Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 04:00
Behavioral task
behavioral1
Sample
b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe
-
Size
333KB
-
MD5
0ec537d5a7ff2301be0b68bf73f26562
-
SHA1
0a532336db28d622c9c5f1b270386985aa38d8d9
-
SHA256
b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7
-
SHA512
13ba6de4cbf05c7ef841a901a6717c3f936459c07d13430b0cbe8f5e15de88675dfd7c0bee9fa51fbaac563e6effab3824d343d921936ad2acb38a4491fc4b2a
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTq:R4wFHoSHYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2116-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2288-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/648-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-444-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2244-468-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1532-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-507-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-537-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/2692-583-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2708-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-659-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1168-693-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2112-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-726-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1984-762-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2380-790-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2380-791-0x0000000077040000-0x000000007715F000-memory.dmp family_blackmoon behavioral1/memory/2380-12924-0x0000000077040000-0x000000007715F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1964 hbbbbh.exe 2212 ppjpd.exe 2856 bbtnhn.exe 2764 rllffff.exe 2188 tnbbth.exe 2684 vppvp.exe 2828 5bbhtt.exe 2672 1hntbn.exe 1084 9frlxrr.exe 1656 rxfffrr.exe 2044 btnnnn.exe 2156 xxfrxrr.exe 2104 jjvdj.exe 1408 lllflff.exe 2920 1tbnnh.exe 3008 pjppv.exe 2696 7llllff.exe 1080 thtbnh.exe 2524 rrflfrx.exe 2144 1lrrxff.exe 440 pdjdv.exe 2304 jvdvd.exe 1952 hnhnbb.exe 2288 pvddj.exe 2488 xxrxlxl.exe 1972 ttbntb.exe 2476 rrflflx.exe 648 3xrxfll.exe 1224 jpddj.exe 1988 3xlflxl.exe 1720 htbtnt.exe 2544 djjpd.exe 996 vvdvp.exe 1736 bbbthb.exe 1704 7ppjv.exe 2992 jddvp.exe 1580 7fllxfl.exe 2072 5nbttt.exe 2788 7nhbtt.exe 2936 1jjjv.exe 2784 9rxxflx.exe 2940 7frrflf.exe 2968 bbhhhn.exe 2188 vvjdd.exe 2876 fllflrx.exe 2652 5lrxxff.exe 2724 1tntbb.exe 1688 jdjjj.exe 1192 frflrxl.exe 2396 lllffxx.exe 752 hnttbb.exe 1776 pjjdd.exe 2532 5pdjp.exe 2576 rllfffl.exe 1640 9hbhnt.exe 3020 3nhtbh.exe 2924 dddjp.exe 3004 rllflff.exe 3008 lrxxfrx.exe 2376 nnbtbt.exe 2060 ppvvv.exe 1080 3dppv.exe 1104 xflrrfr.exe 1748 lfrxffr.exe -
resource yara_rule behavioral1/memory/2116-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fe-7.dat upx behavioral1/files/0x000700000001956c-16.dat upx behavioral1/memory/1964-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001958e-24.dat upx behavioral1/memory/2212-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000195d6-33.dat upx behavioral1/memory/2764-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019604-42.dat upx behavioral1/files/0x0009000000019605-51.dat upx behavioral1/memory/2188-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019606-59.dat upx behavioral1/memory/2684-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019926-68.dat upx behavioral1/memory/2828-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4af-77.dat upx behavioral1/memory/1084-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b1-88.dat upx behavioral1/memory/1084-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b3-94.dat upx behavioral1/memory/1656-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-102.dat upx behavioral1/files/0x000500000001a4b7-110.dat upx behavioral1/memory/2156-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b9-119.dat upx behavioral1/memory/2104-118-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x000500000001a4bb-126.dat upx behavioral1/memory/1408-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bd-135.dat upx behavioral1/memory/3008-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bf-142.dat upx behavioral1/files/0x000500000001a4c1-150.dat upx behavioral1/files/0x00360000000194ef-157.dat upx behavioral1/memory/1080-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c3-165.dat upx behavioral1/files/0x000500000001a4c5-172.dat upx behavioral1/files/0x000500000001a4c7-179.dat upx behavioral1/memory/2304-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c9-186.dat upx behavioral1/files/0x000500000001a4cb-195.dat upx behavioral1/files/0x000500000001a4cd-202.dat upx behavioral1/memory/2288-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4cf-210.dat upx behavioral1/files/0x000500000001a4d1-217.dat upx behavioral1/files/0x000500000001a4d3-224.dat upx behavioral1/memory/648-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4d5-232.dat upx behavioral1/files/0x000500000001a4d7-239.dat upx behavioral1/files/0x000500000001a4d9-249.dat upx behavioral1/files/0x000500000001a4db-255.dat upx behavioral1/memory/2544-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-375-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1640-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-390-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-396-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1964 2116 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 29 PID 2116 wrote to memory of 1964 2116 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 29 PID 2116 wrote to memory of 1964 2116 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 29 PID 2116 wrote to memory of 1964 2116 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 29 PID 1964 wrote to memory of 2212 1964 hbbbbh.exe 30 PID 1964 wrote to memory of 2212 1964 hbbbbh.exe 30 PID 1964 wrote to memory of 2212 1964 hbbbbh.exe 30 PID 1964 wrote to memory of 2212 1964 hbbbbh.exe 30 PID 2212 wrote to memory of 2856 2212 ppjpd.exe 31 PID 2212 wrote to memory of 2856 2212 ppjpd.exe 31 PID 2212 wrote to memory of 2856 2212 ppjpd.exe 31 PID 2212 wrote to memory of 2856 2212 ppjpd.exe 31 PID 2856 wrote to memory of 2764 2856 bbtnhn.exe 32 PID 2856 wrote to memory of 2764 2856 bbtnhn.exe 32 PID 2856 wrote to memory of 2764 2856 bbtnhn.exe 32 PID 2856 wrote to memory of 2764 2856 bbtnhn.exe 32 PID 2764 wrote to memory of 2188 2764 rllffff.exe 33 PID 2764 wrote to memory of 2188 2764 rllffff.exe 33 PID 2764 wrote to memory of 2188 2764 rllffff.exe 33 PID 2764 wrote to memory of 2188 2764 rllffff.exe 33 PID 2188 wrote to memory of 2684 2188 tnbbth.exe 34 PID 2188 wrote to memory of 2684 2188 tnbbth.exe 34 PID 2188 wrote to memory of 2684 2188 tnbbth.exe 34 PID 2188 wrote to memory of 2684 2188 tnbbth.exe 34 PID 2684 wrote to memory of 2828 2684 vppvp.exe 35 PID 2684 wrote to memory of 2828 2684 vppvp.exe 35 PID 2684 wrote to memory of 2828 2684 vppvp.exe 35 PID 2684 wrote to memory of 2828 2684 vppvp.exe 35 PID 2828 wrote to memory of 2672 2828 5bbhtt.exe 36 PID 2828 wrote to memory of 2672 2828 5bbhtt.exe 36 PID 2828 wrote to memory of 2672 2828 5bbhtt.exe 36 PID 2828 wrote to memory of 2672 2828 5bbhtt.exe 36 PID 2672 wrote to memory of 1084 2672 1hntbn.exe 37 PID 2672 wrote to memory of 1084 2672 1hntbn.exe 37 PID 2672 wrote to memory of 1084 2672 1hntbn.exe 37 PID 2672 wrote to memory of 1084 2672 1hntbn.exe 37 PID 1084 wrote to memory of 1656 1084 9frlxrr.exe 38 PID 1084 wrote to memory of 1656 1084 9frlxrr.exe 38 PID 1084 wrote to memory of 1656 1084 9frlxrr.exe 38 PID 1084 wrote to memory of 1656 1084 9frlxrr.exe 38 PID 1656 wrote to memory of 2044 1656 rxfffrr.exe 39 PID 1656 wrote to memory of 2044 1656 rxfffrr.exe 39 PID 1656 wrote to memory of 2044 1656 rxfffrr.exe 39 PID 1656 wrote to memory of 2044 1656 rxfffrr.exe 39 PID 2044 wrote to memory of 2156 2044 btnnnn.exe 40 PID 2044 wrote to memory of 2156 2044 btnnnn.exe 40 PID 2044 wrote to memory of 2156 2044 btnnnn.exe 40 PID 2044 wrote to memory of 2156 2044 btnnnn.exe 40 PID 2156 wrote to memory of 2104 2156 xxfrxrr.exe 41 PID 2156 wrote to memory of 2104 2156 xxfrxrr.exe 41 PID 2156 wrote to memory of 2104 2156 xxfrxrr.exe 41 PID 2156 wrote to memory of 2104 2156 xxfrxrr.exe 41 PID 2104 wrote to memory of 1408 2104 jjvdj.exe 42 PID 2104 wrote to memory of 1408 2104 jjvdj.exe 42 PID 2104 wrote to memory of 1408 2104 jjvdj.exe 42 PID 2104 wrote to memory of 1408 2104 jjvdj.exe 42 PID 1408 wrote to memory of 2920 1408 lllflff.exe 43 PID 1408 wrote to memory of 2920 1408 lllflff.exe 43 PID 1408 wrote to memory of 2920 1408 lllflff.exe 43 PID 1408 wrote to memory of 2920 1408 lllflff.exe 43 PID 2920 wrote to memory of 3008 2920 1tbnnh.exe 44 PID 2920 wrote to memory of 3008 2920 1tbnnh.exe 44 PID 2920 wrote to memory of 3008 2920 1tbnnh.exe 44 PID 2920 wrote to memory of 3008 2920 1tbnnh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe"C:\Users\Admin\AppData\Local\Temp\b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hbbbbh.exec:\hbbbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ppjpd.exec:\ppjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bbtnhn.exec:\bbtnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rllffff.exec:\rllffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tnbbth.exec:\tnbbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\vppvp.exec:\vppvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\5bbhtt.exec:\5bbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1hntbn.exec:\1hntbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9frlxrr.exec:\9frlxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\rxfffrr.exec:\rxfffrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\btnnnn.exec:\btnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\xxfrxrr.exec:\xxfrxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\jjvdj.exec:\jjvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\lllflff.exec:\lllflff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\1tbnnh.exec:\1tbnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pjppv.exec:\pjppv.exe17⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7llllff.exec:\7llllff.exe18⤵
- Executes dropped EXE
PID:2696 -
\??\c:\thtbnh.exec:\thtbnh.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rrflfrx.exec:\rrflfrx.exe20⤵
- Executes dropped EXE
PID:2524 -
\??\c:\1lrrxff.exec:\1lrrxff.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pdjdv.exec:\pdjdv.exe22⤵
- Executes dropped EXE
PID:440 -
\??\c:\jvdvd.exec:\jvdvd.exe23⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hnhnbb.exec:\hnhnbb.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pvddj.exec:\pvddj.exe25⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe26⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ttbntb.exec:\ttbntb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972 -
\??\c:\rrflflx.exec:\rrflflx.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3xrxfll.exec:\3xrxfll.exe29⤵
- Executes dropped EXE
PID:648 -
\??\c:\jpddj.exec:\jpddj.exe30⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3xlflxl.exec:\3xlflxl.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\htbtnt.exec:\htbtnt.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\djjpd.exec:\djjpd.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vvdvp.exec:\vvdvp.exe34⤵
- Executes dropped EXE
PID:996 -
\??\c:\bbbthb.exec:\bbbthb.exe35⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7ppjv.exec:\7ppjv.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jddvp.exec:\jddvp.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7fllxfl.exec:\7fllxfl.exe38⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5nbttt.exec:\5nbttt.exe39⤵
- Executes dropped EXE
PID:2072 -
\??\c:\7nhbtt.exec:\7nhbtt.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1jjjv.exec:\1jjjv.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9rxxflx.exec:\9rxxflx.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7frrflf.exec:\7frrflf.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bbhhhn.exec:\bbhhhn.exe44⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vvjdd.exec:\vvjdd.exe45⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fllflrx.exec:\fllflrx.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5lrxxff.exec:\5lrxxff.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1tntbb.exec:\1tntbb.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jdjjj.exec:\jdjjj.exe49⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frflrxl.exec:\frflrxl.exe50⤵
- Executes dropped EXE
PID:1192 -
\??\c:\lllffxx.exec:\lllffxx.exe51⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hnttbb.exec:\hnttbb.exe52⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjjdd.exec:\pjjdd.exe53⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5pdjp.exec:\5pdjp.exe54⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rllfffl.exec:\rllfffl.exe55⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9hbhnt.exec:\9hbhnt.exe56⤵
- Executes dropped EXE
PID:1640 -
\??\c:\3nhtbh.exec:\3nhtbh.exe57⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dddjp.exec:\dddjp.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rllflff.exec:\rllflff.exe59⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lrxxfrx.exec:\lrxxfrx.exe60⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nnbtbt.exec:\nnbtbt.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ppvvv.exec:\ppvvv.exe62⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3dppv.exec:\3dppv.exe63⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xflrrfr.exec:\xflrrfr.exe64⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lfrxffr.exec:\lfrxffr.exe65⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7tntnn.exec:\7tntnn.exe66⤵PID:1124
-
\??\c:\vvpjj.exec:\vvpjj.exe67⤵PID:1928
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe68⤵PID:1600
-
\??\c:\5lrrffl.exec:\5lrrffl.exe69⤵PID:2244
-
\??\c:\nhthnt.exec:\nhthnt.exe70⤵PID:2236
-
\??\c:\tttnnt.exec:\tttnnt.exe71⤵PID:1636
-
\??\c:\vdjdp.exec:\vdjdp.exe72⤵PID:1532
-
\??\c:\pjvvj.exec:\pjvvj.exe73⤵PID:1008
-
\??\c:\5xrlrxl.exec:\5xrlrxl.exe74⤵PID:1292
-
\??\c:\5htntb.exec:\5htntb.exe75⤵PID:1668
-
\??\c:\3pvvd.exec:\3pvvd.exe76⤵PID:2432
-
\??\c:\5ddvv.exec:\5ddvv.exe77⤵PID:1032
-
\??\c:\xfflrxx.exec:\xfflrxx.exe78⤵PID:1816
-
\??\c:\fflflll.exec:\fflflll.exe79⤵PID:336
-
\??\c:\nthnbn.exec:\nthnbn.exe80⤵PID:1512
-
\??\c:\3vdvd.exec:\3vdvd.exe81⤵PID:2568
-
\??\c:\jjvjv.exec:\jjvjv.exe82⤵PID:2116
-
\??\c:\lflrflx.exec:\lflrflx.exe83⤵PID:2384
-
\??\c:\nnnnbn.exec:\nnnnbn.exe84⤵PID:1684
-
\??\c:\tttbth.exec:\tttbth.exe85⤵PID:2800
-
\??\c:\5ddpv.exec:\5ddpv.exe86⤵PID:944
-
\??\c:\dvdvd.exec:\dvdvd.exe87⤵PID:3048
-
\??\c:\lllflll.exec:\lllflll.exe88⤵PID:2952
-
\??\c:\fxflxxx.exec:\fxflxxx.exe89⤵PID:2692
-
\??\c:\1thnth.exec:\1thnth.exe90⤵PID:2592
-
\??\c:\pdjpv.exec:\pdjpv.exe91⤵PID:2684
-
\??\c:\rrrfxlx.exec:\rrrfxlx.exe92⤵PID:2844
-
\??\c:\1fxxlff.exec:\1fxxlff.exe93⤵PID:2708
-
\??\c:\1htbhn.exec:\1htbhn.exe94⤵PID:2676
-
\??\c:\5bbbhn.exec:\5bbbhn.exe95⤵PID:1324
-
\??\c:\dppdj.exec:\dppdj.exe96⤵PID:2132
-
\??\c:\rlfllff.exec:\rlfllff.exe97⤵PID:1656
-
\??\c:\7frfrxl.exec:\7frfrxl.exe98⤵PID:2052
-
\??\c:\tbbnbh.exec:\tbbnbh.exe99⤵PID:2040
-
\??\c:\tbhbnn.exec:\tbhbnn.exe100⤵PID:2156
-
\??\c:\5dpjp.exec:\5dpjp.exe101⤵PID:2028
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe102⤵PID:2496
-
\??\c:\1xrlrrx.exec:\1xrlrrx.exe103⤵PID:2896
-
\??\c:\9thhtt.exec:\9thhtt.exe104⤵PID:2996
-
\??\c:\9nhbhn.exec:\9nhbhn.exe105⤵PID:1916
-
\??\c:\pvjjj.exec:\pvjjj.exe106⤵PID:2916
-
\??\c:\llrrffr.exec:\llrrffr.exe107⤵PID:1312
-
\??\c:\3lxxllr.exec:\3lxxllr.exe108⤵PID:2464
-
\??\c:\btbttb.exec:\btbttb.exe109⤵PID:1168
-
\??\c:\5tbnnn.exec:\5tbnnn.exe110⤵PID:1108
-
\??\c:\vvvjd.exec:\vvvjd.exe111⤵PID:2456
-
\??\c:\rrffrrf.exec:\rrffrrf.exe112⤵PID:2112
-
\??\c:\3frllll.exec:\3frllll.exe113⤵PID:2604
-
\??\c:\hnbbnt.exec:\hnbbnt.exe114⤵PID:2248
-
\??\c:\5jppp.exec:\5jppp.exe115⤵PID:1600
-
\??\c:\vdpjp.exec:\vdpjp.exe116⤵PID:2244
-
\??\c:\5lrxflr.exec:\5lrxflr.exe117⤵PID:2276
-
\??\c:\thbbhh.exec:\thbbhh.exe118⤵PID:1516
-
\??\c:\9hbtbt.exec:\9hbtbt.exe119⤵PID:2032
-
\??\c:\dpddp.exec:\dpddp.exe120⤵PID:836
-
\??\c:\jddvv.exec:\jddvv.exe121⤵PID:648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-