Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 21:06
Behavioral task
behavioral1
Sample
2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe
-
Size
96KB
-
MD5
7a4194279f68230e8f4427f745592fb3
-
SHA1
9179e48e2f4073cfa54971ded13b3778d153dd2e
-
SHA256
2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13
-
SHA512
2cf3549320556409c16f64382bcd3db9af470af824b453eba7bcfd31f42501fa2e13a4bea4e8183f07bffc482150763c25ec2a137e076fd04f05e235625bd394
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgf:8cm4FmowdHoSgWrXUgf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral1/memory/1276-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-15-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/860-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-83-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2164-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/672-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-130-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2812-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-161-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1732-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-222-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1528-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-374-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2024-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/672-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-430-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2508-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-481-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2200-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-516-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1944-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-717-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1624-730-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2756-865-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1928-891-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2628-897-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2516-908-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2024-914-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2964-931-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/1612-947-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/780-970-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2044-1009-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2276-7876-0x00000000777F0000-0x000000007790F000-memory.dmp family_blackmoon behavioral1/memory/2276-8381-0x0000000077910000-0x0000000077A0A000-memory.dmp family_blackmoon behavioral1/memory/2276-9640-0x00000000777F0000-0x000000007790F000-memory.dmp family_blackmoon behavioral1/memory/2276-13894-0x0000000077910000-0x0000000077A0A000-memory.dmp family_blackmoon behavioral1/memory/2276-16525-0x00000000777F0000-0x000000007790F000-memory.dmp family_blackmoon behavioral1/memory/2276-21182-0x00000000777F0000-0x000000007790F000-memory.dmp family_blackmoon behavioral1/memory/2276-24174-0x0000000077910000-0x0000000077A0A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1276 htbhnt.exe 2428 vvvjv.exe 2800 ppddp.exe 2752 bhthnt.exe 2884 vvjjd.exe 2720 ppddj.exe 1932 3rlrxxf.exe 2956 3bthnt.exe 2808 bthhhh.exe 2664 9ppvj.exe 2164 fxxfffl.exe 2156 nnbthh.exe 672 3dvjp.exe 2444 7lfrrxf.exe 2812 5rllxxl.exe 3008 5nhthn.exe 2976 hbnbtt.exe 2708 jjvjp.exe 1148 dvjpj.exe 1700 ffxxflf.exe 2568 7nbnnt.exe 1732 vpdjd.exe 2564 jdpdd.exe 704 1lflflx.exe 1068 3nhntb.exe 292 9tthnt.exe 1812 vvjvd.exe 1528 llfxxlx.exe 1696 5bntbh.exe 2456 hbbhnb.exe 840 pjvpp.exe 2224 7rllrlx.exe 2284 hhhttn.exe 2332 nnbnbn.exe 884 pjdpp.exe 2340 dvpvv.exe 1292 ffrxlxl.exe 1276 bbntbh.exe 2396 bbhbtt.exe 2528 ppjpj.exe 2180 jjddp.exe 2944 5lxfrrl.exe 2756 7xffrrf.exe 2912 3bhnbh.exe 2744 bthnnt.exe 2096 jjdvv.exe 2920 vpvdd.exe 2036 xrrxllx.exe 2660 xxflrlr.exe 2616 nhbbhh.exe 2628 nhbbhn.exe 2664 1pjjp.exe 2516 3vpvd.exe 1032 rrfrlrf.exe 2024 ffxlfff.exe 672 tnbnbb.exe 2932 thntbb.exe 3000 7vjjp.exe 3020 rfrflll.exe 2376 xfrrxxr.exe 1612 xxlflrr.exe 2708 thnbbt.exe 304 7dvdj.exe 1148 vpvpp.exe -
resource yara_rule behavioral1/memory/860-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016fdf-18.dat upx behavioral1/memory/1276-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-22-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1276-15-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00090000000120f1-9.dat upx behavioral1/memory/860-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000171a8-26.dat upx behavioral1/memory/2800-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173a9-34.dat upx behavioral1/memory/2884-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017492-42.dat upx behavioral1/files/0x00070000000174cc-49.dat upx behavioral1/memory/2720-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000018676-58.dat upx behavioral1/memory/2720-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000186e4-68.dat upx behavioral1/memory/1932-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-65-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2808-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019350-76.dat upx behavioral1/memory/2956-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b4-84.dat upx behavioral1/files/0x00050000000193c2-91.dat upx behavioral1/files/0x00050000000193e1-98.dat upx behavioral1/memory/2164-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941e-106.dat upx behavioral1/memory/672-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019427-113.dat upx behavioral1/files/0x0005000000019431-121.dat upx behavioral1/files/0x0005000000019441-128.dat upx behavioral1/memory/3008-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001944f-140.dat upx behavioral1/memory/3008-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019461-148.dat upx behavioral1/memory/2708-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950c-154.dat upx behavioral1/files/0x0005000000019582-162.dat upx behavioral1/files/0x00050000000195c5-169.dat upx behavioral1/files/0x0005000000019609-176.dat upx behavioral1/files/0x000500000001960b-184.dat upx behavioral1/memory/1732-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960d-191.dat upx behavioral1/memory/704-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960f-201.dat upx behavioral1/files/0x0005000000019611-207.dat upx behavioral1/memory/292-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019613-215.dat upx behavioral1/files/0x0005000000019615-223.dat upx behavioral1/memory/1528-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019617-232.dat upx behavioral1/files/0x0005000000019619-238.dat upx behavioral1/memory/2456-242-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001961b-246.dat upx behavioral1/memory/840-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d68-255.dat upx behavioral1/memory/884-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-320-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 1276 860 2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe 30 PID 860 wrote to memory of 1276 860 2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe 30 PID 860 wrote to memory of 1276 860 2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe 30 PID 860 wrote to memory of 1276 860 2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe 30 PID 1276 wrote to memory of 2428 1276 htbhnt.exe 31 PID 1276 wrote to memory of 2428 1276 htbhnt.exe 31 PID 1276 wrote to memory of 2428 1276 htbhnt.exe 31 PID 1276 wrote to memory of 2428 1276 htbhnt.exe 31 PID 2428 wrote to memory of 2800 2428 vvvjv.exe 32 PID 2428 wrote to memory of 2800 2428 vvvjv.exe 32 PID 2428 wrote to memory of 2800 2428 vvvjv.exe 32 PID 2428 wrote to memory of 2800 2428 vvvjv.exe 32 PID 2800 wrote to memory of 2752 2800 ppddp.exe 33 PID 2800 wrote to memory of 2752 2800 ppddp.exe 33 PID 2800 wrote to memory of 2752 2800 ppddp.exe 33 PID 2800 wrote to memory of 2752 2800 ppddp.exe 33 PID 2752 wrote to memory of 2884 2752 bhthnt.exe 34 PID 2752 wrote to memory of 2884 2752 bhthnt.exe 34 PID 2752 wrote to memory of 2884 2752 bhthnt.exe 34 PID 2752 wrote to memory of 2884 2752 bhthnt.exe 34 PID 2884 wrote to memory of 2720 2884 vvjjd.exe 35 PID 2884 wrote to memory of 2720 2884 vvjjd.exe 35 PID 2884 wrote to memory of 2720 2884 vvjjd.exe 35 PID 2884 wrote to memory of 2720 2884 vvjjd.exe 35 PID 2720 wrote to memory of 1932 2720 ppddj.exe 36 PID 2720 wrote to memory of 1932 2720 ppddj.exe 36 PID 2720 wrote to memory of 1932 2720 ppddj.exe 36 PID 2720 wrote to memory of 1932 2720 ppddj.exe 36 PID 1932 wrote to memory of 2956 1932 3rlrxxf.exe 37 PID 1932 wrote to memory of 2956 1932 3rlrxxf.exe 37 PID 1932 wrote to memory of 2956 1932 3rlrxxf.exe 37 PID 1932 wrote to memory of 2956 1932 3rlrxxf.exe 37 PID 2956 wrote to memory of 2808 2956 3bthnt.exe 38 PID 2956 wrote to memory of 2808 2956 3bthnt.exe 38 PID 2956 wrote to memory of 2808 2956 3bthnt.exe 38 PID 2956 wrote to memory of 2808 2956 3bthnt.exe 38 PID 2808 wrote to memory of 2664 2808 bthhhh.exe 39 PID 2808 wrote to memory of 2664 2808 bthhhh.exe 39 PID 2808 wrote to memory of 2664 2808 bthhhh.exe 39 PID 2808 wrote to memory of 2664 2808 bthhhh.exe 39 PID 2664 wrote to memory of 2164 2664 9ppvj.exe 40 PID 2664 wrote to memory of 2164 2664 9ppvj.exe 40 PID 2664 wrote to memory of 2164 2664 9ppvj.exe 40 PID 2664 wrote to memory of 2164 2664 9ppvj.exe 40 PID 2164 wrote to memory of 2156 2164 fxxfffl.exe 41 PID 2164 wrote to memory of 2156 2164 fxxfffl.exe 41 PID 2164 wrote to memory of 2156 2164 fxxfffl.exe 41 PID 2164 wrote to memory of 2156 2164 fxxfffl.exe 41 PID 2156 wrote to memory of 672 2156 nnbthh.exe 42 PID 2156 wrote to memory of 672 2156 nnbthh.exe 42 PID 2156 wrote to memory of 672 2156 nnbthh.exe 42 PID 2156 wrote to memory of 672 2156 nnbthh.exe 42 PID 672 wrote to memory of 2444 672 3dvjp.exe 43 PID 672 wrote to memory of 2444 672 3dvjp.exe 43 PID 672 wrote to memory of 2444 672 3dvjp.exe 43 PID 672 wrote to memory of 2444 672 3dvjp.exe 43 PID 2444 wrote to memory of 2812 2444 7lfrrxf.exe 44 PID 2444 wrote to memory of 2812 2444 7lfrrxf.exe 44 PID 2444 wrote to memory of 2812 2444 7lfrrxf.exe 44 PID 2444 wrote to memory of 2812 2444 7lfrrxf.exe 44 PID 2812 wrote to memory of 3008 2812 5rllxxl.exe 45 PID 2812 wrote to memory of 3008 2812 5rllxxl.exe 45 PID 2812 wrote to memory of 3008 2812 5rllxxl.exe 45 PID 2812 wrote to memory of 3008 2812 5rllxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe"C:\Users\Admin\AppData\Local\Temp\2efa616d3b50db4693213e81277ac82f4e8629c657d5971a5781d99ea4d6cd13.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\htbhnt.exec:\htbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\vvvjv.exec:\vvvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\ppddp.exec:\ppddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bhthnt.exec:\bhthnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vvjjd.exec:\vvjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ppddj.exec:\ppddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3rlrxxf.exec:\3rlrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\3bthnt.exec:\3bthnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bthhhh.exec:\bthhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9ppvj.exec:\9ppvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fxxfffl.exec:\fxxfffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\nnbthh.exec:\nnbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\3dvjp.exec:\3dvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\7lfrrxf.exec:\7lfrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5rllxxl.exec:\5rllxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\5nhthn.exec:\5nhthn.exe17⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hbnbtt.exec:\hbnbtt.exe18⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jjvjp.exec:\jjvjp.exe19⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvjpj.exec:\dvjpj.exe20⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ffxxflf.exec:\ffxxflf.exe21⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7nbnnt.exec:\7nbnnt.exe22⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vpdjd.exec:\vpdjd.exe23⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jdpdd.exec:\jdpdd.exe24⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1lflflx.exec:\1lflflx.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\3nhntb.exec:\3nhntb.exe26⤵
- Executes dropped EXE
PID:1068 -
\??\c:\9tthnt.exec:\9tthnt.exe27⤵
- Executes dropped EXE
PID:292 -
\??\c:\vvjvd.exec:\vvjvd.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\llfxxlx.exec:\llfxxlx.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5bntbh.exec:\5bntbh.exe30⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hbbhnb.exec:\hbbhnb.exe31⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pjvpp.exec:\pjvpp.exe32⤵
- Executes dropped EXE
PID:840 -
\??\c:\7rllrlx.exec:\7rllrlx.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hhhttn.exec:\hhhttn.exe34⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nnbnbn.exec:\nnbnbn.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pjdpp.exec:\pjdpp.exe36⤵
- Executes dropped EXE
PID:884 -
\??\c:\dvpvv.exec:\dvpvv.exe37⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ffrxlxl.exec:\ffrxlxl.exe38⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bbntbh.exec:\bbntbh.exe39⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bbhbtt.exec:\bbhbtt.exe40⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ppjpj.exec:\ppjpj.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jjddp.exec:\jjddp.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5lxfrrl.exec:\5lxfrrl.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7xffrrf.exec:\7xffrrf.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3bhnbh.exec:\3bhnbh.exe45⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bthnnt.exec:\bthnnt.exe46⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjdvv.exec:\jjdvv.exe47⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vpvdd.exec:\vpvdd.exe48⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrrxllx.exec:\xrrxllx.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xxflrlr.exec:\xxflrlr.exe50⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhbbhh.exec:\nhbbhh.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nhbbhn.exec:\nhbbhn.exe52⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1pjjp.exec:\1pjjp.exe53⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3vpvd.exec:\3vpvd.exe54⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe55⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ffxlfff.exec:\ffxlfff.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnbnbb.exec:\tnbnbb.exe57⤵
- Executes dropped EXE
PID:672 -
\??\c:\thntbb.exec:\thntbb.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7vjjp.exec:\7vjjp.exe59⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rfrflll.exec:\rfrflll.exe60⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xfrrxxr.exec:\xfrrxxr.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xxlflrr.exec:\xxlflrr.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\thnbbt.exec:\thnbbt.exe63⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7dvdj.exec:\7dvdj.exe64⤵
- Executes dropped EXE
PID:304 -
\??\c:\vpvpp.exec:\vpvpp.exe65⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jdpvd.exec:\jdpvd.exe66⤵PID:532
-
\??\c:\lxllfff.exec:\lxllfff.exe67⤵PID:2508
-
\??\c:\btthnb.exec:\btthnb.exe68⤵PID:972
-
\??\c:\1hhntt.exec:\1hhntt.exe69⤵PID:1756
-
\??\c:\dpdpd.exec:\dpdpd.exe70⤵PID:2592
-
\??\c:\xflxxll.exec:\xflxxll.exe71⤵PID:2176
-
\??\c:\5xrfrxl.exec:\5xrfrxl.exe72⤵PID:2304
-
\??\c:\lffrxll.exec:\lffrxll.exe73⤵PID:2012
-
\??\c:\nhtbbh.exec:\nhtbbh.exe74⤵PID:2200
-
\??\c:\dvppp.exec:\dvppp.exe75⤵PID:1140
-
\??\c:\vvdvd.exec:\vvdvd.exe76⤵PID:880
-
\??\c:\rflrxrr.exec:\rflrxrr.exe77⤵PID:956
-
\??\c:\lfxflxf.exec:\lfxflxf.exe78⤵PID:1816
-
\??\c:\tnbnbb.exec:\tnbnbb.exe79⤵PID:2148
-
\??\c:\nhthnt.exec:\nhthnt.exe80⤵PID:1944
-
\??\c:\pppvd.exec:\pppvd.exe81⤵PID:692
-
\??\c:\ppdjp.exec:\ppdjp.exe82⤵PID:2124
-
\??\c:\3fxxxxr.exec:\3fxxxxr.exe83⤵PID:1028
-
\??\c:\lfflrxl.exec:\lfflrxl.exe84⤵PID:2204
-
\??\c:\7nhhnn.exec:\7nhhnn.exe85⤵PID:2536
-
\??\c:\hhthtb.exec:\hhthtb.exe86⤵PID:2380
-
\??\c:\7vppv.exec:\7vppv.exe87⤵PID:2016
-
\??\c:\jddjp.exec:\jddjp.exe88⤵PID:2428
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe89⤵PID:1412
-
\??\c:\rlrfffr.exec:\rlrfffr.exe90⤵PID:2460
-
\??\c:\7btntb.exec:\7btntb.exe91⤵PID:2868
-
\??\c:\9tnhtb.exec:\9tnhtb.exe92⤵PID:2872
-
\??\c:\vjjjj.exec:\vjjjj.exe93⤵PID:2104
-
\??\c:\9vvjv.exec:\9vvjv.exe94⤵PID:2716
-
\??\c:\xrlxxxf.exec:\xrlxxxf.exe95⤵PID:2804
-
\??\c:\9rflrrl.exec:\9rflrrl.exe96⤵PID:2904
-
\??\c:\hthnhn.exec:\hthnhn.exe97⤵PID:2648
-
\??\c:\btnbnb.exec:\btnbnb.exe98⤵PID:2776
-
\??\c:\jjddj.exec:\jjddj.exe99⤵PID:2956
-
\??\c:\jjjdj.exec:\jjjdj.exe100⤵PID:2116
-
\??\c:\xrxxflr.exec:\xrxxflr.exe101⤵PID:2632
-
\??\c:\xrxllrf.exec:\xrxllrf.exe102⤵PID:2664
-
\??\c:\ttntbb.exec:\ttntbb.exe103⤵PID:1800
-
\??\c:\btbhbb.exec:\btbhbb.exe104⤵PID:1916
-
\??\c:\vpvjv.exec:\vpvjv.exe105⤵PID:2796
-
\??\c:\vpjpd.exec:\vpjpd.exe106⤵PID:2816
-
\??\c:\llxxxxf.exec:\llxxxxf.exe107⤵PID:2964
-
\??\c:\lflxlrx.exec:\lflxlrx.exe108⤵PID:1676
-
\??\c:\bnbbbh.exec:\bnbbbh.exe109⤵PID:2844
-
\??\c:\5pjdj.exec:\5pjdj.exe110⤵PID:1736
-
\??\c:\jjvjd.exec:\jjvjd.exe111⤵PID:1660
-
\??\c:\vpjdj.exec:\vpjdj.exe112⤵PID:1824
-
\??\c:\fxrfffr.exec:\fxrfffr.exe113⤵PID:1600
-
\??\c:\1rffrlx.exec:\1rffrlx.exe114⤵PID:1148
-
\??\c:\3nbnht.exec:\3nbnht.exe115⤵PID:992
-
\??\c:\btbttb.exec:\btbttb.exe116⤵PID:1624
-
\??\c:\vvvdp.exec:\vvvdp.exe117⤵PID:2088
-
\??\c:\5pjdd.exec:\5pjdd.exe118⤵PID:2596
-
\??\c:\3llfrrf.exec:\3llfrrf.exe119⤵PID:2056
-
\??\c:\hhtnbb.exec:\hhtnbb.exe120⤵PID:3064
-
\??\c:\nhbbhn.exec:\nhbbhn.exe121⤵PID:1704
-
\??\c:\3jdpv.exec:\3jdpv.exe122⤵PID:292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-