Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 17:41
Behavioral task
behavioral1
Sample
59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe
-
Size
71KB
-
MD5
3211239658f415b2a6e14dada51fe5a5
-
SHA1
958abbc48e8099408bbcb5dbe490069639435bd4
-
SHA256
59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734
-
SHA512
9ff168e8488bd110b3d03a24858416e1d116befe32ad1294c53d421a1e3d92c97611f1ea803d29e9c5fa9c59658e451f734d3d8a8917675cd608075b0af01448
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPkffW2Vl4zQ3yN:zhOmTsF93UYfwC6GIoutiTm5kfuGCN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2664-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-187-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2276-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-211-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1788-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-314-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2768-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-485-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2444-492-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2444-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-559-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1896-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-619-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/408-716-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2972-722-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2748-790-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/592-807-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/3028-818-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1416-825-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1432-854-0x0000000000280000-0x00000000002A7000-memory.dmp family_blackmoon behavioral1/memory/2844-906-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1180-939-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1864-961-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1480-10233-0x00000000778F0000-0x00000000779EA000-memory.dmp family_blackmoon behavioral1/memory/1480-11220-0x00000000778F0000-0x00000000779EA000-memory.dmp family_blackmoon behavioral1/memory/1480-22378-0x00000000779F0000-0x0000000077B0F000-memory.dmp family_blackmoon behavioral1/memory/1480-23782-0x00000000779F0000-0x0000000077B0F000-memory.dmp family_blackmoon behavioral1/memory/1480-25756-0x00000000779F0000-0x0000000077B0F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 frxrxrr.exe 2668 frfrfxx.exe 2824 btbthh.exe 2572 bntbhn.exe 2816 ddvdj.exe 2604 1jdjd.exe 3016 frlxffl.exe 1716 lflxffl.exe 2760 5bnnnn.exe 3000 ttbnbh.exe 2104 7pdjp.exe 2400 bbbhtn.exe 1064 vjjjj.exe 2520 frlxffr.exe 1976 5fllrxf.exe 2872 nhntbn.exe 1784 vpjvd.exe 236 1rlffxf.exe 2516 7rfxfxr.exe 1892 nhhhbb.exe 2212 jdpdp.exe 924 7dpvd.exe 2276 rlxllrr.exe 1952 lllxlxl.exe 1788 hbhnbb.exe 2476 dvvvd.exe 2428 lxfffff.exe 568 9fxxfrf.exe 2964 thnbhh.exe 1576 dvjdd.exe 1428 dvpdj.exe 1220 rlrfrrf.exe 2756 tnhtbh.exe 2540 nhtnth.exe 1632 vvpvj.exe 2668 9djjp.exe 1648 5lfrffl.exe 2856 7xrrrrx.exe 2596 tnhnnn.exe 2080 vvjjj.exe 3028 vppvd.exe 1872 rfxfxxf.exe 3020 xrrxxxf.exe 2840 tnhbbh.exe 2564 jvjvd.exe 3032 pjvdj.exe 2260 jvvjj.exe 2384 1rlrrxf.exe 2000 llflxxf.exe 2104 9bnthh.exe 2416 tthhth.exe 1836 jvvdp.exe 2768 rfrlxlr.exe 2252 9rfflxr.exe 1732 nhtbtb.exe 1644 5nnbtb.exe 1968 jdvvj.exe 1420 ppdjv.exe 2160 xlxxrxf.exe 2108 tnthtt.exe 1900 5bnbhh.exe 2360 jdjjp.exe 1468 dppdd.exe 2212 9rflrfx.exe -
resource yara_rule behavioral1/memory/2664-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000122ce-6.dat upx behavioral1/memory/2664-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-3-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0008000000015d07-19.dat upx behavioral1/files/0x0008000000015d19-26.dat upx behavioral1/files/0x0007000000015d68-44.dat upx behavioral1/files/0x0007000000015d70-54.dat upx behavioral1/files/0x000a000000015d78-61.dat upx behavioral1/memory/2604-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015da1-71.dat upx behavioral1/memory/1716-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c9b-79.dat upx behavioral1/memory/3016-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018657-85.dat upx behavioral1/memory/2816-52-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2572-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d48-37.dat upx behavioral1/memory/2572-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000018662-94.dat upx behavioral1/memory/3000-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001867d-106.dat upx behavioral1/memory/2400-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2104-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186c8-113.dat upx behavioral1/memory/2400-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2520-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878d-123.dat upx behavioral1/memory/1064-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190c6-131.dat upx behavioral1/memory/2520-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190c9-138.dat upx behavioral1/memory/2872-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1976-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f3-147.dat upx behavioral1/files/0x00050000000191fd-158.dat upx behavioral1/memory/236-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019217-164.dat upx behavioral1/files/0x0005000000019220-172.dat upx behavioral1/memory/1892-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019238-180.dat upx behavioral1/files/0x0005000000019240-188.dat upx behavioral1/files/0x000500000001925d-195.dat upx behavioral1/files/0x0005000000019263-202.dat upx behavioral1/memory/2276-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-212.dat upx behavioral1/files/0x0005000000019280-220.dat upx behavioral1/memory/1788-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938b-227.dat upx behavioral1/files/0x0005000000019399-235.dat upx behavioral1/memory/2428-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b7-242.dat upx behavioral1/files/0x00050000000193c1-250.dat upx behavioral1/files/0x00050000000193c8-258.dat upx behavioral1/memory/1576-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d4-266.dat upx behavioral1/memory/2540-277-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2752 2664 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 31 PID 2664 wrote to memory of 2752 2664 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 31 PID 2664 wrote to memory of 2752 2664 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 31 PID 2664 wrote to memory of 2752 2664 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 31 PID 2752 wrote to memory of 2668 2752 frxrxrr.exe 32 PID 2752 wrote to memory of 2668 2752 frxrxrr.exe 32 PID 2752 wrote to memory of 2668 2752 frxrxrr.exe 32 PID 2752 wrote to memory of 2668 2752 frxrxrr.exe 32 PID 2668 wrote to memory of 2824 2668 frfrfxx.exe 33 PID 2668 wrote to memory of 2824 2668 frfrfxx.exe 33 PID 2668 wrote to memory of 2824 2668 frfrfxx.exe 33 PID 2668 wrote to memory of 2824 2668 frfrfxx.exe 33 PID 2824 wrote to memory of 2572 2824 btbthh.exe 34 PID 2824 wrote to memory of 2572 2824 btbthh.exe 34 PID 2824 wrote to memory of 2572 2824 btbthh.exe 34 PID 2824 wrote to memory of 2572 2824 btbthh.exe 34 PID 2572 wrote to memory of 2816 2572 bntbhn.exe 35 PID 2572 wrote to memory of 2816 2572 bntbhn.exe 35 PID 2572 wrote to memory of 2816 2572 bntbhn.exe 35 PID 2572 wrote to memory of 2816 2572 bntbhn.exe 35 PID 2816 wrote to memory of 2604 2816 ddvdj.exe 36 PID 2816 wrote to memory of 2604 2816 ddvdj.exe 36 PID 2816 wrote to memory of 2604 2816 ddvdj.exe 36 PID 2816 wrote to memory of 2604 2816 ddvdj.exe 36 PID 2604 wrote to memory of 3016 2604 1jdjd.exe 37 PID 2604 wrote to memory of 3016 2604 1jdjd.exe 37 PID 2604 wrote to memory of 3016 2604 1jdjd.exe 37 PID 2604 wrote to memory of 3016 2604 1jdjd.exe 37 PID 3016 wrote to memory of 1716 3016 frlxffl.exe 38 PID 3016 wrote to memory of 1716 3016 frlxffl.exe 38 PID 3016 wrote to memory of 1716 3016 frlxffl.exe 38 PID 3016 wrote to memory of 1716 3016 frlxffl.exe 38 PID 1716 wrote to memory of 2760 1716 lflxffl.exe 39 PID 1716 wrote to memory of 2760 1716 lflxffl.exe 39 PID 1716 wrote to memory of 2760 1716 lflxffl.exe 39 PID 1716 wrote to memory of 2760 1716 lflxffl.exe 39 PID 2760 wrote to memory of 3000 2760 5bnnnn.exe 40 PID 2760 wrote to memory of 3000 2760 5bnnnn.exe 40 PID 2760 wrote to memory of 3000 2760 5bnnnn.exe 40 PID 2760 wrote to memory of 3000 2760 5bnnnn.exe 40 PID 3000 wrote to memory of 2104 3000 ttbnbh.exe 41 PID 3000 wrote to memory of 2104 3000 ttbnbh.exe 41 PID 3000 wrote to memory of 2104 3000 ttbnbh.exe 41 PID 3000 wrote to memory of 2104 3000 ttbnbh.exe 41 PID 2104 wrote to memory of 2400 2104 7pdjp.exe 42 PID 2104 wrote to memory of 2400 2104 7pdjp.exe 42 PID 2104 wrote to memory of 2400 2104 7pdjp.exe 42 PID 2104 wrote to memory of 2400 2104 7pdjp.exe 42 PID 2400 wrote to memory of 1064 2400 bbbhtn.exe 43 PID 2400 wrote to memory of 1064 2400 bbbhtn.exe 43 PID 2400 wrote to memory of 1064 2400 bbbhtn.exe 43 PID 2400 wrote to memory of 1064 2400 bbbhtn.exe 43 PID 1064 wrote to memory of 2520 1064 vjjjj.exe 44 PID 1064 wrote to memory of 2520 1064 vjjjj.exe 44 PID 1064 wrote to memory of 2520 1064 vjjjj.exe 44 PID 1064 wrote to memory of 2520 1064 vjjjj.exe 44 PID 2520 wrote to memory of 1976 2520 frlxffr.exe 45 PID 2520 wrote to memory of 1976 2520 frlxffr.exe 45 PID 2520 wrote to memory of 1976 2520 frlxffr.exe 45 PID 2520 wrote to memory of 1976 2520 frlxffr.exe 45 PID 1976 wrote to memory of 2872 1976 5fllrxf.exe 46 PID 1976 wrote to memory of 2872 1976 5fllrxf.exe 46 PID 1976 wrote to memory of 2872 1976 5fllrxf.exe 46 PID 1976 wrote to memory of 2872 1976 5fllrxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe"C:\Users\Admin\AppData\Local\Temp\59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\frxrxrr.exec:\frxrxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\frfrfxx.exec:\frfrfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\btbthh.exec:\btbthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bntbhn.exec:\bntbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ddvdj.exec:\ddvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1jdjd.exec:\1jdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\frlxffl.exec:\frlxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lflxffl.exec:\lflxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\5bnnnn.exec:\5bnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ttbnbh.exec:\ttbnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\7pdjp.exec:\7pdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bbbhtn.exec:\bbbhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\vjjjj.exec:\vjjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\frlxffr.exec:\frlxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5fllrxf.exec:\5fllrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\nhntbn.exec:\nhntbn.exe17⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vpjvd.exec:\vpjvd.exe18⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1rlffxf.exec:\1rlffxf.exe19⤵
- Executes dropped EXE
PID:236 -
\??\c:\7rfxfxr.exec:\7rfxfxr.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\nhhhbb.exec:\nhhhbb.exe21⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jdpdp.exec:\jdpdp.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7dpvd.exec:\7dpvd.exe23⤵
- Executes dropped EXE
PID:924 -
\??\c:\rlxllrr.exec:\rlxllrr.exe24⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lllxlxl.exec:\lllxlxl.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbhnbb.exec:\hbhnbb.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\dvvvd.exec:\dvvvd.exe27⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lxfffff.exec:\lxfffff.exe28⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9fxxfrf.exec:\9fxxfrf.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\thnbhh.exec:\thnbhh.exe30⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvjdd.exec:\dvjdd.exe31⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dvpdj.exec:\dvpdj.exe32⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rlrfrrf.exec:\rlrfrrf.exe33⤵
- Executes dropped EXE
PID:1220 -
\??\c:\tnhtbh.exec:\tnhtbh.exe34⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nhtnth.exec:\nhtnth.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vvpvj.exec:\vvpvj.exe36⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9djjp.exec:\9djjp.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5lfrffl.exec:\5lfrffl.exe38⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7xrrrrx.exec:\7xrrrrx.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tnhnnn.exec:\tnhnnn.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vvjjj.exec:\vvjjj.exe41⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vppvd.exec:\vppvd.exe42⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rfxfxxf.exec:\rfxfxxf.exe43⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnhbbh.exec:\tnhbbh.exe45⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jvjvd.exec:\jvjvd.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjvdj.exec:\pjvdj.exe47⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jvvjj.exec:\jvvjj.exe48⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1rlrrxf.exec:\1rlrrxf.exe49⤵
- Executes dropped EXE
PID:2384 -
\??\c:\llflxxf.exec:\llflxxf.exe50⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9bnthh.exec:\9bnthh.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tthhth.exec:\tthhth.exe52⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jvvdp.exec:\jvvdp.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rfrlxlr.exec:\rfrlxlr.exe54⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9rfflxr.exec:\9rfflxr.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nhtbtb.exec:\nhtbtb.exe56⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5nnbtb.exec:\5nnbtb.exe57⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jdvvj.exec:\jdvvj.exe58⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ppdjv.exec:\ppdjv.exe59⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xlxxrxf.exec:\xlxxrxf.exe60⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnthtt.exec:\tnthtt.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5bnbhh.exec:\5bnbhh.exe62⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jdjjp.exec:\jdjjp.exe63⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dppdd.exec:\dppdd.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\9rflrfx.exec:\9rflrfx.exe65⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nbntbh.exec:\nbntbh.exe66⤵PID:924
-
\??\c:\btnntb.exec:\btnntb.exe67⤵PID:2340
-
\??\c:\1nbnbh.exec:\1nbnbh.exe68⤵PID:444
-
\??\c:\1vdjv.exec:\1vdjv.exe69⤵PID:1168
-
\??\c:\fxrfflr.exec:\fxrfflr.exe70⤵PID:2972
-
\??\c:\frlrxrr.exec:\frlrxrr.exe71⤵PID:1008
-
\??\c:\tnbntt.exec:\tnbntt.exe72⤵PID:2672
-
\??\c:\bbbttb.exec:\bbbttb.exe73⤵PID:2072
-
\??\c:\vpdjp.exec:\vpdjp.exe74⤵PID:2444
-
\??\c:\dvdvv.exec:\dvdvv.exe75⤵PID:1848
-
\??\c:\rlxxffr.exec:\rlxxffr.exe76⤵PID:2952
-
\??\c:\frlrllr.exec:\frlrllr.exe77⤵PID:3064
-
\??\c:\nbhtbb.exec:\nbhtbb.exe78⤵PID:2248
-
\??\c:\thnbnh.exec:\thnbnh.exe79⤵PID:1376
-
\??\c:\jdpvp.exec:\jdpvp.exe80⤵PID:2748
-
\??\c:\vpjjv.exec:\vpjjv.exe81⤵PID:2112
-
\??\c:\xlrxxxf.exec:\xlrxxxf.exe82⤵PID:2540
-
\??\c:\rfllxxf.exec:\rfllxxf.exe83⤵PID:2832
-
\??\c:\tnhnbb.exec:\tnhnbb.exe84⤵PID:2268
-
\??\c:\bnbbhh.exec:\bnbbhh.exe85⤵PID:2536
-
\??\c:\nbnthh.exec:\nbnthh.exe86⤵PID:2544
-
\??\c:\pvddj.exec:\pvddj.exe87⤵PID:3040
-
\??\c:\vppdj.exec:\vppdj.exe88⤵PID:2712
-
\??\c:\7ffrxlr.exec:\7ffrxlr.exe89⤵PID:3016
-
\??\c:\xrxrflx.exec:\xrxrflx.exe90⤵PID:2580
-
\??\c:\tntntt.exec:\tntntt.exe91⤵PID:2892
-
\??\c:\nhhnhh.exec:\nhhnhh.exe92⤵PID:2636
-
\??\c:\7vpjj.exec:\7vpjj.exe93⤵PID:1932
-
\??\c:\jvddv.exec:\jvddv.exe94⤵PID:1216
-
\??\c:\pjppp.exec:\pjppp.exe95⤵PID:2996
-
\??\c:\1lrfrxx.exec:\1lrfrxx.exe96⤵PID:1896
-
\??\c:\rfrfrxf.exec:\rfrfrxf.exe97⤵PID:2776
-
\??\c:\llrflff.exec:\llrflff.exe98⤵PID:1792
-
\??\c:\bnttbt.exec:\bnttbt.exe99⤵PID:2348
-
\??\c:\httthh.exec:\httthh.exe100⤵PID:1836
-
\??\c:\jdjvd.exec:\jdjvd.exe101⤵PID:2768
-
\??\c:\9flrfrf.exec:\9flrfrf.exe102⤵PID:2252
-
\??\c:\7fllrxl.exec:\7fllrxl.exe103⤵PID:332
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe104⤵PID:1972
-
\??\c:\nhhthh.exec:\nhhthh.exe105⤵PID:1652
-
\??\c:\3tbbbb.exec:\3tbbbb.exe106⤵PID:236
-
\??\c:\jjvvd.exec:\jjvvd.exe107⤵PID:2172
-
\??\c:\jdpvv.exec:\jdpvv.exe108⤵PID:2948
-
\??\c:\9vjvd.exec:\9vjvd.exe109⤵PID:2940
-
\??\c:\ffxxflx.exec:\ffxxflx.exe110⤵PID:2368
-
\??\c:\rfllrrr.exec:\rfllrrr.exe111⤵PID:1180
-
\??\c:\tnbntt.exec:\tnbntt.exe112⤵PID:1620
-
\??\c:\ttnntn.exec:\ttnntn.exe113⤵PID:408
-
\??\c:\vjjpd.exec:\vjjpd.exe114⤵PID:956
-
\??\c:\jvpvd.exec:\jvpvd.exe115⤵PID:444
-
\??\c:\rlfrflx.exec:\rlfrflx.exe116⤵PID:1168
-
\??\c:\1bnhnt.exec:\1bnhnt.exe117⤵PID:2972
-
\??\c:\5tntbh.exec:\5tntbh.exe118⤵PID:2040
-
\??\c:\9jvvp.exec:\9jvvp.exe119⤵PID:2980
-
\??\c:\pdpjj.exec:\pdpjj.exe120⤵PID:2968
-
\??\c:\vpdjj.exec:\vpdjj.exe121⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-