Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 09:04
Behavioral task
behavioral1
Sample
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
-
Size
91KB
-
MD5
f66665e8915c3d3682adc114cd97f658
-
SHA1
790d90a518b13d1abd9356b21b34d84257ff9b30
-
SHA256
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379
-
SHA512
433dff41a794073667047e34048dd625f0f2cab5757f43d17e98b65a5b188ce83cd1e94e11deaa2210c08f0187e1c9b96bb23b8f28bfedadf3d57a7b4cbbf90b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436CS:9hOmTsF93UYfwC6GIoutyaVszyKd+XYM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/2284-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-72-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2512-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-135-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-136-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2460-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-153-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-173-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2540-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-226-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2356-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-365-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1824-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-403-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2028-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-622-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-660-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2564-671-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1876-737-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-754-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-768-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-775-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2100-795-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-803-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2064-808-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1832-842-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2200-845-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2280-885-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-890-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-903-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1340-939-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-949-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1680-963-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1488-978-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2796-991-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2844-1020-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2296 fxllxfl.exe 2128 dvjdj.exe 2640 jjjjd.exe 2904 ffllrrf.exe 2888 9btthh.exe 2696 nnnttb.exe 2664 ddpjp.exe 2512 ppjjv.exe 2972 rlflrxl.exe 1256 nnbhbn.exe 808 vvvpv.exe 1500 pjdjp.exe 2028 xxrrxxf.exe 2812 9fxrxrf.exe 2844 rrffllr.exe 1712 hhthnt.exe 2460 7nhnnt.exe 1572 jjpvd.exe 1536 ffxfxfr.exe 1204 3bbthb.exe 1992 jpppd.exe 2076 djdvv.exe 2540 rlxlffl.exe 2908 nhbhtb.exe 2356 5jdvv.exe 964 9rflrrx.exe 1368 nbhbhb.exe 1228 7djpp.exe 888 vjvvv.exe 1528 9rlflll.exe 2176 1btbbh.exe 1496 9nnbbb.exe 1952 ppjvd.exe 3020 xrfxrrr.exe 1588 xlrlllr.exe 3056 tnttbb.exe 2724 jvdjj.exe 2608 ddpjp.exe 2632 xrlrffr.exe 2624 3lrxfll.exe 2888 nhnbnn.exe 2672 pvjpd.exe 2856 llffflr.exe 2544 lfxxfll.exe 2976 1tttbb.exe 2552 pddvv.exe 556 9frffxl.exe 1824 rffflfr.exe 808 nbnnnn.exe 1868 btbthn.exe 2028 pdpvj.exe 2676 vdpjp.exe 2588 lxfflrl.exe 1816 3hbhnn.exe 1248 3thnnt.exe 1400 jvpjj.exe 764 9rffrxf.exe 1836 rffffll.exe 1096 9xllxfl.exe 2404 nbhnnn.exe 2472 vpvjd.exe 1972 lxlllrx.exe 2468 nhhnhb.exe 2076 nbnnhn.exe -
resource yara_rule behavioral1/memory/2284-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001225c-5.dat upx behavioral1/memory/2296-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000014afa-18.dat upx behavioral1/memory/2128-25-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2128-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014b28-26.dat upx behavioral1/memory/2640-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014bda-35.dat upx behavioral1/files/0x0007000000014c23-45.dat upx behavioral1/memory/2904-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014cde-55.dat upx behavioral1/files/0x0007000000014f7b-63.dat upx behavioral1/memory/2664-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015016-73.dat upx behavioral1/memory/2664-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cf8-84.dat upx behavioral1/memory/2972-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d11-94.dat upx behavioral1/files/0x0006000000016d33-101.dat upx behavioral1/files/0x0006000000016d46-111.dat upx behavioral1/memory/808-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4a-118.dat upx behavioral1/files/0x0006000000016d4e-127.dat upx behavioral1/memory/2812-135-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016db3-138.dat upx behavioral1/memory/2844-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-136-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016db8-146.dat upx behavioral1/files/0x0006000000016dd2-165.dat upx behavioral1/memory/2460-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dc7-157.dat upx behavioral1/memory/1712-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1572-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd6-174.dat upx behavioral1/memory/1536-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ee0-184.dat upx behavioral1/files/0x0006000000017051-193.dat upx behavioral1/files/0x00060000000170b5-201.dat upx behavioral1/files/0x0006000000017546-209.dat upx behavioral1/memory/2540-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175c6-218.dat upx behavioral1/memory/2356-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175cc-227.dat upx behavioral1/memory/2356-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175d2-238.dat upx behavioral1/files/0x0031000000018654-246.dat upx behavioral1/files/0x0005000000018669-255.dat upx behavioral1/files/0x00050000000186d2-264.dat upx behavioral1/memory/1228-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186de-273.dat upx behavioral1/files/0x00050000000186ee-281.dat upx behavioral1/files/0x000500000001875d-290.dat upx behavioral1/memory/1952-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-366-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 28 PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 28 PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 28 PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 28 PID 2296 wrote to memory of 2128 2296 fxllxfl.exe 29 PID 2296 wrote to memory of 2128 2296 fxllxfl.exe 29 PID 2296 wrote to memory of 2128 2296 fxllxfl.exe 29 PID 2296 wrote to memory of 2128 2296 fxllxfl.exe 29 PID 2128 wrote to memory of 2640 2128 dvjdj.exe 30 PID 2128 wrote to memory of 2640 2128 dvjdj.exe 30 PID 2128 wrote to memory of 2640 2128 dvjdj.exe 30 PID 2128 wrote to memory of 2640 2128 dvjdj.exe 30 PID 2640 wrote to memory of 2904 2640 jjjjd.exe 31 PID 2640 wrote to memory of 2904 2640 jjjjd.exe 31 PID 2640 wrote to memory of 2904 2640 jjjjd.exe 31 PID 2640 wrote to memory of 2904 2640 jjjjd.exe 31 PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 32 PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 32 PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 32 PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 32 PID 2888 wrote to memory of 2696 2888 9btthh.exe 33 PID 2888 wrote to memory of 2696 2888 9btthh.exe 33 PID 2888 wrote to memory of 2696 2888 9btthh.exe 33 PID 2888 wrote to memory of 2696 2888 9btthh.exe 33 PID 2696 wrote to memory of 2664 2696 nnnttb.exe 34 PID 2696 wrote to memory of 2664 2696 nnnttb.exe 34 PID 2696 wrote to memory of 2664 2696 nnnttb.exe 34 PID 2696 wrote to memory of 2664 2696 nnnttb.exe 34 PID 2664 wrote to memory of 2512 2664 ddpjp.exe 35 PID 2664 wrote to memory of 2512 2664 ddpjp.exe 35 PID 2664 wrote to memory of 2512 2664 ddpjp.exe 35 PID 2664 wrote to memory of 2512 2664 ddpjp.exe 35 PID 2512 wrote to memory of 2972 2512 ppjjv.exe 36 PID 2512 wrote to memory of 2972 2512 ppjjv.exe 36 PID 2512 wrote to memory of 2972 2512 ppjjv.exe 36 PID 2512 wrote to memory of 2972 2512 ppjjv.exe 36 PID 2972 wrote to memory of 1256 2972 rlflrxl.exe 37 PID 2972 wrote to memory of 1256 2972 rlflrxl.exe 37 PID 2972 wrote to memory of 1256 2972 rlflrxl.exe 37 PID 2972 wrote to memory of 1256 2972 rlflrxl.exe 37 PID 1256 wrote to memory of 808 1256 nnbhbn.exe 38 PID 1256 wrote to memory of 808 1256 nnbhbn.exe 38 PID 1256 wrote to memory of 808 1256 nnbhbn.exe 38 PID 1256 wrote to memory of 808 1256 nnbhbn.exe 38 PID 808 wrote to memory of 1500 808 vvvpv.exe 39 PID 808 wrote to memory of 1500 808 vvvpv.exe 39 PID 808 wrote to memory of 1500 808 vvvpv.exe 39 PID 808 wrote to memory of 1500 808 vvvpv.exe 39 PID 1500 wrote to memory of 2028 1500 pjdjp.exe 40 PID 1500 wrote to memory of 2028 1500 pjdjp.exe 40 PID 1500 wrote to memory of 2028 1500 pjdjp.exe 40 PID 1500 wrote to memory of 2028 1500 pjdjp.exe 40 PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 41 PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 41 PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 41 PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 41 PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe 42 PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe 42 PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe 42 PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe 42 PID 2844 wrote to memory of 1712 2844 rrffllr.exe 43 PID 2844 wrote to memory of 1712 2844 rrffllr.exe 43 PID 2844 wrote to memory of 1712 2844 rrffllr.exe 43 PID 2844 wrote to memory of 1712 2844 rrffllr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\fxllxfl.exec:\fxllxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dvjdj.exec:\dvjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\jjjjd.exec:\jjjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ffllrrf.exec:\ffllrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9btthh.exec:\9btthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nnnttb.exec:\nnnttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ddpjp.exec:\ddpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ppjjv.exec:\ppjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rlflrxl.exec:\rlflrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nnbhbn.exec:\nnbhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\vvvpv.exec:\vvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\pjdjp.exec:\pjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9fxrxrf.exec:\9fxrxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rrffllr.exec:\rrffllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hhthnt.exec:\hhthnt.exe17⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7nhnnt.exec:\7nhnnt.exe18⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjpvd.exec:\jjpvd.exe19⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe20⤵
- Executes dropped EXE
PID:1536 -
\??\c:\3bbthb.exec:\3bbthb.exe21⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jpppd.exec:\jpppd.exe22⤵
- Executes dropped EXE
PID:1992 -
\??\c:\djdvv.exec:\djdvv.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rlxlffl.exec:\rlxlffl.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nhbhtb.exec:\nhbhtb.exe25⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5jdvv.exec:\5jdvv.exe26⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9rflrrx.exec:\9rflrrx.exe27⤵
- Executes dropped EXE
PID:964 -
\??\c:\nbhbhb.exec:\nbhbhb.exe28⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7djpp.exec:\7djpp.exe29⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vjvvv.exec:\vjvvv.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\9rlflll.exec:\9rlflll.exe31⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1btbbh.exec:\1btbbh.exe32⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9nnbbb.exec:\9nnbbb.exe33⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ppjvd.exec:\ppjvd.exe34⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xlrlllr.exec:\xlrlllr.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnttbb.exec:\tnttbb.exe37⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvdjj.exec:\jvdjj.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ddpjp.exec:\ddpjp.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrlrffr.exec:\xrlrffr.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3lrxfll.exec:\3lrxfll.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhnbnn.exec:\nhnbnn.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pvjpd.exec:\pvjpd.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\llffflr.exec:\llffflr.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lfxxfll.exec:\lfxxfll.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1tttbb.exec:\1tttbb.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pddvv.exec:\pddvv.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\9frffxl.exec:\9frffxl.exe48⤵
- Executes dropped EXE
PID:556 -
\??\c:\rffflfr.exec:\rffflfr.exe49⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nbnnnn.exec:\nbnnnn.exe50⤵
- Executes dropped EXE
PID:808 -
\??\c:\btbthn.exec:\btbthn.exe51⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pdpvj.exec:\pdpvj.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vdpjp.exec:\vdpjp.exe53⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lxfflrl.exec:\lxfflrl.exe54⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3hbhnn.exec:\3hbhnn.exe55⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3thnnt.exec:\3thnnt.exe56⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jvpjj.exec:\jvpjj.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\9rffrxf.exec:\9rffrxf.exe58⤵
- Executes dropped EXE
PID:764 -
\??\c:\rffffll.exec:\rffffll.exe59⤵
- Executes dropped EXE
PID:1836 -
\??\c:\9xllxfl.exec:\9xllxfl.exe60⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nbhnnn.exec:\nbhnnn.exe61⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vpvjd.exec:\vpvjd.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lxlllrx.exec:\lxlllrx.exe63⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhhnhb.exec:\nhhnhb.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nbnnhn.exec:\nbnnhn.exe65⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pjdjj.exec:\pjdjj.exe66⤵PID:2540
-
\??\c:\llffxrl.exec:\llffxrl.exe67⤵PID:3036
-
\??\c:\rfllxff.exec:\rfllxff.exe68⤵PID:1828
-
\??\c:\hntbbb.exec:\hntbbb.exe69⤵PID:1792
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:1556
-
\??\c:\3lrfflr.exec:\3lrfflr.exe71⤵PID:2268
-
\??\c:\7rrfxfl.exec:\7rrfxfl.exe72⤵PID:944
-
\??\c:\7bhnbb.exec:\7bhnbb.exe73⤵PID:928
-
\??\c:\hhbhnn.exec:\hhbhnn.exe74⤵PID:1968
-
\??\c:\pdpvv.exec:\pdpvv.exe75⤵PID:2132
-
\??\c:\rllrlfx.exec:\rllrlfx.exe76⤵PID:1000
-
\??\c:\7rrlfxx.exec:\7rrlfxx.exe77⤵PID:1516
-
\??\c:\bbnhhb.exec:\bbnhhb.exe78⤵PID:2420
-
\??\c:\9vpvp.exec:\9vpvp.exe79⤵PID:1956
-
\??\c:\1ddjd.exec:\1ddjd.exe80⤵PID:2272
-
\??\c:\ffflxrr.exec:\ffflxrr.exe81⤵PID:2284
-
\??\c:\hbttbt.exec:\hbttbt.exe82⤵PID:2592
-
\??\c:\httthb.exec:\httthb.exe83⤵PID:3056
-
\??\c:\9vvjd.exec:\9vvjd.exe84⤵PID:2640
-
\??\c:\pjdpj.exec:\pjdpj.exe85⤵
- System Location Discovery: System Language Discovery
PID:3068 -
\??\c:\xrlrrlr.exec:\xrlrrlr.exe86⤵PID:2708
-
\??\c:\fxlflll.exec:\fxlflll.exe87⤵PID:2144
-
\??\c:\nbhbhh.exec:\nbhbhh.exe88⤵PID:2696
-
\??\c:\nnhthb.exec:\nnhthb.exe89⤵PID:2520
-
\??\c:\vpddj.exec:\vpddj.exe90⤵PID:2856
-
\??\c:\1pvvv.exec:\1pvvv.exe91⤵PID:2564
-
\??\c:\llxxffl.exec:\llxxffl.exe92⤵PID:2976
-
\??\c:\xlrrffl.exec:\xlrrffl.exe93⤵PID:2980
-
\??\c:\nbnthb.exec:\nbnthb.exe94⤵PID:584
-
\??\c:\7nttbb.exec:\7nttbb.exe95⤵PID:292
-
\??\c:\hhbhtb.exec:\hhbhtb.exe96⤵PID:1500
-
\??\c:\jpdjd.exec:\jpdjd.exe97⤵PID:1868
-
\??\c:\djvvd.exec:\djvvd.exe98⤵PID:552
-
\??\c:\frflxfl.exec:\frflxfl.exe99⤵PID:280
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe100⤵PID:2588
-
\??\c:\3bhnnt.exec:\3bhnnt.exe101⤵PID:1816
-
\??\c:\1vdvv.exec:\1vdvv.exe102⤵PID:1876
-
\??\c:\pdjdj.exec:\pdjdj.exe103⤵PID:2476
-
\??\c:\frfllrx.exec:\frfllrx.exe104⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\lfrxrlr.exec:\lfrxrlr.exe105⤵PID:1080
-
\??\c:\tnbhnt.exec:\tnbhnt.exe106⤵PID:2248
-
\??\c:\vpjpv.exec:\vpjpv.exe107⤵PID:1872
-
\??\c:\jvpdd.exec:\jvpdd.exe108⤵PID:2872
-
\??\c:\lxllrlr.exec:\lxllrlr.exe109⤵PID:2360
-
\??\c:\bhthbb.exec:\bhthbb.exe110⤵PID:2100
-
\??\c:\5ntntb.exec:\5ntntb.exe111⤵PID:2916
-
\??\c:\ddvpp.exec:\ddvpp.exe112⤵PID:2064
-
\??\c:\pdpdj.exec:\pdpdj.exe113⤵PID:684
-
\??\c:\ffffllx.exec:\ffffllx.exe114⤵PID:1332
-
\??\c:\5xfxxxf.exec:\5xfxxxf.exe115⤵PID:1164
-
\??\c:\3tbhtb.exec:\3tbhtb.exe116⤵PID:812
-
\??\c:\tnbbnn.exec:\tnbbnn.exe117⤵PID:1832
-
\??\c:\pvjpv.exec:\pvjpv.exe118⤵PID:2200
-
\??\c:\vpdvd.exec:\vpdvd.exe119⤵PID:1784
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe120⤵PID:996
-
\??\c:\5xrxxxx.exec:\5xrxxxx.exe121⤵PID:2176
-
\??\c:\ttbtnb.exec:\ttbtnb.exe122⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-