Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 14:54
Behavioral task
behavioral1
Sample
440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe
-
Size
91KB
-
MD5
c4a1447b1814e79893249f94213f3475
-
SHA1
db0a5f854444361fa3981a1b936a3d0168e14382
-
SHA256
440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525
-
SHA512
ab0371a8109487c4ff1400072a3fe821137d10578d867a325c9a617490947b819c62821e01fc1a9cf00d4446e57fbda320751cd31f32fd252caaf2d18c52b62d
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436C0:9hOmTsF93UYfwC6GIoutyaVszyKd+XY6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2380-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-117-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2832-137-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-147-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2268-149-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3008-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-164-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2884-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-188-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/548-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1176-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-277-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/2160-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-395-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2552-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-437-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2884-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-562-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/604-583-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2796-606-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/3020-614-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-704-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-711-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2376-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-889-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2924-902-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1288-930-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2984-969-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-1000-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-1064-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2468-1079-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1748-1190-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2336-1241-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2648-1432-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2612 9lxrxfl.exe 3004 hnnbtn.exe 2352 nhtbhh.exe 2900 htbhtb.exe 2764 5frfxlf.exe 2916 bthnth.exe 1360 9tnnnb.exe 2696 pjjdp.exe 2704 3jpdj.exe 2176 nbbhth.exe 2628 9hthnt.exe 2268 9vppd.exe 2500 flrxrxl.exe 2832 hbbbhn.exe 448 9btbbh.exe 2884 vdjvj.exe 3008 xrrfxll.exe 1484 tbnbnt.exe 2016 ddjjv.exe 1692 ffrflrx.exe 2264 lrrxxxx.exe 2120 3thnhh.exe 904 nttbtt.exe 548 dppjp.exe 2116 lrfxfff.exe 2416 hhnhtn.exe 1932 nhtnnn.exe 1912 9vjdj.exe 2196 xrxllxf.exe 1176 bbthtb.exe 3016 9bbhnb.exe 1216 hnbbbt.exe 2160 jjpdv.exe 2732 9xllllf.exe 2844 rlxlrlx.exe 1624 bhhntt.exe 2792 5jvvv.exe 2788 3pddp.exe 2928 xflrxfr.exe 2920 xrrlxrr.exe 2912 3nnthn.exe 2752 tnnhnh.exe 2696 dvjpv.exe 2288 ffllflr.exe 484 5frflrx.exe 1640 xrrrxxl.exe 2432 ttbhth.exe 2476 ttbbhn.exe 2480 ddjvj.exe 2996 1rlfllr.exe 2552 rrrffrr.exe 2700 1rxxfff.exe 448 9hbbbb.exe 2884 dppjp.exe 2568 vpjpd.exe 2972 1lrrlfl.exe 1444 fxxffll.exe 1784 5hbbnt.exe 2624 1htbbb.exe 1984 jvvpd.exe 2440 dvjjv.exe 1496 rxflrfl.exe 788 lrflxll.exe 2232 tnnhtb.exe -
resource yara_rule behavioral1/memory/2380-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fd-7.dat upx behavioral1/files/0x00070000000186ca-18.dat upx behavioral1/memory/3004-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2352-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186d9-27.dat upx behavioral1/memory/2612-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018710-37.dat upx behavioral1/memory/2900-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018766-45.dat upx behavioral1/memory/2900-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018780-55.dat upx behavioral1/memory/2764-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b62-64.dat upx behavioral1/memory/2696-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018bf3-72.dat upx behavioral1/files/0x000700000001933b-80.dat upx behavioral1/memory/2176-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-90.dat upx behavioral1/memory/2704-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961c-98.dat upx behavioral1/files/0x000500000001961e-106.dat upx behavioral1/memory/2268-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019667-115.dat upx behavioral1/memory/448-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019926-138.dat upx behavioral1/memory/2832-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196a1-129.dat upx behavioral1/memory/2500-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c34-150.dat upx behavioral1/memory/3008-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3c-160.dat upx behavioral1/memory/2884-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3e-170.dat upx behavioral1/files/0x0005000000019c57-179.dat upx behavioral1/memory/1484-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019cba-192.dat upx behavioral1/memory/1692-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d8e-208.dat upx behavioral1/files/0x0005000000019cca-200.dat upx behavioral1/files/0x0005000000019dbf-215.dat upx behavioral1/files/0x0005000000019f8a-223.dat upx behavioral1/memory/548-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/548-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f94-232.dat upx behavioral1/files/0x000500000001a075-244.dat upx behavioral1/files/0x000500000001a07e-251.dat upx behavioral1/memory/2116-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1912-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a09e-260.dat upx behavioral1/files/0x000500000001a307-268.dat upx behavioral1/memory/1176-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a359-279.dat upx behavioral1/memory/2196-277-0x0000000001B80000-0x0000000001BA7000-memory.dmp upx behavioral1/memory/2196-275-0x0000000001B80000-0x0000000001BA7000-memory.dmp upx behavioral1/files/0x000500000001a41b-288.dat upx behavioral1/files/0x0035000000017530-295.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2612 2380 440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe 29 PID 2380 wrote to memory of 2612 2380 440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe 29 PID 2380 wrote to memory of 2612 2380 440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe 29 PID 2380 wrote to memory of 2612 2380 440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe 29 PID 2612 wrote to memory of 3004 2612 9lxrxfl.exe 30 PID 2612 wrote to memory of 3004 2612 9lxrxfl.exe 30 PID 2612 wrote to memory of 3004 2612 9lxrxfl.exe 30 PID 2612 wrote to memory of 3004 2612 9lxrxfl.exe 30 PID 3004 wrote to memory of 2352 3004 hnnbtn.exe 31 PID 3004 wrote to memory of 2352 3004 hnnbtn.exe 31 PID 3004 wrote to memory of 2352 3004 hnnbtn.exe 31 PID 3004 wrote to memory of 2352 3004 hnnbtn.exe 31 PID 2352 wrote to memory of 2900 2352 nhtbhh.exe 32 PID 2352 wrote to memory of 2900 2352 nhtbhh.exe 32 PID 2352 wrote to memory of 2900 2352 nhtbhh.exe 32 PID 2352 wrote to memory of 2900 2352 nhtbhh.exe 32 PID 2900 wrote to memory of 2764 2900 htbhtb.exe 33 PID 2900 wrote to memory of 2764 2900 htbhtb.exe 33 PID 2900 wrote to memory of 2764 2900 htbhtb.exe 33 PID 2900 wrote to memory of 2764 2900 htbhtb.exe 33 PID 2764 wrote to memory of 2916 2764 5frfxlf.exe 34 PID 2764 wrote to memory of 2916 2764 5frfxlf.exe 34 PID 2764 wrote to memory of 2916 2764 5frfxlf.exe 34 PID 2764 wrote to memory of 2916 2764 5frfxlf.exe 34 PID 2916 wrote to memory of 1360 2916 bthnth.exe 35 PID 2916 wrote to memory of 1360 2916 bthnth.exe 35 PID 2916 wrote to memory of 1360 2916 bthnth.exe 35 PID 2916 wrote to memory of 1360 2916 bthnth.exe 35 PID 1360 wrote to memory of 2696 1360 9tnnnb.exe 36 PID 1360 wrote to memory of 2696 1360 9tnnnb.exe 36 PID 1360 wrote to memory of 2696 1360 9tnnnb.exe 36 PID 1360 wrote to memory of 2696 1360 9tnnnb.exe 36 PID 2696 wrote to memory of 2704 2696 pjjdp.exe 37 PID 2696 wrote to memory of 2704 2696 pjjdp.exe 37 PID 2696 wrote to memory of 2704 2696 pjjdp.exe 37 PID 2696 wrote to memory of 2704 2696 pjjdp.exe 37 PID 2704 wrote to memory of 2176 2704 3jpdj.exe 38 PID 2704 wrote to memory of 2176 2704 3jpdj.exe 38 PID 2704 wrote to memory of 2176 2704 3jpdj.exe 38 PID 2704 wrote to memory of 2176 2704 3jpdj.exe 38 PID 2176 wrote to memory of 2628 2176 nbbhth.exe 39 PID 2176 wrote to memory of 2628 2176 nbbhth.exe 39 PID 2176 wrote to memory of 2628 2176 nbbhth.exe 39 PID 2176 wrote to memory of 2628 2176 nbbhth.exe 39 PID 2628 wrote to memory of 2268 2628 9hthnt.exe 40 PID 2628 wrote to memory of 2268 2628 9hthnt.exe 40 PID 2628 wrote to memory of 2268 2628 9hthnt.exe 40 PID 2628 wrote to memory of 2268 2628 9hthnt.exe 40 PID 2268 wrote to memory of 2500 2268 9vppd.exe 41 PID 2268 wrote to memory of 2500 2268 9vppd.exe 41 PID 2268 wrote to memory of 2500 2268 9vppd.exe 41 PID 2268 wrote to memory of 2500 2268 9vppd.exe 41 PID 2500 wrote to memory of 2832 2500 flrxrxl.exe 42 PID 2500 wrote to memory of 2832 2500 flrxrxl.exe 42 PID 2500 wrote to memory of 2832 2500 flrxrxl.exe 42 PID 2500 wrote to memory of 2832 2500 flrxrxl.exe 42 PID 2832 wrote to memory of 448 2832 hbbbhn.exe 43 PID 2832 wrote to memory of 448 2832 hbbbhn.exe 43 PID 2832 wrote to memory of 448 2832 hbbbhn.exe 43 PID 2832 wrote to memory of 448 2832 hbbbhn.exe 43 PID 448 wrote to memory of 2884 448 9btbbh.exe 44 PID 448 wrote to memory of 2884 448 9btbbh.exe 44 PID 448 wrote to memory of 2884 448 9btbbh.exe 44 PID 448 wrote to memory of 2884 448 9btbbh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe"C:\Users\Admin\AppData\Local\Temp\440cfe3f5f7103960a8a7f6e925be2e99a5f03216a3fb57c0d2df44b790b6525.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\9lxrxfl.exec:\9lxrxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\hnnbtn.exec:\hnnbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\nhtbhh.exec:\nhtbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\htbhtb.exec:\htbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\5frfxlf.exec:\5frfxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bthnth.exec:\bthnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\9tnnnb.exec:\9tnnnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\pjjdp.exec:\pjjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3jpdj.exec:\3jpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nbbhth.exec:\nbbhth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\9hthnt.exec:\9hthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\9vppd.exec:\9vppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\flrxrxl.exec:\flrxrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\hbbbhn.exec:\hbbbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9btbbh.exec:\9btbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vdjvj.exec:\vdjvj.exe17⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xrrfxll.exec:\xrrfxll.exe18⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tbnbnt.exec:\tbnbnt.exe19⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ddjjv.exec:\ddjjv.exe20⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffrflrx.exec:\ffrflrx.exe21⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lrrxxxx.exec:\lrrxxxx.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3thnhh.exec:\3thnhh.exe23⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nttbtt.exec:\nttbtt.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\dppjp.exec:\dppjp.exe25⤵
- Executes dropped EXE
PID:548 -
\??\c:\lrfxfff.exec:\lrfxfff.exe26⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hhnhtn.exec:\hhnhtn.exe27⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhtnnn.exec:\nhtnnn.exe28⤵
- Executes dropped EXE
PID:1932 -
\??\c:\9vjdj.exec:\9vjdj.exe29⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrxllxf.exec:\xrxllxf.exe30⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bbthtb.exec:\bbthtb.exe31⤵
- Executes dropped EXE
PID:1176 -
\??\c:\9bbhnb.exec:\9bbhnb.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hnbbbt.exec:\hnbbbt.exe33⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jjpdv.exec:\jjpdv.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9xllllf.exec:\9xllllf.exe35⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rlxlrlx.exec:\rlxlrlx.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bhhntt.exec:\bhhntt.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5jvvv.exec:\5jvvv.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3pddp.exec:\3pddp.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xflrxfr.exec:\xflrxfr.exe40⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xrrlxrr.exec:\xrrlxrr.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3nnthn.exec:\3nnthn.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\tnnhnh.exec:\tnnhnh.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dvjpv.exec:\dvjpv.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ffllflr.exec:\ffllflr.exe45⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5frflrx.exec:\5frflrx.exe46⤵
- Executes dropped EXE
PID:484 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe47⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ttbhth.exec:\ttbhth.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ttbbhn.exec:\ttbbhn.exe49⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ddjvj.exec:\ddjvj.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1rlfllr.exec:\1rlfllr.exe51⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rrrffrr.exec:\rrrffrr.exe52⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1rxxfff.exec:\1rxxfff.exe53⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9hbbbb.exec:\9hbbbb.exe54⤵
- Executes dropped EXE
PID:448 -
\??\c:\dppjp.exec:\dppjp.exe55⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vpjpd.exec:\vpjpd.exe56⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1lrrlfl.exec:\1lrrlfl.exe57⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fxxffll.exec:\fxxffll.exe58⤵
- Executes dropped EXE
PID:1444 -
\??\c:\5hbbnt.exec:\5hbbnt.exe59⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1htbbb.exec:\1htbbb.exe60⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jvvpd.exec:\jvvpd.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvjjv.exec:\dvjjv.exe62⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rxflrfl.exec:\rxflrfl.exe63⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lrflxll.exec:\lrflxll.exe64⤵
- Executes dropped EXE
PID:788 -
\??\c:\tnnhtb.exec:\tnnhtb.exe65⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bhbhnb.exec:\bhbhnb.exe66⤵PID:2592
-
\??\c:\1djpd.exec:\1djpd.exe67⤵PID:1628
-
\??\c:\5dvjv.exec:\5dvjv.exe68⤵PID:1584
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe69⤵PID:780
-
\??\c:\rrfflff.exec:\rrfflff.exe70⤵PID:932
-
\??\c:\hntthh.exec:\hntthh.exe71⤵PID:648
-
\??\c:\9tbbbh.exec:\9tbbbh.exe72⤵PID:796
-
\??\c:\pvdpv.exec:\pvdpv.exe73⤵PID:1608
-
\??\c:\llffxrr.exec:\llffxrr.exe74⤵PID:884
-
\??\c:\5xfxlfl.exec:\5xfxlfl.exe75⤵PID:1740
-
\??\c:\bttbnh.exec:\bttbnh.exe76⤵PID:2304
-
\??\c:\hhnnnn.exec:\hhnnnn.exe77⤵PID:604
-
\??\c:\vpjjd.exec:\vpjjd.exe78⤵PID:2160
-
\??\c:\vdvvd.exec:\vdvvd.exe79⤵PID:2768
-
\??\c:\5llrrxx.exec:\5llrrxx.exe80⤵PID:2848
-
\??\c:\llrxfll.exec:\llrxfll.exe81⤵PID:2796
-
\??\c:\btbthh.exec:\btbthh.exe82⤵PID:3020
-
\??\c:\vvddp.exec:\vvddp.exe83⤵PID:2136
-
\??\c:\ppvpp.exec:\ppvpp.exe84⤵PID:2776
-
\??\c:\fxxxfxx.exec:\fxxxfxx.exe85⤵PID:2128
-
\??\c:\xxlflff.exec:\xxlflff.exe86⤵PID:2712
-
\??\c:\9ntnnh.exec:\9ntnnh.exe87⤵PID:1712
-
\??\c:\1nttnn.exec:\1nttnn.exe88⤵PID:2672
-
\??\c:\7vjvj.exec:\7vjvj.exe89⤵PID:1044
-
\??\c:\ppvdd.exec:\ppvdd.exe90⤵PID:1640
-
\??\c:\lfrxffl.exec:\lfrxffl.exe91⤵PID:2268
-
\??\c:\xrrxfxx.exec:\xrrxfxx.exe92⤵PID:1056
-
\??\c:\7fxxxxx.exec:\7fxxxxx.exe93⤵PID:1544
-
\??\c:\nbbtbt.exec:\nbbtbt.exe94⤵PID:1332
-
\??\c:\5pdjv.exec:\5pdjv.exe95⤵PID:2832
-
\??\c:\jdddj.exec:\jdddj.exe96⤵PID:2532
-
\??\c:\1lxlxlx.exec:\1lxlxlx.exe97⤵PID:2860
-
\??\c:\9ttttb.exec:\9ttttb.exe98⤵PID:2076
-
\??\c:\hbnhnn.exec:\hbnhnn.exe99⤵PID:3008
-
\??\c:\vvddj.exec:\vvddj.exe100⤵PID:1996
-
\??\c:\jdjpv.exec:\jdjpv.exe101⤵PID:3048
-
\??\c:\9rflxfl.exec:\9rflxfl.exe102⤵PID:3040
-
\??\c:\xrllrrx.exec:\xrllrrx.exe103⤵PID:1692
-
\??\c:\hbbbtb.exec:\hbbbtb.exe104⤵PID:2436
-
\??\c:\3bnhbb.exec:\3bnhbb.exe105⤵PID:2400
-
\??\c:\jjvvj.exec:\jjvvj.exe106⤵PID:2448
-
\??\c:\pvvdj.exec:\pvvdj.exe107⤵PID:1648
-
\??\c:\5jppv.exec:\5jppv.exe108⤵PID:1644
-
\??\c:\rllrxfl.exec:\rllrxfl.exe109⤵PID:1836
-
\??\c:\xrflxrr.exec:\xrflxrr.exe110⤵PID:2116
-
\??\c:\httntt.exec:\httntt.exe111⤵PID:1764
-
\??\c:\7nnnnt.exec:\7nnnnt.exe112⤵PID:948
-
\??\c:\3pvvp.exec:\3pvvp.exe113⤵PID:1932
-
\??\c:\7vjdj.exec:\7vjdj.exe114⤵PID:1660
-
\??\c:\frlrxxx.exec:\frlrxxx.exe115⤵PID:2724
-
\??\c:\xllfrll.exec:\xllfrll.exe116⤵PID:1176
-
\??\c:\htbhnt.exec:\htbhnt.exe117⤵PID:1508
-
\??\c:\hbnhnh.exec:\hbnhnh.exe118⤵PID:3068
-
\??\c:\7vjpd.exec:\7vjpd.exe119⤵PID:1740
-
\??\c:\vpvvd.exec:\vpvvd.exe120⤵PID:2376
-
\??\c:\pdddd.exec:\pdddd.exe121⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-