Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 18:19
Behavioral task
behavioral1
Sample
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe
Resource
win7-20240729-en
General
-
Target
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe
-
Size
140KB
-
MD5
d560052cac2f8e5508bda4e34720ad8d
-
SHA1
d34a798a56601e4e456c1e4b14a397f4f06fef31
-
SHA256
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62
-
SHA512
072e883d2b4f83f8d7f82ee03c464a44cdbf5732504269321ee312befc2fc8eba83766952e45c4b18710fc88d170aedcc1ae1f4e0077ff5a97652cf5bebbbc33
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1U+a8+NTTyucqoX:ccm4FmowdHoS5ddWX+a/Nigm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-37-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2144-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/576-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1416-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/236-176-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1616-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-221-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2380-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-265-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2192-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-400-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3048-418-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1868-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/528-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-488-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/896-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/972-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-575-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2708-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-705-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3012-712-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2340-719-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/944-773-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1468-799-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2960-879-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2700-900-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-908-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/872-922-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfxllfx.exebhtnbh.exepvddp.exehnbbbn.exeppdjd.exexlrfxrl.exennbbhh.exevpvjp.exelrrfxfr.exevpjvj.exepjpdj.exehntbbh.exe9jdjp.exenthtnt.exe5nbtht.exelfxxllr.exehhthth.exexfxlfrl.exeflrrfrx.exeppdpd.exe7xxfxxf.exe3ttbtb.exe7vjjv.exexrfrxfx.exebhttnt.exe7djjd.exe5vjdp.exebthhnt.exedvdjd.exexrxxxff.exe1httbb.exe3nntnn.exevdjdd.exellrxfll.exerxllllf.exebhntnt.exepvpvd.exeppvjp.exerlfrrlx.exethhntb.exebbhhtt.exeddjjv.exeflrrxxl.exellxrlxx.exebtbbnn.exehbhnbb.exevddpd.exe3lxfxxx.exellllxxx.exe9bnhtt.exe3dpjv.exejpddj.exerffxxrr.exexfxfxff.exetbtbhh.exe5dpdj.exevpppv.exefllflrx.exe7xrxrfl.exebntthh.exehbttbb.exepjvvp.exexrxfrxf.exebhbbth.exepid process 3052 xfxllfx.exe 2152 bhtnbh.exe 2940 pvddp.exe 2144 hnbbbn.exe 3064 ppdjd.exe 3032 xlrfxrl.exe 2984 nnbbhh.exe 2772 vpvjp.exe 2088 lrrfxfr.exe 576 vpjvj.exe 2028 pjpdj.exe 1416 hntbbh.exe 3016 9jdjp.exe 2460 nthtnt.exe 2440 5nbtht.exe 784 lfxxllr.exe 236 hhthth.exe 1616 xfxlfrl.exe 1972 flrrfrx.exe 2480 ppdpd.exe 2252 7xxfxxf.exe 2380 3ttbtb.exe 928 7vjjv.exe 1912 xrfrxfx.exe 2444 bhttnt.exe 964 7djjd.exe 2192 5vjdp.exe 2188 bthhnt.exe 1672 dvdjd.exe 1520 xrxxxff.exe 1944 1httbb.exe 2152 3nntnn.exe 2040 vdjdd.exe 1688 llrxfll.exe 2820 rxllllf.exe 3068 bhntnt.exe 2732 pvpvd.exe 2724 ppvjp.exe 2832 rlfrrlx.exe 2740 thhntb.exe 1904 bbhhtt.exe 2988 ddjjv.exe 948 flrrxxl.exe 2060 llxrlxx.exe 576 btbbnn.exe 2116 hbhnbb.exe 3020 vddpd.exe 3048 3lxfxxx.exe 2412 llllxxx.exe 1532 9bnhtt.exe 1868 3dpjv.exe 2340 jpddj.exe 1132 rffxxrr.exe 528 xfxfxff.exe 236 tbtbhh.exe 1256 5dpdj.exe 2052 vpppv.exe 2240 fllflrx.exe 272 7xrxrfl.exe 2104 bntthh.exe 896 hbttbb.exe 972 pjvvp.exe 1660 xrxfrxf.exe 1536 bhbbth.exe -
Processes:
resource yara_rule behavioral1/memory/1760-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfxllfx.exe upx behavioral1/memory/1760-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhtnbh.exe upx behavioral1/memory/2152-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvddp.exe upx \??\c:\hnbbbn.exe upx behavioral1/memory/2940-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdjd.exe upx behavioral1/memory/2144-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrfxrl.exe upx behavioral1/memory/3064-58-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3064-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbbhh.exe upx behavioral1/memory/2984-75-0x00000000003C0000-0x00000000003E7000-memory.dmp upx \??\c:\vpvjp.exe upx behavioral1/memory/2772-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrfxfr.exe upx behavioral1/memory/2772-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjvj.exe upx C:\pjpdj.exe upx behavioral1/memory/576-106-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hntbbh.exe upx behavioral1/memory/1416-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1416-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9jdjp.exe upx behavioral1/memory/1416-128-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2460-144-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nthtnt.exe upx behavioral1/memory/3016-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5nbtht.exe upx behavioral1/memory/784-160-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfxxllr.exe upx C:\hhthth.exe upx behavioral1/memory/236-169-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfxlfrl.exe upx behavioral1/memory/1616-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1616-188-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flrrfrx.exe upx behavioral1/memory/2480-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-197-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdpd.exe upx C:\7xxfxxf.exe upx behavioral1/memory/2480-206-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ttbtb.exe upx C:\7vjjv.exe upx behavioral1/memory/2380-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2380-226-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\xrfrxfx.exe upx behavioral1/memory/1912-237-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhttnt.exe upx behavioral1/memory/1912-245-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7djjd.exe upx behavioral1/memory/964-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-254-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vjdp.exe upx behavioral1/memory/964-265-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2192-273-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthhnt.exe upx C:\dvdjd.exe upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pvpdp.exettbttt.exefxffrxx.exehtbbhh.exe3rxrffl.exetnbhtt.exexxrfxlr.exevvvvj.exe5xxfffl.exeddjvd.exeppvdj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exexfxllfx.exebhtnbh.exepvddp.exehnbbbn.exeppdjd.exexlrfxrl.exennbbhh.exevpvjp.exelrrfxfr.exevpjvj.exepjpdj.exehntbbh.exe9jdjp.exenthtnt.exe5nbtht.exedescription pid process target process PID 1760 wrote to memory of 3052 1760 26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe xfxllfx.exe PID 1760 wrote to memory of 3052 1760 26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe xfxllfx.exe PID 1760 wrote to memory of 3052 1760 26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe xfxllfx.exe PID 1760 wrote to memory of 3052 1760 26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe xfxllfx.exe PID 3052 wrote to memory of 2152 3052 xfxllfx.exe bhtnbh.exe PID 3052 wrote to memory of 2152 3052 xfxllfx.exe bhtnbh.exe PID 3052 wrote to memory of 2152 3052 xfxllfx.exe bhtnbh.exe PID 3052 wrote to memory of 2152 3052 xfxllfx.exe bhtnbh.exe PID 2152 wrote to memory of 2940 2152 bhtnbh.exe pvddp.exe PID 2152 wrote to memory of 2940 2152 bhtnbh.exe pvddp.exe PID 2152 wrote to memory of 2940 2152 bhtnbh.exe pvddp.exe PID 2152 wrote to memory of 2940 2152 bhtnbh.exe pvddp.exe PID 2940 wrote to memory of 2144 2940 pvddp.exe hnbbbn.exe PID 2940 wrote to memory of 2144 2940 pvddp.exe hnbbbn.exe PID 2940 wrote to memory of 2144 2940 pvddp.exe hnbbbn.exe PID 2940 wrote to memory of 2144 2940 pvddp.exe hnbbbn.exe PID 2144 wrote to memory of 3064 2144 hnbbbn.exe ppdjd.exe PID 2144 wrote to memory of 3064 2144 hnbbbn.exe ppdjd.exe PID 2144 wrote to memory of 3064 2144 hnbbbn.exe ppdjd.exe PID 2144 wrote to memory of 3064 2144 hnbbbn.exe ppdjd.exe PID 3064 wrote to memory of 3032 3064 ppdjd.exe xlrfxrl.exe PID 3064 wrote to memory of 3032 3064 ppdjd.exe xlrfxrl.exe PID 3064 wrote to memory of 3032 3064 ppdjd.exe xlrfxrl.exe PID 3064 wrote to memory of 3032 3064 ppdjd.exe xlrfxrl.exe PID 3032 wrote to memory of 2984 3032 xlrfxrl.exe nnbbhh.exe PID 3032 wrote to memory of 2984 3032 xlrfxrl.exe nnbbhh.exe PID 3032 wrote to memory of 2984 3032 xlrfxrl.exe nnbbhh.exe PID 3032 wrote to memory of 2984 3032 xlrfxrl.exe nnbbhh.exe PID 2984 wrote to memory of 2772 2984 nnbbhh.exe vpvjp.exe PID 2984 wrote to memory of 2772 2984 nnbbhh.exe vpvjp.exe PID 2984 wrote to memory of 2772 2984 nnbbhh.exe vpvjp.exe PID 2984 wrote to memory of 2772 2984 nnbbhh.exe vpvjp.exe PID 2772 wrote to memory of 2088 2772 vpvjp.exe lrrfxfr.exe PID 2772 wrote to memory of 2088 2772 vpvjp.exe lrrfxfr.exe PID 2772 wrote to memory of 2088 2772 vpvjp.exe lrrfxfr.exe PID 2772 wrote to memory of 2088 2772 vpvjp.exe lrrfxfr.exe PID 2088 wrote to memory of 576 2088 lrrfxfr.exe vpjvj.exe PID 2088 wrote to memory of 576 2088 lrrfxfr.exe vpjvj.exe PID 2088 wrote to memory of 576 2088 lrrfxfr.exe vpjvj.exe PID 2088 wrote to memory of 576 2088 lrrfxfr.exe vpjvj.exe PID 576 wrote to memory of 2028 576 vpjvj.exe pjpdj.exe PID 576 wrote to memory of 2028 576 vpjvj.exe pjpdj.exe PID 576 wrote to memory of 2028 576 vpjvj.exe pjpdj.exe PID 576 wrote to memory of 2028 576 vpjvj.exe pjpdj.exe PID 2028 wrote to memory of 1416 2028 pjpdj.exe hntbbh.exe PID 2028 wrote to memory of 1416 2028 pjpdj.exe hntbbh.exe PID 2028 wrote to memory of 1416 2028 pjpdj.exe hntbbh.exe PID 2028 wrote to memory of 1416 2028 pjpdj.exe hntbbh.exe PID 1416 wrote to memory of 3016 1416 hntbbh.exe 9jdjp.exe PID 1416 wrote to memory of 3016 1416 hntbbh.exe 9jdjp.exe PID 1416 wrote to memory of 3016 1416 hntbbh.exe 9jdjp.exe PID 1416 wrote to memory of 3016 1416 hntbbh.exe 9jdjp.exe PID 3016 wrote to memory of 2460 3016 9jdjp.exe nthtnt.exe PID 3016 wrote to memory of 2460 3016 9jdjp.exe nthtnt.exe PID 3016 wrote to memory of 2460 3016 9jdjp.exe nthtnt.exe PID 3016 wrote to memory of 2460 3016 9jdjp.exe nthtnt.exe PID 2460 wrote to memory of 2440 2460 nthtnt.exe 5nbtht.exe PID 2460 wrote to memory of 2440 2460 nthtnt.exe 5nbtht.exe PID 2460 wrote to memory of 2440 2460 nthtnt.exe 5nbtht.exe PID 2460 wrote to memory of 2440 2460 nthtnt.exe 5nbtht.exe PID 2440 wrote to memory of 784 2440 5nbtht.exe lfxxllr.exe PID 2440 wrote to memory of 784 2440 5nbtht.exe lfxxllr.exe PID 2440 wrote to memory of 784 2440 5nbtht.exe lfxxllr.exe PID 2440 wrote to memory of 784 2440 5nbtht.exe lfxxllr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe"C:\Users\Admin\AppData\Local\Temp\26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\xfxllfx.exec:\xfxllfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\bhtnbh.exec:\bhtnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\pvddp.exec:\pvddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hnbbbn.exec:\hnbbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\ppdjd.exec:\ppdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\nnbbhh.exec:\nnbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vpvjp.exec:\vpvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\lrrfxfr.exec:\lrrfxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vpjvj.exec:\vpjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\pjpdj.exec:\pjpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\hntbbh.exec:\hntbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\9jdjp.exec:\9jdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\nthtnt.exec:\nthtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\5nbtht.exec:\5nbtht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\lfxxllr.exec:\lfxxllr.exe17⤵
- Executes dropped EXE
PID:784 -
\??\c:\hhthth.exec:\hhthth.exe18⤵
- Executes dropped EXE
PID:236 -
\??\c:\xfxlfrl.exec:\xfxlfrl.exe19⤵
- Executes dropped EXE
PID:1616 -
\??\c:\flrrfrx.exec:\flrrfrx.exe20⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ppdpd.exec:\ppdpd.exe21⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7xxfxxf.exec:\7xxfxxf.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3ttbtb.exec:\3ttbtb.exe23⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7vjjv.exec:\7vjjv.exe24⤵
- Executes dropped EXE
PID:928 -
\??\c:\xrfrxfx.exec:\xrfrxfx.exe25⤵
- Executes dropped EXE
PID:1912 -
\??\c:\bhttnt.exec:\bhttnt.exe26⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7djjd.exec:\7djjd.exe27⤵
- Executes dropped EXE
PID:964 -
\??\c:\5vjdp.exec:\5vjdp.exe28⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bthhnt.exec:\bthhnt.exe29⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvdjd.exec:\dvdjd.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrxxxff.exec:\xrxxxff.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1httbb.exec:\1httbb.exe32⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3nntnn.exec:\3nntnn.exe33⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vdjdd.exec:\vdjdd.exe34⤵
- Executes dropped EXE
PID:2040 -
\??\c:\llrxfll.exec:\llrxfll.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rxllllf.exec:\rxllllf.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bhntnt.exec:\bhntnt.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvpvd.exec:\pvpvd.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ppvjp.exec:\ppvjp.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlfrrlx.exec:\rlfrrlx.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\thhntb.exec:\thhntb.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bbhhtt.exec:\bbhhtt.exe42⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddjjv.exec:\ddjjv.exe43⤵
- Executes dropped EXE
PID:2988 -
\??\c:\flrrxxl.exec:\flrrxxl.exe44⤵
- Executes dropped EXE
PID:948 -
\??\c:\llxrlxx.exec:\llxrlxx.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\btbbnn.exec:\btbbnn.exe46⤵
- Executes dropped EXE
PID:576 -
\??\c:\hbhnbb.exec:\hbhnbb.exe47⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vddpd.exec:\vddpd.exe48⤵
- Executes dropped EXE
PID:3020 -
\??\c:\3lxfxxx.exec:\3lxfxxx.exe49⤵
- Executes dropped EXE
PID:3048 -
\??\c:\llllxxx.exec:\llllxxx.exe50⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9bnhtt.exec:\9bnhtt.exe51⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3dpjv.exec:\3dpjv.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jpddj.exec:\jpddj.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rffxxrr.exec:\rffxxrr.exe54⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xfxfxff.exec:\xfxfxff.exe55⤵
- Executes dropped EXE
PID:528 -
\??\c:\tbtbhh.exec:\tbtbhh.exe56⤵
- Executes dropped EXE
PID:236 -
\??\c:\5dpdj.exec:\5dpdj.exe57⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vpppv.exec:\vpppv.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fllflrx.exec:\fllflrx.exe59⤵
- Executes dropped EXE
PID:2240 -
\??\c:\7xrxrfl.exec:\7xrxrfl.exe60⤵
- Executes dropped EXE
PID:272 -
\??\c:\bntthh.exec:\bntthh.exe61⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbttbb.exec:\hbttbb.exe62⤵
- Executes dropped EXE
PID:896 -
\??\c:\pjvvp.exec:\pjvvp.exe63⤵
- Executes dropped EXE
PID:972 -
\??\c:\xrxfrxf.exec:\xrxfrxf.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bhbbth.exec:\bhbbth.exe65⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nnntth.exec:\nnntth.exe66⤵PID:1680
-
\??\c:\djpjp.exec:\djpjp.exe67⤵PID:1632
-
\??\c:\jddpp.exec:\jddpp.exe68⤵PID:1628
-
\??\c:\fflrxxf.exec:\fflrxxf.exe69⤵PID:964
-
\??\c:\tntthn.exec:\tntthn.exe70⤵PID:560
-
\??\c:\hbbhtb.exec:\hbbhtb.exe71⤵PID:2400
-
\??\c:\jdjvd.exec:\jdjvd.exe72⤵PID:2392
-
\??\c:\lllfrrx.exec:\lllfrrx.exe73⤵PID:2328
-
\??\c:\rffllll.exec:\rffllll.exe74⤵PID:1820
-
\??\c:\9btbnn.exec:\9btbnn.exe75⤵PID:2232
-
\??\c:\5ttbnn.exec:\5ttbnn.exe76⤵PID:1572
-
\??\c:\vdddj.exec:\vdddj.exe77⤵PID:2928
-
\??\c:\rrxxfff.exec:\rrxxfff.exe78⤵PID:2804
-
\??\c:\rlrrffl.exec:\rlrrffl.exe79⤵PID:2920
-
\??\c:\nntnbb.exec:\nntnbb.exe80⤵PID:2992
-
\??\c:\7bnthh.exec:\7bnthh.exe81⤵PID:3024
-
\??\c:\ppvdj.exec:\ppvdj.exe82⤵PID:2736
-
\??\c:\llfrfrr.exec:\llfrfrr.exe83⤵PID:2708
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe84⤵PID:2744
-
\??\c:\hhnnbb.exec:\hhnnbb.exe85⤵PID:2260
-
\??\c:\ppdvj.exec:\ppdvj.exe86⤵PID:2916
-
\??\c:\vvjpd.exec:\vvjpd.exe87⤵PID:1896
-
\??\c:\fxllrrx.exec:\fxllrrx.exe88⤵PID:948
-
\??\c:\1xlllrx.exec:\1xlllrx.exe89⤵PID:564
-
\??\c:\tntthn.exec:\tntthn.exe90⤵PID:576
-
\??\c:\ddpvd.exec:\ddpvd.exe91⤵PID:2900
-
\??\c:\vvjpj.exec:\vvjpj.exe92⤵PID:1416
-
\??\c:\rrrrfll.exec:\rrrrfll.exe93⤵PID:3012
-
\??\c:\bbhhtt.exec:\bbhhtt.exe94⤵PID:2908
-
\??\c:\7bnthn.exec:\7bnthn.exe95⤵PID:1048
-
\??\c:\dvdpj.exec:\dvdpj.exe96⤵PID:2100
-
\??\c:\lrffrxf.exec:\lrffrxf.exe97⤵PID:2340
-
\??\c:\1lxfflx.exec:\1lxfflx.exe98⤵PID:1248
-
\??\c:\ttnnhn.exec:\ttnnhn.exe99⤵PID:1504
-
\??\c:\pvdjj.exec:\pvdjj.exe100⤵PID:2532
-
\??\c:\ppvjv.exec:\ppvjv.exe101⤵PID:1500
-
\??\c:\lrffrxf.exec:\lrffrxf.exe102⤵PID:2300
-
\??\c:\3hbtht.exec:\3hbtht.exe103⤵PID:2240
-
\??\c:\1pjpd.exec:\1pjpd.exe104⤵PID:492
-
\??\c:\3llxxrr.exec:\3llxxrr.exe105⤵PID:944
-
\??\c:\rxxfrxr.exec:\rxxfrxr.exe106⤵PID:2356
-
\??\c:\1vjpd.exec:\1vjpd.exe107⤵PID:1984
-
\??\c:\ffxlflx.exec:\ffxlflx.exe108⤵PID:2540
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe109⤵PID:1468
-
\??\c:\3htthh.exec:\3htthh.exe110⤵PID:1608
-
\??\c:\jjpdp.exec:\jjpdp.exe111⤵PID:1632
-
\??\c:\vvdjv.exec:\vvdjv.exe112⤵PID:1628
-
\??\c:\xrlrfrl.exec:\xrlrfrl.exe113⤵PID:2192
-
\??\c:\7hnnnn.exec:\7hnnnn.exe114⤵PID:560
-
\??\c:\jpppp.exec:\jpppp.exe115⤵PID:1672
-
\??\c:\7jddd.exec:\7jddd.exe116⤵PID:1760
-
\??\c:\xfxxflr.exec:\xfxxflr.exe117⤵PID:1396
-
\??\c:\hnbbhh.exec:\hnbbhh.exe118⤵PID:3008
-
\??\c:\bthnbh.exec:\bthnbh.exe119⤵PID:1576
-
\??\c:\vpppd.exec:\vpppd.exe120⤵PID:1700
-
\??\c:\9ddjv.exec:\9ddjv.exe121⤵PID:2836
-
\??\c:\7lrfffr.exec:\7lrfffr.exe122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-