Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 21:12
Static task
static1
Behavioral task
behavioral1
Sample
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
Resource
win7-20240903-en
General
-
Target
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
-
Size
332KB
-
MD5
c627dddffa7434e42384fbb2b307622c
-
SHA1
526fd0d28ae693bd9813ebbed46a5bfe297efac1
-
SHA256
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0
-
SHA512
3eb5903d056bddfdaf2e1dc693137b1b17bdd7401f0df856da09403aeb19ded80cd3aaa145369e3f7bb0a193d608cd58d70508cfd7c2eabc2e902a32dab720f6
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhP:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/2404-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-53-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2732-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-93-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2780-91-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3052-111-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2960-123-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1536-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-129-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1804-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-199-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-379-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2608-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-418-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1480-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-469-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/300-511-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1492-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-780-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btntbb.exe5dpjp.exe9xffrxx.exethnntt.exepjdjv.exe1vjpv.exe3pdjp.exejjpdp.exepvjjv.exelfxlxfr.exetthnbb.exevpjvp.exe7frlflr.exe1bttbh.exelfxrlrf.exedvpvv.exellllrfr.exe9vpjd.exevpjjp.exe5httbt.exe5thbht.exefrflxxl.exebbtthh.exevpjpd.exe5fxfrxl.exedvjvj.exejjvdv.exetnntbn.exe7dppp.exefrllrrx.exehbnbtt.exeffrfffl.exexrflrxf.exebtntnn.exe7jvpv.exerlxxxfr.exetnbntb.exe7vdjj.exe7jjpv.exe3lfxffl.exe5htttt.exebtbbnh.exe7jppp.exevpvvv.exefxlrxxf.exetnbbhh.exenhttbh.exejdddv.exe7xfrfxf.exe1xrxrxf.exebnbtbb.exepjvjd.exevpjpj.exe5frfxxl.exe1bhnnt.exepdjjv.exe5dvvd.exe1flrffr.exehbttbt.exettbbtt.exe3vpjd.exe7xflllr.exe7fxfrxf.exe1tntnn.exepid Process 2908 btntbb.exe 2256 5dpjp.exe 2540 9xffrxx.exe 2080 thnntt.exe 2980 pjdjv.exe 2844 1vjpv.exe 2732 3pdjp.exe 2960 jjpdp.exe 2780 pvjjv.exe 2628 lfxlxfr.exe 3052 tthnbb.exe 1536 vpjvp.exe 1764 7frlflr.exe 2360 1bttbh.exe 1804 lfxrlrf.exe 556 dvpvv.exe 2308 llllrfr.exe 2932 9vpjd.exe 2468 vpjjp.exe 2496 5httbt.exe 1264 5thbht.exe 1080 frflxxl.exe 620 bbtthh.exe 692 vpjpd.exe 2116 5fxfrxl.exe 1696 dvjvj.exe 1784 jjvdv.exe 2804 tnntbn.exe 1520 7dppp.exe 1096 frllrrx.exe 1496 hbnbtt.exe 1512 ffrfffl.exe 2404 xrflrxf.exe 476 btntnn.exe 2216 7jvpv.exe 1584 rlxxxfr.exe 2968 tnbntb.exe 1052 7vdjj.exe 2724 7jjpv.exe 2480 3lfxffl.exe 2848 5htttt.exe 2440 btbbnh.exe 2760 7jppp.exe 2816 vpvvv.exe 2668 fxlrxxf.exe 2608 tnbbhh.exe 2632 nhttbh.exe 2192 jdddv.exe 3052 7xfrfxf.exe 1572 1xrxrxf.exe 1480 bnbtbb.exe 1296 pjvjd.exe 2524 vpjpj.exe 1136 5frfxxl.exe 1628 1bhnnt.exe 2128 pdjjv.exe 3032 5dvvd.exe 2932 1flrffr.exe 2244 hbttbt.exe 1256 ttbbtt.exe 1596 3vpjd.exe 2792 7xflllr.exe 1080 7fxfrxf.exe 1356 1tntnn.exe -
Processes:
resource yara_rule behavioral1/memory/2908-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-129-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1804-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-1287-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
lfxxrfr.exetthbht.exe7bnntb.exellxfrxl.exe9lffxff.exenhthbb.exehbntbb.exeffrxlrx.exexrxxflf.exevddjp.exexlrrffl.exe7vdjj.exexlfxrxf.exebtnbth.exexrllrxf.exettttth.exe5bbntb.exevvjdj.exe9btbnn.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exebtntbb.exe5dpjp.exe9xffrxx.exethnntt.exepjdjv.exe1vjpv.exe3pdjp.exejjpdp.exepvjjv.exelfxlxfr.exetthnbb.exevpjvp.exe7frlflr.exe1bttbh.exelfxrlrf.exedescription pid Process procid_target PID 2404 wrote to memory of 2908 2404 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2404 wrote to memory of 2908 2404 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2404 wrote to memory of 2908 2404 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2404 wrote to memory of 2908 2404 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2908 wrote to memory of 2256 2908 btntbb.exe 31 PID 2908 wrote to memory of 2256 2908 btntbb.exe 31 PID 2908 wrote to memory of 2256 2908 btntbb.exe 31 PID 2908 wrote to memory of 2256 2908 btntbb.exe 31 PID 2256 wrote to memory of 2540 2256 5dpjp.exe 32 PID 2256 wrote to memory of 2540 2256 5dpjp.exe 32 PID 2256 wrote to memory of 2540 2256 5dpjp.exe 32 PID 2256 wrote to memory of 2540 2256 5dpjp.exe 32 PID 2540 wrote to memory of 2080 2540 9xffrxx.exe 33 PID 2540 wrote to memory of 2080 2540 9xffrxx.exe 33 PID 2540 wrote to memory of 2080 2540 9xffrxx.exe 33 PID 2540 wrote to memory of 2080 2540 9xffrxx.exe 33 PID 2080 wrote to memory of 2980 2080 thnntt.exe 34 PID 2080 wrote to memory of 2980 2080 thnntt.exe 34 PID 2080 wrote to memory of 2980 2080 thnntt.exe 34 PID 2080 wrote to memory of 2980 2080 thnntt.exe 34 PID 2980 wrote to memory of 2844 2980 pjdjv.exe 35 PID 2980 wrote to memory of 2844 2980 pjdjv.exe 35 PID 2980 wrote to memory of 2844 2980 pjdjv.exe 35 PID 2980 wrote to memory of 2844 2980 pjdjv.exe 35 PID 2844 wrote to memory of 2732 2844 1vjpv.exe 36 PID 2844 wrote to memory of 2732 2844 1vjpv.exe 36 PID 2844 wrote to memory of 2732 2844 1vjpv.exe 36 PID 2844 wrote to memory of 2732 2844 1vjpv.exe 36 PID 2732 wrote to memory of 2960 2732 3pdjp.exe 37 PID 2732 wrote to memory of 2960 2732 3pdjp.exe 37 PID 2732 wrote to memory of 2960 2732 3pdjp.exe 37 PID 2732 wrote to memory of 2960 2732 3pdjp.exe 37 PID 2960 wrote to memory of 2780 2960 jjpdp.exe 38 PID 2960 wrote to memory of 2780 2960 jjpdp.exe 38 PID 2960 wrote to memory of 2780 2960 jjpdp.exe 38 PID 2960 wrote to memory of 2780 2960 jjpdp.exe 38 PID 2780 wrote to memory of 2628 2780 pvjjv.exe 39 PID 2780 wrote to memory of 2628 2780 pvjjv.exe 39 PID 2780 wrote to memory of 2628 2780 pvjjv.exe 39 PID 2780 wrote to memory of 2628 2780 pvjjv.exe 39 PID 2628 wrote to memory of 3052 2628 lfxlxfr.exe 40 PID 2628 wrote to memory of 3052 2628 lfxlxfr.exe 40 PID 2628 wrote to memory of 3052 2628 lfxlxfr.exe 40 PID 2628 wrote to memory of 3052 2628 lfxlxfr.exe 40 PID 3052 wrote to memory of 1536 3052 tthnbb.exe 41 PID 3052 wrote to memory of 1536 3052 tthnbb.exe 41 PID 3052 wrote to memory of 1536 3052 tthnbb.exe 41 PID 3052 wrote to memory of 1536 3052 tthnbb.exe 41 PID 1536 wrote to memory of 1764 1536 vpjvp.exe 42 PID 1536 wrote to memory of 1764 1536 vpjvp.exe 42 PID 1536 wrote to memory of 1764 1536 vpjvp.exe 42 PID 1536 wrote to memory of 1764 1536 vpjvp.exe 42 PID 1764 wrote to memory of 2360 1764 7frlflr.exe 43 PID 1764 wrote to memory of 2360 1764 7frlflr.exe 43 PID 1764 wrote to memory of 2360 1764 7frlflr.exe 43 PID 1764 wrote to memory of 2360 1764 7frlflr.exe 43 PID 2360 wrote to memory of 1804 2360 1bttbh.exe 44 PID 2360 wrote to memory of 1804 2360 1bttbh.exe 44 PID 2360 wrote to memory of 1804 2360 1bttbh.exe 44 PID 2360 wrote to memory of 1804 2360 1bttbh.exe 44 PID 1804 wrote to memory of 556 1804 lfxrlrf.exe 45 PID 1804 wrote to memory of 556 1804 lfxrlrf.exe 45 PID 1804 wrote to memory of 556 1804 lfxrlrf.exe 45 PID 1804 wrote to memory of 556 1804 lfxrlrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\btntbb.exec:\btntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\5dpjp.exec:\5dpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\9xffrxx.exec:\9xffrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\thnntt.exec:\thnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\pjdjv.exec:\pjdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\1vjpv.exec:\1vjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\3pdjp.exec:\3pdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jjpdp.exec:\jjpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\pvjjv.exec:\pvjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\tthnbb.exec:\tthnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\vpjvp.exec:\vpjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\7frlflr.exec:\7frlflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\1bttbh.exec:\1bttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\lfxrlrf.exec:\lfxrlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\dvpvv.exec:\dvpvv.exe17⤵
- Executes dropped EXE
PID:556 -
\??\c:\llllrfr.exec:\llllrfr.exe18⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9vpjd.exec:\9vpjd.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vpjjp.exec:\vpjjp.exe20⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5httbt.exec:\5httbt.exe21⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5thbht.exec:\5thbht.exe22⤵
- Executes dropped EXE
PID:1264 -
\??\c:\frflxxl.exec:\frflxxl.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bbtthh.exec:\bbtthh.exe24⤵
- Executes dropped EXE
PID:620 -
\??\c:\vpjpd.exec:\vpjpd.exe25⤵
- Executes dropped EXE
PID:692 -
\??\c:\5fxfrxl.exec:\5fxfrxl.exe26⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dvjvj.exec:\dvjvj.exe27⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jjvdv.exec:\jjvdv.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tnntbn.exec:\tnntbn.exe29⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7dppp.exec:\7dppp.exe30⤵
- Executes dropped EXE
PID:1520 -
\??\c:\frllrrx.exec:\frllrrx.exe31⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hbnbtt.exec:\hbnbtt.exe32⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ffrfffl.exec:\ffrfffl.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xrflrxf.exec:\xrflrxf.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\btntnn.exec:\btntnn.exe35⤵
- Executes dropped EXE
PID:476 -
\??\c:\7jvpv.exec:\7jvpv.exe36⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tnbntb.exec:\tnbntb.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7vdjj.exec:\7vdjj.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1052 -
\??\c:\7jjpv.exec:\7jjpv.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3lfxffl.exec:\3lfxffl.exe41⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5htttt.exec:\5htttt.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\btbbnh.exec:\btbbnh.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7jppp.exec:\7jppp.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vpvvv.exec:\vpvvv.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\tnbbhh.exec:\tnbbhh.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nhttbh.exec:\nhttbh.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdddv.exec:\jdddv.exe49⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7xfrfxf.exec:\7xfrfxf.exe50⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1xrxrxf.exec:\1xrxrxf.exe51⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bnbtbb.exec:\bnbtbb.exe52⤵
- Executes dropped EXE
PID:1480 -
\??\c:\pjvjd.exec:\pjvjd.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vpjpj.exec:\vpjpj.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5frfxxl.exec:\5frfxxl.exe55⤵
- Executes dropped EXE
PID:1136 -
\??\c:\1bhnnt.exec:\1bhnnt.exe56⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pdjjv.exec:\pdjjv.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5dvvd.exec:\5dvvd.exe58⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1flrffr.exec:\1flrffr.exe59⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hbttbt.exec:\hbttbt.exe60⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ttbbtt.exec:\ttbbtt.exe61⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3vpjd.exec:\3vpjd.exe62⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7xflllr.exec:\7xflllr.exe63⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7fxfrxf.exec:\7fxfrxf.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\1tntnn.exec:\1tntnn.exe65⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vvpvd.exec:\vvpvd.exe66⤵PID:300
-
\??\c:\pjpvj.exec:\pjpvj.exe67⤵PID:1332
-
\??\c:\xrflffl.exec:\xrflffl.exe68⤵PID:1668
-
\??\c:\lxfllrx.exec:\lxfllrx.exe69⤵PID:1756
-
\??\c:\tntnbh.exec:\tntnbh.exe70⤵PID:2988
-
\??\c:\jddpd.exec:\jddpd.exe71⤵PID:2576
-
\??\c:\jdpdp.exec:\jdpdp.exe72⤵PID:2500
-
\??\c:\xrxxflf.exec:\xrxxflf.exe73⤵
- System Location Discovery: System Language Discovery
PID:672 -
\??\c:\tthnbh.exec:\tthnbh.exe74⤵PID:1680
-
\??\c:\hthbtn.exec:\hthbtn.exe75⤵PID:1492
-
\??\c:\dvdjj.exec:\dvdjj.exe76⤵PID:324
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe77⤵PID:1060
-
\??\c:\fxfxffl.exec:\fxfxffl.exe78⤵PID:2428
-
\??\c:\bntbbn.exec:\bntbbn.exe79⤵PID:1752
-
\??\c:\vvjpp.exec:\vvjpp.exe80⤵PID:2220
-
\??\c:\pjdpj.exec:\pjdpj.exe81⤵PID:1608
-
\??\c:\3rrfrrx.exec:\3rrfrrx.exe82⤵PID:2552
-
\??\c:\3nbnbb.exec:\3nbnbb.exe83⤵PID:2344
-
\??\c:\hthntn.exec:\hthntn.exe84⤵PID:3044
-
\??\c:\vpdpd.exec:\vpdpd.exe85⤵PID:2556
-
\??\c:\fxrrflx.exec:\fxrrflx.exe86⤵PID:2836
-
\??\c:\xlllrlr.exec:\xlllrlr.exe87⤵PID:2864
-
\??\c:\ttntbt.exec:\ttntbt.exe88⤵PID:2648
-
\??\c:\pppvd.exec:\pppvd.exe89⤵PID:2952
-
\??\c:\dvpjv.exec:\dvpjv.exe90⤵PID:2860
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe91⤵PID:1996
-
\??\c:\bbtnnt.exec:\bbtnnt.exe92⤵PID:2668
-
\??\c:\1tnntt.exec:\1tnntt.exe93⤵PID:2224
-
\??\c:\pjpvv.exec:\pjpvv.exe94⤵PID:2632
-
\??\c:\pjvvd.exec:\pjvvd.exe95⤵PID:2192
-
\??\c:\frxxfxr.exec:\frxxfxr.exe96⤵PID:1848
-
\??\c:\9btbnn.exec:\9btbnn.exe97⤵
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\vddpv.exec:\vddpv.exe98⤵PID:2452
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe99⤵PID:2856
-
\??\c:\ffrxllx.exec:\ffrxllx.exe100⤵PID:1780
-
\??\c:\5bnnnn.exec:\5bnnnn.exe101⤵PID:1016
-
\??\c:\jdvdj.exec:\jdvdj.exe102⤵PID:2956
-
\??\c:\9xrxllx.exec:\9xrxllx.exe103⤵PID:2916
-
\??\c:\fxrxflx.exec:\fxrxflx.exe104⤵PID:2912
-
\??\c:\7bnnbh.exec:\7bnnbh.exe105⤵PID:2140
-
\??\c:\vpddp.exec:\vpddp.exe106⤵PID:2516
-
\??\c:\vpdjp.exec:\vpdjp.exe107⤵PID:2492
-
\??\c:\7rfxxfr.exec:\7rfxxfr.exe108⤵PID:444
-
\??\c:\5nhntt.exec:\5nhntt.exe109⤵PID:304
-
\??\c:\nhnttt.exec:\nhnttt.exe110⤵PID:1540
-
\??\c:\5ddjv.exec:\5ddjv.exe111⤵PID:2324
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe112⤵PID:692
-
\??\c:\tnhbhh.exec:\tnhbhh.exe113⤵PID:2032
-
\??\c:\tbthtb.exec:\tbthtb.exe114⤵PID:1384
-
\??\c:\dvjvv.exec:\dvjvv.exe115⤵PID:1548
-
\??\c:\rffrflr.exec:\rffrflr.exe116⤵PID:2016
-
\??\c:\nhtttb.exec:\nhtttb.exe117⤵PID:1784
-
\??\c:\thnbtb.exec:\thnbtb.exe118⤵PID:2376
-
\??\c:\jdpvj.exec:\jdpvj.exe119⤵PID:2476
-
\??\c:\3xllrxl.exec:\3xllrxl.exe120⤵PID:2296
-
\??\c:\nhbhbb.exec:\nhbhbb.exe121⤵PID:744
-
\??\c:\tbthtb.exec:\tbthtb.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-