Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe
-
Size
452KB
-
MD5
5e4b7602c45a82420baef79bd855aaf2
-
SHA1
20946d2b058c7cffa1b4d03111fef70e1451a62f
-
SHA256
0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d
-
SHA512
d9cb365a5dde21810f0bac3797ac50c5be911b5965d81706fb8f0f39312894a6aaa845609b3170d22fc8d1f900782e03138a62f358479159a877d3103c33b7f5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2276-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-159-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2392-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-228-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2428-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-352-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2656-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/592-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-419-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-549-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2472-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-633-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2724-665-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2604-673-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1492-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-723-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/580-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-839-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2440-852-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-857-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2540-918-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/3044-931-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-963-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2016-983-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/760-1022-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 hbhhhn.exe 2476 hntnbh.exe 2720 rffxlxx.exe 2648 3vvjd.exe 2752 xxlllrl.exe 2672 1htbth.exe 2832 pdjvd.exe 2676 vvvjv.exe 2536 1ppdv.exe 3040 hnhbtb.exe 536 xllfxlf.exe 2788 bbhthb.exe 1436 3thttb.exe 2012 pvvdv.exe 2016 vpdjj.exe 1492 dpdvv.exe 2948 pvvpv.exe 2392 xfllfrl.exe 1728 jvjvv.exe 2896 rlfrfxf.exe 652 djpjj.exe 1580 rxlxxfl.exe 1636 nnbtbt.exe 1448 5bthbt.exe 1684 dpdvv.exe 1944 flrfrfr.exe 2400 vjdjj.exe 984 vvvpd.exe 2344 7nntnt.exe 872 pvdpj.exe 2276 hhhtht.exe 1616 pjvdd.exe 2316 lfffrrx.exe 2944 1dpvd.exe 2840 lflxfll.exe 2428 hthbhb.exe 2764 vjpdp.exe 2964 djvpj.exe 2656 ttbnnt.exe 2580 bbthnt.exe 2824 lflrxrf.exe 2592 3bnbbt.exe 592 vdjdp.exe 2420 lflxfrf.exe 1424 xflxlff.exe 2028 hbtthh.exe 1432 pvvpd.exe 2784 fffrrxx.exe 1884 hnbthh.exe 1960 vvvjp.exe 1912 vpjdj.exe 1612 fllxrxr.exe 2932 nnntth.exe 2872 vppjj.exe 2636 llxxxfx.exe 844 rxxrrlf.exe 760 hhbnhn.exe 580 jjjdv.exe 1296 ffrlxlf.exe 1640 3tbttn.exe 1644 5jjvp.exe 752 xrllxll.exe 1276 bntnth.exe 1808 bhnnhn.exe -
resource yara_rule behavioral1/memory/2316-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-27-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2752-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-199-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/652-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-549-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2472-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-665-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1492-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-839-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2440-852-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2540-918-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/3044-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-963-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2016-983-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1476-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-1022-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2524-1035-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2316 2276 0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe 31 PID 2276 wrote to memory of 2316 2276 0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe 31 PID 2276 wrote to memory of 2316 2276 0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe 31 PID 2276 wrote to memory of 2316 2276 0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe 31 PID 2316 wrote to memory of 2476 2316 hbhhhn.exe 32 PID 2316 wrote to memory of 2476 2316 hbhhhn.exe 32 PID 2316 wrote to memory of 2476 2316 hbhhhn.exe 32 PID 2316 wrote to memory of 2476 2316 hbhhhn.exe 32 PID 2476 wrote to memory of 2720 2476 hntnbh.exe 33 PID 2476 wrote to memory of 2720 2476 hntnbh.exe 33 PID 2476 wrote to memory of 2720 2476 hntnbh.exe 33 PID 2476 wrote to memory of 2720 2476 hntnbh.exe 33 PID 2720 wrote to memory of 2648 2720 rffxlxx.exe 34 PID 2720 wrote to memory of 2648 2720 rffxlxx.exe 34 PID 2720 wrote to memory of 2648 2720 rffxlxx.exe 34 PID 2720 wrote to memory of 2648 2720 rffxlxx.exe 34 PID 2648 wrote to memory of 2752 2648 3vvjd.exe 35 PID 2648 wrote to memory of 2752 2648 3vvjd.exe 35 PID 2648 wrote to memory of 2752 2648 3vvjd.exe 35 PID 2648 wrote to memory of 2752 2648 3vvjd.exe 35 PID 2752 wrote to memory of 2672 2752 xxlllrl.exe 36 PID 2752 wrote to memory of 2672 2752 xxlllrl.exe 36 PID 2752 wrote to memory of 2672 2752 xxlllrl.exe 36 PID 2752 wrote to memory of 2672 2752 xxlllrl.exe 36 PID 2672 wrote to memory of 2832 2672 1htbth.exe 37 PID 2672 wrote to memory of 2832 2672 1htbth.exe 37 PID 2672 wrote to memory of 2832 2672 1htbth.exe 37 PID 2672 wrote to memory of 2832 2672 1htbth.exe 37 PID 2832 wrote to memory of 2676 2832 pdjvd.exe 38 PID 2832 wrote to memory of 2676 2832 pdjvd.exe 38 PID 2832 wrote to memory of 2676 2832 pdjvd.exe 38 PID 2832 wrote to memory of 2676 2832 pdjvd.exe 38 PID 2676 wrote to memory of 2536 2676 vvvjv.exe 39 PID 2676 wrote to memory of 2536 2676 vvvjv.exe 39 PID 2676 wrote to memory of 2536 2676 vvvjv.exe 39 PID 2676 wrote to memory of 2536 2676 vvvjv.exe 39 PID 2536 wrote to memory of 3040 2536 1ppdv.exe 40 PID 2536 wrote to memory of 3040 2536 1ppdv.exe 40 PID 2536 wrote to memory of 3040 2536 1ppdv.exe 40 PID 2536 wrote to memory of 3040 2536 1ppdv.exe 40 PID 3040 wrote to memory of 536 3040 hnhbtb.exe 41 PID 3040 wrote to memory of 536 3040 hnhbtb.exe 41 PID 3040 wrote to memory of 536 3040 hnhbtb.exe 41 PID 3040 wrote to memory of 536 3040 hnhbtb.exe 41 PID 536 wrote to memory of 2788 536 xllfxlf.exe 42 PID 536 wrote to memory of 2788 536 xllfxlf.exe 42 PID 536 wrote to memory of 2788 536 xllfxlf.exe 42 PID 536 wrote to memory of 2788 536 xllfxlf.exe 42 PID 2788 wrote to memory of 1436 2788 bbhthb.exe 43 PID 2788 wrote to memory of 1436 2788 bbhthb.exe 43 PID 2788 wrote to memory of 1436 2788 bbhthb.exe 43 PID 2788 wrote to memory of 1436 2788 bbhthb.exe 43 PID 1436 wrote to memory of 2012 1436 3thttb.exe 44 PID 1436 wrote to memory of 2012 1436 3thttb.exe 44 PID 1436 wrote to memory of 2012 1436 3thttb.exe 44 PID 1436 wrote to memory of 2012 1436 3thttb.exe 44 PID 2012 wrote to memory of 2016 2012 pvvdv.exe 45 PID 2012 wrote to memory of 2016 2012 pvvdv.exe 45 PID 2012 wrote to memory of 2016 2012 pvvdv.exe 45 PID 2012 wrote to memory of 2016 2012 pvvdv.exe 45 PID 2016 wrote to memory of 1492 2016 vpdjj.exe 46 PID 2016 wrote to memory of 1492 2016 vpdjj.exe 46 PID 2016 wrote to memory of 1492 2016 vpdjj.exe 46 PID 2016 wrote to memory of 1492 2016 vpdjj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe"C:\Users\Admin\AppData\Local\Temp\0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\hbhhhn.exec:\hbhhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\hntnbh.exec:\hntnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rffxlxx.exec:\rffxlxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3vvjd.exec:\3vvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xxlllrl.exec:\xxlllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\1htbth.exec:\1htbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pdjvd.exec:\pdjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vvvjv.exec:\vvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1ppdv.exec:\1ppdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\hnhbtb.exec:\hnhbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xllfxlf.exec:\xllfxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\bbhthb.exec:\bbhthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\3thttb.exec:\3thttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\pvvdv.exec:\pvvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vpdjj.exec:\vpdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dpdvv.exec:\dpdvv.exe17⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pvvpv.exec:\pvvpv.exe18⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xfllfrl.exec:\xfllfrl.exe19⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jvjvv.exec:\jvjvv.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rlfrfxf.exec:\rlfrfxf.exe21⤵
- Executes dropped EXE
PID:2896 -
\??\c:\djpjj.exec:\djpjj.exe22⤵
- Executes dropped EXE
PID:652 -
\??\c:\rxlxxfl.exec:\rxlxxfl.exe23⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nnbtbt.exec:\nnbtbt.exe24⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5bthbt.exec:\5bthbt.exe25⤵
- Executes dropped EXE
PID:1448 -
\??\c:\dpdvv.exec:\dpdvv.exe26⤵
- Executes dropped EXE
PID:1684 -
\??\c:\flrfrfr.exec:\flrfrfr.exe27⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vjdjj.exec:\vjdjj.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vvvpd.exec:\vvvpd.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\7nntnt.exec:\7nntnt.exe30⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pvdpj.exec:\pvdpj.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\hhhtht.exec:\hhhtht.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pjvdd.exec:\pjvdd.exe33⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lfffrrx.exec:\lfffrrx.exe34⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1dpvd.exec:\1dpvd.exe35⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lflxfll.exec:\lflxfll.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hthbhb.exec:\hthbhb.exe37⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vjpdp.exec:\vjpdp.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\djvpj.exec:\djvpj.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ttbnnt.exec:\ttbnnt.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbthnt.exec:\bbthnt.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lflrxrf.exec:\lflrxrf.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3bnbbt.exec:\3bnbbt.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vdjdp.exec:\vdjdp.exe44⤵
- Executes dropped EXE
PID:592 -
\??\c:\lflxfrf.exec:\lflxfrf.exe45⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xflxlff.exec:\xflxlff.exe46⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hbtthh.exec:\hbtthh.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pvvpd.exec:\pvvpd.exe48⤵
- Executes dropped EXE
PID:1432 -
\??\c:\fffrrxx.exec:\fffrrxx.exe49⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hnbthh.exec:\hnbthh.exe50⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vvvjp.exec:\vvvjp.exe51⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vpjdj.exec:\vpjdj.exe52⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fllxrxr.exec:\fllxrxr.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nnntth.exec:\nnntth.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vppjj.exec:\vppjj.exe55⤵
- Executes dropped EXE
PID:2872 -
\??\c:\llxxxfx.exec:\llxxxfx.exe56⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe57⤵
- Executes dropped EXE
PID:844 -
\??\c:\hhbnhn.exec:\hhbnhn.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\jjjdv.exec:\jjjdv.exe59⤵
- Executes dropped EXE
PID:580 -
\??\c:\ffrlxlf.exec:\ffrlxlf.exe60⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3tbttn.exec:\3tbttn.exe61⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5jjvp.exec:\5jjvp.exe62⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xrllxll.exec:\xrllxll.exe63⤵
- Executes dropped EXE
PID:752 -
\??\c:\bntnth.exec:\bntnth.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bhnnhn.exec:\bhnnhn.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\9vdvv.exec:\9vdvv.exe66⤵PID:1696
-
\??\c:\1llflxr.exec:\1llflxr.exe67⤵PID:2096
-
\??\c:\tbbhhn.exec:\tbbhhn.exe68⤵PID:996
-
\??\c:\5vvjj.exec:\5vvjj.exe69⤵PID:2160
-
\??\c:\dppjp.exec:\dppjp.exe70⤵PID:1412
-
\??\c:\xlxxlfr.exec:\xlxxlfr.exe71⤵PID:1556
-
\??\c:\bhhhnn.exec:\bhhhnn.exe72⤵PID:1560
-
\??\c:\djjvp.exec:\djjvp.exe73⤵PID:872
-
\??\c:\rfrfffx.exec:\rfrfffx.exe74⤵PID:2340
-
\??\c:\tbtbbh.exec:\tbtbbh.exe75⤵PID:3004
-
\??\c:\dppdj.exec:\dppdj.exe76⤵PID:2472
-
\??\c:\7frfrxl.exec:\7frfrxl.exe77⤵PID:2316
-
\??\c:\bhbtnb.exec:\bhbtnb.exe78⤵PID:2944
-
\??\c:\1nhbbh.exec:\1nhbbh.exe79⤵PID:2720
-
\??\c:\ddvjd.exec:\ddvjd.exe80⤵PID:2792
-
\??\c:\rrxrfxl.exec:\rrxrfxl.exe81⤵PID:2752
-
\??\c:\tttnhb.exec:\tttnhb.exe82⤵PID:2700
-
\??\c:\jjjdp.exec:\jjjdp.exe83⤵PID:2244
-
\??\c:\9ththb.exec:\9ththb.exe84⤵PID:2576
-
\??\c:\dpvpv.exec:\dpvpv.exe85⤵PID:2804
-
\??\c:\xflllff.exec:\xflllff.exe86⤵PID:2604
-
\??\c:\nnhtbb.exec:\nnhtbb.exe87⤵PID:3064
-
\??\c:\jvvjv.exec:\jvvjv.exe88⤵PID:2724
-
\??\c:\vdjpd.exec:\vdjpd.exe89⤵PID:536
-
\??\c:\rrrxrxf.exec:\rrrxrxf.exe90⤵PID:2868
-
\??\c:\bhthnb.exec:\bhthnb.exe91⤵PID:2768
-
\??\c:\pjjjv.exec:\pjjjv.exe92⤵PID:1436
-
\??\c:\frxrxrr.exec:\frxrxrr.exe93⤵PID:1496
-
\??\c:\hthtnn.exec:\hthtnn.exe94⤵PID:952
-
\??\c:\vvvjd.exec:\vvvjd.exe95⤵PID:1960
-
\??\c:\xxlxlrl.exec:\xxlxlrl.exe96⤵PID:1492
-
\??\c:\llrlfrl.exec:\llrlfrl.exe97⤵PID:1612
-
\??\c:\thtntn.exec:\thtntn.exe98⤵PID:1776
-
\??\c:\vjvvd.exec:\vjvvd.exe99⤵PID:448
-
\??\c:\xlxfxrx.exec:\xlxfxrx.exe100⤵PID:2636
-
\??\c:\hbbtnh.exec:\hbbtnh.exe101⤵PID:844
-
\??\c:\ppvjv.exec:\ppvjv.exe102⤵PID:1416
-
\??\c:\lxflxfx.exec:\lxflxfx.exe103⤵PID:580
-
\??\c:\hbhnth.exec:\hbhnth.exe104⤵PID:2424
-
\??\c:\jpvpv.exec:\jpvpv.exe105⤵PID:896
-
\??\c:\rrrlxfr.exec:\rrrlxfr.exe106⤵PID:1468
-
\??\c:\nnnbtn.exec:\nnnbtn.exe107⤵PID:1724
-
\??\c:\hhhtht.exec:\hhhtht.exe108⤵PID:1276
-
\??\c:\pjdvv.exec:\pjdvv.exe109⤵PID:1684
-
\??\c:\rrxrrxr.exec:\rrxrrxr.exe110⤵
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\ntttnt.exec:\ntttnt.exe111⤵PID:3024
-
\??\c:\jvvpp.exec:\jvvpp.exe112⤵PID:3028
-
\??\c:\5ppdp.exec:\5ppdp.exe113⤵PID:984
-
\??\c:\fxlxflr.exec:\fxlxflr.exe114⤵PID:1552
-
\??\c:\9hhnbh.exec:\9hhnbh.exe115⤵PID:2332
-
\??\c:\pddpp.exec:\pddpp.exe116⤵PID:1508
-
\??\c:\llfrlxl.exec:\llfrlxl.exe117⤵PID:1364
-
\??\c:\bbtnbn.exec:\bbtnbn.exe118⤵PID:2440
-
\??\c:\jpvpp.exec:\jpvpp.exe119⤵PID:2324
-
\??\c:\frrrxrf.exec:\frrrxrf.exe120⤵PID:2836
-
\??\c:\rrxflff.exec:\rrxflff.exe121⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-