Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 20:22
Static task
static1
Behavioral task
behavioral1
Sample
1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe
Resource
win7-20240903-en
General
-
Target
1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe
-
Size
455KB
-
MD5
665c6c57bec5443dd19c09bf26229498
-
SHA1
2efbb80fd11f945211b97a2dc9e4fe147e0d8bf0
-
SHA256
1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7
-
SHA512
c6337aa319c85ee894bdfa343034236749f55016c9c56a41065b206009c19f657878625bbe37217ef5199479e5190acca199d6a81cebfdfcababf54f78092930
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-39-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2372-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-1036-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-1067-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-223-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2012-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrrxlrf.exerxrflxr.exetbhntt.exellrffrl.exebtbhth.exepdvvp.exelxrlrrl.exebbthnh.exettnnbh.exevpdvj.exerfxrxfr.exebttbtt.exepjjpv.exe5xrlrxl.exehhbbhn.exevvjvp.exejvjjp.exerrxxlrl.exebbtbbb.exelxllxxf.exebtntnt.exe5dppd.exexxrrxxl.exebtnttt.exe3vjdd.exelrfrxfx.exenhhthn.exe3djjp.exefffxrxx.exebthnnn.exevpjvv.exedvpvd.exe7xllxfr.exethnbnn.exehnhthn.exevpddp.exe9llxllx.exe9tbhhh.exepjdpp.exerfrfrrf.exehbbtbb.exepvvdd.exejvjjp.exe3lffxxl.exetnbhnn.exejjddd.exelfxlflx.exelxlrflx.exe3thhnn.exedvjjp.exe1dvdd.exexrxxffl.exehhhbhn.exevvvdv.exefxfflrx.exexlfflrf.exebbnthn.exehbbhhn.exeddpjd.exe3rxxxfx.exe5rfflrr.exe5tnnnn.exeppdpd.exe5vjjp.exepid process 2824 rrrxlrf.exe 2672 rxrflxr.exe 2724 tbhntt.exe 2372 llrffrl.exe 796 btbhth.exe 2640 pdvvp.exe 3060 lxrlrrl.exe 2940 bbthnh.exe 1520 ttnnbh.exe 2024 vpdvj.exe 1744 rfxrxfr.exe 2784 bttbtt.exe 576 pjjpv.exe 2928 5xrlrxl.exe 908 hhbbhn.exe 1920 vvjvp.exe 3004 jvjjp.exe 492 rrxxlrl.exe 1176 bbtbbb.exe 448 lxllxxf.exe 2012 btntnt.exe 1500 5dppd.exe 1504 xxrrxxl.exe 2464 btnttt.exe 1424 3vjdd.exe 1840 lrfrxfx.exe 2116 nhhthn.exe 700 3djjp.exe 2072 fffxrxx.exe 2644 bthnnn.exe 1488 vpjvv.exe 2980 dvpvd.exe 2696 7xllxfr.exe 2908 thnbnn.exe 2700 hnhthn.exe 2924 vpddp.exe 2580 9llxllx.exe 796 9tbhhh.exe 2056 pjdpp.exe 2596 rfrfrrf.exe 2616 hbbtbb.exe 2172 pvvdd.exe 2912 jvjjp.exe 1856 3lffxxl.exe 1968 tnbhnn.exe 3068 jjddd.exe 1412 lfxlflx.exe 2776 lxlrflx.exe 340 3thhnn.exe 476 dvjjp.exe 2544 1dvdd.exe 1920 xrxxffl.exe 3004 hhhbhn.exe 1884 vvvdv.exe 300 fxfflrx.exe 2896 xlfflrf.exe 1628 bbnthn.exe 2340 hbbhhn.exe 992 ddpjd.exe 2920 3rxxxfx.exe 2460 5rfflrr.exe 1512 5tnnnn.exe 760 ppdpd.exe 856 5vjjp.exe -
Processes:
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-1142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-1093-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-80-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rlrrrrf.exerrrxffx.exetnbtbb.exe7fxxfff.exedvppd.exe9jvvv.exeflxxrrf.exebnnhbt.exepjvvd.exebbtbbb.exexxxrlfr.exe3xrxfrf.exehhbbhn.exebnhhtt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exerrrxlrf.exerxrflxr.exetbhntt.exellrffrl.exebtbhth.exepdvvp.exelxrlrrl.exebbthnh.exettnnbh.exevpdvj.exerfxrxfr.exebttbtt.exepjjpv.exe5xrlrxl.exehhbbhn.exedescription pid process target process PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe rrrxlrf.exe PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe rrrxlrf.exe PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe rrrxlrf.exe PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe rrrxlrf.exe PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe rxrflxr.exe PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe rxrflxr.exe PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe rxrflxr.exe PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe rxrflxr.exe PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 7btnhh.exe PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 7btnhh.exe PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 7btnhh.exe PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 7btnhh.exe PID 2724 wrote to memory of 2372 2724 tbhntt.exe llrffrl.exe PID 2724 wrote to memory of 2372 2724 tbhntt.exe llrffrl.exe PID 2724 wrote to memory of 2372 2724 tbhntt.exe llrffrl.exe PID 2724 wrote to memory of 2372 2724 tbhntt.exe llrffrl.exe PID 2372 wrote to memory of 796 2372 llrffrl.exe llxrlxr.exe PID 2372 wrote to memory of 796 2372 llrffrl.exe llxrlxr.exe PID 2372 wrote to memory of 796 2372 llrffrl.exe llxrlxr.exe PID 2372 wrote to memory of 796 2372 llrffrl.exe llxrlxr.exe PID 796 wrote to memory of 2640 796 btbhth.exe vvdvv.exe PID 796 wrote to memory of 2640 796 btbhth.exe vvdvv.exe PID 796 wrote to memory of 2640 796 btbhth.exe vvdvv.exe PID 796 wrote to memory of 2640 796 btbhth.exe vvdvv.exe PID 2640 wrote to memory of 3060 2640 pdvvp.exe lxrlrrl.exe PID 2640 wrote to memory of 3060 2640 pdvvp.exe lxrlrrl.exe PID 2640 wrote to memory of 3060 2640 pdvvp.exe lxrlrrl.exe PID 2640 wrote to memory of 3060 2640 pdvvp.exe lxrlrrl.exe PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe bbthnh.exe PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe bbthnh.exe PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe bbthnh.exe PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe bbthnh.exe PID 2940 wrote to memory of 1520 2940 bbthnh.exe ttnnbh.exe PID 2940 wrote to memory of 1520 2940 bbthnh.exe ttnnbh.exe PID 2940 wrote to memory of 1520 2940 bbthnh.exe ttnnbh.exe PID 2940 wrote to memory of 1520 2940 bbthnh.exe ttnnbh.exe PID 1520 wrote to memory of 2024 1520 ttnnbh.exe xrlrllr.exe PID 1520 wrote to memory of 2024 1520 ttnnbh.exe xrlrllr.exe PID 1520 wrote to memory of 2024 1520 ttnnbh.exe xrlrllr.exe PID 1520 wrote to memory of 2024 1520 ttnnbh.exe xrlrllr.exe PID 2024 wrote to memory of 1744 2024 vpdvj.exe rfxrxfr.exe PID 2024 wrote to memory of 1744 2024 vpdvj.exe rfxrxfr.exe PID 2024 wrote to memory of 1744 2024 vpdvj.exe rfxrxfr.exe PID 2024 wrote to memory of 1744 2024 vpdvj.exe rfxrxfr.exe PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe bttbtt.exe PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe bttbtt.exe PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe bttbtt.exe PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe bttbtt.exe PID 2784 wrote to memory of 576 2784 bttbtt.exe pjjpv.exe PID 2784 wrote to memory of 576 2784 bttbtt.exe pjjpv.exe PID 2784 wrote to memory of 576 2784 bttbtt.exe pjjpv.exe PID 2784 wrote to memory of 576 2784 bttbtt.exe pjjpv.exe PID 576 wrote to memory of 2928 576 pjjpv.exe 5xrlrxl.exe PID 576 wrote to memory of 2928 576 pjjpv.exe 5xrlrxl.exe PID 576 wrote to memory of 2928 576 pjjpv.exe 5xrlrxl.exe PID 576 wrote to memory of 2928 576 pjjpv.exe 5xrlrxl.exe PID 2928 wrote to memory of 908 2928 5xrlrxl.exe hhbbhn.exe PID 2928 wrote to memory of 908 2928 5xrlrxl.exe hhbbhn.exe PID 2928 wrote to memory of 908 2928 5xrlrxl.exe hhbbhn.exe PID 2928 wrote to memory of 908 2928 5xrlrxl.exe hhbbhn.exe PID 908 wrote to memory of 1920 908 hhbbhn.exe vvjvp.exe PID 908 wrote to memory of 1920 908 hhbbhn.exe vvjvp.exe PID 908 wrote to memory of 1920 908 hhbbhn.exe vvjvp.exe PID 908 wrote to memory of 1920 908 hhbbhn.exe vvjvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe"C:\Users\Admin\AppData\Local\Temp\1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rxrflxr.exec:\rxrflxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tbhntt.exec:\tbhntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\llrffrl.exec:\llrffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\btbhth.exec:\btbhth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\pdvvp.exec:\pdvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\lxrlrrl.exec:\lxrlrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\bbthnh.exec:\bbthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ttnnbh.exec:\ttnnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vpdvj.exec:\vpdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\rfxrxfr.exec:\rfxrxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\bttbtt.exec:\bttbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjjpv.exec:\pjjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\5xrlrxl.exec:\5xrlrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\hhbbhn.exec:\hhbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\vvjvp.exec:\vvjvp.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jvjjp.exec:\jvjjp.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrxxlrl.exec:\rrxxlrl.exe19⤵
- Executes dropped EXE
PID:492 -
\??\c:\bbtbbb.exec:\bbtbbb.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176 -
\??\c:\lxllxxf.exec:\lxllxxf.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\btntnt.exec:\btntnt.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5dppd.exec:\5dppd.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\btnttt.exec:\btnttt.exe25⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3vjdd.exec:\3vjdd.exe26⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lrfrxfx.exec:\lrfrxfx.exe27⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhhthn.exec:\nhhthn.exe28⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3djjp.exec:\3djjp.exe29⤵
- Executes dropped EXE
PID:700 -
\??\c:\fffxrxx.exec:\fffxrxx.exe30⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bthnnn.exec:\bthnnn.exe31⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpjvv.exec:\vpjvv.exe32⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dvpvd.exec:\dvpvd.exe33⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7xllxfr.exec:\7xllxfr.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\thnbnn.exec:\thnbnn.exe35⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hnhthn.exec:\hnhthn.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpddp.exec:\vpddp.exe37⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9llxllx.exec:\9llxllx.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9tbhhh.exec:\9tbhhh.exe39⤵
- Executes dropped EXE
PID:796 -
\??\c:\pjdpp.exec:\pjdpp.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rfrfrrf.exec:\rfrfrrf.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbbtbb.exec:\hbbtbb.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pvvdd.exec:\pvvdd.exe43⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jvjjp.exec:\jvjjp.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3lffxxl.exec:\3lffxxl.exe45⤵
- Executes dropped EXE
PID:1856 -
\??\c:\tnbhnn.exec:\tnbhnn.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jjddd.exec:\jjddd.exe47⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfxlflx.exec:\lfxlflx.exe48⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lxlrflx.exec:\lxlrflx.exe49⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3thhnn.exec:\3thhnn.exe50⤵
- Executes dropped EXE
PID:340 -
\??\c:\dvjjp.exec:\dvjjp.exe51⤵
- Executes dropped EXE
PID:476 -
\??\c:\1dvdd.exec:\1dvdd.exe52⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrxxffl.exec:\xrxxffl.exe53⤵
- Executes dropped EXE
PID:1920 -
\??\c:\hhhbhn.exec:\hhhbhn.exe54⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vvvdv.exec:\vvvdv.exe55⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxfflrx.exec:\fxfflrx.exe56⤵
- Executes dropped EXE
PID:300 -
\??\c:\xlfflrf.exec:\xlfflrf.exe57⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbnthn.exec:\bbnthn.exe58⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hbbhhn.exec:\hbbhhn.exe59⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ddpjd.exec:\ddpjd.exe60⤵
- Executes dropped EXE
PID:992 -
\??\c:\3rxxxfx.exec:\3rxxxfx.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5rfflrr.exec:\5rfflrr.exe62⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5tnnnn.exec:\5tnnnn.exe63⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ppdpd.exec:\ppdpd.exe64⤵
- Executes dropped EXE
PID:760 -
\??\c:\5vjjp.exec:\5vjjp.exe65⤵
- Executes dropped EXE
PID:856 -
\??\c:\lxllflr.exec:\lxllflr.exe66⤵PID:1840
-
\??\c:\htbbnh.exec:\htbbnh.exe67⤵PID:2164
-
\??\c:\7hbtnt.exec:\7hbtnt.exe68⤵PID:1648
-
\??\c:\pjddv.exec:\pjddv.exe69⤵PID:1760
-
\??\c:\ddpvd.exec:\ddpvd.exe70⤵PID:2144
-
\??\c:\5xlrflf.exec:\5xlrflf.exe71⤵PID:2828
-
\??\c:\tnnnhn.exec:\tnnnhn.exe72⤵PID:1488
-
\??\c:\bnhhtt.exec:\bnhhtt.exe73⤵PID:2936
-
\??\c:\pjdpv.exec:\pjdpv.exe74⤵PID:2972
-
\??\c:\lllrxxr.exec:\lllrxxr.exe75⤵PID:2728
-
\??\c:\3nhnhh.exec:\3nhnhh.exe76⤵PID:2700
-
\??\c:\hnbhbt.exec:\hnbhbt.exe77⤵PID:2592
-
\??\c:\vvppv.exec:\vvppv.exe78⤵PID:2520
-
\??\c:\jdvvj.exec:\jdvvj.exe79⤵PID:2612
-
\??\c:\llflxfx.exec:\llflxfx.exe80⤵PID:1708
-
\??\c:\xxllxrf.exec:\xxllxrf.exe81⤵PID:2836
-
\??\c:\ntttbb.exec:\ntttbb.exe82⤵PID:2596
-
\??\c:\bbbhht.exec:\bbbhht.exe83⤵PID:1044
-
\??\c:\3jvdj.exec:\3jvdj.exe84⤵PID:1604
-
\??\c:\xrlrllr.exec:\xrlrllr.exe85⤵PID:2024
-
\??\c:\lxlrfxl.exec:\lxlrfxl.exe86⤵PID:1540
-
\??\c:\hbnhhn.exec:\hbnhhn.exe87⤵PID:468
-
\??\c:\tnbhnn.exec:\tnbhnn.exe88⤵PID:2792
-
\??\c:\ppddd.exec:\ppddd.exe89⤵PID:1248
-
\??\c:\lrllxlf.exec:\lrllxlf.exe90⤵PID:2760
-
\??\c:\flllrrl.exec:\flllrrl.exe91⤵PID:2900
-
\??\c:\ttbtnb.exec:\ttbtnb.exe92⤵PID:340
-
\??\c:\ppjjp.exec:\ppjjp.exe93⤵PID:476
-
\??\c:\jjvvd.exec:\jjvvd.exe94⤵PID:2136
-
\??\c:\9frrxfr.exec:\9frrxfr.exe95⤵PID:1920
-
\??\c:\frfrffl.exec:\frfrffl.exe96⤵PID:2436
-
\??\c:\nnnbnt.exec:\nnnbnt.exe97⤵PID:1176
-
\??\c:\3ppjj.exec:\3ppjj.exe98⤵PID:1684
-
\??\c:\jdvdp.exec:\jdvdp.exe99⤵PID:2896
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe100⤵PID:612
-
\??\c:\ffflffx.exec:\ffflffx.exe101⤵PID:2340
-
\??\c:\1hnhhb.exec:\1hnhhb.exe102⤵PID:992
-
\??\c:\djvvj.exec:\djvvj.exe103⤵PID:2224
-
\??\c:\5jpvd.exec:\5jpvd.exe104⤵PID:1356
-
\??\c:\fxlllfx.exec:\fxlllfx.exe105⤵PID:1716
-
\??\c:\ntnttn.exec:\ntnttn.exe106⤵PID:1124
-
\??\c:\pjvdp.exec:\pjvdp.exe107⤵PID:2192
-
\??\c:\ddppv.exec:\ddppv.exe108⤵PID:2304
-
\??\c:\3llxffx.exec:\3llxffx.exe109⤵PID:1180
-
\??\c:\9frxxxx.exec:\9frxxxx.exe110⤵PID:884
-
\??\c:\9nhhth.exec:\9nhhth.exe111⤵PID:2484
-
\??\c:\ppjpj.exec:\ppjpj.exe112⤵PID:1492
-
\??\c:\vjvvj.exec:\vjvvj.exe113⤵PID:2816
-
\??\c:\5rlxlxl.exec:\5rlxlxl.exe114⤵PID:2668
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe115⤵PID:2696
-
\??\c:\7btnhh.exec:\7btnhh.exe116⤵PID:2724
-
\??\c:\jvdpp.exec:\jvdpp.exe117⤵PID:2708
-
\??\c:\9pdpd.exec:\9pdpd.exe118⤵PID:1872
-
\??\c:\fxxrxrx.exec:\fxxrxrx.exe119⤵PID:3052
-
\??\c:\rlffllf.exec:\rlffllf.exe120⤵PID:2580
-
\??\c:\frfffff.exec:\frfffff.exe121⤵PID:3044
-
\??\c:\tnbtbb.exec:\tnbtbb.exe122⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-