Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 22:21
Behavioral task
behavioral1
Sample
df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe
-
Size
97KB
-
MD5
40851959580fb7b5b87d56f126a9219e
-
SHA1
4b8ac3b4b25a5f04e04707ea1b780eaad9d67b76
-
SHA256
df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f
-
SHA512
316c9f3f4d86e44eb68fd81eec7a2cd414e6845bc5fdab250308f5aaadff2faa852c12401dc7f17b3390930f7aaf0099b93c3a44ccec39797ae37ca2d8c231df
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgL:8cm4FmowdHoSgWrXUgL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral1/memory/2572-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-57-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2980-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-56-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-75-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2300-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-91-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2728-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-108-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1116-114-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1116-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-126-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1984-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-174-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1508-205-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1508-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-222-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2476-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-303-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2416-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-349-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-370-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1192-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-469-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-481-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1732-490-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-493-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-574-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-608-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-631-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1540-672-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1744-684-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1452-730-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/804-762-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1512-881-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1972-1012-0x00000000777D0000-0x00000000778EF000-memory.dmp family_blackmoon behavioral1/memory/1972-13308-0x00000000776D0000-0x00000000777CA000-memory.dmp family_blackmoon behavioral1/memory/1972-19719-0x00000000776D0000-0x00000000777CA000-memory.dmp family_blackmoon behavioral1/memory/1972-20810-0x00000000776D0000-0x00000000777CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2424 5ddpj.exe 3028 rlxxfrx.exe 2188 nbnntb.exe 2100 tnbhhn.exe 344 5pdpj.exe 2980 9vjjp.exe 2612 5xxlrll.exe 2300 bthhtt.exe 2856 9jjdp.exe 2620 nhntht.exe 2728 jdvpd.exe 3056 rllrffr.exe 1116 xrlrxrf.exe 1984 bnthtn.exe 1968 dvpvp.exe 632 fxfrxlr.exe 1820 5htbtt.exe 1692 bhtnnh.exe 1332 pjdpv.exe 296 rfrxlxl.exe 2024 9frxlfr.exe 1104 tnnnbb.exe 2312 dvjjp.exe 1508 djddj.exe 2152 fxflxxr.exe 1452 bbtnbh.exe 2476 dvdpd.exe 2120 rfxlrff.exe 2496 tttnbb.exe 884 1tnthh.exe 1748 7dvpp.exe 332 rfxfrrx.exe 2372 7xllxfl.exe 3020 nbtbhh.exe 320 htnbtt.exe 2952 pjdjd.exe 2140 fxrfrxr.exe 2792 5rxfllr.exe 1704 nbhnbh.exe 2816 pjjdd.exe 2836 dddjd.exe 2876 xrlrffx.exe 2788 5rlrffl.exe 2860 3bnnnt.exe 2644 1bthtb.exe 2416 9dvjp.exe 2780 pdjjp.exe 2684 fxffrrx.exe 3040 3lfrffl.exe 1664 5bnbnt.exe 3056 bbnnhh.exe 1512 3ddjp.exe 1696 pjpdd.exe 1984 9ddpp.exe 1140 xxlffrf.exe 1192 dpvdp.exe 2092 dvpdd.exe 1276 rlrxxfl.exe 1540 9rllfxf.exe 1568 nhbhnn.exe 2844 hbbhtt.exe 296 pjvdp.exe 2024 1dvpv.exe 2480 xrflrfl.exe -
resource yara_rule behavioral1/memory/2572-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-9.dat upx behavioral1/memory/2424-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d68-17.dat upx behavioral1/memory/2424-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d6d-25.dat upx behavioral1/memory/2188-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d89-34.dat upx behavioral1/memory/344-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000171a8-42.dat upx behavioral1/memory/2100-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173a7-50.dat upx behavioral1/memory/2980-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000017488-60.dat upx behavioral1/files/0x0007000000019023-68.dat upx behavioral1/memory/2612-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2300-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-76.dat upx behavioral1/files/0x0005000000019261-84.dat upx behavioral1/files/0x0005000000019282-92.dat upx behavioral1/memory/2620-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019334-101.dat upx behavioral1/memory/2728-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019350-109.dat upx behavioral1/memory/3056-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b4-119.dat upx behavioral1/memory/1116-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c2-127.dat upx behavioral1/memory/1968-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e1-136.dat upx behavioral1/files/0x000500000001941e-143.dat upx behavioral1/files/0x0005000000019427-152.dat upx behavioral1/memory/1820-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019431-159.dat upx behavioral1/files/0x0005000000019441-167.dat upx behavioral1/files/0x000500000001944f-177.dat upx behavioral1/memory/296-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/296-174-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019461-184.dat upx behavioral1/files/0x000500000001950c-191.dat upx behavioral1/files/0x0005000000019582-198.dat upx behavioral1/memory/1508-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-206.dat upx behavioral1/files/0x0005000000019609-215.dat upx behavioral1/memory/2152-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960b-223.dat upx behavioral1/files/0x000500000001960d-232.dat upx behavioral1/memory/2476-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960f-239.dat upx behavioral1/files/0x0008000000016d42-248.dat upx behavioral1/memory/2496-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019611-255.dat upx behavioral1/files/0x0005000000019613-262.dat upx behavioral1/memory/2372-271-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3020-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-292-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1704-306-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2816-315-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/2416-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-359-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2424 2572 df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe 31 PID 2572 wrote to memory of 2424 2572 df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe 31 PID 2572 wrote to memory of 2424 2572 df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe 31 PID 2572 wrote to memory of 2424 2572 df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe 31 PID 2424 wrote to memory of 3028 2424 5ddpj.exe 32 PID 2424 wrote to memory of 3028 2424 5ddpj.exe 32 PID 2424 wrote to memory of 3028 2424 5ddpj.exe 32 PID 2424 wrote to memory of 3028 2424 5ddpj.exe 32 PID 3028 wrote to memory of 2188 3028 rlxxfrx.exe 33 PID 3028 wrote to memory of 2188 3028 rlxxfrx.exe 33 PID 3028 wrote to memory of 2188 3028 rlxxfrx.exe 33 PID 3028 wrote to memory of 2188 3028 rlxxfrx.exe 33 PID 2188 wrote to memory of 2100 2188 nbnntb.exe 34 PID 2188 wrote to memory of 2100 2188 nbnntb.exe 34 PID 2188 wrote to memory of 2100 2188 nbnntb.exe 34 PID 2188 wrote to memory of 2100 2188 nbnntb.exe 34 PID 2100 wrote to memory of 344 2100 tnbhhn.exe 35 PID 2100 wrote to memory of 344 2100 tnbhhn.exe 35 PID 2100 wrote to memory of 344 2100 tnbhhn.exe 35 PID 2100 wrote to memory of 344 2100 tnbhhn.exe 35 PID 344 wrote to memory of 2980 344 5pdpj.exe 36 PID 344 wrote to memory of 2980 344 5pdpj.exe 36 PID 344 wrote to memory of 2980 344 5pdpj.exe 36 PID 344 wrote to memory of 2980 344 5pdpj.exe 36 PID 2980 wrote to memory of 2612 2980 9vjjp.exe 37 PID 2980 wrote to memory of 2612 2980 9vjjp.exe 37 PID 2980 wrote to memory of 2612 2980 9vjjp.exe 37 PID 2980 wrote to memory of 2612 2980 9vjjp.exe 37 PID 2612 wrote to memory of 2300 2612 5xxlrll.exe 38 PID 2612 wrote to memory of 2300 2612 5xxlrll.exe 38 PID 2612 wrote to memory of 2300 2612 5xxlrll.exe 38 PID 2612 wrote to memory of 2300 2612 5xxlrll.exe 38 PID 2300 wrote to memory of 2856 2300 bthhtt.exe 39 PID 2300 wrote to memory of 2856 2300 bthhtt.exe 39 PID 2300 wrote to memory of 2856 2300 bthhtt.exe 39 PID 2300 wrote to memory of 2856 2300 bthhtt.exe 39 PID 2856 wrote to memory of 2620 2856 9jjdp.exe 40 PID 2856 wrote to memory of 2620 2856 9jjdp.exe 40 PID 2856 wrote to memory of 2620 2856 9jjdp.exe 40 PID 2856 wrote to memory of 2620 2856 9jjdp.exe 40 PID 2620 wrote to memory of 2728 2620 nhntht.exe 41 PID 2620 wrote to memory of 2728 2620 nhntht.exe 41 PID 2620 wrote to memory of 2728 2620 nhntht.exe 41 PID 2620 wrote to memory of 2728 2620 nhntht.exe 41 PID 2728 wrote to memory of 3056 2728 jdvpd.exe 42 PID 2728 wrote to memory of 3056 2728 jdvpd.exe 42 PID 2728 wrote to memory of 3056 2728 jdvpd.exe 42 PID 2728 wrote to memory of 3056 2728 jdvpd.exe 42 PID 3056 wrote to memory of 1116 3056 rllrffr.exe 43 PID 3056 wrote to memory of 1116 3056 rllrffr.exe 43 PID 3056 wrote to memory of 1116 3056 rllrffr.exe 43 PID 3056 wrote to memory of 1116 3056 rllrffr.exe 43 PID 1116 wrote to memory of 1984 1116 xrlrxrf.exe 44 PID 1116 wrote to memory of 1984 1116 xrlrxrf.exe 44 PID 1116 wrote to memory of 1984 1116 xrlrxrf.exe 44 PID 1116 wrote to memory of 1984 1116 xrlrxrf.exe 44 PID 1984 wrote to memory of 1968 1984 bnthtn.exe 45 PID 1984 wrote to memory of 1968 1984 bnthtn.exe 45 PID 1984 wrote to memory of 1968 1984 bnthtn.exe 45 PID 1984 wrote to memory of 1968 1984 bnthtn.exe 45 PID 1968 wrote to memory of 632 1968 dvpvp.exe 46 PID 1968 wrote to memory of 632 1968 dvpvp.exe 46 PID 1968 wrote to memory of 632 1968 dvpvp.exe 46 PID 1968 wrote to memory of 632 1968 dvpvp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe"C:\Users\Admin\AppData\Local\Temp\df32f423457aaa3a40e933abaa0a8d48636c98bfb002dfa0255a81c096bfe53f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5ddpj.exec:\5ddpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\nbnntb.exec:\nbnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\tnbhhn.exec:\tnbhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\5pdpj.exec:\5pdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\9vjjp.exec:\9vjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5xxlrll.exec:\5xxlrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\bthhtt.exec:\bthhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\9jjdp.exec:\9jjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhntht.exec:\nhntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jdvpd.exec:\jdvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rllrffr.exec:\rllrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\xrlrxrf.exec:\xrlrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\bnthtn.exec:\bnthtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\dvpvp.exec:\dvpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\fxfrxlr.exec:\fxfrxlr.exe17⤵
- Executes dropped EXE
PID:632 -
\??\c:\5htbtt.exec:\5htbtt.exe18⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bhtnnh.exec:\bhtnnh.exe19⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pjdpv.exec:\pjdpv.exe20⤵
- Executes dropped EXE
PID:1332 -
\??\c:\rfrxlxl.exec:\rfrxlxl.exe21⤵
- Executes dropped EXE
PID:296 -
\??\c:\9frxlfr.exec:\9frxlfr.exe22⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnnnbb.exec:\tnnnbb.exe23⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dvjjp.exec:\dvjjp.exe24⤵
- Executes dropped EXE
PID:2312 -
\??\c:\djddj.exec:\djddj.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fxflxxr.exec:\fxflxxr.exe26⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bbtnbh.exec:\bbtnbh.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvdpd.exec:\dvdpd.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rfxlrff.exec:\rfxlrff.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tttnbb.exec:\tttnbb.exe30⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1tnthh.exec:\1tnthh.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\7dvpp.exec:\7dvpp.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfxfrrx.exec:\rfxfrrx.exe33⤵
- Executes dropped EXE
PID:332 -
\??\c:\7xllxfl.exec:\7xllxfl.exe34⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nbtbhh.exec:\nbtbhh.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\htnbtt.exec:\htnbtt.exe36⤵
- Executes dropped EXE
PID:320 -
\??\c:\pjdjd.exec:\pjdjd.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe38⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5rxfllr.exec:\5rxfllr.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nbhnbh.exec:\nbhnbh.exe40⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pjjdd.exec:\pjjdd.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dddjd.exec:\dddjd.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrlrffx.exec:\xrlrffx.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5rlrffl.exec:\5rlrffl.exe44⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3bnnnt.exec:\3bnnnt.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1bthtb.exec:\1bthtb.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9dvjp.exec:\9dvjp.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pdjjp.exec:\pdjjp.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fxffrrx.exec:\fxffrrx.exe49⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3lfrffl.exec:\3lfrffl.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5bnbnt.exec:\5bnbnt.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bbnnhh.exec:\bbnnhh.exe52⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3ddjp.exec:\3ddjp.exe53⤵
- Executes dropped EXE
PID:1512 -
\??\c:\pjpdd.exec:\pjpdd.exe54⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9ddpp.exec:\9ddpp.exe55⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xxlffrf.exec:\xxlffrf.exe56⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dpvdp.exec:\dpvdp.exe57⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvpdd.exec:\dvpdd.exe58⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rlrxxfl.exec:\rlrxxfl.exe59⤵
- Executes dropped EXE
PID:1276 -
\??\c:\9rllfxf.exec:\9rllfxf.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nhbhnn.exec:\nhbhnn.exe61⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbbhtt.exec:\hbbhtt.exe62⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pjvdp.exec:\pjvdp.exe63⤵
- Executes dropped EXE
PID:296 -
\??\c:\1dvpv.exec:\1dvpv.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xrflrfl.exec:\xrflrfl.exe65⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9lrrffr.exec:\9lrrffr.exe66⤵PID:1104
-
\??\c:\bntbhn.exec:\bntbhn.exe67⤵PID:960
-
\??\c:\tnbthn.exec:\tnbthn.exe68⤵PID:2208
-
\??\c:\5pdpd.exec:\5pdpd.exe69⤵PID:2232
-
\??\c:\pjvdv.exec:\pjvdv.exe70⤵PID:1632
-
\??\c:\rffrrrr.exec:\rffrrrr.exe71⤵PID:2448
-
\??\c:\rfrflff.exec:\rfrflff.exe72⤵PID:2652
-
\??\c:\thtnnh.exec:\thtnnh.exe73⤵PID:1732
-
\??\c:\1nbtbb.exec:\1nbtbb.exe74⤵PID:2120
-
\??\c:\vjjjp.exec:\vjjjp.exe75⤵PID:860
-
\??\c:\5lrxflr.exec:\5lrxflr.exe76⤵PID:800
-
\??\c:\rlfrrrx.exec:\rlfrrrx.exe77⤵PID:564
-
\??\c:\nhtbnt.exec:\nhtbnt.exe78⤵PID:2576
-
\??\c:\pdpvv.exec:\pdpvv.exe79⤵PID:2344
-
\??\c:\jjdpp.exec:\jjdpp.exe80⤵PID:2372
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe81⤵PID:3016
-
\??\c:\7lxflrx.exec:\7lxflrx.exe82⤵PID:2524
-
\??\c:\nbbhbt.exec:\nbbhbt.exe83⤵PID:2188
-
\??\c:\hhbbhn.exec:\hhbbhn.exe84⤵PID:2716
-
\??\c:\7pjpv.exec:\7pjpv.exe85⤵PID:1576
-
\??\c:\lfxfffr.exec:\lfxfffr.exe86⤵PID:2736
-
\??\c:\fxfflll.exec:\fxfflll.exe87⤵PID:2760
-
\??\c:\bhnnbt.exec:\bhnnbt.exe88⤵PID:2836
-
\??\c:\thnhhb.exec:\thnhhb.exe89⤵PID:2964
-
\??\c:\7vpvv.exec:\7vpvv.exe90⤵PID:2876
-
\??\c:\pjpdp.exec:\pjpdp.exe91⤵PID:2632
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe92⤵PID:2300
-
\??\c:\rfllxfr.exec:\rfllxfr.exe93⤵PID:2604
-
\??\c:\bnnntn.exec:\bnnntn.exe94⤵PID:2648
-
\??\c:\hnttbh.exec:\hnttbh.exe95⤵PID:2164
-
\??\c:\jvvdd.exec:\jvvdd.exe96⤵PID:2728
-
\??\c:\pdppd.exec:\pdppd.exe97⤵PID:1480
-
\??\c:\flxrlfl.exec:\flxrlfl.exe98⤵PID:3056
-
\??\c:\flrxffl.exec:\flrxffl.exe99⤵PID:1288
-
\??\c:\tnhnht.exec:\tnhnht.exe100⤵PID:1728
-
\??\c:\hbnbnn.exec:\hbnbnn.exe101⤵PID:1800
-
\??\c:\pdddp.exec:\pdddp.exe102⤵PID:1808
-
\??\c:\pjpvp.exec:\pjpvp.exe103⤵PID:2392
-
\??\c:\lxfrxrx.exec:\lxfrxrx.exe104⤵PID:2512
-
\??\c:\xlxxlrr.exec:\xlxxlrr.exe105⤵PID:2092
-
\??\c:\7rxfllr.exec:\7rxfllr.exe106⤵PID:1320
-
\??\c:\tnbnbt.exec:\tnbnbt.exe107⤵PID:1540
-
\??\c:\5nbbbh.exec:\5nbbbh.exe108⤵PID:1568
-
\??\c:\dpddj.exec:\dpddj.exe109⤵PID:1744
-
\??\c:\9pjpd.exec:\9pjpd.exe110⤵PID:296
-
\??\c:\5lrfffl.exec:\5lrfffl.exe111⤵PID:2292
-
\??\c:\btnbtb.exec:\btnbtb.exe112⤵PID:620
-
\??\c:\7tnttn.exec:\7tnttn.exe113⤵PID:448
-
\??\c:\3ddjd.exec:\3ddjd.exe114⤵PID:848
-
\??\c:\1vdjj.exec:\1vdjj.exe115⤵PID:1724
-
\??\c:\xrlrffl.exec:\xrlrffl.exe116⤵PID:1784
-
\??\c:\flrxfxx.exec:\flrxfxx.exe117⤵PID:1452
-
\??\c:\nhthhn.exec:\nhthhn.exe118⤵PID:2476
-
\??\c:\hbhntn.exec:\hbhntn.exe119⤵PID:2052
-
\??\c:\vpdpj.exec:\vpdpj.exe120⤵PID:2096
-
\??\c:\ppvjj.exec:\ppvjj.exe121⤵PID:2484
-
\??\c:\xxrllxr.exec:\xxrllxr.exe122⤵PID:884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-