Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
-
Size
455KB
-
MD5
38ca51c1f67607323a862005e6101600
-
SHA1
09d31aa71a6c00ff9b735ba369ee1ec3ca031aab
-
SHA256
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6
-
SHA512
bf2b1df7f48c5c6316f0c157b24599d143366e3cecbbe03560059e95d8d093b7f38efe52a61f80a2fc340e995397fa7c4a90f3e4917141ae8fc09ad86a1333ac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1292-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-91-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2244-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-134-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2948-133-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2984-152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1456-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-256-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/784-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-527-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-535-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-742-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-881-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-898-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-921-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2660-942-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1892-1083-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2376-1130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-1152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 rrllrxx.exe 1404 bnbthh.exe 1160 pjdpv.exe 1260 flflrxl.exe 2836 ttbbhb.exe 2876 5jvdd.exe 1172 lfxfffl.exe 2992 ttntht.exe 2684 hbnntt.exe 2704 fflfxrf.exe 2244 nhbbhh.exe 1488 5htbbb.exe 2948 dpjjj.exe 580 hnhhbh.exe 2984 ddddj.exe 1072 nhnhbh.exe 3024 ttnbnt.exe 1456 fxrrfff.exe 2360 hhtttb.exe 2140 rflllll.exe 2112 xxxrrlf.exe 1712 jpdjp.exe 1872 rlflrrx.exe 1864 xxrfxfx.exe 1360 xxflrxl.exe 1680 jpddj.exe 1336 xrrxfrf.exe 784 bbnthn.exe 1928 ppjvj.exe 1876 3xxfrrf.exe 320 jjdjp.exe 1584 lfrlrxl.exe 1136 ntbnbb.exe 2552 vdvjv.exe 1160 ffxxflx.exe 2856 lllxfxl.exe 2260 nttntt.exe 2872 jjdpv.exe 2096 ddvdv.exe 2892 9xxlrxr.exe 3020 hbtbnt.exe 2992 pjppd.exe 1888 9llrlrf.exe 2444 frlfrxl.exe 2700 7tnbnb.exe 572 pdjjv.exe 2868 djjdv.exe 2972 5frrffl.exe 1140 hbbbhn.exe 2880 jdvdv.exe 2036 5jdvj.exe 2044 9rrxflr.exe 2072 hhbbbh.exe 2804 bthhbn.exe 1516 dvvjd.exe 2028 llfrxfr.exe 1800 ffllxlx.exe 1656 bnhhnn.exe 2132 ppjpv.exe 2348 jvpdp.exe 1000 ffxlxfx.exe 304 nhtbnn.exe 1868 5nhhnt.exe 1368 9vvjd.exe -
resource yara_rule behavioral1/memory/1292-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-256-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/784-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-742-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1648-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-898-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2660-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-1125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-1152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-1172-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2540 1292 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 30 PID 1292 wrote to memory of 2540 1292 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 30 PID 1292 wrote to memory of 2540 1292 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 30 PID 1292 wrote to memory of 2540 1292 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 30 PID 2540 wrote to memory of 1404 2540 rrllrxx.exe 31 PID 2540 wrote to memory of 1404 2540 rrllrxx.exe 31 PID 2540 wrote to memory of 1404 2540 rrllrxx.exe 31 PID 2540 wrote to memory of 1404 2540 rrllrxx.exe 31 PID 1404 wrote to memory of 1160 1404 bnbthh.exe 32 PID 1404 wrote to memory of 1160 1404 bnbthh.exe 32 PID 1404 wrote to memory of 1160 1404 bnbthh.exe 32 PID 1404 wrote to memory of 1160 1404 bnbthh.exe 32 PID 1160 wrote to memory of 1260 1160 pjdpv.exe 33 PID 1160 wrote to memory of 1260 1160 pjdpv.exe 33 PID 1160 wrote to memory of 1260 1160 pjdpv.exe 33 PID 1160 wrote to memory of 1260 1160 pjdpv.exe 33 PID 1260 wrote to memory of 2836 1260 flflrxl.exe 34 PID 1260 wrote to memory of 2836 1260 flflrxl.exe 34 PID 1260 wrote to memory of 2836 1260 flflrxl.exe 34 PID 1260 wrote to memory of 2836 1260 flflrxl.exe 34 PID 2836 wrote to memory of 2876 2836 ttbbhb.exe 35 PID 2836 wrote to memory of 2876 2836 ttbbhb.exe 35 PID 2836 wrote to memory of 2876 2836 ttbbhb.exe 35 PID 2836 wrote to memory of 2876 2836 ttbbhb.exe 35 PID 2876 wrote to memory of 1172 2876 5jvdd.exe 36 PID 2876 wrote to memory of 1172 2876 5jvdd.exe 36 PID 2876 wrote to memory of 1172 2876 5jvdd.exe 36 PID 2876 wrote to memory of 1172 2876 5jvdd.exe 36 PID 1172 wrote to memory of 2992 1172 lfxfffl.exe 37 PID 1172 wrote to memory of 2992 1172 lfxfffl.exe 37 PID 1172 wrote to memory of 2992 1172 lfxfffl.exe 37 PID 1172 wrote to memory of 2992 1172 lfxfffl.exe 37 PID 2992 wrote to memory of 2684 2992 ttntht.exe 38 PID 2992 wrote to memory of 2684 2992 ttntht.exe 38 PID 2992 wrote to memory of 2684 2992 ttntht.exe 38 PID 2992 wrote to memory of 2684 2992 ttntht.exe 38 PID 2684 wrote to memory of 2704 2684 hbnntt.exe 39 PID 2684 wrote to memory of 2704 2684 hbnntt.exe 39 PID 2684 wrote to memory of 2704 2684 hbnntt.exe 39 PID 2684 wrote to memory of 2704 2684 hbnntt.exe 39 PID 2704 wrote to memory of 2244 2704 fflfxrf.exe 40 PID 2704 wrote to memory of 2244 2704 fflfxrf.exe 40 PID 2704 wrote to memory of 2244 2704 fflfxrf.exe 40 PID 2704 wrote to memory of 2244 2704 fflfxrf.exe 40 PID 2244 wrote to memory of 1488 2244 nhbbhh.exe 41 PID 2244 wrote to memory of 1488 2244 nhbbhh.exe 41 PID 2244 wrote to memory of 1488 2244 nhbbhh.exe 41 PID 2244 wrote to memory of 1488 2244 nhbbhh.exe 41 PID 1488 wrote to memory of 2948 1488 5htbbb.exe 42 PID 1488 wrote to memory of 2948 1488 5htbbb.exe 42 PID 1488 wrote to memory of 2948 1488 5htbbb.exe 42 PID 1488 wrote to memory of 2948 1488 5htbbb.exe 42 PID 2948 wrote to memory of 580 2948 dpjjj.exe 43 PID 2948 wrote to memory of 580 2948 dpjjj.exe 43 PID 2948 wrote to memory of 580 2948 dpjjj.exe 43 PID 2948 wrote to memory of 580 2948 dpjjj.exe 43 PID 580 wrote to memory of 2984 580 hnhhbh.exe 44 PID 580 wrote to memory of 2984 580 hnhhbh.exe 44 PID 580 wrote to memory of 2984 580 hnhhbh.exe 44 PID 580 wrote to memory of 2984 580 hnhhbh.exe 44 PID 2984 wrote to memory of 1072 2984 ddddj.exe 45 PID 2984 wrote to memory of 1072 2984 ddddj.exe 45 PID 2984 wrote to memory of 1072 2984 ddddj.exe 45 PID 2984 wrote to memory of 1072 2984 ddddj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\rrllrxx.exec:\rrllrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\bnbthh.exec:\bnbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\pjdpv.exec:\pjdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\flflrxl.exec:\flflrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\ttbbhb.exec:\ttbbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\5jvdd.exec:\5jvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lfxfffl.exec:\lfxfffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\ttntht.exec:\ttntht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\hbnntt.exec:\hbnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\fflfxrf.exec:\fflfxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhbbhh.exec:\nhbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\5htbbb.exec:\5htbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\dpjjj.exec:\dpjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hnhhbh.exec:\hnhhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\ddddj.exec:\ddddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\nhnhbh.exec:\nhnhbh.exe17⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ttnbnt.exec:\ttnbnt.exe18⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fxrrfff.exec:\fxrrfff.exe19⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hhtttb.exec:\hhtttb.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rflllll.exec:\rflllll.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jpdjp.exec:\jpdjp.exe23⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rlflrrx.exec:\rlflrrx.exe24⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xxrfxfx.exec:\xxrfxfx.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\xxflrxl.exec:\xxflrxl.exe26⤵
- Executes dropped EXE
PID:1360 -
\??\c:\jpddj.exec:\jpddj.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xrrxfrf.exec:\xrrxfrf.exe28⤵
- Executes dropped EXE
PID:1336 -
\??\c:\bbnthn.exec:\bbnthn.exe29⤵
- Executes dropped EXE
PID:784 -
\??\c:\ppjvj.exec:\ppjvj.exe30⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3xxfrrf.exec:\3xxfrrf.exe31⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jjdjp.exec:\jjdjp.exe32⤵
- Executes dropped EXE
PID:320 -
\??\c:\lfrlrxl.exec:\lfrlrxl.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ntbnbb.exec:\ntbnbb.exe34⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vdvjv.exec:\vdvjv.exe35⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ffxxflx.exec:\ffxxflx.exe36⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lllxfxl.exec:\lllxfxl.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nttntt.exec:\nttntt.exe38⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjdpv.exec:\jjdpv.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ddvdv.exec:\ddvdv.exe40⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9xxlrxr.exec:\9xxlrxr.exe41⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hbtbnt.exec:\hbtbnt.exe42⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pjppd.exec:\pjppd.exe43⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9llrlrf.exec:\9llrlrf.exe44⤵
- Executes dropped EXE
PID:1888 -
\??\c:\frlfrxl.exec:\frlfrxl.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7tnbnb.exec:\7tnbnb.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pdjjv.exec:\pdjjv.exe47⤵
- Executes dropped EXE
PID:572 -
\??\c:\djjdv.exec:\djjdv.exe48⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5frrffl.exec:\5frrffl.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hbbbhn.exec:\hbbbhn.exe50⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jdvdv.exec:\jdvdv.exe51⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5jdvj.exec:\5jdvj.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9rrxflr.exec:\9rrxflr.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hhbbbh.exec:\hhbbbh.exe54⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bthhbn.exec:\bthhbn.exe55⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dvvjd.exec:\dvvjd.exe56⤵
- Executes dropped EXE
PID:1516 -
\??\c:\llfrxfr.exec:\llfrxfr.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ffllxlx.exec:\ffllxlx.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bnhhnn.exec:\bnhhnn.exe59⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ppjpv.exec:\ppjpv.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jvpdp.exec:\jvpdp.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe62⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nhtbnn.exec:\nhtbnn.exe63⤵
- Executes dropped EXE
PID:304 -
\??\c:\5nhhnt.exec:\5nhhnt.exe64⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9vvjd.exec:\9vvjd.exe65⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rxrxflx.exec:\rxrxflx.exe66⤵PID:2480
-
\??\c:\5ttthh.exec:\5ttthh.exe67⤵PID:2224
-
\??\c:\bnbhtb.exec:\bnbhtb.exe68⤵PID:1256
-
\??\c:\ddvdd.exec:\ddvdd.exe69⤵PID:2220
-
\??\c:\fxlrffl.exec:\fxlrffl.exe70⤵PID:3064
-
\??\c:\xrlflrx.exec:\xrlflrx.exe71⤵PID:884
-
\??\c:\nhttbh.exec:\nhttbh.exe72⤵PID:1896
-
\??\c:\pjppj.exec:\pjppj.exe73⤵PID:584
-
\??\c:\xfflrfl.exec:\xfflrfl.exe74⤵PID:2420
-
\??\c:\nnnbht.exec:\nnnbht.exe75⤵PID:1716
-
\??\c:\thbhtb.exec:\thbhtb.exe76⤵PID:2256
-
\??\c:\dppvj.exec:\dppvj.exe77⤵PID:1744
-
\??\c:\vpjvj.exec:\vpjvj.exe78⤵PID:2552
-
\??\c:\ffrlrxl.exec:\ffrlrxl.exe79⤵PID:3044
-
\??\c:\3bttbh.exec:\3bttbh.exe80⤵PID:2076
-
\??\c:\pjdjp.exec:\pjdjp.exe81⤵PID:2820
-
\??\c:\vpddv.exec:\vpddv.exe82⤵PID:2864
-
\??\c:\3rlrrrf.exec:\3rlrrrf.exe83⤵PID:3056
-
\??\c:\tnhbnt.exec:\tnhbnt.exe84⤵PID:2828
-
\??\c:\ppjjv.exec:\ppjjv.exe85⤵PID:2628
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe86⤵PID:2740
-
\??\c:\rrllrrf.exec:\rrllrrf.exe87⤵PID:2528
-
\??\c:\ntttnt.exec:\ntttnt.exe88⤵PID:2008
-
\??\c:\vdjpv.exec:\vdjpv.exe89⤵PID:2240
-
\??\c:\7pjjp.exec:\7pjjp.exe90⤵PID:2244
-
\??\c:\5rffflx.exec:\5rffflx.exe91⤵PID:2056
-
\??\c:\tnbhnn.exec:\tnbhnn.exe92⤵PID:992
-
\??\c:\vjjjp.exec:\vjjjp.exe93⤵PID:2948
-
\??\c:\rrlrfrr.exec:\rrlrfrr.exe94⤵PID:1280
-
\??\c:\nttbtt.exec:\nttbtt.exe95⤵PID:2952
-
\??\c:\nhbnbb.exec:\nhbnbb.exe96⤵PID:3000
-
\??\c:\jpjvd.exec:\jpjvd.exe97⤵PID:1072
-
\??\c:\lrffxlx.exec:\lrffxlx.exe98⤵PID:1272
-
\??\c:\fffrlfl.exec:\fffrlfl.exe99⤵PID:1764
-
\??\c:\hnhhtb.exec:\hnhhtb.exe100⤵PID:3032
-
\??\c:\ppjpv.exec:\ppjpv.exe101⤵PID:2372
-
\??\c:\xfrxxfx.exec:\xfrxxfx.exe102⤵PID:2168
-
\??\c:\btttbh.exec:\btttbh.exe103⤵PID:1944
-
\??\c:\nhtbhb.exec:\nhtbhb.exe104⤵PID:2112
-
\??\c:\dvjjj.exec:\dvjjj.exe105⤵PID:1940
-
\??\c:\llfrlrl.exec:\llfrlrl.exe106⤵PID:1960
-
\??\c:\bbbhtt.exec:\bbbhtt.exe107⤵PID:1648
-
\??\c:\bthhbb.exec:\bthhbb.exe108⤵PID:1776
-
\??\c:\ppdjp.exec:\ppdjp.exe109⤵PID:1360
-
\??\c:\xxrxffr.exec:\xxrxffr.exe110⤵PID:2196
-
\??\c:\btntnt.exec:\btntnt.exe111⤵PID:380
-
\??\c:\hbhnnb.exec:\hbhnnb.exe112⤵PID:1336
-
\??\c:\jjdjv.exec:\jjdjv.exe113⤵PID:896
-
\??\c:\llffrrf.exec:\llffrrf.exe114⤵PID:2116
-
\??\c:\ttntbh.exec:\ttntbh.exe115⤵PID:1912
-
\??\c:\hthbbt.exec:\hthbbt.exe116⤵PID:1924
-
\??\c:\5jddp.exec:\5jddp.exe117⤵PID:1592
-
\??\c:\lfxfrrr.exec:\lfxfrrr.exe118⤵PID:1716
-
\??\c:\9tnbnt.exec:\9tnbnt.exe119⤵PID:1564
-
\??\c:\3htttb.exec:\3htttb.exe120⤵PID:1136
-
\??\c:\vvpvj.exec:\vvpvj.exe121⤵PID:336
-
\??\c:\7lffflf.exec:\7lffflf.exe122⤵PID:1952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-