Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 16:05
Behavioral task
behavioral1
Sample
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
-
Size
78KB
-
MD5
36fe4429aa9fe723066f85d27d8134f9
-
SHA1
118a2801451743b606ea3addc5a81a70bc34e7cc
-
SHA256
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a
-
SHA512
dfb518201b9e7c2caa108ced5641eeb85d44ce0458e0b3596fc6b02f8104da88f5fafc8bfe0105547a323665e962621a5814932c2edd53426dff4e19d15eca1d
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7kew:xhOmTsF93UYfwC6GIout03LzGFw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2972-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-35-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2472-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-53-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-83-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2696-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-138-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1496-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-229-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1000-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-258-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/592-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/616-288-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2064-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-340-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1712-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-362-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/924-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-498-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1624-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-518-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-592-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1384-710-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2404-817-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/812-830-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/812-850-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2648-939-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2412-947-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-954-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2780-1003-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1536-1058-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2080-1113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-1160-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2352 vvvdp.exe 2524 lxllrlr.exe 2336 3hbhhh.exe 2472 7thhhn.exe 2852 jdvdj.exe 2968 jjvjp.exe 2620 fxrxxxr.exe 2612 thbhbh.exe 2696 hbhnnt.exe 2660 vpjjj.exe 3052 jvjjv.exe 800 5xllllf.exe 1152 nbntbt.exe 2556 5vvdp.exe 1428 vvjvp.exe 580 7rlrrrx.exe 1496 lflrllf.exe 2824 rrxffff.exe 2684 bnttbb.exe 916 vjppv.exe 2944 1vddp.exe 924 lxrrlrr.exe 2020 lfxxlrx.exe 1928 tnhhnn.exe 1000 vjddd.exe 2464 1vjpj.exe 3068 llllrrx.exe 592 hthnhn.exe 1476 7pdjj.exe 616 1xllrrf.exe 2064 hbbhtb.exe 2488 5tbbbh.exe 2084 5pjjj.exe 2664 vjvvd.exe 2300 5xlllfr.exe 2692 rlxxffl.exe 1712 hbnbhn.exe 2912 nhntbh.exe 2840 5pjjd.exe 2756 vjppv.exe 2592 xlxxrxf.exe 2600 hnhbnt.exe 1704 bthhnn.exe 2616 vdddv.exe 2648 9vpvd.exe 2180 5xrllrx.exe 1596 rllxxlr.exe 1480 9nbntb.exe 1936 nhbtbh.exe 1632 9jjpd.exe 964 ppjdp.exe 1488 7lfflxf.exe 1380 5nbhnn.exe 1224 5htntn.exe 2164 vvpjd.exe 2868 vjvdd.exe 1792 lxrxfxf.exe 1688 fxxflfx.exe 924 btbbnn.exe 2988 ththtb.exe 840 7pvvd.exe 940 dvpvv.exe 1624 5lfflrr.exe 1628 7lxlrrl.exe -
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-9.dat upx behavioral1/memory/2972-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001749c-27.dat upx behavioral1/memory/2524-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017481-19.dat upx behavioral1/memory/2352-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000174bf-38.dat upx behavioral1/memory/2336-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0016000000018657-46.dat upx behavioral1/memory/2472-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001867d-59.dat upx behavioral1/memory/2968-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c8-66.dat upx behavioral1/memory/2852-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001878d-75.dat upx behavioral1/files/0x00080000000190c9-85.dat upx behavioral1/memory/2612-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c38-96.dat upx behavioral1/memory/2660-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3a-103.dat upx behavioral1/memory/800-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c53-111.dat upx behavioral1/files/0x0005000000019d20-121.dat upx behavioral1/files/0x0005000000019d44-128.dat upx behavioral1/memory/2556-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019da4-139.dat upx behavioral1/files/0x0005000000019db8-149.dat upx behavioral1/memory/580-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f9f-156.dat upx behavioral1/memory/1496-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fb9-167.dat upx behavioral1/memory/2824-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a067-177.dat upx behavioral1/memory/2824-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-175-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x000500000001a07b-188.dat upx behavioral1/memory/2684-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0a1-196.dat upx behavioral1/files/0x000500000001a345-212.dat upx behavioral1/files/0x000500000001a301-204.dat upx behavioral1/files/0x000500000001a42b-222.dat upx behavioral1/memory/2020-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1928-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42d-231.dat upx behavioral1/files/0x000500000001a42f-242.dat upx behavioral1/memory/2464-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1000-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a431-250.dat upx behavioral1/files/0x000500000001a434-259.dat upx behavioral1/memory/592-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46a-268.dat upx behavioral1/memory/616-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48c-280.dat upx behavioral1/files/0x000500000001a48e-286.dat upx behavioral1/memory/2064-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49a-299.dat upx behavioral1/memory/2488-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2300-323-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2692-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-333-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2352 2972 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2972 wrote to memory of 2352 2972 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2972 wrote to memory of 2352 2972 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2972 wrote to memory of 2352 2972 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2352 wrote to memory of 2524 2352 vvvdp.exe 31 PID 2352 wrote to memory of 2524 2352 vvvdp.exe 31 PID 2352 wrote to memory of 2524 2352 vvvdp.exe 31 PID 2352 wrote to memory of 2524 2352 vvvdp.exe 31 PID 2524 wrote to memory of 2336 2524 lxllrlr.exe 32 PID 2524 wrote to memory of 2336 2524 lxllrlr.exe 32 PID 2524 wrote to memory of 2336 2524 lxllrlr.exe 32 PID 2524 wrote to memory of 2336 2524 lxllrlr.exe 32 PID 2336 wrote to memory of 2472 2336 3hbhhh.exe 33 PID 2336 wrote to memory of 2472 2336 3hbhhh.exe 33 PID 2336 wrote to memory of 2472 2336 3hbhhh.exe 33 PID 2336 wrote to memory of 2472 2336 3hbhhh.exe 33 PID 2472 wrote to memory of 2852 2472 7thhhn.exe 34 PID 2472 wrote to memory of 2852 2472 7thhhn.exe 34 PID 2472 wrote to memory of 2852 2472 7thhhn.exe 34 PID 2472 wrote to memory of 2852 2472 7thhhn.exe 34 PID 2852 wrote to memory of 2968 2852 jdvdj.exe 35 PID 2852 wrote to memory of 2968 2852 jdvdj.exe 35 PID 2852 wrote to memory of 2968 2852 jdvdj.exe 35 PID 2852 wrote to memory of 2968 2852 jdvdj.exe 35 PID 2968 wrote to memory of 2620 2968 jjvjp.exe 36 PID 2968 wrote to memory of 2620 2968 jjvjp.exe 36 PID 2968 wrote to memory of 2620 2968 jjvjp.exe 36 PID 2968 wrote to memory of 2620 2968 jjvjp.exe 36 PID 2620 wrote to memory of 2612 2620 fxrxxxr.exe 37 PID 2620 wrote to memory of 2612 2620 fxrxxxr.exe 37 PID 2620 wrote to memory of 2612 2620 fxrxxxr.exe 37 PID 2620 wrote to memory of 2612 2620 fxrxxxr.exe 37 PID 2612 wrote to memory of 2696 2612 thbhbh.exe 38 PID 2612 wrote to memory of 2696 2612 thbhbh.exe 38 PID 2612 wrote to memory of 2696 2612 thbhbh.exe 38 PID 2612 wrote to memory of 2696 2612 thbhbh.exe 38 PID 2696 wrote to memory of 2660 2696 hbhnnt.exe 39 PID 2696 wrote to memory of 2660 2696 hbhnnt.exe 39 PID 2696 wrote to memory of 2660 2696 hbhnnt.exe 39 PID 2696 wrote to memory of 2660 2696 hbhnnt.exe 39 PID 2660 wrote to memory of 3052 2660 vpjjj.exe 40 PID 2660 wrote to memory of 3052 2660 vpjjj.exe 40 PID 2660 wrote to memory of 3052 2660 vpjjj.exe 40 PID 2660 wrote to memory of 3052 2660 vpjjj.exe 40 PID 3052 wrote to memory of 800 3052 jvjjv.exe 41 PID 3052 wrote to memory of 800 3052 jvjjv.exe 41 PID 3052 wrote to memory of 800 3052 jvjjv.exe 41 PID 3052 wrote to memory of 800 3052 jvjjv.exe 41 PID 800 wrote to memory of 1152 800 5xllllf.exe 42 PID 800 wrote to memory of 1152 800 5xllllf.exe 42 PID 800 wrote to memory of 1152 800 5xllllf.exe 42 PID 800 wrote to memory of 1152 800 5xllllf.exe 42 PID 1152 wrote to memory of 2556 1152 nbntbt.exe 43 PID 1152 wrote to memory of 2556 1152 nbntbt.exe 43 PID 1152 wrote to memory of 2556 1152 nbntbt.exe 43 PID 1152 wrote to memory of 2556 1152 nbntbt.exe 43 PID 2556 wrote to memory of 1428 2556 5vvdp.exe 44 PID 2556 wrote to memory of 1428 2556 5vvdp.exe 44 PID 2556 wrote to memory of 1428 2556 5vvdp.exe 44 PID 2556 wrote to memory of 1428 2556 5vvdp.exe 44 PID 1428 wrote to memory of 580 1428 vvjvp.exe 45 PID 1428 wrote to memory of 580 1428 vvjvp.exe 45 PID 1428 wrote to memory of 580 1428 vvjvp.exe 45 PID 1428 wrote to memory of 580 1428 vvjvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vvvdp.exec:\vvvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lxllrlr.exec:\lxllrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3hbhhh.exec:\3hbhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\7thhhn.exec:\7thhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\jdvdj.exec:\jdvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jjvjp.exec:\jjvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\fxrxxxr.exec:\fxrxxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\thbhbh.exec:\thbhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\hbhnnt.exec:\hbhnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vpjjj.exec:\vpjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\jvjjv.exec:\jvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\5xllllf.exec:\5xllllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\nbntbt.exec:\nbntbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\5vvdp.exec:\5vvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\vvjvp.exec:\vvjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\7rlrrrx.exec:\7rlrrrx.exe17⤵
- Executes dropped EXE
PID:580 -
\??\c:\lflrllf.exec:\lflrllf.exe18⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rrxffff.exec:\rrxffff.exe19⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bnttbb.exec:\bnttbb.exe20⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vjppv.exec:\vjppv.exe21⤵
- Executes dropped EXE
PID:916 -
\??\c:\1vddp.exec:\1vddp.exe22⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe23⤵
- Executes dropped EXE
PID:924 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe24⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tnhhnn.exec:\tnhhnn.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vjddd.exec:\vjddd.exe26⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1vjpj.exec:\1vjpj.exe27⤵
- Executes dropped EXE
PID:2464 -
\??\c:\llllrrx.exec:\llllrrx.exe28⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hthnhn.exec:\hthnhn.exe29⤵
- Executes dropped EXE
PID:592 -
\??\c:\7pdjj.exec:\7pdjj.exe30⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1xllrrf.exec:\1xllrrf.exe31⤵
- Executes dropped EXE
PID:616 -
\??\c:\hbbhtb.exec:\hbbhtb.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5tbbbh.exec:\5tbbbh.exe33⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5pjjj.exec:\5pjjj.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vjvvd.exec:\vjvvd.exe35⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5xlllfr.exec:\5xlllfr.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rlxxffl.exec:\rlxxffl.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbnbhn.exec:\hbnbhn.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhntbh.exec:\nhntbh.exe39⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5pjjd.exec:\5pjjd.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vjppv.exec:\vjppv.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xlxxrxf.exec:\xlxxrxf.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hnhbnt.exec:\hnhbnt.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bthhnn.exec:\bthhnn.exe44⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vdddv.exec:\vdddv.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9vpvd.exec:\9vpvd.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5xrllrx.exec:\5xrllrx.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rllxxlr.exec:\rllxxlr.exe48⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9nbntb.exec:\9nbntb.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\nhbtbh.exec:\nhbtbh.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9jjpd.exec:\9jjpd.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ppjdp.exec:\ppjdp.exe52⤵
- Executes dropped EXE
PID:964 -
\??\c:\7lfflxf.exec:\7lfflxf.exe53⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5nbhnn.exec:\5nbhnn.exe54⤵
- Executes dropped EXE
PID:1380 -
\??\c:\5htntn.exec:\5htntn.exe55⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vvpjd.exec:\vvpjd.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vjvdd.exec:\vjvdd.exe57⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe58⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fxxflfx.exec:\fxxflfx.exe59⤵
- Executes dropped EXE
PID:1688 -
\??\c:\btbbnn.exec:\btbbnn.exe60⤵
- Executes dropped EXE
PID:924 -
\??\c:\ththtb.exec:\ththtb.exe61⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7pvvd.exec:\7pvvd.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\dvpvv.exec:\dvpvv.exe63⤵
- Executes dropped EXE
PID:940 -
\??\c:\5lfflrr.exec:\5lfflrr.exe64⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7lxlrrl.exec:\7lxlrrl.exe65⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3bnnnn.exec:\3bnnnn.exe66⤵PID:2908
-
\??\c:\3bnbhn.exec:\3bnbhn.exe67⤵PID:1728
-
\??\c:\vvdjp.exec:\vvdjp.exe68⤵PID:3032
-
\??\c:\vvpdd.exec:\vvpdd.exe69⤵PID:1748
-
\??\c:\lfflrxx.exec:\lfflrxx.exe70⤵PID:1736
-
\??\c:\rflrxrr.exec:\rflrxrr.exe71⤵PID:812
-
\??\c:\nhnnnn.exec:\nhnnnn.exe72⤵PID:340
-
\??\c:\nbbnnh.exec:\nbbnnh.exe73⤵PID:2352
-
\??\c:\9ppvd.exec:\9ppvd.exe74⤵PID:3004
-
\??\c:\jdvdj.exec:\jdvdj.exe75⤵PID:2488
-
\??\c:\llxxfxl.exec:\llxxfxl.exe76⤵PID:2676
-
\??\c:\3xxxlrf.exec:\3xxxlrf.exe77⤵PID:2492
-
\??\c:\nnhntt.exec:\nnhntt.exe78⤵PID:2172
-
\??\c:\pdvvj.exec:\pdvvj.exe79⤵
- System Location Discovery: System Language Discovery
PID:2900 -
\??\c:\3ppdj.exec:\3ppdj.exe80⤵PID:2708
-
\??\c:\fxrxrfx.exec:\fxrxrfx.exe81⤵PID:2856
-
\??\c:\hbhntt.exec:\hbhntt.exe82⤵PID:2832
-
\??\c:\nnhbnh.exec:\nnhbnh.exe83⤵PID:2840
-
\??\c:\nhnnbn.exec:\nhnnbn.exe84⤵PID:2752
-
\??\c:\1dpvj.exec:\1dpvj.exe85⤵PID:2608
-
\??\c:\vpjpv.exec:\vpjpv.exe86⤵PID:2584
-
\??\c:\xfrlffr.exec:\xfrlffr.exe87⤵PID:2204
-
\??\c:\9tntbt.exec:\9tntbt.exe88⤵PID:1844
-
\??\c:\1tbbtn.exec:\1tbbtn.exe89⤵PID:1916
-
\??\c:\3jvvv.exec:\3jvvv.exe90⤵PID:764
-
\??\c:\vvjjj.exec:\vvjjj.exe91⤵PID:1956
-
\??\c:\7xlfrrx.exec:\7xlfrrx.exe92⤵PID:284
-
\??\c:\lffflrf.exec:\lffflrf.exe93⤵PID:1676
-
\??\c:\9hbbhh.exec:\9hbbhh.exe94⤵PID:1980
-
\??\c:\nnbhnt.exec:\nnbhnt.exe95⤵PID:2000
-
\??\c:\ddvpp.exec:\ddvpp.exe96⤵PID:1384
-
\??\c:\dddvp.exec:\dddvp.exe97⤵PID:1508
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe98⤵PID:2824
-
\??\c:\7fflxfl.exec:\7fflxfl.exe99⤵PID:380
-
\??\c:\tthtnn.exec:\tthtnn.exe100⤵PID:2164
-
\??\c:\hbhhnh.exec:\hbhhnh.exe101⤵PID:2624
-
\??\c:\jvpjp.exec:\jvpjp.exe102⤵PID:1792
-
\??\c:\pdppp.exec:\pdppp.exe103⤵PID:264
-
\??\c:\llfxxxf.exec:\llfxxxf.exe104⤵PID:1500
-
\??\c:\xxrxrfr.exec:\xxrxrfr.exe105⤵PID:1720
-
\??\c:\tnnthn.exec:\tnnthn.exe106⤵PID:2996
-
\??\c:\btnnnt.exec:\btnnnt.exe107⤵PID:1192
-
\??\c:\vvjjd.exec:\vvjjd.exe108⤵PID:892
-
\??\c:\dpvvd.exec:\dpvvd.exe109⤵PID:2476
-
\??\c:\rlrxxfx.exec:\rlrxxfx.exe110⤵PID:2124
-
\??\c:\rxlrflr.exec:\rxlrflr.exe111⤵PID:3060
-
\??\c:\bthhnt.exec:\bthhnt.exe112⤵PID:2268
-
\??\c:\bnhbhh.exec:\bnhbhh.exe113⤵PID:2404
-
\??\c:\ppjjj.exec:\ppjjj.exe114⤵PID:1476
-
\??\c:\dvdvd.exec:\dvdvd.exe115⤵PID:812
-
\??\c:\xffxrxl.exec:\xffxrxl.exe116⤵PID:3016
-
\??\c:\lxfxfxl.exec:\lxfxfxl.exe117⤵PID:2668
-
\??\c:\thtbnn.exec:\thtbnn.exe118⤵PID:1580
-
\??\c:\9bttbh.exec:\9bttbh.exe119⤵PID:2084
-
\??\c:\pdvvj.exec:\pdvvj.exe120⤵PID:2732
-
\??\c:\jdvdj.exec:\jdvdj.exe121⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-