Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 20:27
Behavioral task
behavioral1
Sample
1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe
Resource
win7-20240903-en
General
-
Target
1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe
-
Size
79KB
-
MD5
fb1fd035f1e8b278cc61ad4c6994f02c
-
SHA1
7ee7405d8b19b01da9fa0fa4bd1f4bf04b3f6d9d
-
SHA256
1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc
-
SHA512
4bb26691d8110924b214e99353b83a42145e7b57f26520561970870fd95e363b687b9792b52a400efeecf45024612184523312f4c75955ee3a07901a2630171c
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzC8BSYobia:xhOmTsF93UYfwC6GIout03Lze8BSYobh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2536-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-32-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2252-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-73-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2788-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/484-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/484-112-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2828-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-184-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2200-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-499-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/628-513-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2016-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-581-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2772-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-885-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-909-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1324-1018-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2228-1264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-1301-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3048-1359-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2456-1452-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdpvp.exellxxlrf.exe5llxlrf.exebbtbnh.exe3tnhtn.exe7dvpd.exeffffrrf.exexrlfllx.exehbtbnb.exelffrflr.exerrlrxfl.exenhhnbb.exe3hhbnt.exexrrrflx.exe1flflrf.exenbthtb.exejjdjp.exerfxflxl.exerrxrlxf.exe7htbtt.exehnhthb.exejdjvd.exedpdvv.exe9fffllx.exe7bbnbh.exebtttht.exepjdjp.exerxxlfff.exe7hbnht.exennhtbn.exevpjpp.exedvvjv.exeffxrlxl.exe5nthtn.exenhbhnt.exejjdvd.exexxxlxlx.exe1flrxfr.exe5btthh.exehhbhth.exe1jvpd.exelfxlrfl.exerlrrffr.exexxlrffr.exe3tnntb.exe3dvdd.exevvpdp.exelfrrllf.exe7lfrflr.exe7nnntb.exennntht.exedppvj.exevpddj.exe7lflxfx.exe7lxrxfx.exehhbhnn.exetnbtth.exejvjjv.exe7tbhtb.exetnhhtt.exejdvvd.exedpjvv.exe9flrflf.exelfrrxfr.exepid process 2556 pdpvp.exe 1944 llxxlrf.exe 1628 5llxlrf.exe 2252 bbtbnh.exe 2768 3tnhtn.exe 2896 7dvpd.exe 2744 ffffrrf.exe 2652 xrlfllx.exe 2788 hbtbnb.exe 2636 lffrflr.exe 484 rrlrxfl.exe 1092 nhhnbb.exe 2828 3hhbnt.exe 1928 xrrrflx.exe 1716 1flflrf.exe 1056 nbthtb.exe 1908 jjdjp.exe 2960 rfxflxl.exe 2832 rrxrlxf.exe 2204 7htbtt.exe 2200 hnhthb.exe 444 jdjvd.exe 3064 dpdvv.exe 960 9fffllx.exe 760 7bbnbh.exe 1040 btttht.exe 1444 pjdjp.exe 1792 rxxlfff.exe 2676 7hbnht.exe 1752 nnhtbn.exe 1712 vpjpp.exe 2552 dvvjv.exe 1944 ffxrlxl.exe 2580 5nthtn.exe 2500 nhbhnt.exe 2412 jjdvd.exe 2152 xxxlxlx.exe 2728 1flrxfr.exe 2932 5btthh.exe 2876 hhbhth.exe 2316 1jvpd.exe 2976 lfxlrfl.exe 2652 rlrrffr.exe 2672 xxlrffr.exe 2788 3tnntb.exe 1744 3dvdd.exe 2632 vvpdp.exe 1048 lfrrllf.exe 1288 7lfrflr.exe 2604 7nnntb.exe 2432 nnntht.exe 1912 dppvj.exe 2040 vpddj.exe 2848 7lflxfx.exe 2844 7lxrxfx.exe 1192 hhbhnn.exe 2960 tnbtth.exe 2952 jvjjv.exe 2716 7tbhtb.exe 2280 tnhhtt.exe 944 jdvvd.exe 1084 dpjvv.exe 1996 9flrflf.exe 1528 lfrrxfr.exe -
Processes:
resource yara_rule behavioral1/memory/2536-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpvp.exe upx behavioral1/memory/2556-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llxxlrf.exe upx behavioral1/memory/1944-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1628-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5llxlrf.exe upx behavioral1/memory/2556-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-50-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3tnhtn.exe upx C:\bbtbnh.exe upx behavioral1/memory/1628-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffffrrf.exe upx behavioral1/memory/2896-64-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7dvpd.exe upx behavioral1/memory/2652-77-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrlfllx.exe upx C:\hbtbnb.exe upx C:\lffrflr.exe upx behavioral1/memory/2636-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrlrxfl.exe upx behavioral1/memory/484-103-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhnbb.exe upx behavioral1/memory/484-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3hhbnt.exe upx C:\xrrrflx.exe upx behavioral1/memory/1928-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1flflrf.exe upx C:\nbthtb.exe upx behavioral1/memory/1056-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1716-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdjp.exe upx C:\rfxflxl.exe upx behavioral1/memory/2960-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-168-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxrlxf.exe upx \??\c:\7htbtt.exe upx behavioral1/memory/2832-187-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnhthb.exe upx behavioral1/memory/2200-198-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjvd.exe upx behavioral1/memory/2200-204-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\dpdvv.exe upx C:\9fffllx.exe upx behavioral1/memory/960-222-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bbnbh.exe upx behavioral1/memory/960-230-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btttht.exe upx C:\pjdjp.exe upx behavioral1/memory/1444-255-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxxlfff.exe upx C:\7hbnht.exe upx \??\c:\nnhtbn.exe upx \??\c:\vpjpp.exe upx C:\dvvjv.exe upx behavioral1/memory/2552-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2152-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-335-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
jvpjj.exe9jdjp.exe3pjpv.exe7hbttn.exejdjdj.exe7nhntb.exevdvjv.exelxrxfrx.exeddvvd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exepdpvp.exellxxlrf.exe5llxlrf.exebbtbnh.exe3tnhtn.exe7dvpd.exeffffrrf.exexrlfllx.exehbtbnb.exelffrflr.exerrlrxfl.exenhhnbb.exe3hhbnt.exexrrrflx.exe1flflrf.exedescription pid process target process PID 2536 wrote to memory of 2556 2536 1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe pdpvp.exe PID 2536 wrote to memory of 2556 2536 1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe pdpvp.exe PID 2536 wrote to memory of 2556 2536 1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe pdpvp.exe PID 2536 wrote to memory of 2556 2536 1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe pdpvp.exe PID 2556 wrote to memory of 1944 2556 pdpvp.exe llxxlrf.exe PID 2556 wrote to memory of 1944 2556 pdpvp.exe llxxlrf.exe PID 2556 wrote to memory of 1944 2556 pdpvp.exe llxxlrf.exe PID 2556 wrote to memory of 1944 2556 pdpvp.exe llxxlrf.exe PID 1944 wrote to memory of 1628 1944 llxxlrf.exe 5llxlrf.exe PID 1944 wrote to memory of 1628 1944 llxxlrf.exe 5llxlrf.exe PID 1944 wrote to memory of 1628 1944 llxxlrf.exe 5llxlrf.exe PID 1944 wrote to memory of 1628 1944 llxxlrf.exe 5llxlrf.exe PID 1628 wrote to memory of 2252 1628 5llxlrf.exe bbtbnh.exe PID 1628 wrote to memory of 2252 1628 5llxlrf.exe bbtbnh.exe PID 1628 wrote to memory of 2252 1628 5llxlrf.exe bbtbnh.exe PID 1628 wrote to memory of 2252 1628 5llxlrf.exe bbtbnh.exe PID 2252 wrote to memory of 2768 2252 bbtbnh.exe 3tnhtn.exe PID 2252 wrote to memory of 2768 2252 bbtbnh.exe 3tnhtn.exe PID 2252 wrote to memory of 2768 2252 bbtbnh.exe 3tnhtn.exe PID 2252 wrote to memory of 2768 2252 bbtbnh.exe 3tnhtn.exe PID 2768 wrote to memory of 2896 2768 3tnhtn.exe 7dvpd.exe PID 2768 wrote to memory of 2896 2768 3tnhtn.exe 7dvpd.exe PID 2768 wrote to memory of 2896 2768 3tnhtn.exe 7dvpd.exe PID 2768 wrote to memory of 2896 2768 3tnhtn.exe 7dvpd.exe PID 2896 wrote to memory of 2744 2896 7dvpd.exe ffffrrf.exe PID 2896 wrote to memory of 2744 2896 7dvpd.exe ffffrrf.exe PID 2896 wrote to memory of 2744 2896 7dvpd.exe ffffrrf.exe PID 2896 wrote to memory of 2744 2896 7dvpd.exe ffffrrf.exe PID 2744 wrote to memory of 2652 2744 ffffrrf.exe xrlfllx.exe PID 2744 wrote to memory of 2652 2744 ffffrrf.exe xrlfllx.exe PID 2744 wrote to memory of 2652 2744 ffffrrf.exe xrlfllx.exe PID 2744 wrote to memory of 2652 2744 ffffrrf.exe xrlfllx.exe PID 2652 wrote to memory of 2788 2652 xrlfllx.exe hbtbnb.exe PID 2652 wrote to memory of 2788 2652 xrlfllx.exe hbtbnb.exe PID 2652 wrote to memory of 2788 2652 xrlfllx.exe hbtbnb.exe PID 2652 wrote to memory of 2788 2652 xrlfllx.exe hbtbnb.exe PID 2788 wrote to memory of 2636 2788 hbtbnb.exe lffrflr.exe PID 2788 wrote to memory of 2636 2788 hbtbnb.exe lffrflr.exe PID 2788 wrote to memory of 2636 2788 hbtbnb.exe lffrflr.exe PID 2788 wrote to memory of 2636 2788 hbtbnb.exe lffrflr.exe PID 2636 wrote to memory of 484 2636 lffrflr.exe rrlrxfl.exe PID 2636 wrote to memory of 484 2636 lffrflr.exe rrlrxfl.exe PID 2636 wrote to memory of 484 2636 lffrflr.exe rrlrxfl.exe PID 2636 wrote to memory of 484 2636 lffrflr.exe rrlrxfl.exe PID 484 wrote to memory of 1092 484 rrlrxfl.exe nhhnbb.exe PID 484 wrote to memory of 1092 484 rrlrxfl.exe nhhnbb.exe PID 484 wrote to memory of 1092 484 rrlrxfl.exe nhhnbb.exe PID 484 wrote to memory of 1092 484 rrlrxfl.exe nhhnbb.exe PID 1092 wrote to memory of 2828 1092 nhhnbb.exe 3hhbnt.exe PID 1092 wrote to memory of 2828 1092 nhhnbb.exe 3hhbnt.exe PID 1092 wrote to memory of 2828 1092 nhhnbb.exe 3hhbnt.exe PID 1092 wrote to memory of 2828 1092 nhhnbb.exe 3hhbnt.exe PID 2828 wrote to memory of 1928 2828 3hhbnt.exe xrrrflx.exe PID 2828 wrote to memory of 1928 2828 3hhbnt.exe xrrrflx.exe PID 2828 wrote to memory of 1928 2828 3hhbnt.exe xrrrflx.exe PID 2828 wrote to memory of 1928 2828 3hhbnt.exe xrrrflx.exe PID 1928 wrote to memory of 1716 1928 xrrrflx.exe 1flflrf.exe PID 1928 wrote to memory of 1716 1928 xrrrflx.exe 1flflrf.exe PID 1928 wrote to memory of 1716 1928 xrrrflx.exe 1flflrf.exe PID 1928 wrote to memory of 1716 1928 xrrrflx.exe 1flflrf.exe PID 1716 wrote to memory of 1056 1716 1flflrf.exe nbthtb.exe PID 1716 wrote to memory of 1056 1716 1flflrf.exe nbthtb.exe PID 1716 wrote to memory of 1056 1716 1flflrf.exe nbthtb.exe PID 1716 wrote to memory of 1056 1716 1flflrf.exe nbthtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe"C:\Users\Admin\AppData\Local\Temp\1fcc8c976fb3591ad059be4b34199991df72c41fec89c0491bb83f45b6f8b4dc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\pdpvp.exec:\pdpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\llxxlrf.exec:\llxxlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\5llxlrf.exec:\5llxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\bbtbnh.exec:\bbtbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\3tnhtn.exec:\3tnhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7dvpd.exec:\7dvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ffffrrf.exec:\ffffrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xrlfllx.exec:\xrlfllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hbtbnb.exec:\hbtbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lffrflr.exec:\lffrflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\nhhnbb.exec:\nhhnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\3hhbnt.exec:\3hhbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xrrrflx.exec:\xrrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\1flflrf.exec:\1flflrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nbthtb.exec:\nbthtb.exe17⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jjdjp.exec:\jjdjp.exe18⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rfxflxl.exec:\rfxflxl.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rrxrlxf.exec:\rrxrlxf.exe20⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7htbtt.exec:\7htbtt.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hnhthb.exec:\hnhthb.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdjvd.exec:\jdjvd.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\dpdvv.exec:\dpdvv.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\9fffllx.exec:\9fffllx.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\7bbnbh.exec:\7bbnbh.exe26⤵
- Executes dropped EXE
PID:760 -
\??\c:\btttht.exec:\btttht.exe27⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjdjp.exec:\pjdjp.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rxxlfff.exec:\rxxlfff.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\7hbnht.exec:\7hbnht.exe30⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nnhtbn.exec:\nnhtbn.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vpjpp.exec:\vpjpp.exe32⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dvvjv.exec:\dvvjv.exe33⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ffxrlxl.exec:\ffxrlxl.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5nthtn.exec:\5nthtn.exe35⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nhbhnt.exec:\nhbhnt.exe36⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jjdvd.exec:\jjdvd.exe37⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xxxlxlx.exec:\xxxlxlx.exe38⤵
- Executes dropped EXE
PID:2152 -
\??\c:\1flrxfr.exec:\1flrxfr.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5btthh.exec:\5btthh.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhbhth.exec:\hhbhth.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1jvpd.exec:\1jvpd.exe42⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lfxlrfl.exec:\lfxlrfl.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rlrrffr.exec:\rlrrffr.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xxlrffr.exec:\xxlrffr.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3tnntb.exec:\3tnntb.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3dvdd.exec:\3dvdd.exe47⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vvpdp.exec:\vvpdp.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lfrrllf.exec:\lfrrllf.exe49⤵
- Executes dropped EXE
PID:1048 -
\??\c:\7lfrflr.exec:\7lfrflr.exe50⤵
- Executes dropped EXE
PID:1288 -
\??\c:\7nnntb.exec:\7nnntb.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nnntht.exec:\nnntht.exe52⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dppvj.exec:\dppvj.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vpddj.exec:\vpddj.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7lflxfx.exec:\7lflxfx.exe55⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7lxrxfx.exec:\7lxrxfx.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hhbhnn.exec:\hhbhnn.exe57⤵
- Executes dropped EXE
PID:1192 -
\??\c:\tnbtth.exec:\tnbtth.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jvjjv.exec:\jvjjv.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7tbhtb.exec:\7tbhtb.exe60⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnhhtt.exec:\tnhhtt.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jdvvd.exec:\jdvvd.exe62⤵
- Executes dropped EXE
PID:944 -
\??\c:\dpjvv.exec:\dpjvv.exe63⤵
- Executes dropped EXE
PID:1084 -
\??\c:\9flrflf.exec:\9flrflf.exe64⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe65⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hhthtb.exec:\hhthtb.exe66⤵PID:960
-
\??\c:\nhbnth.exec:\nhbnth.exe67⤵PID:628
-
\??\c:\pjpdp.exec:\pjpdp.exe68⤵PID:2340
-
\??\c:\vpjpd.exec:\vpjpd.exe69⤵PID:1740
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe70⤵PID:1972
-
\??\c:\9bttbh.exec:\9bttbh.exe71⤵PID:2248
-
\??\c:\nnhhbb.exec:\nnhhbb.exe72⤵PID:2572
-
\??\c:\tthhhn.exec:\tthhhn.exe73⤵PID:1000
-
\??\c:\vdjvv.exec:\vdjvv.exe74⤵PID:2532
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe75⤵PID:1712
-
\??\c:\rfrxfrx.exec:\rfrxfrx.exe76⤵PID:2548
-
\??\c:\bbtnth.exec:\bbtnth.exe77⤵PID:2016
-
\??\c:\nhhtbt.exec:\nhhtbt.exe78⤵PID:2060
-
\??\c:\dvvdd.exec:\dvvdd.exe79⤵PID:1584
-
\??\c:\ppjjv.exec:\ppjjv.exe80⤵PID:1576
-
\??\c:\lfrxlxf.exec:\lfrxlxf.exe81⤵PID:604
-
\??\c:\fxfrlrl.exec:\fxfrlrl.exe82⤵PID:2912
-
\??\c:\bbthnn.exec:\bbthnn.exe83⤵PID:2772
-
\??\c:\bthntn.exec:\bthntn.exe84⤵PID:2920
-
\??\c:\vpvvd.exec:\vpvvd.exe85⤵PID:2736
-
\??\c:\dpjpv.exec:\dpjpv.exe86⤵PID:2808
-
\??\c:\lrlflxf.exec:\lrlflxf.exe87⤵PID:2924
-
\??\c:\xflxflr.exec:\xflxflr.exe88⤵PID:2660
-
\??\c:\hhhtbb.exec:\hhhtbb.exe89⤵PID:2648
-
\??\c:\nbhnht.exec:\nbhnht.exe90⤵PID:1696
-
\??\c:\vvvdp.exec:\vvvdp.exe91⤵PID:2680
-
\??\c:\3pjpv.exec:\3pjpv.exe92⤵
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\xlxxffl.exec:\xlxxffl.exe93⤵PID:2000
-
\??\c:\ffxxlxr.exec:\ffxxlxr.exe94⤵PID:1656
-
\??\c:\7thntb.exec:\7thntb.exe95⤵PID:2144
-
\??\c:\3bntth.exec:\3bntth.exe96⤵PID:1912
-
\??\c:\jdjpv.exec:\jdjpv.exe97⤵PID:2796
-
\??\c:\ppdpv.exec:\ppdpv.exe98⤵PID:1704
-
\??\c:\lfrrlfr.exec:\lfrrlfr.exe99⤵PID:376
-
\??\c:\fflrflx.exec:\fflrflx.exe100⤵PID:1620
-
\??\c:\nnntbt.exec:\nnntbt.exe101⤵PID:2260
-
\??\c:\dpdvd.exec:\dpdvd.exe102⤵PID:2864
-
\??\c:\vpvvd.exec:\vpvvd.exe103⤵PID:2204
-
\??\c:\ddpjv.exec:\ddpjv.exe104⤵PID:1556
-
\??\c:\xrllxlf.exec:\xrllxlf.exe105⤵PID:2968
-
\??\c:\3rrfrrx.exec:\3rrfrrx.exe106⤵PID:556
-
\??\c:\1ttbhh.exec:\1ttbhh.exe107⤵PID:872
-
\??\c:\3tbhtb.exec:\3tbhtb.exe108⤵PID:1996
-
\??\c:\dpvdp.exec:\dpvdp.exe109⤵PID:1592
-
\??\c:\jjdpv.exec:\jjdpv.exe110⤵PID:1980
-
\??\c:\ffxlfff.exec:\ffxlfff.exe111⤵PID:1732
-
\??\c:\rrrxffr.exec:\rrrxffr.exe112⤵PID:2384
-
\??\c:\lfrffff.exec:\lfrffff.exe113⤵PID:1444
-
\??\c:\1thhtt.exec:\1thhtt.exe114⤵PID:1368
-
\??\c:\tnbbnb.exec:\tnbbnb.exe115⤵PID:2108
-
\??\c:\jjjjv.exec:\jjjjv.exe116⤵PID:1344
-
\??\c:\3ddjv.exec:\3ddjv.exe117⤵PID:2536
-
\??\c:\rrrrxxl.exec:\rrrrxxl.exe118⤵PID:3040
-
\??\c:\llxxxfr.exec:\llxxxfr.exe119⤵PID:2380
-
\??\c:\1rxxflr.exec:\1rxxflr.exe120⤵PID:1708
-
\??\c:\hbntth.exec:\hbntth.exe121⤵PID:2348
-
\??\c:\bbtntt.exec:\bbtntt.exe122⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-