Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 20:07
Behavioral task
behavioral1
Sample
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
Resource
win7-20240903-en
General
-
Target
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
-
Size
332KB
-
MD5
f66e32ae53325232d1d14d721fbc2f6b
-
SHA1
0686dc81ac94ace7db64d89e7eff3c847f01f036
-
SHA256
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1
-
SHA512
55cff182fdfcd5c58a40fb92fcd91f8a7f91f749c109e4e14a1e0ae39896ff236eb3c386b00acbf520be2ab9970be8c99cfbeaaa1e2c3572358193f4b7177fde
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/3044-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2000-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1288-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-141-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1436-150-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1548-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-166-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-193-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2284-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/936-466-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/712-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-560-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2788-579-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1660-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-689-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2744-843-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1716-885-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2012-995-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-1106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1nnthh.exe7jvvv.exelfflfll.exennbhbb.exe5jddv.exefrffllr.exetttttt.exepjdpd.exe1hnntt.exethtttn.exejdvjv.exexfxlxxl.exe3thhnt.exevpdjp.exe3xlrxxf.exetnbbhn.exevjdvd.exexrxlllx.exenhthbn.exebnnntn.exedvppj.exerfrrlrx.exetnhnhn.exejdvvv.exe7fxflrx.exelfrxxfr.exehnbhtt.exetbnhhb.exelxlrrrx.exexlffxfl.exebtnntb.exetnttbb.exe3fxrfrx.exexrllrxf.exebnhbhn.exenhnhth.exejjddj.exedvdjp.exe5fxxflr.exe7frrxlr.exelfrrxxl.exebtnthh.exebnhhhn.exevvdvp.exepjdpd.exe5lxffrr.exerlxrrlr.exehtnbbb.exehtnntt.exe1pvdj.exevpdpd.exe3jdjj.exexfxflrf.exerrlxfll.exehbhhnn.exettntth.exejdppv.exevpvdv.exelflrrfl.exe5rxxflr.exehtttbb.exetnttbb.exehnbhtb.exevpvvv.exepid process 2064 1nnthh.exe 2896 7jvvv.exe 2024 lfflfll.exe 1824 nnbhbb.exe 2804 5jddv.exe 2736 frffllr.exe 2320 tttttt.exe 2916 pjdpd.exe 2776 1hnntt.exe 1296 thtttn.exe 2120 jdvjv.exe 2608 xfxlxxl.exe 2704 3thhnt.exe 1288 vpdjp.exe 2000 3xlrxxf.exe 1756 tnbbhn.exe 1436 vjdvd.exe 1548 xrxlllx.exe 3064 nhthbn.exe 2184 bnnntn.exe 2376 dvppj.exe 2200 rfrrlrx.exe 1940 tnhnhn.exe 1092 jdvvv.exe 1992 7fxflrx.exe 920 lfrxxfr.exe 892 hnbhtt.exe 1036 tbnhhb.exe 1644 lxlrrrx.exe 2204 xlffxfl.exe 2172 btnntb.exe 2332 tnttbb.exe 896 3fxrfrx.exe 2300 xrllrxf.exe 2148 bnhbhn.exe 2884 nhnhth.exe 1604 jjddj.exe 2968 dvdjp.exe 2364 5fxxflr.exe 2964 7frrxlr.exe 2220 lfrrxxl.exe 2792 btnthh.exe 2820 bnhhhn.exe 2768 vvdvp.exe 2320 pjdpd.exe 2708 5lxffrr.exe 2824 rlxrrlr.exe 2624 htnbbb.exe 1716 htnntt.exe 2648 1pvdj.exe 2244 vpdpd.exe 2152 3jdjj.exe 2836 xfxflrf.exe 860 rrlxfll.exe 2664 hbhhnn.exe 1928 ttntth.exe 1272 jdppv.exe 284 vpvdv.exe 2692 lflrrfl.exe 1432 5rxxflr.exe 1548 htttbb.exe 3064 tnttbb.exe 2284 hnbhtb.exe 2416 vpvvv.exe -
Processes:
resource yara_rule behavioral1/memory/3044-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1nnthh.exe upx behavioral1/memory/3044-6-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7jvvv.exe upx behavioral1/memory/2064-14-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfflfll.exe upx behavioral1/memory/2024-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbhbb.exe upx behavioral1/memory/2024-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-42-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5jddv.exe upx behavioral1/memory/1824-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frffllr.exe upx behavioral1/memory/2736-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tttttt.exe upx C:\pjdpd.exe upx behavioral1/memory/2320-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hnntt.exe upx C:\thtttn.exe upx \??\c:\xfxlxxl.exe upx behavioral1/memory/2120-99-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdvjv.exe upx behavioral1/memory/2120-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2608-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3thhnt.exe upx C:\vpdjp.exe upx C:\3xlrxxf.exe upx behavioral1/memory/2000-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbbhn.exe upx behavioral1/memory/2000-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1288-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjdvd.exe upx behavioral1/memory/1756-143-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxlllx.exe upx \??\c:\nhthbn.exe upx behavioral1/memory/1548-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnntn.exe upx C:\rfrrlrx.exe upx C:\tnhnhn.exe upx behavioral1/memory/1092-201-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrxxfr.exe upx \??\c:\tbnhhb.exe upx \??\c:\xlffxfl.exe upx C:\tnttbb.exe upx behavioral1/memory/2300-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-299-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2768-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-389-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1432-415-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-315-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btnntb.exe upx behavioral1/memory/1036-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-244-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxlrrrx.exe upx \??\c:\hnbhtt.exe upx behavioral1/memory/1992-215-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7fxflrx.exe upx behavioral1/memory/1992-208-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdvvv.exe upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5fllxfx.exe9hbntt.exejjddj.exevpvdd.exetnttbb.exedpvvv.exethnhbt.exehhntbn.exehbtbhh.exepdppd.exenbnhnh.exexrrxlrx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fllxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxlrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe1nnthh.exe7jvvv.exelfflfll.exennbhbb.exe5jddv.exefrffllr.exetttttt.exepjdpd.exe1hnntt.exethtttn.exejdvjv.exexfxlxxl.exe3thhnt.exevpdjp.exe3xlrxxf.exedescription pid process target process PID 3044 wrote to memory of 2064 3044 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe 1nnthh.exe PID 3044 wrote to memory of 2064 3044 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe 1nnthh.exe PID 3044 wrote to memory of 2064 3044 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe 1nnthh.exe PID 3044 wrote to memory of 2064 3044 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe 1nnthh.exe PID 2064 wrote to memory of 2896 2064 1nnthh.exe 7jvvv.exe PID 2064 wrote to memory of 2896 2064 1nnthh.exe 7jvvv.exe PID 2064 wrote to memory of 2896 2064 1nnthh.exe 7jvvv.exe PID 2064 wrote to memory of 2896 2064 1nnthh.exe 7jvvv.exe PID 2896 wrote to memory of 2024 2896 7jvvv.exe lfflfll.exe PID 2896 wrote to memory of 2024 2896 7jvvv.exe lfflfll.exe PID 2896 wrote to memory of 2024 2896 7jvvv.exe lfflfll.exe PID 2896 wrote to memory of 2024 2896 7jvvv.exe lfflfll.exe PID 2024 wrote to memory of 1824 2024 lfflfll.exe nnbhbb.exe PID 2024 wrote to memory of 1824 2024 lfflfll.exe nnbhbb.exe PID 2024 wrote to memory of 1824 2024 lfflfll.exe nnbhbb.exe PID 2024 wrote to memory of 1824 2024 lfflfll.exe nnbhbb.exe PID 1824 wrote to memory of 2804 1824 nnbhbb.exe 5jddv.exe PID 1824 wrote to memory of 2804 1824 nnbhbb.exe 5jddv.exe PID 1824 wrote to memory of 2804 1824 nnbhbb.exe 5jddv.exe PID 1824 wrote to memory of 2804 1824 nnbhbb.exe 5jddv.exe PID 2804 wrote to memory of 2736 2804 5jddv.exe frffllr.exe PID 2804 wrote to memory of 2736 2804 5jddv.exe frffllr.exe PID 2804 wrote to memory of 2736 2804 5jddv.exe frffllr.exe PID 2804 wrote to memory of 2736 2804 5jddv.exe frffllr.exe PID 2736 wrote to memory of 2320 2736 frffllr.exe tttttt.exe PID 2736 wrote to memory of 2320 2736 frffllr.exe tttttt.exe PID 2736 wrote to memory of 2320 2736 frffllr.exe tttttt.exe PID 2736 wrote to memory of 2320 2736 frffllr.exe tttttt.exe PID 2320 wrote to memory of 2916 2320 tttttt.exe pjdpd.exe PID 2320 wrote to memory of 2916 2320 tttttt.exe pjdpd.exe PID 2320 wrote to memory of 2916 2320 tttttt.exe pjdpd.exe PID 2320 wrote to memory of 2916 2320 tttttt.exe pjdpd.exe PID 2916 wrote to memory of 2776 2916 pjdpd.exe 1hnntt.exe PID 2916 wrote to memory of 2776 2916 pjdpd.exe 1hnntt.exe PID 2916 wrote to memory of 2776 2916 pjdpd.exe 1hnntt.exe PID 2916 wrote to memory of 2776 2916 pjdpd.exe 1hnntt.exe PID 2776 wrote to memory of 1296 2776 1hnntt.exe thtttn.exe PID 2776 wrote to memory of 1296 2776 1hnntt.exe thtttn.exe PID 2776 wrote to memory of 1296 2776 1hnntt.exe thtttn.exe PID 2776 wrote to memory of 1296 2776 1hnntt.exe thtttn.exe PID 1296 wrote to memory of 2120 1296 thtttn.exe jdvjv.exe PID 1296 wrote to memory of 2120 1296 thtttn.exe jdvjv.exe PID 1296 wrote to memory of 2120 1296 thtttn.exe jdvjv.exe PID 1296 wrote to memory of 2120 1296 thtttn.exe jdvjv.exe PID 2120 wrote to memory of 2608 2120 jdvjv.exe xfxlxxl.exe PID 2120 wrote to memory of 2608 2120 jdvjv.exe xfxlxxl.exe PID 2120 wrote to memory of 2608 2120 jdvjv.exe xfxlxxl.exe PID 2120 wrote to memory of 2608 2120 jdvjv.exe xfxlxxl.exe PID 2608 wrote to memory of 2704 2608 xfxlxxl.exe 3thhnt.exe PID 2608 wrote to memory of 2704 2608 xfxlxxl.exe 3thhnt.exe PID 2608 wrote to memory of 2704 2608 xfxlxxl.exe 3thhnt.exe PID 2608 wrote to memory of 2704 2608 xfxlxxl.exe 3thhnt.exe PID 2704 wrote to memory of 1288 2704 3thhnt.exe vpdjp.exe PID 2704 wrote to memory of 1288 2704 3thhnt.exe vpdjp.exe PID 2704 wrote to memory of 1288 2704 3thhnt.exe vpdjp.exe PID 2704 wrote to memory of 1288 2704 3thhnt.exe vpdjp.exe PID 1288 wrote to memory of 2000 1288 vpdjp.exe 3xlrxxf.exe PID 1288 wrote to memory of 2000 1288 vpdjp.exe 3xlrxxf.exe PID 1288 wrote to memory of 2000 1288 vpdjp.exe 3xlrxxf.exe PID 1288 wrote to memory of 2000 1288 vpdjp.exe 3xlrxxf.exe PID 2000 wrote to memory of 1756 2000 3xlrxxf.exe tnbbhn.exe PID 2000 wrote to memory of 1756 2000 3xlrxxf.exe tnbbhn.exe PID 2000 wrote to memory of 1756 2000 3xlrxxf.exe tnbbhn.exe PID 2000 wrote to memory of 1756 2000 3xlrxxf.exe tnbbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\1nnthh.exec:\1nnthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\7jvvv.exec:\7jvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lfflfll.exec:\lfflfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\nnbhbb.exec:\nnbhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\5jddv.exec:\5jddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\frffllr.exec:\frffllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tttttt.exec:\tttttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\pjdpd.exec:\pjdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\1hnntt.exec:\1hnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\thtttn.exec:\thtttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\jdvjv.exec:\jdvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xfxlxxl.exec:\xfxlxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\3thhnt.exec:\3thhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vpdjp.exec:\vpdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\3xlrxxf.exec:\3xlrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\tnbbhn.exec:\tnbbhn.exe17⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vjdvd.exec:\vjdvd.exe18⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xrxlllx.exec:\xrxlllx.exe19⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nhthbn.exec:\nhthbn.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bnnntn.exec:\bnnntn.exe21⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvppj.exec:\dvppj.exe22⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rfrrlrx.exec:\rfrrlrx.exe23⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tnhnhn.exec:\tnhnhn.exe24⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jdvvv.exec:\jdvvv.exe25⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7fxflrx.exec:\7fxflrx.exe26⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lfrxxfr.exec:\lfrxxfr.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\hnbhtt.exec:\hnbhtt.exe28⤵
- Executes dropped EXE
PID:892 -
\??\c:\tbnhhb.exec:\tbnhhb.exe29⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe30⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xlffxfl.exec:\xlffxfl.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\btnntb.exec:\btnntb.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnttbb.exec:\tnttbb.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2332 -
\??\c:\3fxrfrx.exec:\3fxrfrx.exe34⤵
- Executes dropped EXE
PID:896 -
\??\c:\xrllrxf.exec:\xrllrxf.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bnhbhn.exec:\bnhbhn.exe36⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nhnhth.exec:\nhnhth.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jjddj.exec:\jjddj.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1604 -
\??\c:\dvdjp.exec:\dvdjp.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5fxxflr.exec:\5fxxflr.exe40⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7frrxlr.exec:\7frrxlr.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe42⤵
- Executes dropped EXE
PID:2220 -
\??\c:\btnthh.exec:\btnthh.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bnhhhn.exec:\bnhhhn.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vvdvp.exec:\vvdvp.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pjdpd.exec:\pjdpd.exe46⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5lxffrr.exec:\5lxffrr.exe47⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\htnbbb.exec:\htnbbb.exe49⤵
- Executes dropped EXE
PID:2624 -
\??\c:\htnntt.exec:\htnntt.exe50⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1pvdj.exec:\1pvdj.exe51⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vpdpd.exec:\vpdpd.exe52⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3jdjj.exec:\3jdjj.exe53⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xfxflrf.exec:\xfxflrf.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rrlxfll.exec:\rrlxfll.exe55⤵
- Executes dropped EXE
PID:860 -
\??\c:\hbhhnn.exec:\hbhhnn.exe56⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ttntth.exec:\ttntth.exe57⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdppv.exec:\jdppv.exe58⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vpvdv.exec:\vpvdv.exe59⤵
- Executes dropped EXE
PID:284 -
\??\c:\lflrrfl.exec:\lflrrfl.exe60⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5rxxflr.exec:\5rxxflr.exe61⤵
- Executes dropped EXE
PID:1432 -
\??\c:\htttbb.exec:\htttbb.exe62⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tnttbb.exec:\tnttbb.exe63⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hnbhtb.exec:\hnbhtb.exe64⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vpvvv.exec:\vpvvv.exe65⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tnbbbb.exec:\tnbbbb.exe66⤵PID:2132
-
\??\c:\ntbthh.exec:\ntbthh.exe67⤵PID:2200
-
\??\c:\pdppp.exec:\pdppp.exe68⤵PID:2460
-
\??\c:\pdppp.exec:\pdppp.exe69⤵PID:2008
-
\??\c:\fxlrffx.exec:\fxlrffx.exe70⤵PID:1996
-
\??\c:\5rffllf.exec:\5rffllf.exe71⤵PID:328
-
\??\c:\1dppp.exec:\1dppp.exe72⤵PID:936
-
\??\c:\dvvdj.exec:\dvvdj.exe73⤵PID:920
-
\??\c:\nnttbb.exec:\nnttbb.exe74⤵PID:1760
-
\??\c:\tntbnt.exec:\tntbnt.exe75⤵PID:1868
-
\??\c:\ppddd.exec:\ppddd.exe76⤵PID:2368
-
\??\c:\lxfxfxl.exec:\lxfxfxl.exe77⤵PID:712
-
\??\c:\nnttbh.exec:\nnttbh.exe78⤵PID:2204
-
\??\c:\vpjjp.exec:\vpjjp.exe79⤵PID:1984
-
\??\c:\fxllxxf.exec:\fxllxxf.exe80⤵PID:840
-
\??\c:\frxfffl.exec:\frxfffl.exe81⤵PID:1504
-
\??\c:\hhntbn.exec:\hhntbn.exe82⤵
- System Location Discovery: System Language Discovery
PID:768 -
\??\c:\tntntb.exec:\tntntb.exe83⤵PID:2160
-
\??\c:\pdjpv.exec:\pdjpv.exe84⤵PID:1768
-
\??\c:\vpjpd.exec:\vpjpd.exe85⤵PID:2412
-
\??\c:\3fxxxfl.exec:\3fxxxfl.exe86⤵PID:1576
-
\??\c:\rfrrfll.exec:\rfrrfll.exe87⤵PID:2144
-
\??\c:\3thbtt.exec:\3thbtt.exe88⤵PID:2396
-
\??\c:\3bhthn.exec:\3bhthn.exe89⤵PID:2308
-
\??\c:\7pdvv.exec:\7pdvv.exe90⤵PID:2852
-
\??\c:\vjdjj.exec:\vjdjj.exe91⤵PID:2220
-
\??\c:\9hnbht.exec:\9hnbht.exe92⤵PID:2732
-
\??\c:\thtnhn.exec:\thtnhn.exe93⤵PID:2788
-
\??\c:\jjpvd.exec:\jjpvd.exe94⤵PID:1656
-
\??\c:\9pjpd.exec:\9pjpd.exe95⤵PID:2936
-
\??\c:\thtbhn.exec:\thtbhn.exe96⤵PID:1740
-
\??\c:\ttnbnn.exec:\ttnbnn.exe97⤵PID:2776
-
\??\c:\7jpvp.exec:\7jpvp.exe98⤵PID:2600
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe99⤵PID:2216
-
\??\c:\bbnhtn.exec:\bbnhtn.exe100⤵PID:2336
-
\??\c:\nbhhnt.exec:\nbhhnt.exe101⤵PID:2304
-
\??\c:\3pvpv.exec:\3pvpv.exe102⤵PID:1748
-
\??\c:\lxfllrx.exec:\lxfllrx.exe103⤵PID:1448
-
\??\c:\frxrxxx.exec:\frxrxxx.exe104⤵PID:1660
-
\??\c:\tntnnt.exec:\tntnnt.exe105⤵PID:2456
-
\??\c:\bhhbtn.exec:\bhhbtn.exe106⤵PID:2864
-
\??\c:\9jpjj.exec:\9jpjj.exe107⤵PID:1756
-
\??\c:\fxllffl.exec:\fxllffl.exe108⤵PID:1916
-
\??\c:\xrlffxf.exec:\xrlffxf.exe109⤵PID:2956
-
\??\c:\5hhthh.exec:\5hhthh.exe110⤵PID:884
-
\??\c:\9pdjv.exec:\9pdjv.exe111⤵PID:3060
-
\??\c:\pdvpv.exec:\pdvpv.exe112⤵PID:2180
-
\??\c:\fllflff.exec:\fllflff.exe113⤵PID:2184
-
\??\c:\frflrxf.exec:\frflrxf.exe114⤵PID:2700
-
\??\c:\hhtnnh.exec:\hhtnnh.exe115⤵PID:1564
-
\??\c:\pjdjv.exec:\pjdjv.exe116⤵PID:2240
-
\??\c:\vpddp.exec:\vpddp.exe117⤵PID:1532
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe118⤵PID:2008
-
\??\c:\tbbbht.exec:\tbbbht.exe119⤵PID:1996
-
\??\c:\hthnnn.exec:\hthnnn.exe120⤵PID:624
-
\??\c:\jjvdp.exec:\jjvdp.exe121⤵PID:936
-
\??\c:\pjvvv.exec:\pjvvv.exe122⤵PID:1552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-