Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 07:47
Static task
static1
Behavioral task
behavioral1
Sample
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
Resource
win7-20240903-en
General
-
Target
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
-
Size
455KB
-
MD5
38ca51c1f67607323a862005e6101600
-
SHA1
09d31aa71a6c00ff9b735ba369ee1ec3ca031aab
-
SHA256
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6
-
SHA512
bf2b1df7f48c5c6316f0c157b24599d143366e3cecbbe03560059e95d8d093b7f38efe52a61f80a2fc340e995397fa7c4a90f3e4917141ae8fc09ad86a1333ac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-850-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/856-857-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3056-1003-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-1061-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/3060-1209-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1420-1368-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tbtthn.exevvjpd.exelfxlxlr.exenhntbh.exe1vjvj.exelrfrlxr.exentbbtn.exevdvpp.exe7frxlrf.exetbbnhb.exelllrlrl.exenntnhh.exe7bbhbh.exedvjdd.exebbbbhn.exenthbtb.exexlxlxxf.exe7btntb.exedpvdj.exe3xrlxfr.exebnhnhb.exeflxfxxf.exepjdpd.exefxrfrrx.exettbhbt.exerrlxlfr.exetbbhnn.exefrrrffl.exedjjvp.exelfrfrxl.exe1hhbhn.exelfrrxxf.exebthhtb.exepjddp.exelrllrxf.exe5jvjp.exellfxrrf.exenbnntb.exejpjjv.exe3rllxrf.exetbbtbb.exevjjdj.exerlxxfxf.exettbnbh.exennthbh.exe9dvvp.exe3xllxfr.exetthtbb.exe9vpvj.exefllrflx.exerxrxlfl.exe9bthbh.exe3dppv.exe5dvdp.exeffrfrrf.exe9nttnn.exe5jvpj.exeflfrxfr.exe3tbhnt.exe3tnbnb.exevvjpd.exeffxrflf.exefxrfrxl.exetbthnt.exepid process 2900 tbtthn.exe 1728 vvjpd.exe 2540 lfxlxlr.exe 1964 nhntbh.exe 2784 1vjvj.exe 2600 lrfrlxr.exe 2628 ntbbtn.exe 2216 vdvpp.exe 2864 7frxlrf.exe 1252 tbbnhb.exe 2240 lllrlrl.exe 632 nntnhh.exe 376 7bbhbh.exe 2632 dvjdd.exe 2768 bbbbhn.exe 2816 nthbtb.exe 2964 xlxlxxf.exe 1152 7btntb.exe 1204 dpvdj.exe 2132 3xrlxfr.exe 392 bnhnhb.exe 2804 flxfxxf.exe 1260 pjdpd.exe 1932 fxrfrrx.exe 1388 ttbhbt.exe 1940 rrlxlfr.exe 492 tbbhnn.exe 1852 frrrffl.exe 2552 djjvp.exe 2140 lfrfrxl.exe 1492 1hhbhn.exe 1748 lfrrxxf.exe 2416 bthhtb.exe 2084 pjddp.exe 2404 lrllrxf.exe 2560 5jvjp.exe 2972 llfxrrf.exe 2988 nbnntb.exe 2700 jpjjv.exe 2856 3rllxrf.exe 2740 tbbtbb.exe 2956 vjjdj.exe 2860 rlxxfxf.exe 2300 ttbnbh.exe 2752 nnthbh.exe 2712 9dvvp.exe 2432 3xllxfr.exe 2852 tthtbb.exe 1560 9vpvj.exe 2460 fllrflx.exe 1240 rxrxlfl.exe 2768 9bthbh.exe 2936 3dppv.exe 2948 5dvdp.exe 1664 ffrfrrf.exe 2580 9nttnn.exe 2152 5jvpj.exe 2356 flfrxfr.exe 2556 3tbhnt.exe 2020 3tnbnb.exe 1372 vvjpd.exe 3012 ffxrflf.exe 1124 fxrfrxl.exe 1320 tbthnt.exe -
Processes:
resource yara_rule behavioral1/memory/2032-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-552-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2320-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-1061-0x00000000002A0000-0x00000000002CA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pjdpd.exe3xlrxfr.exettbnbn.exejjdjp.exe5fflrxl.exerrlxlrl.exe3nhhbn.exerllrflf.exerrlrlrf.exevjjvj.exedpdvv.exevpdpv.exe5hhtnb.exe1rxllxf.exetnbhnn.exe9llxxfl.exelllxlxr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exetbtthn.exevvjpd.exelfxlxlr.exenhntbh.exe1vjvj.exelrfrlxr.exentbbtn.exevdvpp.exe7frxlrf.exetbbnhb.exelllrlrl.exenntnhh.exe7bbhbh.exedvjdd.exebbbbhn.exedescription pid process target process PID 2032 wrote to memory of 2900 2032 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe tbtthn.exe PID 2032 wrote to memory of 2900 2032 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe tbtthn.exe PID 2032 wrote to memory of 2900 2032 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe tbtthn.exe PID 2032 wrote to memory of 2900 2032 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe tbtthn.exe PID 2900 wrote to memory of 1728 2900 tbtthn.exe vvjpd.exe PID 2900 wrote to memory of 1728 2900 tbtthn.exe vvjpd.exe PID 2900 wrote to memory of 1728 2900 tbtthn.exe vvjpd.exe PID 2900 wrote to memory of 1728 2900 tbtthn.exe vvjpd.exe PID 1728 wrote to memory of 2540 1728 vvjpd.exe lfxlxlr.exe PID 1728 wrote to memory of 2540 1728 vvjpd.exe lfxlxlr.exe PID 1728 wrote to memory of 2540 1728 vvjpd.exe lfxlxlr.exe PID 1728 wrote to memory of 2540 1728 vvjpd.exe lfxlxlr.exe PID 2540 wrote to memory of 1964 2540 lfxlxlr.exe nhntbh.exe PID 2540 wrote to memory of 1964 2540 lfxlxlr.exe nhntbh.exe PID 2540 wrote to memory of 1964 2540 lfxlxlr.exe nhntbh.exe PID 2540 wrote to memory of 1964 2540 lfxlxlr.exe nhntbh.exe PID 1964 wrote to memory of 2784 1964 nhntbh.exe 1vjvj.exe PID 1964 wrote to memory of 2784 1964 nhntbh.exe 1vjvj.exe PID 1964 wrote to memory of 2784 1964 nhntbh.exe 1vjvj.exe PID 1964 wrote to memory of 2784 1964 nhntbh.exe 1vjvj.exe PID 2784 wrote to memory of 2600 2784 1vjvj.exe lrfrlxr.exe PID 2784 wrote to memory of 2600 2784 1vjvj.exe lrfrlxr.exe PID 2784 wrote to memory of 2600 2784 1vjvj.exe lrfrlxr.exe PID 2784 wrote to memory of 2600 2784 1vjvj.exe lrfrlxr.exe PID 2600 wrote to memory of 2628 2600 lrfrlxr.exe ntbbtn.exe PID 2600 wrote to memory of 2628 2600 lrfrlxr.exe ntbbtn.exe PID 2600 wrote to memory of 2628 2600 lrfrlxr.exe ntbbtn.exe PID 2600 wrote to memory of 2628 2600 lrfrlxr.exe ntbbtn.exe PID 2628 wrote to memory of 2216 2628 ntbbtn.exe vdvpp.exe PID 2628 wrote to memory of 2216 2628 ntbbtn.exe vdvpp.exe PID 2628 wrote to memory of 2216 2628 ntbbtn.exe vdvpp.exe PID 2628 wrote to memory of 2216 2628 ntbbtn.exe vdvpp.exe PID 2216 wrote to memory of 2864 2216 vdvpp.exe 7frxlrf.exe PID 2216 wrote to memory of 2864 2216 vdvpp.exe 7frxlrf.exe PID 2216 wrote to memory of 2864 2216 vdvpp.exe 7frxlrf.exe PID 2216 wrote to memory of 2864 2216 vdvpp.exe 7frxlrf.exe PID 2864 wrote to memory of 1252 2864 7frxlrf.exe tbbnhb.exe PID 2864 wrote to memory of 1252 2864 7frxlrf.exe tbbnhb.exe PID 2864 wrote to memory of 1252 2864 7frxlrf.exe tbbnhb.exe PID 2864 wrote to memory of 1252 2864 7frxlrf.exe tbbnhb.exe PID 1252 wrote to memory of 2240 1252 tbbnhb.exe lllrlrl.exe PID 1252 wrote to memory of 2240 1252 tbbnhb.exe lllrlrl.exe PID 1252 wrote to memory of 2240 1252 tbbnhb.exe lllrlrl.exe PID 1252 wrote to memory of 2240 1252 tbbnhb.exe lllrlrl.exe PID 2240 wrote to memory of 632 2240 lllrlrl.exe nntnhh.exe PID 2240 wrote to memory of 632 2240 lllrlrl.exe nntnhh.exe PID 2240 wrote to memory of 632 2240 lllrlrl.exe nntnhh.exe PID 2240 wrote to memory of 632 2240 lllrlrl.exe nntnhh.exe PID 632 wrote to memory of 376 632 nntnhh.exe 7bbhbh.exe PID 632 wrote to memory of 376 632 nntnhh.exe 7bbhbh.exe PID 632 wrote to memory of 376 632 nntnhh.exe 7bbhbh.exe PID 632 wrote to memory of 376 632 nntnhh.exe 7bbhbh.exe PID 376 wrote to memory of 2632 376 7bbhbh.exe dvjdd.exe PID 376 wrote to memory of 2632 376 7bbhbh.exe dvjdd.exe PID 376 wrote to memory of 2632 376 7bbhbh.exe dvjdd.exe PID 376 wrote to memory of 2632 376 7bbhbh.exe dvjdd.exe PID 2632 wrote to memory of 2768 2632 dvjdd.exe bbbbhn.exe PID 2632 wrote to memory of 2768 2632 dvjdd.exe bbbbhn.exe PID 2632 wrote to memory of 2768 2632 dvjdd.exe bbbbhn.exe PID 2632 wrote to memory of 2768 2632 dvjdd.exe bbbbhn.exe PID 2768 wrote to memory of 2816 2768 bbbbhn.exe nthbtb.exe PID 2768 wrote to memory of 2816 2768 bbbbhn.exe nthbtb.exe PID 2768 wrote to memory of 2816 2768 bbbbhn.exe nthbtb.exe PID 2768 wrote to memory of 2816 2768 bbbbhn.exe nthbtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\tbtthn.exec:\tbtthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vvjpd.exec:\vvjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\lfxlxlr.exec:\lfxlxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhntbh.exec:\nhntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\1vjvj.exec:\1vjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lrfrlxr.exec:\lrfrlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\ntbbtn.exec:\ntbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vdvpp.exec:\vdvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\7frxlrf.exec:\7frxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\tbbnhb.exec:\tbbnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\lllrlrl.exec:\lllrlrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nntnhh.exec:\nntnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\7bbhbh.exec:\7bbhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\dvjdd.exec:\dvjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\bbbbhn.exec:\bbbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\nthbtb.exec:\nthbtb.exe17⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xlxlxxf.exec:\xlxlxxf.exe18⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7btntb.exec:\7btntb.exe19⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dpvdj.exec:\dpvdj.exe20⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3xrlxfr.exec:\3xrlxfr.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bnhnhb.exec:\bnhnhb.exe22⤵
- Executes dropped EXE
PID:392 -
\??\c:\flxfxxf.exec:\flxfxxf.exe23⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pjdpd.exec:\pjdpd.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1260 -
\??\c:\fxrfrrx.exec:\fxrfrrx.exe25⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ttbhbt.exec:\ttbhbt.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tbbhnn.exec:\tbbhnn.exe28⤵
- Executes dropped EXE
PID:492 -
\??\c:\frrrffl.exec:\frrrffl.exe29⤵
- Executes dropped EXE
PID:1852 -
\??\c:\djjvp.exec:\djjvp.exe30⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe31⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1hhbhn.exec:\1hhbhn.exe32⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe33⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bthhtb.exec:\bthhtb.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pjddp.exec:\pjddp.exe35⤵
- Executes dropped EXE
PID:2084 -
\??\c:\lrllrxf.exec:\lrllrxf.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5jvjp.exec:\5jvjp.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\llfxrrf.exec:\llfxrrf.exe38⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nbnntb.exec:\nbnntb.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jpjjv.exec:\jpjjv.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3rllxrf.exec:\3rllxrf.exe41⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tbbtbb.exec:\tbbtbb.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vjjdj.exec:\vjjdj.exe43⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ttbnbh.exec:\ttbnbh.exe45⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nnthbh.exec:\nnthbh.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9dvvp.exec:\9dvvp.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3xllxfr.exec:\3xllxfr.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tthtbb.exec:\tthtbb.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9vpvj.exec:\9vpvj.exe50⤵
- Executes dropped EXE
PID:1560 -
\??\c:\fllrflx.exec:\fllrflx.exe51⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rxrxlfl.exec:\rxrxlfl.exe52⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9bthbh.exec:\9bthbh.exe53⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3dppv.exec:\3dppv.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5dvdp.exec:\5dvdp.exe55⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ffrfrrf.exec:\ffrfrrf.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9nttnn.exec:\9nttnn.exe57⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5jvpj.exec:\5jvpj.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\flfrxfr.exec:\flfrxfr.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3tbhnt.exec:\3tbhnt.exe60⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3tnbnb.exec:\3tnbnb.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvjpd.exec:\vvjpd.exe62⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ffxrflf.exec:\ffxrflf.exe63⤵
- Executes dropped EXE
PID:3012 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe64⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tbthnt.exec:\tbthnt.exe65⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ppjvd.exec:\ppjvd.exe66⤵PID:608
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe67⤵PID:1824
-
\??\c:\nnnhnt.exec:\nnnhnt.exe68⤵PID:1532
-
\??\c:\tbtnbh.exec:\tbtnbh.exe69⤵PID:1656
-
\??\c:\jvddj.exec:\jvddj.exe70⤵PID:892
-
\??\c:\rrflrxr.exec:\rrflrxr.exe71⤵PID:492
-
\??\c:\hhtnth.exec:\hhtnth.exe72⤵PID:1692
-
\??\c:\tnhntb.exec:\tnhntb.exe73⤵PID:2100
-
\??\c:\vdjjd.exec:\vdjjd.exe74⤵PID:2080
-
\??\c:\llfrflf.exec:\llfrflf.exe75⤵PID:1524
-
\??\c:\9nnttt.exec:\9nnttt.exe76⤵PID:2296
-
\??\c:\jdvdj.exec:\jdvdj.exe77⤵PID:2364
-
\??\c:\jdvdp.exec:\jdvdp.exe78⤵PID:2004
-
\??\c:\5frxffx.exec:\5frxffx.exe79⤵PID:1556
-
\??\c:\hhbhtn.exec:\hhbhtn.exe80⤵PID:1596
-
\??\c:\5tttnt.exec:\5tttnt.exe81⤵PID:2404
-
\??\c:\jjdjd.exec:\jjdjd.exe82⤵PID:2320
-
\??\c:\9xfrxfr.exec:\9xfrxfr.exe83⤵PID:840
-
\??\c:\3tnbhn.exec:\3tnbhn.exe84⤵PID:2696
-
\??\c:\5hbbtt.exec:\5hbbtt.exe85⤵PID:1964
-
\??\c:\jdjjd.exec:\jdjjd.exe86⤵PID:2716
-
\??\c:\fxrxlrr.exec:\fxrxlrr.exe87⤵PID:2892
-
\??\c:\htthbh.exec:\htthbh.exe88⤵PID:2956
-
\??\c:\bthhnh.exec:\bthhnh.exe89⤵PID:2616
-
\??\c:\vvvdv.exec:\vvvdv.exe90⤵PID:2300
-
\??\c:\5xxrflf.exec:\5xxrflf.exe91⤵PID:2752
-
\??\c:\tbbnbh.exec:\tbbnbh.exe92⤵PID:1252
-
\??\c:\3jdvd.exec:\3jdvd.exe93⤵PID:1632
-
\??\c:\dvvdp.exec:\dvvdp.exe94⤵PID:1572
-
\??\c:\flllxfr.exec:\flllxfr.exe95⤵PID:1368
-
\??\c:\1ntnht.exec:\1ntnht.exe96⤵PID:2940
-
\??\c:\hbbntb.exec:\hbbntb.exe97⤵PID:980
-
\??\c:\9vvdp.exec:\9vvdp.exe98⤵PID:1512
-
\??\c:\fxflxxr.exec:\fxflxxr.exe99⤵PID:2692
-
\??\c:\nntbtn.exec:\nntbtn.exe100⤵PID:3040
-
\??\c:\jjdjj.exec:\jjdjj.exe101⤵PID:1868
-
\??\c:\jpvdv.exec:\jpvdv.exe102⤵PID:2908
-
\??\c:\5xrxflx.exec:\5xrxflx.exe103⤵PID:1028
-
\??\c:\ntttnh.exec:\ntttnh.exe104⤵PID:1156
-
\??\c:\jdvpd.exec:\jdvpd.exe105⤵PID:2232
-
\??\c:\9vpvp.exec:\9vpvp.exe106⤵PID:2132
-
\??\c:\fxrlrxl.exec:\fxrlrxl.exe107⤵PID:1068
-
\??\c:\bbbtht.exec:\bbbtht.exe108⤵PID:2576
-
\??\c:\jjdjv.exec:\jjdjv.exe109⤵PID:948
-
\??\c:\xxxlrrl.exec:\xxxlrrl.exe110⤵PID:1352
-
\??\c:\7btbht.exec:\7btbht.exe111⤵PID:1844
-
\??\c:\nnnthn.exec:\nnnthn.exe112⤵PID:2072
-
\??\c:\dvppd.exec:\dvppd.exe113⤵PID:1636
-
\??\c:\llrlfll.exec:\llrlfll.exe114⤵PID:2476
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe115⤵PID:2124
-
\??\c:\hhbnht.exec:\hhbnht.exe116⤵PID:1420
-
\??\c:\dpjjp.exec:\dpjjp.exe117⤵PID:1268
-
\??\c:\tnbbnh.exec:\tnbbnh.exe118⤵PID:2120
-
\??\c:\9nnnbb.exec:\9nnnbb.exe119⤵PID:584
-
\??\c:\djpdp.exec:\djpdp.exe120⤵PID:1928
-
\??\c:\llfrlxr.exec:\llfrlxr.exe121⤵PID:1748
-
\??\c:\5tnbtb.exec:\5tnbtb.exe122⤵PID:3024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-