Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe
-
Size
347KB
-
MD5
ebb7ae3467d22a97a49ee1786fc8dd4c
-
SHA1
5f5d1ec09fed52585fccbead1bb2d118da741fe2
-
SHA256
bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4
-
SHA512
e090127dec120b9248a082deb4acd3632d36d2eb56adab8376f933420b5b614887c7b7140206441c14a051bdb4b257d290f5f2d310d2c7c07a7a03343f87241b
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAw:l7TcbWXZshJX2VGdw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1372-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2948-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2976-31-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3008-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3008-27-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/2660-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2792-57-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2536-87-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2652-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2784-99-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/480-114-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/528-139-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/624-151-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1624-162-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2572-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1268-200-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1652-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2824-223-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1496-232-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1524-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2432-259-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3060-268-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2136-294-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2564-378-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/1448-387-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/1872-421-0x0000000000230000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2076-423-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2076-429-0x00000000002B0000-0x00000000002D8000-memory.dmp family_blackmoon behavioral1/memory/2496-436-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1008-437-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2520-456-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2860-464-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2708-478-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1504-533-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/2136-577-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1512-586-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2956-587-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2376-628-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2668-641-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2532-642-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2296-723-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2296-743-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2804-751-0x00000000002B0000-0x00000000002D8000-memory.dmp family_blackmoon behavioral1/memory/1628-807-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1372 hhbhhn.exe 3008 dvppd.exe 2976 xxrflrf.exe 2660 pvjpv.exe 2792 hhbtnt.exe 2664 jjjdv.exe 1800 llfrffl.exe 2704 hbtttt.exe 2536 vdjvp.exe 2652 hhbtnt.exe 2784 djvpv.exe 480 xxxlxxr.exe 2060 bbtbhn.exe 1960 ddpdp.exe 528 3hhnth.exe 624 jjjvp.exe 1624 9nhntn.exe 1760 ddpdj.exe 1200 xflfrfx.exe 2572 nhhtht.exe 2392 ffxlrrf.exe 1268 tbhbhh.exe 1652 7jvjv.exe 2824 thhnhn.exe 1496 xfxfxlr.exe 1524 bnhhnh.exe 2444 vvpvp.exe 2432 hbnnhn.exe 3060 jjvvd.exe 2464 bhhtnt.exe 1436 vvdpv.exe 2136 rrlrflr.exe 1536 vvjpv.exe 3004 vvppd.exe 2968 llfrfrf.exe 2624 ntbnbb.exe 2672 1jvpp.exe 2724 xxxfrxl.exe 2688 lrfrfrf.exe 2540 btbnhh.exe 2568 jdjdj.exe 1800 fxlllfx.exe 2560 tnhnth.exe 2564 7ntbhh.exe 3024 pjdpv.exe 1448 lfrlxfl.exe 1872 9hhtbt.exe 480 nbhnnh.exe 2060 9ppdp.exe 2332 fxfrlxx.exe 2076 hbhntb.exe 2496 jpdjd.exe 1008 xrlfxxl.exe 1592 lxxllff.exe 2520 3bthht.exe 2860 ppjvv.exe 2804 rfrlfrx.exe 2708 rrrxlrl.exe 2384 hhtbhn.exe 1724 vdvvp.exe 1292 fllfllx.exe 904 nnthtt.exe 2228 9hbnth.exe 1180 vvvpj.exe -
resource yara_rule behavioral1/memory/1372-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2948-8-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3008-25-0x00000000003A0000-0x00000000003C8000-memory.dmp upx behavioral1/memory/2976-31-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3008-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2792-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2660-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2792-57-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-81-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2536-87-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2652-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2784-99-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/480-114-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/528-139-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/624-151-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1624-162-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1200-179-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2572-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1268-200-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1652-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2824-223-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1496-232-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1524-242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2432-259-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3060-268-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2136-294-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/480-406-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2076-423-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2496-436-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1008-437-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2520-456-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2708-478-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1728-520-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1512-579-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2136-577-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1512-586-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2956-587-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2724-620-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2668-641-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1956-691-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2804-744-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2804-751-0x00000000002B0000-0x00000000002D8000-memory.dmp upx behavioral1/memory/2236-758-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1628-783-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 1372 2948 bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe 31 PID 2948 wrote to memory of 1372 2948 bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe 31 PID 2948 wrote to memory of 1372 2948 bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe 31 PID 2948 wrote to memory of 1372 2948 bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe 31 PID 1372 wrote to memory of 3008 1372 hhbhhn.exe 32 PID 1372 wrote to memory of 3008 1372 hhbhhn.exe 32 PID 1372 wrote to memory of 3008 1372 hhbhhn.exe 32 PID 1372 wrote to memory of 3008 1372 hhbhhn.exe 32 PID 3008 wrote to memory of 2976 3008 dvppd.exe 33 PID 3008 wrote to memory of 2976 3008 dvppd.exe 33 PID 3008 wrote to memory of 2976 3008 dvppd.exe 33 PID 3008 wrote to memory of 2976 3008 dvppd.exe 33 PID 2976 wrote to memory of 2660 2976 xxrflrf.exe 34 PID 2976 wrote to memory of 2660 2976 xxrflrf.exe 34 PID 2976 wrote to memory of 2660 2976 xxrflrf.exe 34 PID 2976 wrote to memory of 2660 2976 xxrflrf.exe 34 PID 2660 wrote to memory of 2792 2660 pvjpv.exe 35 PID 2660 wrote to memory of 2792 2660 pvjpv.exe 35 PID 2660 wrote to memory of 2792 2660 pvjpv.exe 35 PID 2660 wrote to memory of 2792 2660 pvjpv.exe 35 PID 2792 wrote to memory of 2664 2792 hhbtnt.exe 36 PID 2792 wrote to memory of 2664 2792 hhbtnt.exe 36 PID 2792 wrote to memory of 2664 2792 hhbtnt.exe 36 PID 2792 wrote to memory of 2664 2792 hhbtnt.exe 36 PID 2664 wrote to memory of 1800 2664 jjjdv.exe 37 PID 2664 wrote to memory of 1800 2664 jjjdv.exe 37 PID 2664 wrote to memory of 1800 2664 jjjdv.exe 37 PID 2664 wrote to memory of 1800 2664 jjjdv.exe 37 PID 1800 wrote to memory of 2704 1800 llfrffl.exe 38 PID 1800 wrote to memory of 2704 1800 llfrffl.exe 38 PID 1800 wrote to memory of 2704 1800 llfrffl.exe 38 PID 1800 wrote to memory of 2704 1800 llfrffl.exe 38 PID 2704 wrote to memory of 2536 2704 hbtttt.exe 39 PID 2704 wrote to memory of 2536 2704 hbtttt.exe 39 PID 2704 wrote to memory of 2536 2704 hbtttt.exe 39 PID 2704 wrote to memory of 2536 2704 hbtttt.exe 39 PID 2536 wrote to memory of 2652 2536 vdjvp.exe 40 PID 2536 wrote to memory of 2652 2536 vdjvp.exe 40 PID 2536 wrote to memory of 2652 2536 vdjvp.exe 40 PID 2536 wrote to memory of 2652 2536 vdjvp.exe 40 PID 2652 wrote to memory of 2784 2652 hhbtnt.exe 41 PID 2652 wrote to memory of 2784 2652 hhbtnt.exe 41 PID 2652 wrote to memory of 2784 2652 hhbtnt.exe 41 PID 2652 wrote to memory of 2784 2652 hhbtnt.exe 41 PID 2784 wrote to memory of 480 2784 djvpv.exe 42 PID 2784 wrote to memory of 480 2784 djvpv.exe 42 PID 2784 wrote to memory of 480 2784 djvpv.exe 42 PID 2784 wrote to memory of 480 2784 djvpv.exe 42 PID 480 wrote to memory of 2060 480 xxxlxxr.exe 43 PID 480 wrote to memory of 2060 480 xxxlxxr.exe 43 PID 480 wrote to memory of 2060 480 xxxlxxr.exe 43 PID 480 wrote to memory of 2060 480 xxxlxxr.exe 43 PID 2060 wrote to memory of 1960 2060 bbtbhn.exe 44 PID 2060 wrote to memory of 1960 2060 bbtbhn.exe 44 PID 2060 wrote to memory of 1960 2060 bbtbhn.exe 44 PID 2060 wrote to memory of 1960 2060 bbtbhn.exe 44 PID 1960 wrote to memory of 528 1960 ddpdp.exe 45 PID 1960 wrote to memory of 528 1960 ddpdp.exe 45 PID 1960 wrote to memory of 528 1960 ddpdp.exe 45 PID 1960 wrote to memory of 528 1960 ddpdp.exe 45 PID 528 wrote to memory of 624 528 3hhnth.exe 46 PID 528 wrote to memory of 624 528 3hhnth.exe 46 PID 528 wrote to memory of 624 528 3hhnth.exe 46 PID 528 wrote to memory of 624 528 3hhnth.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe"C:\Users\Admin\AppData\Local\Temp\bd581ef6101ad92557c142d1dad2a42f4980174cd5e7ffa5a291c35748a6abc4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hhbhhn.exec:\hhbhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\dvppd.exec:\dvppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\xxrflrf.exec:\xxrflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\pvjpv.exec:\pvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hhbtnt.exec:\hhbtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjjdv.exec:\jjjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\llfrffl.exec:\llfrffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\hbtttt.exec:\hbtttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vdjvp.exec:\vdjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\hhbtnt.exec:\hhbtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\djvpv.exec:\djvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xxxlxxr.exec:\xxxlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\bbtbhn.exec:\bbtbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\ddpdp.exec:\ddpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\3hhnth.exec:\3hhnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\jjjvp.exec:\jjjvp.exe17⤵
- Executes dropped EXE
PID:624 -
\??\c:\9nhntn.exec:\9nhntn.exe18⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ddpdj.exec:\ddpdj.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xflfrfx.exec:\xflfrfx.exe20⤵
- Executes dropped EXE
PID:1200 -
\??\c:\nhhtht.exec:\nhhtht.exe21⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ffxlrrf.exec:\ffxlrrf.exe22⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tbhbhh.exec:\tbhbhh.exe23⤵
- Executes dropped EXE
PID:1268 -
\??\c:\7jvjv.exec:\7jvjv.exe24⤵
- Executes dropped EXE
PID:1652 -
\??\c:\thhnhn.exec:\thhnhn.exe25⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xfxfxlr.exec:\xfxfxlr.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\bnhhnh.exec:\bnhhnh.exe27⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vvpvp.exec:\vvpvp.exe28⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hbnnhn.exec:\hbnnhn.exe29⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jjvvd.exec:\jjvvd.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhhtnt.exec:\bhhtnt.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vvdpv.exec:\vvdpv.exe32⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rrlrflr.exec:\rrlrflr.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2136 -
\??\c:\vvjpv.exec:\vvjpv.exe34⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vvppd.exec:\vvppd.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\llfrfrf.exec:\llfrfrf.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\ntbnbb.exec:\ntbnbb.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1jvpp.exec:\1jvpp.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lrfrfrf.exec:\lrfrfrf.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\btbnhh.exec:\btbnhh.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jdjdj.exec:\jdjdj.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\fxlllfx.exec:\fxlllfx.exe43⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tnhnth.exec:\tnhnth.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7ntbhh.exec:\7ntbhh.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjdpv.exec:\pjdpv.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe47⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9hhtbt.exec:\9hhtbt.exe48⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nbhnnh.exec:\nbhnnh.exe49⤵
- Executes dropped EXE
PID:480 -
\??\c:\9ppdp.exec:\9ppdp.exe50⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxfrlxx.exec:\fxfrlxx.exe51⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hbhntb.exec:\hbhntb.exe52⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jpdjd.exec:\jpdjd.exe53⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xrlfxxl.exec:\xrlfxxl.exe54⤵
- Executes dropped EXE
PID:1008 -
\??\c:\lxxllff.exec:\lxxllff.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3bthht.exec:\3bthht.exe56⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ppjvv.exec:\ppjvv.exe57⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rfrlfrx.exec:\rfrlfrx.exe58⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe59⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hhtbhn.exec:\hhtbhn.exe60⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vdvvp.exec:\vdvvp.exe61⤵
- Executes dropped EXE
PID:1724 -
\??\c:\fllfllx.exec:\fllfllx.exe62⤵
- Executes dropped EXE
PID:1292 -
\??\c:\nnthtt.exec:\nnthtt.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\9hbnth.exec:\9hbnth.exe64⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vvvpj.exec:\vvvpj.exe65⤵
- Executes dropped EXE
PID:1180 -
\??\c:\xxlxfrl.exec:\xxlxfrl.exe66⤵PID:1728
-
\??\c:\ttntnh.exec:\ttntnh.exe67⤵PID:1504
-
\??\c:\vpvdv.exec:\vpvdv.exe68⤵PID:2444
-
\??\c:\dppjv.exec:\dppjv.exe69⤵PID:808
-
\??\c:\xrxlfxl.exec:\xrxlfxl.exe70⤵PID:3060
-
\??\c:\nttntn.exec:\nttntn.exe71⤵PID:488
-
\??\c:\vppjv.exec:\vppjv.exe72⤵PID:2616
-
\??\c:\vvdvj.exec:\vvdvj.exe73⤵PID:2336
-
\??\c:\xfrflrr.exec:\xfrflrr.exe74⤵PID:2136
-
\??\c:\bbnnnt.exec:\bbnnnt.exe75⤵PID:1512
-
\??\c:\1pdjv.exec:\1pdjv.exe76⤵PID:2956
-
\??\c:\xxflflx.exec:\xxflflx.exe77⤵PID:3048
-
\??\c:\tbhbnt.exec:\tbhbnt.exe78⤵PID:2676
-
\??\c:\nntbhh.exec:\nntbhh.exe79⤵PID:2728
-
\??\c:\vpdvv.exec:\vpdvv.exe80⤵PID:2724
-
\??\c:\fxrxflr.exec:\fxrxflr.exe81⤵PID:2376
-
\??\c:\nbtbbb.exec:\nbtbbb.exe82⤵PID:2832
-
\??\c:\bnbbhb.exec:\bnbbhb.exe83⤵PID:2668
-
\??\c:\vvdpp.exec:\vvdpp.exe84⤵PID:2532
-
\??\c:\1rxllxr.exec:\1rxllxr.exe85⤵PID:2324
-
\??\c:\nnnhth.exec:\nnnhth.exe86⤵PID:2576
-
\??\c:\1hbnnt.exec:\1hbnnt.exe87⤵PID:2260
-
\??\c:\dvpdj.exec:\dvpdj.exe88⤵PID:1448
-
\??\c:\vvpjv.exec:\vvpjv.exe89⤵PID:604
-
\??\c:\flflrfr.exec:\flflrfr.exe90⤵PID:1276
-
\??\c:\ttntth.exec:\ttntth.exe91⤵PID:1944
-
\??\c:\vjdvv.exec:\vjdvv.exe92⤵PID:1956
-
\??\c:\1vpvd.exec:\1vpvd.exe93⤵PID:528
-
\??\c:\llxlfxf.exec:\llxlfxf.exe94⤵PID:1744
-
\??\c:\1bttbb.exec:\1bttbb.exe95⤵PID:2496
-
\??\c:\1pvdd.exec:\1pvdd.exe96⤵PID:2296
-
\??\c:\9vdpp.exec:\9vdpp.exe97⤵PID:1860
-
\??\c:\1xflrlx.exec:\1xflrlx.exe98⤵PID:2520
-
\??\c:\bhhnnn.exec:\bhhnnn.exe99⤵PID:2860
-
\??\c:\djvdj.exec:\djvdj.exe100⤵PID:2804
-
\??\c:\ppddd.exec:\ppddd.exe101⤵PID:2708
-
\??\c:\9nhttt.exec:\9nhttt.exe102⤵PID:2236
-
\??\c:\btnttb.exec:\btnttb.exe103⤵PID:680
-
\??\c:\vdjdd.exec:\vdjdd.exe104⤵
- System Location Discovery: System Language Discovery
PID:1680 -
\??\c:\1rxfxfr.exec:\1rxfxfr.exe105⤵PID:1948
-
\??\c:\tntbnb.exec:\tntbnb.exe106⤵PID:1628
-
\??\c:\bhthbh.exec:\bhthbh.exe107⤵PID:996
-
\??\c:\jjjvj.exec:\jjjvj.exe108⤵PID:2172
-
\??\c:\3rrxlrr.exec:\3rrxlrr.exe109⤵PID:2288
-
\??\c:\rflxfxx.exec:\rflxfxx.exe110⤵PID:2088
-
\??\c:\nnhtnh.exec:\nnhtnh.exe111⤵PID:876
-
\??\c:\3jddv.exec:\3jddv.exe112⤵PID:2456
-
\??\c:\1jjpj.exec:\1jjpj.exe113⤵PID:2464
-
\??\c:\rxxflrf.exec:\rxxflrf.exe114⤵PID:2064
-
\??\c:\nthbth.exec:\nthbth.exe115⤵PID:372
-
\??\c:\bthnhn.exec:\bthnhn.exe116⤵PID:1544
-
\??\c:\jjdvd.exec:\jjdvd.exe117⤵PID:2480
-
\??\c:\dddpj.exec:\dddpj.exe118⤵PID:2124
-
\??\c:\xfllrrx.exec:\xfllrrx.exe119⤵PID:2092
-
\??\c:\btthnn.exec:\btthnn.exe120⤵PID:2968
-
\??\c:\vppvp.exec:\vppvp.exe121⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-