 784 wrote to memory of 1500 784 rflllll.exe 36 PID 784 wrote to memory of 1500 784 rflllll.exe 36 PID 784 wrote to memory of 1500 784 rflllll.exe 36 PID 1500 wrote to memory of 1868 1500 pvpdd.exe 37 PID 1500 wrote to memory of 1868 1500 pvpdd.exe 37 PID 1500 wrote to memory of 1868 1500 pvpdd.exe 37 PID 1500 wrote to memory of 1868 1500 pvpdd.exe 37 PID 1868 wrote to memory of 2132 1868 rfllxxx.exe 38 PID 1868 wrote to memory of 2132 1868 rfllxxx.exe 38 PID 1868 wrote to memory of 2132 1868 rfllxxx.exe 38 PID 1868 wrote to memory of 2132 1868 rfllxxx.exe 38 PID 2132 wrote to memory of 1276 2132 vjpjj.exe 39 PID 2132 wrote to memory of 1276 2132 vjpjj.exe 39 PID 2132 wrote to memory of 1276 2132 vjpjj.exe 39 PID 2132 wrote to memory of 1276 2132 vjpjj.exe 39 PID 1276 wrote to memory of 3040 1276 frffffl.exe 40 PID 1276 wrote to memory of 3040 1276 frffffl.exe 40 PID 1276 wrote to memory of 3040 1276 frffffl.exe 40 PID 1276 wrote to memory of 3040 1276 frffffl.exe 40 PID 3040 wrote to memory of 1824 3040 btbbht.exe 41 PID 3040 wrote to memory of 1824 3040 btbbht.exe 41 PID 3040 wrote to memory of 1824 3040 btbbht.exe 41 PID 3040 wrote to memory of 1824 3040 btbbht.exe 41 PID 1824 wrote to memory of 2808 1824 9jjdd.exe 42 PID 1824 wrote to memory of 2808 1824 9jjdd.exe 42 PID 1824 wrote to memory of 2808 1824 9jjdd.exe 42 PID 1824 wrote to memory of 2808 1824 9jjdd.exe 42 PID 2808 wrote to memory of 1968 2808 nthbhb.exe 43 PID 2808 wrote to memory of 1968 2808 nthbhb.exe 43 PID 2808 wrote to memory of 1968 2808 nthbhb.exe 43 PID 2808 wrote to memory of 1968 2808 nthbhb.exe 43 PID 1968 wrote to memory of 2448 1968 tnhhtn.exe 44 PID 1968 wrote to memory of 2448 1968 tnhhtn.exe 44 PID 1968 wrote to memory of 2448 1968 tnhhtn.exe 44 PID 1968 wrote to memory of 2448 1968 tnhhtn.exe 44 PID 2448 wrote to memory of 1164 2448 7lxxfxl.exe 45 PID 2448 wrote to memory of 1164 2448 7lxxfxl.exe 45 PID 2448 wrote to memory of 1164 2448 7lxxfxl.exe 45 PID 2448 wrote to memory of 1164 2448 7lxxfxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f05b0c52180f69ff68b152297abda5f0N.exe"C:\Users\Admin\AppData\Local\Temp\f05b0c52180f69ff68b152297abda5f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vvddj.exec:\vvddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\tbtnhh.exec:\tbtnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xxfxfxx.exec:\xxfxfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\nnbtbt.exec:\nnbtbt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\frffllx.exec:\frffllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rflllll.exec:\rflllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\pvpdd.exec:\pvpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\rfllxxx.exec:\rfllxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\vjpjj.exec:\vjpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\frffffl.exec:\frffffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\btbbht.exec:\btbbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\9jjdd.exec:\9jjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nthbhb.exec:\nthbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\tnhhtn.exec:\tnhhtn.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\7lxxfxl.exec:\7lxxfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\3rrrlfl.exec:\3rrrlfl.exe17⤵
- Executes dropped EXE
PID:1164 -
\??\c:\1vvjv.exec:\1vvjv.exe18⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rrflrlr.exec:\rrflrlr.exe19⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vpdvd.exec:\vpdvd.exe20⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5fxxfxf.exec:\5fxxfxf.exe21⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvdvv.exec:\dvdvv.exe22⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9xffrxr.exec:\9xffrxr.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\nbtbbb.exec:\nbtbbb.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\5pppd.exec:\5pppd.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xlxffxx.exec:\xlxffxx.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7vddv.exec:\7vddv.exe27⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7rrfxrl.exec:\7rrfxrl.exe28⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tnbhhn.exec:\tnbhhn.exe29⤵
- Executes dropped EXE
PID:2556 -
\??\c:\5vvjp.exec:\5vvjp.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xlffxxl.exec:\xlffxxl.exe31⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nbnhht.exec:\nbnhht.exe32⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rlrrxrr.exec:\rlrrxrr.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nbnnnn.exec:\nbnnnn.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bbnntb.exec:\bbnntb.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjvdj.exec:\pjvdj.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe37⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hhbbhb.exec:\hhbbhb.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vppjp.exec:\vppjp.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\5frxxrx.exec:\5frxxrx.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rrfflrf.exec:\rrfflrf.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3bhbhh.exec:\3bhbhh.exe42⤵
- Executes dropped EXE
PID:484 -
\??\c:\1jppd.exec:\1jppd.exe43⤵
- Executes dropped EXE
PID:1488 -
\??\c:\3lflffr.exec:\3lflffr.exe44⤵
- Executes dropped EXE
PID:1500 -
\??\c:\btbtnn.exec:\btbtnn.exe45⤵
- Executes dropped EXE
PID:2088 -
\??\c:\djpjj.exec:\djpjj.exe46⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7djjj.exec:\7djjj.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrflllr.exec:\xrflllr.exe48⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bhhtnb.exec:\bhhtnb.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjppj.exec:\pjppj.exe50⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1lllflr.exec:\1lllflr.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\thttbt.exec:\thttbt.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\djdvd.exec:\djdvd.exe53⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lxlllrl.exec:\lxlllrl.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bntttb.exec:\bntttb.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\thnhnt.exec:\thnhnt.exe56⤵
- Executes dropped EXE
PID:1164 -
\??\c:\5jvpp.exec:\5jvpp.exe57⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lxlflrx.exec:\lxlflrx.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hnbhnb.exec:\hnbhnb.exe59⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3bbbnt.exec:\3bbbnt.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pdddd.exec:\pdddd.exe61⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1rlxffr.exec:\1rlxffr.exe62⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nhhnhh.exec:\nhhnhh.exe63⤵
- Executes dropped EXE
PID:468 -
\??\c:\jdpjp.exec:\jdpjp.exe64⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vjvdj.exec:\vjvdj.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fxrxrrl.exec:\fxrxrrl.exe66⤵PID:308
-
\??\c:\tnnntn.exec:\tnnntn.exe67⤵PID:772
-
\??\c:\vjjjj.exec:\vjjjj.exe68⤵PID:620
-
\??\c:\3vjjp.exec:\3vjjp.exe69⤵PID:868
-
\??\c:\3lxxrxf.exec:\3lxxrxf.exe70⤵PID:2524
-
\??\c:\ntthbh.exec:\ntthbh.exe71⤵PID:1996
-
\??\c:\dvpvv.exec:\dvpvv.exe72⤵PID:1744
-
\??\c:\xxlxfrx.exec:\xxlxfrx.exe73⤵PID:1028
-
\??\c:\hhntnt.exec:\hhntnt.exe74⤵PID:1012
-
\??\c:\ttnnhn.exec:\ttnnhn.exe75⤵PID:2440
-
\??\c:\dpjjv.exec:\dpjjv.exe76⤵PID:2732
-
\??\c:\7xlfllr.exec:\7xlfllr.exe77⤵PID:1596
-
\??\c:\7bhhhb.exec:\7bhhhb.exe78⤵PID:2872
-
\??\c:\5thbbb.exec:\5thbbb.exe79⤵PID:2196
-
\??\c:\dvpvv.exec:\dvpvv.exe80⤵PID:2900
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe81⤵PID:2784
-
\??\c:\rfxflrr.exec:\rfxflrr.exe82⤵PID:3044
-
\??\c:\htnttb.exec:\htnttb.exe83⤵PID:3068
-
\??\c:\jjvdd.exec:\jjvdd.exe84⤵PID:320
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe85⤵PID:592
-
\??\c:\9rrllfr.exec:\9rrllfr.exe86⤵PID:1656
-
\??\c:\nhtthh.exec:\nhtthh.exe87⤵PID:580
-
\??\c:\ddvpd.exec:\ddvpd.exe88⤵PID:548
-
\??\c:\3xfxrrx.exec:\3xfxrrx.exe89⤵PID:2148
-
\??\c:\fxxlrxl.exec:\fxxlrxl.exe90⤵PID:2980
-
\??\c:\thtbhb.exec:\thtbhb.exe91⤵PID:2988
-
\??\c:\3pvjj.exec:\3pvjj.exe92⤵PID:1276
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe93⤵PID:2936
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe94⤵PID:2808
-
\??\c:\htnttt.exec:\htnttt.exe95⤵PID:2040
-
\??\c:\ppvvd.exec:\ppvvd.exe96⤵PID:2656
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe97⤵PID:644
-
\??\c:\fxfrxfr.exec:\fxfrxfr.exe98⤵PID:1664
-
\??\c:\hbnbhn.exec:\hbnbhn.exe99⤵PID:2468
-
\??\c:\dpddj.exec:\dpddj.exe100⤵PID:2344
-
\??\c:\rrfffff.exec:\rrfffff.exe101⤵PID:2140
-
\??\c:\bbnntb.exec:\bbnntb.exe102⤵PID:2472
-
\??\c:\thtnbb.exec:\thtnbb.exe103⤵PID:1768
-
\??\c:\vpddj.exec:\vpddj.exe104⤵PID:2384
-
\??\c:\rlxfffr.exec:\rlxfffr.exe105⤵PID:1680
-
\??\c:\hbttbh.exec:\hbttbh.exe106⤵PID:956
-
\??\c:\hbtbnn.exec:\hbtbnn.exe107⤵PID:708
-
\??\c:\jdpvv.exec:\jdpvv.exe108⤵PID:1876
-
\??\c:\llxfrrx.exec:\llxfrrx.exe109⤵PID:1788
-
\??\c:\xlrxxrr.exec:\xlrxxrr.exe110⤵PID:2064
-
\??\c:\btbbhb.exec:\btbbhb.exe111⤵PID:1660
-
\??\c:\httnhh.exec:\httnhh.exe112⤵PID:2044
-
\??\c:\ddjjj.exec:\ddjjj.exe113⤵
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\frfffxx.exec:\frfffxx.exe114⤵PID:1544
-
\??\c:\hnbtbn.exec:\hnbtbn.exe115⤵PID:1936
-
\??\c:\tbtnnn.exec:\tbtnnn.exe116⤵PID:2452
-
\??\c:\jdppv.exec:\jdppv.exe117⤵PID:1672
-
\??\c:\lfllrrf.exec:\lfllrrf.exe118⤵PID:3064
-
\??\c:\lflllrx.exec:\lflllrx.exe119⤵PID:2540
-
\??\c:\thtbht.exec:\thtbht.exe120⤵PID:2732
-
\??\c:\bnbhhn.exec:\bnbhhn.exe121⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-