Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 10:22
Behavioral task
behavioral1
Sample
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe
Resource
win10v2004-20241007-en
General
-
Target
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe
-
Size
91KB
-
MD5
d86d960a54efe7c9f9801b7fc58e35ab
-
SHA1
76fa8703bda1dbad4cd62ed2ff9c030882e2aa0e
-
SHA256
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb
-
SHA512
1b5398f0fb86e61a281ed82544ccdafcd171d6948f76109f9371a0ac99e5ab79ed4f80aa82bc703b03cb2281c54350c807bd8de3ed68f99f8303056cc236a8e1
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436Cn:9hOmTsF93UYfwC6GIoutyaVszyKd+XYt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1320-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-54-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2816-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1480-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-136-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/572-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-167-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1128-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-196-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2992-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-204-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-290-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2092-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-357-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2628-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1088-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-487-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/620-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-544-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1956-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-602-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1324-738-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-745-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-796-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1736-862-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2092-863-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-877-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2836-893-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/844-932-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/844-930-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2308-939-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2308-960-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-980-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-979-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2928-1012-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2900-1250-0x00000000001E0000-0x0000000000207000-memory.dmp family_blackmoon behavioral1/memory/2548-1289-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3044-1320-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/336-1352-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrfllrr.exetthnnn.exepddvj.exenbtbbn.exehhbhnb.exepjjdd.exexlxfrlr.exettntbh.exebtbhtb.exepdvpp.exeppdvj.exexrfrflx.exerlxrfrr.exe3thnnt.exe5jddp.exe5rxrrfx.exe9lxrffl.exe1ttbtt.exehbnhnn.exepjvpj.exefxxrxxf.exefxxflfl.exebhthnb.exejddjv.exeppjvv.exerrxfxxr.exebbthbn.exe9jjjd.exe5vvpj.exexxlrlll.exerffrxxl.exettnttb.exethbnbh.exevjpvv.exelfrxffr.exeffxlrxf.exenbtbtt.exe5nbhnb.exe9hbthh.exexrxfrrf.exerrrllrf.exehnhhnh.exebtbtbn.exe3jpvp.exeflrrrfl.exefxfxrfr.exenbhbhb.exetbhbbn.exe7pjpj.exedpvvv.exefrlxrfr.exettnhht.exe5hnhbn.exepjdpv.exefxrflrl.exethbbhh.exe9nnbnb.exehbnnbh.exe7ppvd.exefxrflrl.exerlfxlxl.exetthtnt.exenbthnb.exejdvvv.exepid process 2540 xrfllrr.exe 2100 tthnnn.exe 1952 pddvj.exe 1320 nbtbbn.exe 2816 hhbhnb.exe 2752 pjjdd.exe 2136 xlxfrlr.exe 1776 ttntbh.exe 2604 btbhtb.exe 2680 pdvpp.exe 2220 ppdvj.exe 1480 xrfrflx.exe 1884 rlxrfrr.exe 876 3thnnt.exe 1316 5jddp.exe 572 5rxrrfx.exe 1128 9lxrffl.exe 1704 1ttbtt.exe 2976 hbnhnn.exe 2992 pjvpj.exe 2536 fxxrxxf.exe 2984 fxxflfl.exe 408 bhthnb.exe 2588 jddjv.exe 1380 ppjvv.exe 2744 rrxfxxr.exe 2228 bbthbn.exe 2980 9jjjd.exe 1184 5vvpj.exe 1960 xxlrlll.exe 2244 rffrxxl.exe 1732 ttnttb.exe 2316 thbnbh.exe 2092 vjpvv.exe 3012 lfrxffr.exe 1304 ffxlrxf.exe 2708 nbtbtt.exe 2832 5nbhnb.exe 2816 9hbthh.exe 2756 xrxfrrf.exe 2628 rrrllrf.exe 2776 hnhhnh.exe 2960 btbtbn.exe 2676 3jpvp.exe 2140 flrrrfl.exe 2648 fxfxrfr.exe 1860 nbhbhb.exe 1480 tbhbbn.exe 2904 7pjpj.exe 380 dpvvv.exe 876 frlxrfr.exe 1088 ttnhht.exe 1936 5hnhbn.exe 820 pjdpv.exe 236 fxrflrl.exe 816 thbbhh.exe 2796 9nnbnb.exe 2916 hbnnbh.exe 2144 7ppvd.exe 2536 fxrflrl.exe 2472 rlfxlxl.exe 1688 tthtnt.exe 620 nbthnb.exe 3048 jdvvv.exe -
Processes:
resource yara_rule behavioral1/memory/1732-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfllrr.exe upx behavioral1/memory/2540-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthnnn.exe upx behavioral1/memory/2100-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddvj.exe upx behavioral1/memory/2100-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1320-39-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbtbbn.exe upx C:\hhbhnb.exe upx C:\pjjdd.exe upx behavioral1/memory/2816-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxfrlr.exe upx behavioral1/memory/2752-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-57-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttntbh.exe upx behavioral1/memory/2136-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbhtb.exe upx behavioral1/memory/1776-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvpp.exe upx behavioral1/memory/2604-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdvj.exe upx behavioral1/memory/2220-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1480-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxrfrr.exe upx C:\xrfrflx.exe upx C:\3thnnt.exe upx C:\5jddp.exe upx behavioral1/memory/876-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lxrffl.exe upx behavioral1/memory/572-156-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5rxrrfx.exe upx C:\1ttbtt.exe upx C:\hbnhnn.exe upx behavioral1/memory/1704-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-166-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvpj.exe upx behavioral1/memory/2976-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxrxxf.exe upx behavioral1/memory/2992-194-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxxflfl.exe upx behavioral1/memory/2536-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-213-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\bhthnb.exe upx behavioral1/memory/2984-215-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddjv.exe upx behavioral1/memory/2588-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-233-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjvv.exe upx \??\c:\rrxfxxr.exe upx C:\bbthbn.exe upx C:\9jjjd.exe upx C:\5vvpj.exe upx C:\xxlrlll.exe upx behavioral1/memory/1184-273-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rffrxxl.exe upx behavioral1/memory/1960-282-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1732-294-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttnttb.exe upx behavioral1/memory/2244-290-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2092-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-344-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
lfrrrrx.exerxrxflr.exe1xxflxf.exepvdpp.exerlxlrxl.exehhhnbn.exexlxlxxx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exexrfllrr.exetthnnn.exepddvj.exenbtbbn.exehhbhnb.exepjjdd.exexlxfrlr.exettntbh.exebtbhtb.exepdvpp.exeppdvj.exexrfrflx.exerlxrfrr.exe3thnnt.exe5jddp.exedescription pid process target process PID 1732 wrote to memory of 2540 1732 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xrfllrr.exe PID 1732 wrote to memory of 2540 1732 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xrfllrr.exe PID 1732 wrote to memory of 2540 1732 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xrfllrr.exe PID 1732 wrote to memory of 2540 1732 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xrfllrr.exe PID 2540 wrote to memory of 2100 2540 xrfllrr.exe tthnnn.exe PID 2540 wrote to memory of 2100 2540 xrfllrr.exe tthnnn.exe PID 2540 wrote to memory of 2100 2540 xrfllrr.exe tthnnn.exe PID 2540 wrote to memory of 2100 2540 xrfllrr.exe tthnnn.exe PID 2100 wrote to memory of 1952 2100 tthnnn.exe pddvj.exe PID 2100 wrote to memory of 1952 2100 tthnnn.exe pddvj.exe PID 2100 wrote to memory of 1952 2100 tthnnn.exe pddvj.exe PID 2100 wrote to memory of 1952 2100 tthnnn.exe pddvj.exe PID 1952 wrote to memory of 1320 1952 pddvj.exe nbtbbn.exe PID 1952 wrote to memory of 1320 1952 pddvj.exe nbtbbn.exe PID 1952 wrote to memory of 1320 1952 pddvj.exe nbtbbn.exe PID 1952 wrote to memory of 1320 1952 pddvj.exe nbtbbn.exe PID 1320 wrote to memory of 2816 1320 nbtbbn.exe hhbhnb.exe PID 1320 wrote to memory of 2816 1320 nbtbbn.exe hhbhnb.exe PID 1320 wrote to memory of 2816 1320 nbtbbn.exe hhbhnb.exe PID 1320 wrote to memory of 2816 1320 nbtbbn.exe hhbhnb.exe PID 2816 wrote to memory of 2752 2816 hhbhnb.exe pjjdd.exe PID 2816 wrote to memory of 2752 2816 hhbhnb.exe pjjdd.exe PID 2816 wrote to memory of 2752 2816 hhbhnb.exe pjjdd.exe PID 2816 wrote to memory of 2752 2816 hhbhnb.exe pjjdd.exe PID 2752 wrote to memory of 2136 2752 pjjdd.exe xlxfrlr.exe PID 2752 wrote to memory of 2136 2752 pjjdd.exe xlxfrlr.exe PID 2752 wrote to memory of 2136 2752 pjjdd.exe xlxfrlr.exe PID 2752 wrote to memory of 2136 2752 pjjdd.exe xlxfrlr.exe PID 2136 wrote to memory of 1776 2136 xlxfrlr.exe ttntbh.exe PID 2136 wrote to memory of 1776 2136 xlxfrlr.exe ttntbh.exe PID 2136 wrote to memory of 1776 2136 xlxfrlr.exe ttntbh.exe PID 2136 wrote to memory of 1776 2136 xlxfrlr.exe ttntbh.exe PID 1776 wrote to memory of 2604 1776 ttntbh.exe btbhtb.exe PID 1776 wrote to memory of 2604 1776 ttntbh.exe btbhtb.exe PID 1776 wrote to memory of 2604 1776 ttntbh.exe btbhtb.exe PID 1776 wrote to memory of 2604 1776 ttntbh.exe btbhtb.exe PID 2604 wrote to memory of 2680 2604 btbhtb.exe pdvpp.exe PID 2604 wrote to memory of 2680 2604 btbhtb.exe pdvpp.exe PID 2604 wrote to memory of 2680 2604 btbhtb.exe pdvpp.exe PID 2604 wrote to memory of 2680 2604 btbhtb.exe pdvpp.exe PID 2680 wrote to memory of 2220 2680 pdvpp.exe ppdvj.exe PID 2680 wrote to memory of 2220 2680 pdvpp.exe ppdvj.exe PID 2680 wrote to memory of 2220 2680 pdvpp.exe ppdvj.exe PID 2680 wrote to memory of 2220 2680 pdvpp.exe ppdvj.exe PID 2220 wrote to memory of 1480 2220 ppdvj.exe xrfrflx.exe PID 2220 wrote to memory of 1480 2220 ppdvj.exe xrfrflx.exe PID 2220 wrote to memory of 1480 2220 ppdvj.exe xrfrflx.exe PID 2220 wrote to memory of 1480 2220 ppdvj.exe xrfrflx.exe PID 1480 wrote to memory of 1884 1480 xrfrflx.exe rlxrfrr.exe PID 1480 wrote to memory of 1884 1480 xrfrflx.exe rlxrfrr.exe PID 1480 wrote to memory of 1884 1480 xrfrflx.exe rlxrfrr.exe PID 1480 wrote to memory of 1884 1480 xrfrflx.exe rlxrfrr.exe PID 1884 wrote to memory of 876 1884 rlxrfrr.exe 3thnnt.exe PID 1884 wrote to memory of 876 1884 rlxrfrr.exe 3thnnt.exe PID 1884 wrote to memory of 876 1884 rlxrfrr.exe 3thnnt.exe PID 1884 wrote to memory of 876 1884 rlxrfrr.exe 3thnnt.exe PID 876 wrote to memory of 1316 876 3thnnt.exe 5jddp.exe PID 876 wrote to memory of 1316 876 3thnnt.exe 5jddp.exe PID 876 wrote to memory of 1316 876 3thnnt.exe 5jddp.exe PID 876 wrote to memory of 1316 876 3thnnt.exe 5jddp.exe PID 1316 wrote to memory of 572 1316 5jddp.exe 5rxrrfx.exe PID 1316 wrote to memory of 572 1316 5jddp.exe 5rxrrfx.exe PID 1316 wrote to memory of 572 1316 5jddp.exe 5rxrrfx.exe PID 1316 wrote to memory of 572 1316 5jddp.exe 5rxrrfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe"C:\Users\Admin\AppData\Local\Temp\fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\xrfllrr.exec:\xrfllrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\tthnnn.exec:\tthnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\pddvj.exec:\pddvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\nbtbbn.exec:\nbtbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\hhbhnb.exec:\hhbhnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pjjdd.exec:\pjjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\xlxfrlr.exec:\xlxfrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\ttntbh.exec:\ttntbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\btbhtb.exec:\btbhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pdvpp.exec:\pdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ppdvj.exec:\ppdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xrfrflx.exec:\xrfrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rlxrfrr.exec:\rlxrfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\3thnnt.exec:\3thnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\5jddp.exec:\5jddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\5rxrrfx.exec:\5rxrrfx.exe17⤵
- Executes dropped EXE
PID:572 -
\??\c:\9lxrffl.exec:\9lxrffl.exe18⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1ttbtt.exec:\1ttbtt.exe19⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbnhnn.exec:\hbnhnn.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pjvpj.exec:\pjvpj.exe21⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe22⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxxflfl.exec:\fxxflfl.exe23⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bhthnb.exec:\bhthnb.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\jddjv.exec:\jddjv.exe25⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ppjvv.exec:\ppjvv.exe26⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rrxfxxr.exec:\rrxfxxr.exe27⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bbthbn.exec:\bbthbn.exe28⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9jjjd.exec:\9jjjd.exe29⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5vvpj.exec:\5vvpj.exe30⤵
- Executes dropped EXE
PID:1184 -
\??\c:\xxlrlll.exec:\xxlrlll.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rffrxxl.exec:\rffrxxl.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ttnttb.exec:\ttnttb.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\thbnbh.exec:\thbnbh.exe34⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vjpvv.exec:\vjpvv.exe35⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lfrxffr.exec:\lfrxffr.exe36⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ffxlrxf.exec:\ffxlrxf.exe37⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nbtbtt.exec:\nbtbtt.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5nbhnb.exec:\5nbhnb.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9hbthh.exec:\9hbthh.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrxfrrf.exec:\xrxfrrf.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rrrllrf.exec:\rrrllrf.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hnhhnh.exec:\hnhhnh.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\btbtbn.exec:\btbtbn.exe44⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3jpvp.exec:\3jpvp.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\flrrrfl.exec:\flrrrfl.exe46⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fxfxrfr.exec:\fxfxrfr.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nbhbhb.exec:\nbhbhb.exe48⤵
- Executes dropped EXE
PID:1860 -
\??\c:\tbhbbn.exec:\tbhbbn.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7pjpj.exec:\7pjpj.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dpvvv.exec:\dpvvv.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\frlxrfr.exec:\frlxrfr.exe52⤵
- Executes dropped EXE
PID:876 -
\??\c:\ttnhht.exec:\ttnhht.exe53⤵
- Executes dropped EXE
PID:1088 -
\??\c:\5hnhbn.exec:\5hnhbn.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjdpv.exec:\pjdpv.exe55⤵
- Executes dropped EXE
PID:820 -
\??\c:\fxrflrl.exec:\fxrflrl.exe56⤵
- Executes dropped EXE
PID:236 -
\??\c:\thbbhh.exec:\thbbhh.exe57⤵
- Executes dropped EXE
PID:816 -
\??\c:\9nnbnb.exec:\9nnbnb.exe58⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbnnbh.exec:\hbnnbh.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7ppvd.exec:\7ppvd.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\fxrflrl.exec:\fxrflrl.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlfxlxl.exec:\rlfxlxl.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tthtnt.exec:\tthtnt.exe63⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nbthnb.exec:\nbthnb.exe64⤵
- Executes dropped EXE
PID:620 -
\??\c:\jdvvv.exec:\jdvvv.exe65⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pvvdp.exec:\pvvdp.exe66⤵PID:968
-
\??\c:\rrfrllf.exec:\rrfrllf.exe67⤵PID:688
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe68⤵PID:2296
-
\??\c:\fxlxflx.exec:\fxlxflx.exe69⤵PID:2116
-
\??\c:\nhhtbn.exec:\nhhtbn.exe70⤵PID:1268
-
\??\c:\3hbbth.exec:\3hbbth.exe71⤵PID:1812
-
\??\c:\pjvpp.exec:\pjvpp.exe72⤵PID:1184
-
\??\c:\dvjjv.exec:\dvjjv.exe73⤵PID:1080
-
\??\c:\lfflrff.exec:\lfflrff.exe74⤵PID:1932
-
\??\c:\5tttbn.exec:\5tttbn.exe75⤵PID:1752
-
\??\c:\tnbhtt.exec:\tnbhtt.exe76⤵PID:1516
-
\??\c:\vvvjv.exec:\vvvjv.exe77⤵PID:2316
-
\??\c:\dvpvd.exec:\dvpvd.exe78⤵PID:2092
-
\??\c:\lfxrxlx.exec:\lfxrxlx.exe79⤵PID:1956
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe80⤵PID:2732
-
\??\c:\fxffrrf.exec:\fxffrrf.exe81⤵PID:2820
-
\??\c:\hbtbtb.exec:\hbtbtb.exe82⤵PID:2836
-
\??\c:\pjjpd.exec:\pjjpd.exe83⤵PID:2812
-
\??\c:\ppvdv.exec:\ppvdv.exe84⤵PID:2908
-
\??\c:\flfrxff.exec:\flfrxff.exe85⤵PID:2084
-
\??\c:\frrrfxx.exec:\frrrfxx.exe86⤵PID:2800
-
\??\c:\7nthbt.exec:\7nthbt.exe87⤵PID:1796
-
\??\c:\pjvdv.exec:\pjvdv.exe88⤵PID:1780
-
\??\c:\vpjvp.exec:\vpjvp.exe89⤵PID:684
-
\??\c:\7fflxxf.exec:\7fflxxf.exe90⤵PID:1292
-
\??\c:\xxrrflx.exec:\xxrrflx.exe91⤵PID:2320
-
\??\c:\tnbnht.exec:\tnbnht.exe92⤵PID:1480
-
\??\c:\bnhtth.exec:\bnhtth.exe93⤵PID:1816
-
\??\c:\tnhthn.exec:\tnhthn.exe94⤵PID:2932
-
\??\c:\dvpdv.exec:\dvpdv.exe95⤵PID:1316
-
\??\c:\1ddjv.exec:\1ddjv.exe96⤵PID:2896
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe97⤵PID:352
-
\??\c:\rfxfrfx.exec:\rfxfrfx.exe98⤵PID:1248
-
\??\c:\9lxfxxr.exec:\9lxfxxr.exe99⤵PID:1640
-
\??\c:\bnbbtb.exec:\bnbbtb.exe100⤵PID:236
-
\??\c:\tnnnbh.exec:\tnnnbh.exe101⤵PID:1624
-
\??\c:\jdvjp.exec:\jdvjp.exe102⤵PID:1324
-
\??\c:\jdpvd.exec:\jdpvd.exe103⤵PID:1444
-
\??\c:\7fflflf.exec:\7fflflf.exe104⤵PID:2144
-
\??\c:\rflfrlr.exec:\rflfrlr.exe105⤵PID:2336
-
\??\c:\btbnbb.exec:\btbnbb.exe106⤵PID:2784
-
\??\c:\3thtbb.exec:\3thtbb.exe107⤵PID:408
-
\??\c:\jpddj.exec:\jpddj.exe108⤵PID:1372
-
\??\c:\3ddjd.exec:\3ddjd.exe109⤵PID:3048
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe110⤵PID:968
-
\??\c:\rlllxfr.exec:\rlllxfr.exe111⤵PID:2128
-
\??\c:\hhhnnn.exec:\hhhnnn.exe112⤵PID:2296
-
\??\c:\hbhnbh.exec:\hbhnbh.exe113⤵PID:824
-
\??\c:\1dvvj.exec:\1dvvj.exe114⤵PID:1980
-
\??\c:\jdvdp.exec:\jdvdp.exe115⤵PID:1508
-
\??\c:\3xrlxxl.exec:\3xrlxxl.exe116⤵PID:2432
-
\??\c:\7xfxlxx.exec:\7xfxlxx.exe117⤵PID:2100
-
\??\c:\ttntnb.exec:\ttntnb.exe118⤵PID:3064
-
\??\c:\nnbhbh.exec:\nnbhbh.exe119⤵PID:1736
-
\??\c:\7bntbn.exec:\7bntbn.exe120⤵PID:2328
-
\??\c:\pjdpv.exec:\pjdpv.exe121⤵PID:2240
-
\??\c:\pjjvv.exec:\pjjvv.exe122⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-