Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 03:07
Behavioral task
behavioral1
Sample
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe
-
Size
331KB
-
MD5
958137e15ddb683bdab8ef037d82db90
-
SHA1
0ae6dd802f6b7e43f069b94c3d3894f5f5d3896b
-
SHA256
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420
-
SHA512
938fe091f9a99a6429b75a3dbab82d71a37cd38fe83c0985ec1fb8b09629c11652ac5be42c964197ba76e2f63cbe53f9d90b3ed45840135121656d7bf39468bf
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tB:94wFHoStJdSjylh2b77BoTMA9gX59sT5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2668-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-30-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2840-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-47-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2724-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1160-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/592-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-373-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2700-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-445-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2104-537-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-696-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1356-719-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/772-718-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3020-7047-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/3020-7048-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_blackmoon behavioral1/memory/3020-8541-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/3020-11325-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/3020-15204-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/3020-17981-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/3020-19108-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2704 9flrxlr.exe 2784 btntht.exe 2304 nhnbhh.exe 2840 xrffffl.exe 2724 tnbhhn.exe 2552 rlrxfxl.exe 1080 btbhnn.exe 2248 7jppj.exe 1112 fxfrlrl.exe 2936 httnbt.exe 3048 dpppp.exe 2236 bttbhn.exe 2428 dpdpv.exe 1104 5rfffff.exe 2036 nbhhnn.exe 1100 vpddd.exe 1064 xrfrrrr.exe 2176 jjpvd.exe 1760 rflffrx.exe 2376 btbbhn.exe 2212 7pddj.exe 1792 xxlxffl.exe 1252 ttttbh.exe 1160 frxfllr.exe 836 xrflllr.exe 1560 5pjjv.exe 1968 xxxfrlx.exe 2336 pdvpp.exe 2320 7jvvj.exe 2148 thbtbb.exe 2240 dpdjp.exe 2476 xrfxxfr.exe 900 7bnnnh.exe 1888 vpdvv.exe 3020 xrlrlrx.exe 2764 nbnhtb.exe 1600 5rfllxx.exe 2684 htbbbb.exe 2836 1thbbb.exe 2584 1vppv.exe 2828 frfxxrx.exe 2556 fxlflrr.exe 2588 bnbttt.exe 592 jvjjp.exe 2224 3pddj.exe 2248 frfxlfl.exe 1068 5hnnnn.exe 2916 5btthh.exe 2744 ppddp.exe 1800 9rfrllx.exe 2912 fxxxlrx.exe 2236 bntnnh.exe 304 ppdpv.exe 2812 jvvjd.exe 2016 rfllfff.exe 2036 tthtbb.exe 588 ttbtbt.exe 1580 vpjpj.exe 1584 jdvdd.exe 556 frrxxxx.exe 2536 bhntnb.exe 2700 vvjpv.exe 2232 vpvpv.exe 1880 1frrfff.exe -
resource yara_rule behavioral1/memory/2668-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001227f-7.dat upx behavioral1/memory/2668-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c4a-16.dat upx behavioral1/files/0x0007000000016c9d-23.dat upx behavioral1/memory/2784-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2304-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cc8-31.dat upx behavioral1/files/0x0007000000016cec-40.dat upx behavioral1/memory/2840-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d06-48.dat upx behavioral1/memory/2552-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d0e-57.dat upx behavioral1/files/0x0006000000017079-64.dat upx behavioral1/memory/1080-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000171a8-73.dat upx behavioral1/memory/2248-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173a7-80.dat upx behavioral1/memory/2936-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1112-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173a9-89.dat upx behavioral1/memory/2236-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017488-96.dat upx behavioral1/files/0x0006000000017492-106.dat upx behavioral1/memory/2236-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174cc-114.dat upx behavioral1/files/0x000d000000018676-123.dat upx behavioral1/memory/1104-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2036-130-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x0005000000018683-131.dat upx behavioral1/memory/1100-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2036-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186e4-141.dat upx behavioral1/memory/1100-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ea-148.dat upx behavioral1/files/0x00050000000186ee-155.dat upx behavioral1/files/0x00050000000186fd-162.dat upx behavioral1/memory/2376-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1760-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018728-172.dat upx behavioral1/memory/2376-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000016814-180.dat upx behavioral1/files/0x000500000001873d-187.dat upx behavioral1/memory/1792-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018784-196.dat upx behavioral1/memory/1160-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1252-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878f-206.dat upx behavioral1/memory/1160-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a5-213.dat upx behavioral1/files/0x0006000000019023-221.dat upx behavioral1/memory/1968-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-230.dat upx behavioral1/memory/2336-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-238.dat upx behavioral1/files/0x0005000000019282-246.dat upx behavioral1/files/0x0005000000019334-252.dat upx behavioral1/files/0x0005000000019350-259.dat upx behavioral1/memory/2476-266-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2704 2668 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 31 PID 2668 wrote to memory of 2704 2668 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 31 PID 2668 wrote to memory of 2704 2668 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 31 PID 2668 wrote to memory of 2704 2668 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 31 PID 2704 wrote to memory of 2784 2704 9flrxlr.exe 32 PID 2704 wrote to memory of 2784 2704 9flrxlr.exe 32 PID 2704 wrote to memory of 2784 2704 9flrxlr.exe 32 PID 2704 wrote to memory of 2784 2704 9flrxlr.exe 32 PID 2784 wrote to memory of 2304 2784 btntht.exe 33 PID 2784 wrote to memory of 2304 2784 btntht.exe 33 PID 2784 wrote to memory of 2304 2784 btntht.exe 33 PID 2784 wrote to memory of 2304 2784 btntht.exe 33 PID 2304 wrote to memory of 2840 2304 nhnbhh.exe 34 PID 2304 wrote to memory of 2840 2304 nhnbhh.exe 34 PID 2304 wrote to memory of 2840 2304 nhnbhh.exe 34 PID 2304 wrote to memory of 2840 2304 nhnbhh.exe 34 PID 2840 wrote to memory of 2724 2840 xrffffl.exe 35 PID 2840 wrote to memory of 2724 2840 xrffffl.exe 35 PID 2840 wrote to memory of 2724 2840 xrffffl.exe 35 PID 2840 wrote to memory of 2724 2840 xrffffl.exe 35 PID 2724 wrote to memory of 2552 2724 tnbhhn.exe 36 PID 2724 wrote to memory of 2552 2724 tnbhhn.exe 36 PID 2724 wrote to memory of 2552 2724 tnbhhn.exe 36 PID 2724 wrote to memory of 2552 2724 tnbhhn.exe 36 PID 2552 wrote to memory of 1080 2552 rlrxfxl.exe 37 PID 2552 wrote to memory of 1080 2552 rlrxfxl.exe 37 PID 2552 wrote to memory of 1080 2552 rlrxfxl.exe 37 PID 2552 wrote to memory of 1080 2552 rlrxfxl.exe 37 PID 1080 wrote to memory of 2248 1080 btbhnn.exe 38 PID 1080 wrote to memory of 2248 1080 btbhnn.exe 38 PID 1080 wrote to memory of 2248 1080 btbhnn.exe 38 PID 1080 wrote to memory of 2248 1080 btbhnn.exe 38 PID 2248 wrote to memory of 1112 2248 7jppj.exe 39 PID 2248 wrote to memory of 1112 2248 7jppj.exe 39 PID 2248 wrote to memory of 1112 2248 7jppj.exe 39 PID 2248 wrote to memory of 1112 2248 7jppj.exe 39 PID 1112 wrote to memory of 2936 1112 fxfrlrl.exe 40 PID 1112 wrote to memory of 2936 1112 fxfrlrl.exe 40 PID 1112 wrote to memory of 2936 1112 fxfrlrl.exe 40 PID 1112 wrote to memory of 2936 1112 fxfrlrl.exe 40 PID 2936 wrote to memory of 3048 2936 httnbt.exe 41 PID 2936 wrote to memory of 3048 2936 httnbt.exe 41 PID 2936 wrote to memory of 3048 2936 httnbt.exe 41 PID 2936 wrote to memory of 3048 2936 httnbt.exe 41 PID 3048 wrote to memory of 2236 3048 dpppp.exe 42 PID 3048 wrote to memory of 2236 3048 dpppp.exe 42 PID 3048 wrote to memory of 2236 3048 dpppp.exe 42 PID 3048 wrote to memory of 2236 3048 dpppp.exe 42 PID 2236 wrote to memory of 2428 2236 bttbhn.exe 43 PID 2236 wrote to memory of 2428 2236 bttbhn.exe 43 PID 2236 wrote to memory of 2428 2236 bttbhn.exe 43 PID 2236 wrote to memory of 2428 2236 bttbhn.exe 43 PID 2428 wrote to memory of 1104 2428 dpdpv.exe 44 PID 2428 wrote to memory of 1104 2428 dpdpv.exe 44 PID 2428 wrote to memory of 1104 2428 dpdpv.exe 44 PID 2428 wrote to memory of 1104 2428 dpdpv.exe 44 PID 1104 wrote to memory of 2036 1104 5rfffff.exe 45 PID 1104 wrote to memory of 2036 1104 5rfffff.exe 45 PID 1104 wrote to memory of 2036 1104 5rfffff.exe 45 PID 1104 wrote to memory of 2036 1104 5rfffff.exe 45 PID 2036 wrote to memory of 1100 2036 nbhhnn.exe 46 PID 2036 wrote to memory of 1100 2036 nbhhnn.exe 46 PID 2036 wrote to memory of 1100 2036 nbhhnn.exe 46 PID 2036 wrote to memory of 1100 2036 nbhhnn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe"C:\Users\Admin\AppData\Local\Temp\a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\9flrxlr.exec:\9flrxlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\btntht.exec:\btntht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nhnbhh.exec:\nhnbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xrffffl.exec:\xrffffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\tnbhhn.exec:\tnbhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlrxfxl.exec:\rlrxfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\btbhnn.exec:\btbhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\7jppj.exec:\7jppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\httnbt.exec:\httnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\dpppp.exec:\dpppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bttbhn.exec:\bttbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\dpdpv.exec:\dpdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\5rfffff.exec:\5rfffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\nbhhnn.exec:\nbhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\vpddd.exec:\vpddd.exe17⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe18⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jjpvd.exec:\jjpvd.exe19⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rflffrx.exec:\rflffrx.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\btbbhn.exec:\btbbhn.exe21⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7pddj.exec:\7pddj.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxlxffl.exec:\xxlxffl.exe23⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ttttbh.exec:\ttttbh.exe24⤵
- Executes dropped EXE
PID:1252 -
\??\c:\frxfllr.exec:\frxfllr.exe25⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xrflllr.exec:\xrflllr.exe26⤵
- Executes dropped EXE
PID:836 -
\??\c:\5pjjv.exec:\5pjjv.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xxxfrlx.exec:\xxxfrlx.exe28⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pdvpp.exec:\pdvpp.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7jvvj.exec:\7jvvj.exe30⤵
- Executes dropped EXE
PID:2320 -
\??\c:\thbtbb.exec:\thbtbb.exe31⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dpdjp.exec:\dpdjp.exe32⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xrfxxfr.exec:\xrfxxfr.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7bnnnh.exec:\7bnnnh.exe34⤵
- Executes dropped EXE
PID:900 -
\??\c:\vpdvv.exec:\vpdvv.exe35⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xrlrlrx.exec:\xrlrlrx.exe36⤵
- Executes dropped EXE
PID:3020 -
\??\c:\httnnb.exec:\httnnb.exe37⤵PID:2772
-
\??\c:\nbnhtb.exec:\nbnhtb.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5rfllxx.exec:\5rfllxx.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\htbbbb.exec:\htbbbb.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1thbbb.exec:\1thbbb.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1vppv.exec:\1vppv.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\frfxxrx.exec:\frfxxrx.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fxlflrr.exec:\fxlflrr.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bnbttt.exec:\bnbttt.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jvjjp.exec:\jvjjp.exe46⤵
- Executes dropped EXE
PID:592 -
\??\c:\3pddj.exec:\3pddj.exe47⤵
- Executes dropped EXE
PID:2224 -
\??\c:\frfxlfl.exec:\frfxlfl.exe48⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5hnnnn.exec:\5hnnnn.exe49⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5btthh.exec:\5btthh.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ppddp.exec:\ppddp.exe51⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9rfrllx.exec:\9rfrllx.exe52⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxxxlrx.exec:\fxxxlrx.exe53⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bntnnh.exec:\bntnnh.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ppdpv.exec:\ppdpv.exe55⤵
- Executes dropped EXE
PID:304 -
\??\c:\jvvjd.exec:\jvvjd.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rfllfff.exec:\rfllfff.exe57⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tthtbb.exec:\tthtbb.exe58⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ttbtbt.exec:\ttbtbt.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\vpjpj.exec:\vpjpj.exe60⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jdvdd.exec:\jdvdd.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\frrxxxx.exec:\frrxxxx.exe62⤵
- Executes dropped EXE
PID:556 -
\??\c:\bhntnb.exec:\bhntnb.exe63⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vvjpv.exec:\vvjpv.exe64⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpvpv.exec:\vpvpv.exe65⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1frrfff.exec:\1frrfff.exe66⤵
- Executes dropped EXE
PID:1880 -
\??\c:\fxrrfxf.exec:\fxrrfxf.exe67⤵PID:1488
-
\??\c:\nhtbnn.exec:\nhtbnn.exe68⤵PID:2140
-
\??\c:\vpdvp.exec:\vpdvp.exe69⤵PID:1628
-
\??\c:\3pjpj.exec:\3pjpj.exe70⤵PID:700
-
\??\c:\xlrxxxf.exec:\xlrxxxf.exe71⤵PID:2532
-
\??\c:\bntthb.exec:\bntthb.exe72⤵PID:2024
-
\??\c:\thbtnn.exec:\thbtnn.exe73⤵PID:640
-
\??\c:\vvjjp.exec:\vvjjp.exe74⤵PID:916
-
\??\c:\5xrfllr.exec:\5xrfllr.exe75⤵PID:2064
-
\??\c:\3lfllrx.exec:\3lfllrx.exe76⤵PID:3024
-
\??\c:\7tbttn.exec:\7tbttn.exe77⤵PID:2340
-
\??\c:\3nhhhh.exec:\3nhhhh.exe78⤵PID:1008
-
\??\c:\9dvvd.exec:\9dvvd.exe79⤵PID:712
-
\??\c:\lxxrrlr.exec:\lxxrrlr.exe80⤵PID:2240
-
\??\c:\1rxxlxf.exec:\1rxxlxf.exe81⤵PID:1512
-
\??\c:\7hbbhn.exec:\7hbbhn.exe82⤵PID:2856
-
\??\c:\jvddd.exec:\jvddd.exe83⤵PID:2104
-
\??\c:\9jdjp.exec:\9jdjp.exe84⤵PID:3020
-
\??\c:\9lxlllx.exec:\9lxlllx.exe85⤵PID:1576
-
\??\c:\5bhthh.exec:\5bhthh.exe86⤵PID:2824
-
\??\c:\jpvpv.exec:\jpvpv.exe87⤵PID:2676
-
\??\c:\jdvjp.exec:\jdvjp.exe88⤵PID:2684
-
\??\c:\rfrrrll.exec:\rfrrrll.exe89⤵PID:2836
-
\??\c:\btbhnh.exec:\btbhnh.exe90⤵PID:2844
-
\??\c:\dvpjv.exec:\dvpjv.exe91⤵PID:2600
-
\??\c:\dpjjj.exec:\dpjjj.exe92⤵PID:2636
-
\??\c:\frffffl.exec:\frffffl.exe93⤵PID:2620
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe94⤵PID:3060
-
\??\c:\hthhbb.exec:\hthhbb.exe95⤵PID:2400
-
\??\c:\tnhnhh.exec:\tnhnhh.exe96⤵PID:2248
-
\??\c:\7jpjj.exec:\7jpjj.exe97⤵PID:2940
-
\??\c:\7lxxlll.exec:\7lxxlll.exe98⤵PID:2916
-
\??\c:\frxrflr.exec:\frxrflr.exe99⤵PID:2124
-
\??\c:\1ttbhn.exec:\1ttbhn.exe100⤵PID:2144
-
\??\c:\dpvvd.exec:\dpvvd.exe101⤵PID:2912
-
\??\c:\vjjjp.exec:\vjjjp.exe102⤵PID:1660
-
\??\c:\frxxffl.exec:\frxxffl.exe103⤵PID:304
-
\??\c:\9lrllfr.exec:\9lrllfr.exe104⤵PID:876
-
\??\c:\thnnnn.exec:\thnnnn.exe105⤵PID:2044
-
\??\c:\pjddj.exec:\pjddj.exe106⤵PID:2888
-
\??\c:\vjpjd.exec:\vjpjd.exe107⤵PID:1100
-
\??\c:\rlllxxx.exec:\rlllxxx.exe108⤵PID:1992
-
\??\c:\1frfllr.exec:\1frfllr.exe109⤵PID:1584
-
\??\c:\nbhbhb.exec:\nbhbhb.exe110⤵PID:2792
-
\??\c:\pjddd.exec:\pjddd.exe111⤵PID:1632
-
\??\c:\vjvjj.exec:\vjvjj.exe112⤵PID:772
-
\??\c:\lxfffxx.exec:\lxfffxx.exe113⤵PID:2204
-
\??\c:\frlxxfr.exec:\frlxxfr.exe114⤵PID:1792
-
\??\c:\tntbnn.exec:\tntbnn.exe115⤵PID:1416
-
\??\c:\pdjpv.exec:\pdjpv.exe116⤵PID:1356
-
\??\c:\pjjdd.exec:\pjjdd.exe117⤵PID:1252
-
\??\c:\rrllrxl.exec:\rrllrxl.exe118⤵PID:2272
-
\??\c:\bthbhn.exec:\bthbhn.exe119⤵PID:2472
-
\??\c:\tnbntb.exec:\tnbntb.exe120⤵PID:784
-
\??\c:\jdjdd.exec:\jdjdd.exe121⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-