Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:52
Static task
static1
Behavioral task
behavioral1
Sample
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe
Resource
win7-20240903-en
General
-
Target
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe
-
Size
453KB
-
MD5
cc4d46815384798476dfe3a17633726f
-
SHA1
da32d8c42958b8c85cc8f98d8b67743c21ac1caa
-
SHA256
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b
-
SHA512
c8b147afac53acba404e8b00fd1c3a12881e65cbd8f4938b054878429598a7c5631efc758c98dd159728b63dbfd6ed45acd575fd2084324e350206fd08cc4b87
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-65-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2776-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-85-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-160-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2900-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-195-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2140-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-197-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2140-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-242-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2428-266-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1468-271-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2400-289-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2644-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-316-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2412-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-344-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2708-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1184-402-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2796-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-480-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2204-543-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1484-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-797-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2960-804-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/3012-817-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1532-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-1008-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-1021-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjvd.exe1fxfrrf.exenbnbth.exedvpvj.exehbhhhh.exeddpvd.exehhhthb.exevjjjp.exelfxfrrf.exe1pjdp.exe7htttt.exerxllrxl.exennhttt.exe3fxrfff.exebthhnt.exedvvvj.exennntnt.exe1jjpp.exentnbnb.exejdpdj.exehhttnh.exethbbhb.exe1fxfffl.exebnbbbb.exelffxfff.exejdpjv.exe1rflrxl.exe1pppp.exerxrlxfr.exefflrxxl.exedvvdj.exelxxxflx.exejdpdj.exefxxflrf.exelrrrlrf.exe9nbbnt.exe5jvvj.exerxllrrx.exexxlfllf.exetnhthh.exevpjjp.exefxllrrf.exefxrrlxf.exenbhnbh.exeppdpv.exe3dvdp.exexxxfrrf.exenhbbhh.exe3nhtbb.exe5vddj.exelxrrflf.exehbbbhb.exehbnhbb.exejdvdd.exerlxrxxl.exenhthnn.exe5thhhn.exe1dvjp.exellfrxfl.exe3rflxxl.exehhbbhh.exe1vjjp.exexrlrffx.exelxflrxl.exepid Process 376 ppjvd.exe 484 1fxfrrf.exe 380 nbnbth.exe 2744 dvpvj.exe 2148 hbhhhh.exe 2856 ddpvd.exe 2776 hhhthb.exe 2588 vjjjp.exe 2676 lfxfrrf.exe 2632 1pjdp.exe 2236 7htttt.exe 1892 rxllrxl.exe 2016 nnhttt.exe 2372 3fxrfff.exe 2036 bthhnt.exe 1748 dvvvj.exe 2900 nnntnt.exe 1352 1jjpp.exe 2908 ntnbnb.exe 2172 jdpdj.exe 2140 hhttnh.exe 408 thbbhb.exe 1752 1fxfffl.exe 688 bnbbbb.exe 1468 lffxfff.exe 1112 jdpjv.exe 3012 1rflrxl.exe 2428 1pppp.exe 2532 rxrlxfr.exe 1792 fflrxxl.exe 2400 dvvdj.exe 2644 lxxxflx.exe 2364 jdpdj.exe 1524 fxxflrf.exe 2352 lrrrlrf.exe 2096 9nbbnt.exe 2412 5jvvj.exe 2668 rxllrrx.exe 2708 xxlfllf.exe 2696 tnhthh.exe 2680 vpjjp.exe 2700 fxllrrf.exe 2588 fxrrlxf.exe 2564 nbhnbh.exe 2636 ppdpv.exe 2860 3dvdp.exe 1184 xxxfrrf.exe 2236 nhbbhh.exe 1788 3nhtbb.exe 2040 5vddj.exe 2100 lxrrflf.exe 2768 hbbbhb.exe 1612 hbnhbb.exe 1740 jdvdd.exe 1508 rlxrxxl.exe 2796 nhthnn.exe 2924 5thhhn.exe 1076 1dvjp.exe 1736 llfrxfl.exe 1400 3rflxxl.exe 1180 hhbbhh.exe 448 1vjjp.exe 1240 xrlrffx.exe 632 lxflrxl.exe -
Processes:
resource yara_rule behavioral1/memory/1968-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-160-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2900-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-197-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/2644-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-316-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2412-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-480-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2204-543-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1484-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-721-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2024-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-817-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1532-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-982-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-1008-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-1036-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2152-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1ddpp.exe5bnnbh.exefrfrfrl.exepjjvv.exexrrrlrx.exehbbhnn.exethbhnh.exerlxrxxl.exetnhbbb.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exeppjvd.exe1fxfrrf.exenbnbth.exedvpvj.exehbhhhh.exeddpvd.exehhhthb.exevjjjp.exelfxfrrf.exe1pjdp.exe7htttt.exerxllrxl.exennhttt.exe3fxrfff.exebthhnt.exedescription pid Process procid_target PID 1968 wrote to memory of 376 1968 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 31 PID 1968 wrote to memory of 376 1968 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 31 PID 1968 wrote to memory of 376 1968 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 31 PID 1968 wrote to memory of 376 1968 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 31 PID 376 wrote to memory of 484 376 ppjvd.exe 32 PID 376 wrote to memory of 484 376 ppjvd.exe 32 PID 376 wrote to memory of 484 376 ppjvd.exe 32 PID 376 wrote to memory of 484 376 ppjvd.exe 32 PID 484 wrote to memory of 380 484 1fxfrrf.exe 33 PID 484 wrote to memory of 380 484 1fxfrrf.exe 33 PID 484 wrote to memory of 380 484 1fxfrrf.exe 33 PID 484 wrote to memory of 380 484 1fxfrrf.exe 33 PID 380 wrote to memory of 2744 380 nbnbth.exe 34 PID 380 wrote to memory of 2744 380 nbnbth.exe 34 PID 380 wrote to memory of 2744 380 nbnbth.exe 34 PID 380 wrote to memory of 2744 380 nbnbth.exe 34 PID 2744 wrote to memory of 2148 2744 dvpvj.exe 35 PID 2744 wrote to memory of 2148 2744 dvpvj.exe 35 PID 2744 wrote to memory of 2148 2744 dvpvj.exe 35 PID 2744 wrote to memory of 2148 2744 dvpvj.exe 35 PID 2148 wrote to memory of 2856 2148 hbhhhh.exe 36 PID 2148 wrote to memory of 2856 2148 hbhhhh.exe 36 PID 2148 wrote to memory of 2856 2148 hbhhhh.exe 36 PID 2148 wrote to memory of 2856 2148 hbhhhh.exe 36 PID 2856 wrote to memory of 2776 2856 ddpvd.exe 37 PID 2856 wrote to memory of 2776 2856 ddpvd.exe 37 PID 2856 wrote to memory of 2776 2856 ddpvd.exe 37 PID 2856 wrote to memory of 2776 2856 ddpvd.exe 37 PID 2776 wrote to memory of 2588 2776 hhhthb.exe 38 PID 2776 wrote to memory of 2588 2776 hhhthb.exe 38 PID 2776 wrote to memory of 2588 2776 hhhthb.exe 38 PID 2776 wrote to memory of 2588 2776 hhhthb.exe 38 PID 2588 wrote to memory of 2676 2588 vjjjp.exe 39 PID 2588 wrote to memory of 2676 2588 vjjjp.exe 39 PID 2588 wrote to memory of 2676 2588 vjjjp.exe 39 PID 2588 wrote to memory of 2676 2588 vjjjp.exe 39 PID 2676 wrote to memory of 2632 2676 lfxfrrf.exe 40 PID 2676 wrote to memory of 2632 2676 lfxfrrf.exe 40 PID 2676 wrote to memory of 2632 2676 lfxfrrf.exe 40 PID 2676 wrote to memory of 2632 2676 lfxfrrf.exe 40 PID 2632 wrote to memory of 2236 2632 1pjdp.exe 41 PID 2632 wrote to memory of 2236 2632 1pjdp.exe 41 PID 2632 wrote to memory of 2236 2632 1pjdp.exe 41 PID 2632 wrote to memory of 2236 2632 1pjdp.exe 41 PID 2236 wrote to memory of 1892 2236 7htttt.exe 42 PID 2236 wrote to memory of 1892 2236 7htttt.exe 42 PID 2236 wrote to memory of 1892 2236 7htttt.exe 42 PID 2236 wrote to memory of 1892 2236 7htttt.exe 42 PID 1892 wrote to memory of 2016 1892 rxllrxl.exe 43 PID 1892 wrote to memory of 2016 1892 rxllrxl.exe 43 PID 1892 wrote to memory of 2016 1892 rxllrxl.exe 43 PID 1892 wrote to memory of 2016 1892 rxllrxl.exe 43 PID 2016 wrote to memory of 2372 2016 nnhttt.exe 44 PID 2016 wrote to memory of 2372 2016 nnhttt.exe 44 PID 2016 wrote to memory of 2372 2016 nnhttt.exe 44 PID 2016 wrote to memory of 2372 2016 nnhttt.exe 44 PID 2372 wrote to memory of 2036 2372 3fxrfff.exe 45 PID 2372 wrote to memory of 2036 2372 3fxrfff.exe 45 PID 2372 wrote to memory of 2036 2372 3fxrfff.exe 45 PID 2372 wrote to memory of 2036 2372 3fxrfff.exe 45 PID 2036 wrote to memory of 1748 2036 bthhnt.exe 46 PID 2036 wrote to memory of 1748 2036 bthhnt.exe 46 PID 2036 wrote to memory of 1748 2036 bthhnt.exe 46 PID 2036 wrote to memory of 1748 2036 bthhnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe"C:\Users\Admin\AppData\Local\Temp\c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\ppjvd.exec:\ppjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\1fxfrrf.exec:\1fxfrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\nbnbth.exec:\nbnbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\dvpvj.exec:\dvpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hbhhhh.exec:\hbhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ddpvd.exec:\ddpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\hhhthb.exec:\hhhthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vjjjp.exec:\vjjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1pjdp.exec:\1pjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\7htttt.exec:\7htttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rxllrxl.exec:\rxllrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\nnhttt.exec:\nnhttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\3fxrfff.exec:\3fxrfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\bthhnt.exec:\bthhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\dvvvj.exec:\dvvvj.exe17⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nnntnt.exec:\nnntnt.exe18⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1jjpp.exec:\1jjpp.exe19⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ntnbnb.exec:\ntnbnb.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jdpdj.exec:\jdpdj.exe21⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hhttnh.exec:\hhttnh.exe22⤵
- Executes dropped EXE
PID:2140 -
\??\c:\thbbhb.exec:\thbbhb.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\1fxfffl.exec:\1fxfffl.exe24⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bnbbbb.exec:\bnbbbb.exe25⤵
- Executes dropped EXE
PID:688 -
\??\c:\lffxfff.exec:\lffxfff.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jdpjv.exec:\jdpjv.exe27⤵
- Executes dropped EXE
PID:1112 -
\??\c:\1rflrxl.exec:\1rflrxl.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1pppp.exec:\1pppp.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rxrlxfr.exec:\rxrlxfr.exe30⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fflrxxl.exec:\fflrxxl.exe31⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvvdj.exec:\dvvdj.exe32⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lxxxflx.exec:\lxxxflx.exe33⤵
- Executes dropped EXE
PID:2644 -
\??\c:\jdpdj.exec:\jdpdj.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fxxflrf.exec:\fxxflrf.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lrrrlrf.exec:\lrrrlrf.exe36⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9nbbnt.exec:\9nbbnt.exe37⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5jvvj.exec:\5jvvj.exe38⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rxllrrx.exec:\rxllrrx.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xxlfllf.exec:\xxlfllf.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tnhthh.exec:\tnhthh.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpjjp.exec:\vpjjp.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fxllrrf.exec:\fxllrrf.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fxrrlxf.exec:\fxrrlxf.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nbhnbh.exec:\nbhnbh.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ppdpv.exec:\ppdpv.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3dvdp.exec:\3dvdp.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xxxfrrf.exec:\xxxfrrf.exe48⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nhbbhh.exec:\nhbbhh.exe49⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3nhtbb.exec:\3nhtbb.exe50⤵
- Executes dropped EXE
PID:1788 -
\??\c:\5vddj.exec:\5vddj.exe51⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lxrrflf.exec:\lxrrflf.exe52⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hbbbhb.exec:\hbbbhb.exe53⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbnhbb.exec:\hbnhbb.exe54⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jdvdd.exec:\jdvdd.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\nhthnn.exec:\nhthnn.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5thhhn.exec:\5thhhn.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1dvjp.exec:\1dvjp.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\llfrxfl.exec:\llfrxfl.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3rflxxl.exec:\3rflxxl.exe61⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hhbbhh.exec:\hhbbhh.exe62⤵
- Executes dropped EXE
PID:1180 -
\??\c:\1vjjp.exec:\1vjjp.exe63⤵
- Executes dropped EXE
PID:448 -
\??\c:\xrlrffx.exec:\xrlrffx.exe64⤵
- Executes dropped EXE
PID:1240 -
\??\c:\lxflrxl.exec:\lxflrxl.exe65⤵
- Executes dropped EXE
PID:632 -
\??\c:\9nbhtn.exec:\9nbhtn.exe66⤵PID:2192
-
\??\c:\pjvjp.exec:\pjvjp.exe67⤵PID:828
-
\??\c:\pvpjj.exec:\pvpjj.exe68⤵PID:2184
-
\??\c:\5fxflrr.exec:\5fxflrr.exe69⤵PID:908
-
\??\c:\9tbhhb.exec:\9tbhhb.exe70⤵PID:2204
-
\??\c:\ttnbtb.exec:\ttnbtb.exe71⤵PID:576
-
\??\c:\7jddd.exec:\7jddd.exe72⤵PID:1848
-
\??\c:\rllxlrx.exec:\rllxlrx.exe73⤵PID:1484
-
\??\c:\nhhnbt.exec:\nhhnbt.exe74⤵PID:1932
-
\??\c:\9hbtbh.exec:\9hbtbh.exe75⤵PID:2132
-
\??\c:\vvppd.exec:\vvppd.exe76⤵PID:1552
-
\??\c:\1pjjp.exec:\1pjjp.exe77⤵PID:1532
-
\??\c:\flxrxxf.exec:\flxrxxf.exe78⤵PID:2340
-
\??\c:\hbbhnn.exec:\hbbhnn.exe79⤵
- System Location Discovery: System Language Discovery
PID:1028 -
\??\c:\9jddv.exec:\9jddv.exe80⤵PID:1928
-
\??\c:\3lxfrrf.exec:\3lxfrrf.exe81⤵PID:1936
-
\??\c:\bnnbnn.exec:\bnnbnn.exe82⤵PID:3016
-
\??\c:\hbnhnt.exec:\hbnhnt.exe83⤵PID:2720
-
\??\c:\jdddj.exec:\jdddj.exe84⤵PID:2724
-
\??\c:\ffflffl.exec:\ffflffl.exe85⤵PID:2776
-
\??\c:\fxrxfrl.exec:\fxrxfrl.exe86⤵PID:2804
-
\??\c:\3bhnnb.exec:\3bhnnb.exe87⤵PID:2728
-
\??\c:\pjvdv.exec:\pjvdv.exe88⤵PID:2676
-
\??\c:\lfrxlrl.exec:\lfrxlrl.exe89⤵PID:2612
-
\??\c:\3rrlflr.exec:\3rrlflr.exe90⤵PID:2392
-
\??\c:\tnbhbt.exec:\tnbhbt.exe91⤵PID:1184
-
\??\c:\jvvdj.exec:\jvvdj.exe92⤵PID:1440
-
\??\c:\fxrxllx.exec:\fxrxllx.exe93⤵PID:1892
-
\??\c:\3lxxlrx.exec:\3lxxlrx.exe94⤵PID:1944
-
\??\c:\7ntbbb.exec:\7ntbbb.exe95⤵PID:2548
-
\??\c:\1tnnbb.exec:\1tnnbb.exe96⤵PID:2036
-
\??\c:\vpvdp.exec:\vpvdp.exe97⤵PID:1992
-
\??\c:\fxxflrx.exec:\fxxflrx.exe98⤵PID:2024
-
\??\c:\rrlfflf.exec:\rrlfflf.exe99⤵PID:1508
-
\??\c:\ttthbn.exec:\ttthbn.exe100⤵PID:2944
-
\??\c:\jjpjv.exec:\jjpjv.exe101⤵PID:2908
-
\??\c:\xrxxrlx.exec:\xrxxrlx.exe102⤵PID:2328
-
\??\c:\tnthtb.exec:\tnthtb.exe103⤵PID:904
-
\??\c:\1htnbh.exec:\1htnbh.exe104⤵PID:2140
-
\??\c:\vpjpj.exec:\vpjpj.exe105⤵PID:940
-
\??\c:\5rxrxxl.exec:\5rxrxxl.exe106⤵PID:1088
-
\??\c:\9xrrxxl.exec:\9xrrxxl.exe107⤵PID:1864
-
\??\c:\hbnbhh.exec:\hbnbhh.exe108⤵PID:688
-
\??\c:\jpjjv.exec:\jpjjv.exe109⤵PID:804
-
\??\c:\vpddj.exec:\vpddj.exe110⤵PID:2960
-
\??\c:\fllfxfl.exec:\fllfxfl.exe111⤵PID:1220
-
\??\c:\tbttnt.exec:\tbttnt.exe112⤵PID:3012
-
\??\c:\vvpdp.exec:\vvpdp.exe113⤵PID:2200
-
\??\c:\fxrrffl.exec:\fxrrffl.exe114⤵PID:2160
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe115⤵PID:880
-
\??\c:\tnbhtt.exec:\tnbhtt.exe116⤵PID:3040
-
\??\c:\vpjdd.exec:\vpjdd.exe117⤵PID:1932
-
\??\c:\rrrllxr.exec:\rrrllxr.exe118⤵PID:2132
-
\??\c:\btnbtb.exec:\btnbtb.exe119⤵PID:2996
-
\??\c:\ppdjv.exec:\ppdjv.exe120⤵PID:1532
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe121⤵PID:2352
-
\??\c:\5ntbbb.exec:\5ntbbb.exe122⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-