Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-11-2024 22:10
Behavioral task
behavioral1
Sample
30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe
Resource
win7-20240903-en
General
-
Target
30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe
-
Size
1.9MB
-
MD5
739a4cc33f07c69c7a37b5848967ce9b
-
SHA1
a2aab686705709fa39475da23b327a4c919867d9
-
SHA256
30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747
-
SHA512
886d831ef51a8c5709fc818080f6262f71a1fd9ad954704d49812fd7485af6fe7719c2a676203fb2b04385f0d26627edd7ff25449bf40e8e39e55d8d2a39a564
-
SSDEEP
24576:gC8d36kLBXlnB8j7v5Ta+hLLQ20JmXSeWwa1oWJQjk0svTS/PPsbb1hwR4j:gCOfN6X5tLLQTg20ITS/PPs/1kk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/2364-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-27-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2220-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-53-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2644-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-88-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2696-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-99-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/968-208-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2404-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-558-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2888-595-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1316-615-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2796-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-775-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-795-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1836-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-808-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-822-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-718-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-441-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1500-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-79-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2812-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-67-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2752-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-57-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2780-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
Processes:
bbtnbt.exerrrlrlf.exevvvpp.exenbbhnb.exettbtbn.exefxxlfrl.exehhtthb.exellxrxrr.exepdppv.exe9bbtbt.exe7vvpv.exefxfxxxx.exexrlrrrr.exepjjdp.exejjpvd.exentbttn.exehhthbh.exefxrrffl.exe5jdjp.exebtbbbt.exexxxrflx.exevvpdp.exepvvvp.exebhntnt.exeflrxxfx.exepdddd.exerxfrlxx.exepvvjd.exetttthh.exeflxfrrr.exettnhnh.exerxrxfll.exejdpjj.exedvppp.exetbtbnh.exe5xfffxx.exevddpp.exebntbtb.exentbbhb.exexxrflrr.exe3tnbbn.exepppdv.exennntnh.exexfrxxfl.exejvdpd.exetnhnbb.exethnntn.exelrrxlxr.exethhtbb.exeffrflff.exedjpjp.exettbbnt.exerrfrflx.exehbhtbh.exe1ffllff.exebnbbbn.exelrffrrx.exedppdv.exehnbtbh.exerlrfrxl.exeddpdp.exennbtbb.exexrlfllf.exe1vvpv.exepid process 2544 bbtnbt.exe 2988 rrrlrlf.exe 2220 vvvpp.exe 2780 nbbhnb.exe 2752 ttbtbn.exe 2812 fxxlfrl.exe 2644 hhtthb.exe 2360 llxrxrr.exe 2696 pdppv.exe 1936 9bbtbt.exe 1128 7vvpv.exe 3068 fxfxxxx.exe 1536 xrlrrrr.exe 1512 pjjdp.exe 2016 jjpvd.exe 2068 ntbttn.exe 2248 hhthbh.exe 756 fxrrffl.exe 2604 5jdjp.exe 692 btbbbt.exe 968 xxxrflx.exe 1252 vvpdp.exe 1084 pvvvp.exe 2404 bhntnt.exe 1552 flrxxfx.exe 2380 pdddd.exe 2384 rxfrlxx.exe 984 pvvjd.exe 2232 tttthh.exe 1500 flxfrrr.exe 2276 ttnhnh.exe 1636 rxrxfll.exe 2984 jdpjj.exe 2352 dvppp.exe 2056 tbtbnh.exe 2188 5xfffxx.exe 2732 vddpp.exe 2312 bntbtb.exe 2724 ntbbhb.exe 2980 xxrflrr.exe 2644 3tnbbn.exe 2516 pppdv.exe 2728 nnntnh.exe 2788 xfrxxfl.exe 1936 jvdpd.exe 2940 tnhnbb.exe 2052 thnntn.exe 3044 lrrxlxr.exe 1536 thhtbb.exe 2820 ffrflff.exe 524 djpjp.exe 1944 ttbbnt.exe 816 rrfrflx.exe 2324 hbhtbh.exe 444 1ffllff.exe 2684 bnbbbn.exe 2420 lrffrrx.exe 1724 dppdv.exe 1184 hnbtbh.exe 1964 rlrfrxl.exe 1084 ddpdp.exe 2404 nnbtbb.exe 2712 xrlfllf.exe 2844 1vvpv.exe -
Processes:
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtnbt.exe upx behavioral1/memory/2364-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrlrlf.exe upx behavioral1/memory/2988-29-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvvpp.exe upx behavioral1/memory/2220-40-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbhnb.exe upx C:\ttbtbn.exe upx \??\c:\fxxlfrl.exe upx behavioral1/memory/2644-72-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llxrxrr.exe upx behavioral1/memory/2696-92-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9bbtbt.exe upx C:\7vvpv.exe upx behavioral1/memory/1936-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxfxxxx.exe upx behavioral1/memory/1536-131-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrlrrrr.exe upx \??\c:\pjjdp.exe upx \??\c:\jjpvd.exe upx behavioral1/memory/2016-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntbttn.exe upx \??\c:\hhthbh.exe upx behavioral1/memory/2248-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2068-164-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxrrffl.exe upx behavioral1/memory/2248-174-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5jdjp.exe upx behavioral1/memory/2604-185-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btbbbt.exe upx C:\xxxrflx.exe upx C:\vvpdp.exe upx behavioral1/memory/968-208-0x0000000000220000-0x0000000000247000-memory.dmp upx \??\c:\pvvvp.exe upx C:\bhntnt.exe upx C:\flrxxfx.exe upx behavioral1/memory/2404-235-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdddd.exe upx behavioral1/memory/2380-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1552-244-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxfrlxx.exe upx behavioral1/memory/2384-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/984-264-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvvjd.exe upx \??\c:\tttthh.exe upx \??\c:\flxfrrr.exe upx \??\c:\ttnhnh.exe upx C:\rxrxfll.exe upx behavioral1/memory/2724-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-370-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-383-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/816-434-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-442-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/444-449-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-462-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1184-481-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2404-494-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-513-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-520-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ppdjd.exexfrrfxf.exettbbnb.exejpjdd.exepvpvp.exevvpdd.exe3rffffl.exentbttn.exelxllxlr.exejdppp.exexrlfllf.exexfxrrrr.exexffrlxl.exevddpp.exe5tnnbn.exevppjj.exexlrlfxx.exenhhhtt.exelrfrrfl.exerxrlffr.exetbthth.exejpdjj.exehhntbb.exeppvdv.exehhbttt.exerlrxxxr.exevjppv.exebbbbth.exefrlflff.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exebbtnbt.exerrrlrlf.exevvvpp.exenbbhnb.exettbtbn.exefxxlfrl.exehhtthb.exellxrxrr.exepdppv.exe9bbtbt.exe7vvpv.exefxfxxxx.exexrlrrrr.exepjjdp.exejjpvd.exedescription pid process target process PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe vjddv.exe PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe vjddv.exe PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe vjddv.exe PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe vjddv.exe PID 2544 wrote to memory of 2988 2544 bbtnbt.exe rrrlrlf.exe PID 2544 wrote to memory of 2988 2544 bbtnbt.exe rrrlrlf.exe PID 2544 wrote to memory of 2988 2544 bbtnbt.exe rrrlrlf.exe PID 2544 wrote to memory of 2988 2544 bbtnbt.exe rrrlrlf.exe PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe vvvpp.exe PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe vvvpp.exe PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe vvvpp.exe PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe vvvpp.exe PID 2220 wrote to memory of 2780 2220 vvvpp.exe nbbhnb.exe PID 2220 wrote to memory of 2780 2220 vvvpp.exe nbbhnb.exe PID 2220 wrote to memory of 2780 2220 vvvpp.exe nbbhnb.exe PID 2220 wrote to memory of 2780 2220 vvvpp.exe nbbhnb.exe PID 2780 wrote to memory of 2752 2780 nbbhnb.exe ttbtbn.exe PID 2780 wrote to memory of 2752 2780 nbbhnb.exe ttbtbn.exe PID 2780 wrote to memory of 2752 2780 nbbhnb.exe ttbtbn.exe PID 2780 wrote to memory of 2752 2780 nbbhnb.exe ttbtbn.exe PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 3jddd.exe PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 3jddd.exe PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 3jddd.exe PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 3jddd.exe PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 3tnbbn.exe PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 3tnbbn.exe PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 3tnbbn.exe PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 3tnbbn.exe PID 2644 wrote to memory of 2360 2644 hhtthb.exe llxrxrr.exe PID 2644 wrote to memory of 2360 2644 hhtthb.exe llxrxrr.exe PID 2644 wrote to memory of 2360 2644 hhtthb.exe llxrxrr.exe PID 2644 wrote to memory of 2360 2644 hhtthb.exe llxrxrr.exe PID 2360 wrote to memory of 2696 2360 llxrxrr.exe pdppv.exe PID 2360 wrote to memory of 2696 2360 llxrxrr.exe pdppv.exe PID 2360 wrote to memory of 2696 2360 llxrxrr.exe pdppv.exe PID 2360 wrote to memory of 2696 2360 llxrxrr.exe pdppv.exe PID 2696 wrote to memory of 1936 2696 pdppv.exe jvdpd.exe PID 2696 wrote to memory of 1936 2696 pdppv.exe jvdpd.exe PID 2696 wrote to memory of 1936 2696 pdppv.exe jvdpd.exe PID 2696 wrote to memory of 1936 2696 pdppv.exe jvdpd.exe PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 7vvpv.exe PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 7vvpv.exe PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 7vvpv.exe PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 7vvpv.exe PID 1128 wrote to memory of 3068 1128 7vvpv.exe fxfxxxx.exe PID 1128 wrote to memory of 3068 1128 7vvpv.exe fxfxxxx.exe PID 1128 wrote to memory of 3068 1128 7vvpv.exe fxfxxxx.exe PID 1128 wrote to memory of 3068 1128 7vvpv.exe fxfxxxx.exe PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe xrlrrrr.exe PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe xrlrrrr.exe PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe xrlrrrr.exe PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe xrlrrrr.exe PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe pjjdp.exe PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe pjjdp.exe PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe pjjdp.exe PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe pjjdp.exe PID 1512 wrote to memory of 2016 1512 pjjdp.exe lrlflfr.exe PID 1512 wrote to memory of 2016 1512 pjjdp.exe lrlflfr.exe PID 1512 wrote to memory of 2016 1512 pjjdp.exe lrlflfr.exe PID 1512 wrote to memory of 2016 1512 pjjdp.exe lrlflfr.exe PID 2016 wrote to memory of 2068 2016 jjpvd.exe bhbtth.exe PID 2016 wrote to memory of 2068 2016 jjpvd.exe bhbtth.exe PID 2016 wrote to memory of 2068 2016 jjpvd.exe bhbtth.exe PID 2016 wrote to memory of 2068 2016 jjpvd.exe bhbtth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe"C:\Users\Admin\AppData\Local\Temp\30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bbtnbt.exec:\bbtnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rrrlrlf.exec:\rrrlrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vvvpp.exec:\vvvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\nbbhnb.exec:\nbbhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ttbtbn.exec:\ttbtbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\fxxlfrl.exec:\fxxlfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hhtthb.exec:\hhtthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\llxrxrr.exec:\llxrxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pdppv.exec:\pdppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9bbtbt.exec:\9bbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7vvpv.exec:\7vvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\pjjdp.exec:\pjjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jjpvd.exec:\jjpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\ntbttn.exec:\ntbttn.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\hhthbh.exec:\hhthbh.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxrrffl.exec:\fxrrffl.exe19⤵
- Executes dropped EXE
PID:756 -
\??\c:\5jdjp.exec:\5jdjp.exe20⤵
- Executes dropped EXE
PID:2604 -
\??\c:\btbbbt.exec:\btbbbt.exe21⤵
- Executes dropped EXE
PID:692 -
\??\c:\xxxrflx.exec:\xxxrflx.exe22⤵
- Executes dropped EXE
PID:968 -
\??\c:\vvpdp.exec:\vvpdp.exe23⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pvvvp.exec:\pvvvp.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bhntnt.exec:\bhntnt.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\flrxxfx.exec:\flrxxfx.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pdddd.exec:\pdddd.exe27⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxfrlxx.exec:\rxfrlxx.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pvvjd.exec:\pvvjd.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\tttthh.exec:\tttthh.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\flxfrrr.exec:\flxfrrr.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ttnhnh.exec:\ttnhnh.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rxrxfll.exec:\rxrxfll.exe33⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jdpjj.exec:\jdpjj.exe34⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvppp.exec:\dvppp.exe35⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tbtbnh.exec:\tbtbnh.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5xfffxx.exec:\5xfffxx.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vddpp.exec:\vddpp.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
\??\c:\bntbtb.exec:\bntbtb.exe39⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ntbbhb.exec:\ntbbhb.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxrflrr.exec:\xxrflrr.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3tnbbn.exec:\3tnbbn.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pppdv.exec:\pppdv.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nnntnh.exec:\nnntnh.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xfrxxfl.exec:\xfrxxfl.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jvdpd.exec:\jvdpd.exe46⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tnhnbb.exec:\tnhnbb.exe47⤵
- Executes dropped EXE
PID:2940 -
\??\c:\thnntn.exec:\thnntn.exe48⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lrrxlxr.exec:\lrrxlxr.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\thhtbb.exec:\thhtbb.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ffrflff.exec:\ffrflff.exe51⤵
- Executes dropped EXE
PID:2820 -
\??\c:\djpjp.exec:\djpjp.exe52⤵
- Executes dropped EXE
PID:524 -
\??\c:\ttbbnt.exec:\ttbbnt.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rrfrflx.exec:\rrfrflx.exe54⤵
- Executes dropped EXE
PID:816 -
\??\c:\hbhtbh.exec:\hbhtbh.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1ffllff.exec:\1ffllff.exe56⤵
- Executes dropped EXE
PID:444 -
\??\c:\bnbbbn.exec:\bnbbbn.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lrffrrx.exec:\lrffrrx.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dppdv.exec:\dppdv.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hnbtbh.exec:\hnbtbh.exe60⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe61⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ddpdp.exec:\ddpdp.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nnbtbb.exec:\nnbtbb.exe63⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xrlfllf.exec:\xrlfllf.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\1vvpv.exec:\1vvpv.exe65⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ttnbhb.exec:\ttnbhb.exe66⤵PID:1508
-
\??\c:\rfxlfxf.exec:\rfxlfxf.exe67⤵PID:2224
-
\??\c:\ddpjj.exec:\ddpjj.exe68⤵PID:2272
-
\??\c:\llllrrf.exec:\llllrrf.exe69⤵PID:308
-
\??\c:\9pjjp.exec:\9pjjp.exe70⤵PID:888
-
\??\c:\tbbnbh.exec:\tbbnbh.exe71⤵PID:268
-
\??\c:\9llxlrf.exec:\9llxlrf.exe72⤵PID:1800
-
\??\c:\vjddv.exec:\vjddv.exe73⤵PID:2544
-
\??\c:\nbbntt.exec:\nbbntt.exe74⤵PID:2480
-
\??\c:\rxrflrl.exec:\rxrflrl.exe75⤵PID:2352
-
\??\c:\nnnhnn.exec:\nnnhnn.exe76⤵PID:2768
-
\??\c:\xxxlffr.exec:\xxxlffr.exe77⤵PID:2220
-
\??\c:\fxlflll.exec:\fxlflll.exe78⤵PID:2888
-
\??\c:\vvpdv.exec:\vvpdv.exe79⤵PID:1808
-
\??\c:\fxxlfrl.exec:\fxxlfrl.exe80⤵PID:2792
-
\??\c:\ddjdv.exec:\ddjdv.exe81⤵PID:1316
-
\??\c:\xffxxxl.exec:\xffxxxl.exe82⤵PID:932
-
\??\c:\vvjpp.exec:\vvjpp.exe83⤵PID:1052
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe84⤵
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\9dvpd.exec:\9dvpd.exe85⤵PID:1880
-
\??\c:\hhbhbh.exec:\hhbhbh.exe86⤵PID:2832
-
\??\c:\7pjvp.exec:\7pjvp.exe87⤵PID:844
-
\??\c:\ttbhnn.exec:\ttbhnn.exe88⤵PID:2196
-
\??\c:\frxxffl.exec:\frxxffl.exe89⤵PID:2692
-
\??\c:\hbnhtt.exec:\hbnhtt.exe90⤵PID:2796
-
\??\c:\flrlfxx.exec:\flrlfxx.exe91⤵PID:3048
-
\??\c:\nttbnb.exec:\nttbnb.exe92⤵PID:1512
-
\??\c:\lrlflfr.exec:\lrlflfr.exe93⤵PID:2016
-
\??\c:\bhntbn.exec:\bhntbn.exe94⤵PID:2416
-
\??\c:\xrfxlxf.exec:\xrfxlxf.exe95⤵PID:1944
-
\??\c:\bhbtth.exec:\bhbtth.exe96⤵PID:2068
-
\??\c:\5fflrlx.exec:\5fflrlx.exe97⤵PID:2808
-
\??\c:\btntnh.exec:\btntnh.exe98⤵PID:444
-
\??\c:\xlxxffl.exec:\xlxxffl.exe99⤵PID:1684
-
\??\c:\jjvvd.exec:\jjvvd.exe100⤵PID:1028
-
\??\c:\ntbbhn.exec:\ntbbhn.exe101⤵PID:1724
-
\??\c:\djdjv.exec:\djdjv.exe102⤵PID:1236
-
\??\c:\7ntttb.exec:\7ntttb.exe103⤵PID:1252
-
\??\c:\vvvdv.exec:\vvvdv.exe104⤵PID:3020
-
\??\c:\bhbnhh.exec:\bhbnhh.exe105⤵PID:916
-
\??\c:\xxxfflr.exec:\xxxfflr.exe106⤵PID:1044
-
\??\c:\dvvvv.exec:\dvvvv.exe107⤵PID:2368
-
\??\c:\bnhhhb.exec:\bnhhhb.exe108⤵PID:1816
-
\??\c:\lllflfl.exec:\lllflfl.exe109⤵PID:764
-
\??\c:\hbtttt.exec:\hbtttt.exe110⤵PID:2568
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe111⤵PID:1100
-
\??\c:\jvvvd.exec:\jvvvd.exe112⤵PID:1836
-
\??\c:\xlrlllr.exec:\xlrlllr.exe113⤵PID:1764
-
\??\c:\jjdjv.exec:\jjdjv.exe114⤵PID:1636
-
\??\c:\rllxflx.exec:\rllxflx.exe115⤵PID:2192
-
\??\c:\vddpj.exec:\vddpj.exe116⤵PID:2764
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe117⤵PID:2428
-
\??\c:\ddvvj.exec:\ddvvj.exe118⤵PID:1768
-
\??\c:\htnhnh.exec:\htnhnh.exe119⤵PID:2628
-
\??\c:\djvjd.exec:\djvjd.exe120⤵PID:2220
-
\??\c:\nhhhtt.exec:\nhhhtt.exe121⤵
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\jddvv.exec:\jddvv.exe122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-