Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 23:23
Behavioral task
behavioral1
Sample
0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe
-
Size
67KB
-
MD5
28ad9528f44fa7bab934285e87902d36
-
SHA1
dedf3f6bbf4f8a22e3f22d1dbc907e8c5ac9b507
-
SHA256
0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114
-
SHA512
db7a264c5e7aed2aed140d38b30e8a8720ccda8e781ee196598533302436f507b8fe3f20a230d3ed6e3bcf6b895e825de9ba919c7e674d44ec5091ce970bb652
-
SSDEEP
1536:vvQBeOGtrYS3srx93UBWfwC6Ggnouy8TeRkuCwS:vhOmTsF93UYfwC6GIoutCRrS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2692-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-33-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-100-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1720-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/672-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/672-123-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-153-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2232-177-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2112-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-209-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1864-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-252-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-325-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2560-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-370-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1964-378-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1976-391-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2964-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-416-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2944-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-425-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3048-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-442-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1012-456-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1608-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-474-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/624-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-815-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2280-912-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/700-925-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/992-944-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2292-1048-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/996-1217-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2180-1303-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 nhbbbb.exe 2676 1dvvd.exe 2780 xrffxlr.exe 2952 fxxflrr.exe 2540 tnhhhn.exe 1996 vvvjp.exe 1612 1jdvd.exe 1700 lfrrxfr.exe 1356 hbhthn.exe 1720 djvjd.exe 3000 jdddj.exe 672 5fflxxl.exe 2872 3fxlrrf.exe 2916 bttnhb.exe 3004 7pjdp.exe 544 rflllrr.exe 2188 xrlxflx.exe 2232 bthntn.exe 2112 vjpvv.exe 2224 3pvpv.exe 2044 xrllllr.exe 2328 bnhntn.exe 1864 3nhhnt.exe 328 vvppd.exe 1228 ffrrrxl.exe 2260 llfrxxf.exe 2384 htntnt.exe 1580 pjdvj.exe 1912 vpdpv.exe 2040 llffflx.exe 552 3htbhb.exe 2676 vpvdd.exe 1632 9pjpd.exe 2708 xxrfflf.exe 2560 lflrrrr.exe 2596 nnttbt.exe 2716 dvvpj.exe 348 ddpjd.exe 2016 ffffffl.exe 1612 fxffrlr.exe 1700 ttnbnn.exe 1964 ttnhhn.exe 2120 vpjvv.exe 1976 1vddd.exe 1616 1lllxlr.exe 2896 9frrrfl.exe 2900 hbthbh.exe 2964 nhbbhn.exe 2944 pdppd.exe 3048 vpjjd.exe 1840 rlxxlrx.exe 1948 hhthhh.exe 1936 1hbbnt.exe 1012 pjvdp.exe 2404 jjvjv.exe 1608 xrllrrr.exe 624 7rffflr.exe 2504 hthhtn.exe 2516 xrffrrl.exe 756 5lflrxl.exe 1296 btnhtn.exe 1760 nhbhtb.exe 2492 vpvpd.exe 2500 vpjjp.exe -
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-8.dat upx behavioral1/memory/2692-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cfd-18.dat upx behavioral1/memory/2676-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d07-26.dat upx behavioral1/files/0x0008000000015d19-39.dat upx behavioral1/memory/2952-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d48-48.dat upx behavioral1/memory/2540-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d68-59.dat upx behavioral1/files/0x0007000000015d70-68.dat upx behavioral1/files/0x0008000000015da1-75.dat upx behavioral1/memory/1700-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c9b-86.dat upx behavioral1/memory/1700-84-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/memory/1356-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018657-97.dat upx behavioral1/files/0x000d000000018662-106.dat upx behavioral1/memory/1720-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001867d-114.dat upx behavioral1/memory/3000-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/672-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186c8-125.dat upx behavioral1/files/0x000500000001878d-133.dat upx behavioral1/memory/2872-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190c6-144.dat upx behavioral1/files/0x00060000000190c9-155.dat upx behavioral1/files/0x00050000000191f3-163.dat upx behavioral1/files/0x00050000000191fd-174.dat upx behavioral1/memory/2232-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019217-182.dat upx behavioral1/files/0x0005000000019220-190.dat upx behavioral1/memory/2224-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019238-201.dat upx behavioral1/memory/2224-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019240-211.dat upx behavioral1/memory/2044-209-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001925d-220.dat upx behavioral1/memory/1864-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1864-229-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019263-232.dat upx behavioral1/memory/1864-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-239.dat upx behavioral1/files/0x0005000000019280-248.dat upx behavioral1/memory/1228-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-252-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001938b-257.dat upx behavioral1/memory/2384-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019399-266.dat upx behavioral1/memory/1580-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b7-276.dat upx behavioral1/memory/1580-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c1-283.dat upx behavioral1/memory/2040-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/552-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c8-293.dat upx behavioral1/memory/552-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d4-305.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2768 2692 0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe 31 PID 2692 wrote to memory of 2768 2692 0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe 31 PID 2692 wrote to memory of 2768 2692 0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe 31 PID 2692 wrote to memory of 2768 2692 0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe 31 PID 2768 wrote to memory of 2676 2768 nhbbbb.exe 32 PID 2768 wrote to memory of 2676 2768 nhbbbb.exe 32 PID 2768 wrote to memory of 2676 2768 nhbbbb.exe 32 PID 2768 wrote to memory of 2676 2768 nhbbbb.exe 32 PID 2676 wrote to memory of 2780 2676 1dvvd.exe 33 PID 2676 wrote to memory of 2780 2676 1dvvd.exe 33 PID 2676 wrote to memory of 2780 2676 1dvvd.exe 33 PID 2676 wrote to memory of 2780 2676 1dvvd.exe 33 PID 2780 wrote to memory of 2952 2780 xrffxlr.exe 34 PID 2780 wrote to memory of 2952 2780 xrffxlr.exe 34 PID 2780 wrote to memory of 2952 2780 xrffxlr.exe 34 PID 2780 wrote to memory of 2952 2780 xrffxlr.exe 34 PID 2952 wrote to memory of 2540 2952 fxxflrr.exe 35 PID 2952 wrote to memory of 2540 2952 fxxflrr.exe 35 PID 2952 wrote to memory of 2540 2952 fxxflrr.exe 35 PID 2952 wrote to memory of 2540 2952 fxxflrr.exe 35 PID 2540 wrote to memory of 1996 2540 tnhhhn.exe 36 PID 2540 wrote to memory of 1996 2540 tnhhhn.exe 36 PID 2540 wrote to memory of 1996 2540 tnhhhn.exe 36 PID 2540 wrote to memory of 1996 2540 tnhhhn.exe 36 PID 1996 wrote to memory of 1612 1996 vvvjp.exe 37 PID 1996 wrote to memory of 1612 1996 vvvjp.exe 37 PID 1996 wrote to memory of 1612 1996 vvvjp.exe 37 PID 1996 wrote to memory of 1612 1996 vvvjp.exe 37 PID 1612 wrote to memory of 1700 1612 1jdvd.exe 38 PID 1612 wrote to memory of 1700 1612 1jdvd.exe 38 PID 1612 wrote to memory of 1700 1612 1jdvd.exe 38 PID 1612 wrote to memory of 1700 1612 1jdvd.exe 38 PID 1700 wrote to memory of 1356 1700 lfrrxfr.exe 39 PID 1700 wrote to memory of 1356 1700 lfrrxfr.exe 39 PID 1700 wrote to memory of 1356 1700 lfrrxfr.exe 39 PID 1700 wrote to memory of 1356 1700 lfrrxfr.exe 39 PID 1356 wrote to memory of 1720 1356 hbhthn.exe 40 PID 1356 wrote to memory of 1720 1356 hbhthn.exe 40 PID 1356 wrote to memory of 1720 1356 hbhthn.exe 40 PID 1356 wrote to memory of 1720 1356 hbhthn.exe 40 PID 1720 wrote to memory of 3000 1720 djvjd.exe 41 PID 1720 wrote to memory of 3000 1720 djvjd.exe 41 PID 1720 wrote to memory of 3000 1720 djvjd.exe 41 PID 1720 wrote to memory of 3000 1720 djvjd.exe 41 PID 3000 wrote to memory of 672 3000 jdddj.exe 42 PID 3000 wrote to memory of 672 3000 jdddj.exe 42 PID 3000 wrote to memory of 672 3000 jdddj.exe 42 PID 3000 wrote to memory of 672 3000 jdddj.exe 42 PID 672 wrote to memory of 2872 672 5fflxxl.exe 43 PID 672 wrote to memory of 2872 672 5fflxxl.exe 43 PID 672 wrote to memory of 2872 672 5fflxxl.exe 43 PID 672 wrote to memory of 2872 672 5fflxxl.exe 43 PID 2872 wrote to memory of 2916 2872 3fxlrrf.exe 44 PID 2872 wrote to memory of 2916 2872 3fxlrrf.exe 44 PID 2872 wrote to memory of 2916 2872 3fxlrrf.exe 44 PID 2872 wrote to memory of 2916 2872 3fxlrrf.exe 44 PID 2916 wrote to memory of 3004 2916 bttnhb.exe 45 PID 2916 wrote to memory of 3004 2916 bttnhb.exe 45 PID 2916 wrote to memory of 3004 2916 bttnhb.exe 45 PID 2916 wrote to memory of 3004 2916 bttnhb.exe 45 PID 3004 wrote to memory of 544 3004 7pjdp.exe 46 PID 3004 wrote to memory of 544 3004 7pjdp.exe 46 PID 3004 wrote to memory of 544 3004 7pjdp.exe 46 PID 3004 wrote to memory of 544 3004 7pjdp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe"C:\Users\Admin\AppData\Local\Temp\0e65387d408b9f826d05885cb8242b65eb3fee0458403c3fc3527c50711e7114.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nhbbbb.exec:\nhbbbb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\1dvvd.exec:\1dvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xrffxlr.exec:\xrffxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\fxxflrr.exec:\fxxflrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\tnhhhn.exec:\tnhhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vvvjp.exec:\vvvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\1jdvd.exec:\1jdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\hbhthn.exec:\hbhthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\djvjd.exec:\djvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\jdddj.exec:\jdddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\5fflxxl.exec:\5fflxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\3fxlrrf.exec:\3fxlrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\bttnhb.exec:\bttnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\7pjdp.exec:\7pjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rflllrr.exec:\rflllrr.exe17⤵
- Executes dropped EXE
PID:544 -
\??\c:\xrlxflx.exec:\xrlxflx.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bthntn.exec:\bthntn.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vjpvv.exec:\vjpvv.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3pvpv.exec:\3pvpv.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrllllr.exec:\xrllllr.exe22⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bnhntn.exec:\bnhntn.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3nhhnt.exec:\3nhhnt.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vvppd.exec:\vvppd.exe25⤵
- Executes dropped EXE
PID:328 -
\??\c:\ffrrrxl.exec:\ffrrrxl.exe26⤵
- Executes dropped EXE
PID:1228 -
\??\c:\llfrxxf.exec:\llfrxxf.exe27⤵
- Executes dropped EXE
PID:2260 -
\??\c:\htntnt.exec:\htntnt.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pjdvj.exec:\pjdvj.exe29⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vpdpv.exec:\vpdpv.exe30⤵
- Executes dropped EXE
PID:1912 -
\??\c:\llffflx.exec:\llffflx.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3htbhb.exec:\3htbhb.exe32⤵
- Executes dropped EXE
PID:552 -
\??\c:\vpvdd.exec:\vpvdd.exe33⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9pjpd.exec:\9pjpd.exe34⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xxrfflf.exec:\xxrfflf.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lflrrrr.exec:\lflrrrr.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nnttbt.exec:\nnttbt.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvvpj.exec:\dvvpj.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ddpjd.exec:\ddpjd.exe39⤵
- Executes dropped EXE
PID:348 -
\??\c:\ffffffl.exec:\ffffffl.exe40⤵
- Executes dropped EXE
PID:2016 -
\??\c:\fxffrlr.exec:\fxffrlr.exe41⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ttnbnn.exec:\ttnbnn.exe42⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ttnhhn.exec:\ttnhhn.exe43⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vpjvv.exec:\vpjvv.exe44⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1vddd.exec:\1vddd.exe45⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1lllxlr.exec:\1lllxlr.exe46⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9frrrfl.exec:\9frrrfl.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbthbh.exec:\hbthbh.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhbbhn.exec:\nhbbhn.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pdppd.exec:\pdppd.exe50⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpjjd.exec:\vpjjd.exe51⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe52⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hhthhh.exec:\hhthhh.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\1hbbnt.exec:\1hbbnt.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjvdp.exec:\pjvdp.exe55⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jjvjv.exec:\jjvjv.exe56⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xrllrrr.exec:\xrllrrr.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7rffflr.exec:\7rffflr.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\hthhtn.exec:\hthhtn.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrffrrl.exec:\xrffrrl.exe60⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5lflrxl.exec:\5lflrxl.exe61⤵
- Executes dropped EXE
PID:756 -
\??\c:\btnhtn.exec:\btnhtn.exe62⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nhbhtb.exec:\nhbhtb.exe63⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vpvpd.exec:\vpvpd.exe64⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpjjp.exec:\vpjjp.exe65⤵
- Executes dropped EXE
PID:2500 -
\??\c:\flxlfxx.exec:\flxlfxx.exe66⤵PID:1848
-
\??\c:\7xrlxxf.exec:\7xrlxxf.exe67⤵PID:2468
-
\??\c:\7tttbb.exec:\7tttbb.exe68⤵PID:1512
-
\??\c:\3thbtb.exec:\3thbtb.exe69⤵PID:2072
-
\??\c:\hbttbh.exec:\hbttbh.exe70⤵PID:2432
-
\??\c:\7dvdp.exec:\7dvdp.exe71⤵PID:2164
-
\??\c:\vpjpv.exec:\vpjpv.exe72⤵PID:1504
-
\??\c:\lxllrrx.exec:\lxllrrx.exe73⤵PID:2736
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe74⤵PID:1740
-
\??\c:\5tnnnn.exec:\5tnnnn.exe75⤵PID:2704
-
\??\c:\nhtntn.exec:\nhtntn.exe76⤵PID:2548
-
\??\c:\vvjvd.exec:\vvjvd.exe77⤵PID:2952
-
\??\c:\pjvpv.exec:\pjvpv.exe78⤵PID:2656
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe79⤵PID:1724
-
\??\c:\9xxlxxf.exec:\9xxlxxf.exe80⤵PID:2716
-
\??\c:\tntbnn.exec:\tntbnn.exe81⤵PID:2816
-
\??\c:\nnhhhn.exec:\nnhhhn.exe82⤵PID:1048
-
\??\c:\nhbhnt.exec:\nhbhnt.exe83⤵PID:2996
-
\??\c:\vjvvj.exec:\vjvvj.exe84⤵PID:1700
-
\??\c:\5jjvj.exec:\5jjvj.exe85⤵PID:2888
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe86⤵PID:2120
-
\??\c:\xrllrrx.exec:\xrllrrx.exe87⤵PID:776
-
\??\c:\1bnbtt.exec:\1bnbtt.exe88⤵PID:2844
-
\??\c:\hbtbhh.exec:\hbtbhh.exe89⤵PID:2860
-
\??\c:\jdjpv.exec:\jdjpv.exe90⤵PID:2872
-
\??\c:\5pjdj.exec:\5pjdj.exe91⤵PID:2876
-
\??\c:\fxfflfx.exec:\fxfflfx.exe92⤵PID:1540
-
\??\c:\lfllrrx.exec:\lfllrrx.exe93⤵PID:308
-
\??\c:\3fxlfrx.exec:\3fxlfrx.exe94⤵PID:1584
-
\??\c:\hbhnnn.exec:\hbhnnn.exe95⤵PID:1836
-
\??\c:\hbnnht.exec:\hbnnht.exe96⤵PID:352
-
\??\c:\jddvv.exec:\jddvv.exe97⤵PID:2196
-
\??\c:\3vddj.exec:\3vddj.exe98⤵PID:2112
-
\??\c:\llxffrx.exec:\llxffrx.exe99⤵PID:2220
-
\??\c:\9frfflx.exec:\9frfflx.exe100⤵PID:884
-
\??\c:\3hbhtt.exec:\3hbhtt.exe101⤵PID:1960
-
\??\c:\hbthtt.exec:\hbthtt.exe102⤵PID:624
-
\??\c:\5nhhtt.exec:\5nhhtt.exe103⤵PID:2504
-
\??\c:\jddjv.exec:\jddjv.exe104⤵PID:2132
-
\??\c:\1dvjp.exec:\1dvjp.exe105⤵PID:756
-
\??\c:\rfrrffl.exec:\rfrrffl.exe106⤵PID:1916
-
\??\c:\lxllrrx.exec:\lxllrrx.exe107⤵PID:1760
-
\??\c:\3rllllr.exec:\3rllllr.exe108⤵PID:1212
-
\??\c:\htntbb.exec:\htntbb.exe109⤵PID:2244
-
\??\c:\tnhhnn.exec:\tnhhnn.exe110⤵PID:2496
-
\??\c:\jvdjp.exec:\jvdjp.exe111⤵PID:1716
-
\??\c:\jvdjp.exec:\jvdjp.exe112⤵PID:3068
-
\??\c:\jvvpp.exec:\jvvpp.exe113⤵PID:876
-
\??\c:\7lflxff.exec:\7lflxff.exe114⤵PID:2024
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe115⤵PID:2660
-
\??\c:\tntntb.exec:\tntntb.exe116⤵PID:552
-
\??\c:\htnnbn.exec:\htnnbn.exe117⤵PID:1528
-
\??\c:\vpvjj.exec:\vpvjj.exe118⤵PID:2812
-
\??\c:\3vvvp.exec:\3vvvp.exe119⤵PID:2840
-
\??\c:\9xlfxxl.exec:\9xlfxxl.exe120⤵PID:2576
-
\??\c:\1xlffll.exec:\1xlffll.exe121⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-