Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe
-
Size
454KB
-
MD5
6503689e6e1dc128232bc30cf5e336df
-
SHA1
7635c8a9834b22b8715ef027d5c03c62c6df44ab
-
SHA256
d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8
-
SHA512
bb069969882cb2304da507aba4429aae08c03824efab78e526eeb84437458b863ff414eae2f36bc3c769da3eb51a732edd2fcf486cce20c75d684e36d1288912
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeta:q7Tc2NYHUrAwfMp3CDta
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2104-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-145-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1536-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1352-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-224-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1436-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-426-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1924-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-570-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2000-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-941-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-1131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-1175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-1195-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/288-1342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 788 5pdjj.exe 1932 lffflfx.exe 2536 hthnnh.exe 2984 rxfxxrr.exe 2748 frrrxlr.exe 2920 tbnnhh.exe 2916 frxrxrf.exe 2912 btbbbt.exe 2756 dpdjp.exe 2632 9nbbbt.exe 1952 dvjpp.exe 1400 rlxfffr.exe 1260 jvjpp.exe 1536 pjvpj.exe 1996 xxrlrrx.exe 2004 jdjdp.exe 620 lfrlffr.exe 2820 bnnnnh.exe 2936 5vddp.exe 2480 hbnbnt.exe 2968 7thbhh.exe 1352 lxlrlll.exe 1436 hbhnbb.exe 1584 jdjpv.exe 1868 frxxffl.exe 2448 frffrxf.exe 2212 vpvvv.exe 2572 7jppp.exe 2268 thnnnn.exe 316 jdvdv.exe 2104 5fxrfxr.exe 1608 5tbhnt.exe 2052 9dppv.exe 1864 fflflfl.exe 2944 7htttn.exe 604 vpjjp.exe 2868 dpvvd.exe 2900 xlfxxxf.exe 2880 htbbhh.exe 2908 htnhnn.exe 2916 pdppv.exe 2788 fxrrffl.exe 2892 xrrrrxr.exe 2756 bbnntt.exe 2160 htbhnn.exe 2300 jvjjv.exe 1952 rxffffl.exe 832 5frlrrx.exe 1736 nhnntt.exe 1344 pjvdj.exe 1808 vvpjp.exe 1596 flffllx.exe 1924 hbhnbh.exe 1912 3dpvv.exe 2688 ppdjj.exe 2860 lxllrxf.exe 1964 thhhbn.exe 2484 hnhhnn.exe 596 pjvjj.exe 2372 xrlfffx.exe 1040 frxxxrx.exe 1780 hhbbnn.exe 648 5pdjp.exe 1988 jdpjd.exe -
resource yara_rule behavioral1/memory/2104-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-180-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2480-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-1138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-1175-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1596-1227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-1276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-1301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-1314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-1327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-1334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-1342-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 788 2104 d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe 30 PID 2104 wrote to memory of 788 2104 d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe 30 PID 2104 wrote to memory of 788 2104 d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe 30 PID 2104 wrote to memory of 788 2104 d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe 30 PID 788 wrote to memory of 1932 788 5pdjj.exe 31 PID 788 wrote to memory of 1932 788 5pdjj.exe 31 PID 788 wrote to memory of 1932 788 5pdjj.exe 31 PID 788 wrote to memory of 1932 788 5pdjj.exe 31 PID 1932 wrote to memory of 2536 1932 lffflfx.exe 32 PID 1932 wrote to memory of 2536 1932 lffflfx.exe 32 PID 1932 wrote to memory of 2536 1932 lffflfx.exe 32 PID 1932 wrote to memory of 2536 1932 lffflfx.exe 32 PID 2536 wrote to memory of 2984 2536 hthnnh.exe 33 PID 2536 wrote to memory of 2984 2536 hthnnh.exe 33 PID 2536 wrote to memory of 2984 2536 hthnnh.exe 33 PID 2536 wrote to memory of 2984 2536 hthnnh.exe 33 PID 2984 wrote to memory of 2748 2984 rxfxxrr.exe 34 PID 2984 wrote to memory of 2748 2984 rxfxxrr.exe 34 PID 2984 wrote to memory of 2748 2984 rxfxxrr.exe 34 PID 2984 wrote to memory of 2748 2984 rxfxxrr.exe 34 PID 2748 wrote to memory of 2920 2748 frrrxlr.exe 35 PID 2748 wrote to memory of 2920 2748 frrrxlr.exe 35 PID 2748 wrote to memory of 2920 2748 frrrxlr.exe 35 PID 2748 wrote to memory of 2920 2748 frrrxlr.exe 35 PID 2920 wrote to memory of 2916 2920 tbnnhh.exe 36 PID 2920 wrote to memory of 2916 2920 tbnnhh.exe 36 PID 2920 wrote to memory of 2916 2920 tbnnhh.exe 36 PID 2920 wrote to memory of 2916 2920 tbnnhh.exe 36 PID 2916 wrote to memory of 2912 2916 frxrxrf.exe 37 PID 2916 wrote to memory of 2912 2916 frxrxrf.exe 37 PID 2916 wrote to memory of 2912 2916 frxrxrf.exe 37 PID 2916 wrote to memory of 2912 2916 frxrxrf.exe 37 PID 2912 wrote to memory of 2756 2912 btbbbt.exe 38 PID 2912 wrote to memory of 2756 2912 btbbbt.exe 38 PID 2912 wrote to memory of 2756 2912 btbbbt.exe 38 PID 2912 wrote to memory of 2756 2912 btbbbt.exe 38 PID 2756 wrote to memory of 2632 2756 dpdjp.exe 39 PID 2756 wrote to memory of 2632 2756 dpdjp.exe 39 PID 2756 wrote to memory of 2632 2756 dpdjp.exe 39 PID 2756 wrote to memory of 2632 2756 dpdjp.exe 39 PID 2632 wrote to memory of 1952 2632 9nbbbt.exe 40 PID 2632 wrote to memory of 1952 2632 9nbbbt.exe 40 PID 2632 wrote to memory of 1952 2632 9nbbbt.exe 40 PID 2632 wrote to memory of 1952 2632 9nbbbt.exe 40 PID 1952 wrote to memory of 1400 1952 dvjpp.exe 41 PID 1952 wrote to memory of 1400 1952 dvjpp.exe 41 PID 1952 wrote to memory of 1400 1952 dvjpp.exe 41 PID 1952 wrote to memory of 1400 1952 dvjpp.exe 41 PID 1400 wrote to memory of 1260 1400 rlxfffr.exe 42 PID 1400 wrote to memory of 1260 1400 rlxfffr.exe 42 PID 1400 wrote to memory of 1260 1400 rlxfffr.exe 42 PID 1400 wrote to memory of 1260 1400 rlxfffr.exe 42 PID 1260 wrote to memory of 1536 1260 jvjpp.exe 43 PID 1260 wrote to memory of 1536 1260 jvjpp.exe 43 PID 1260 wrote to memory of 1536 1260 jvjpp.exe 43 PID 1260 wrote to memory of 1536 1260 jvjpp.exe 43 PID 1536 wrote to memory of 1996 1536 pjvpj.exe 44 PID 1536 wrote to memory of 1996 1536 pjvpj.exe 44 PID 1536 wrote to memory of 1996 1536 pjvpj.exe 44 PID 1536 wrote to memory of 1996 1536 pjvpj.exe 44 PID 1996 wrote to memory of 2004 1996 xxrlrrx.exe 45 PID 1996 wrote to memory of 2004 1996 xxrlrrx.exe 45 PID 1996 wrote to memory of 2004 1996 xxrlrrx.exe 45 PID 1996 wrote to memory of 2004 1996 xxrlrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe"C:\Users\Admin\AppData\Local\Temp\d2d8c7fba2ca67084a16f518c81d66c6f34c036740c04ed9aed88b4d9281dfd8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5pdjj.exec:\5pdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\lffflfx.exec:\lffflfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\hthnnh.exec:\hthnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\frrrxlr.exec:\frrrxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tbnnhh.exec:\tbnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\frxrxrf.exec:\frxrxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\btbbbt.exec:\btbbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\dpdjp.exec:\dpdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\9nbbbt.exec:\9nbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dvjpp.exec:\dvjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rlxfffr.exec:\rlxfffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\jvjpp.exec:\jvjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pjvpj.exec:\pjvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\jdjdp.exec:\jdjdp.exe17⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lfrlffr.exec:\lfrlffr.exe18⤵
- Executes dropped EXE
PID:620 -
\??\c:\bnnnnh.exec:\bnnnnh.exe19⤵
- Executes dropped EXE
PID:2820 -
\??\c:\5vddp.exec:\5vddp.exe20⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hbnbnt.exec:\hbnbnt.exe21⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7thbhh.exec:\7thbhh.exe22⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lxlrlll.exec:\lxlrlll.exe23⤵
- Executes dropped EXE
PID:1352 -
\??\c:\hbhnbb.exec:\hbhnbb.exe24⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jdjpv.exec:\jdjpv.exe25⤵
- Executes dropped EXE
PID:1584 -
\??\c:\frxxffl.exec:\frxxffl.exe26⤵
- Executes dropped EXE
PID:1868 -
\??\c:\frffrxf.exec:\frffrxf.exe27⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpvvv.exec:\vpvvv.exe28⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7jppp.exec:\7jppp.exe29⤵
- Executes dropped EXE
PID:2572 -
\??\c:\thnnnn.exec:\thnnnn.exe30⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdvdv.exec:\jdvdv.exe31⤵
- Executes dropped EXE
PID:316 -
\??\c:\5fxrfxr.exec:\5fxrfxr.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5tbhnt.exec:\5tbhnt.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9dppv.exec:\9dppv.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fflflfl.exec:\fflflfl.exe35⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7htttn.exec:\7htttn.exe36⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpjjp.exec:\vpjjp.exe37⤵
- Executes dropped EXE
PID:604 -
\??\c:\dpvvd.exec:\dpvvd.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xlfxxxf.exec:\xlfxxxf.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\htbbhh.exec:\htbbhh.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\htnhnn.exec:\htnhnn.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pdppv.exec:\pdppv.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fxrrffl.exec:\fxrrffl.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\xrrrrxr.exec:\xrrrrxr.exe44⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bbnntt.exec:\bbnntt.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htbhnn.exec:\htbhnn.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jvjjv.exec:\jvjjv.exe47⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rxffffl.exec:\rxffffl.exe48⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5frlrrx.exec:\5frlrrx.exe49⤵
- Executes dropped EXE
PID:832 -
\??\c:\nhnntt.exec:\nhnntt.exe50⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pjvdj.exec:\pjvdj.exe51⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vvpjp.exec:\vvpjp.exe52⤵
- Executes dropped EXE
PID:1808 -
\??\c:\flffllx.exec:\flffllx.exe53⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hbhnbh.exec:\hbhnbh.exe54⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3dpvv.exec:\3dpvv.exe55⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ppdjj.exec:\ppdjj.exe56⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lxllrxf.exec:\lxllrxf.exe57⤵
- Executes dropped EXE
PID:2860 -
\??\c:\thhhbn.exec:\thhhbn.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hnhhnn.exec:\hnhhnn.exe59⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pjvjj.exec:\pjvjj.exe60⤵
- Executes dropped EXE
PID:596 -
\??\c:\xrlfffx.exec:\xrlfffx.exe61⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frxxxrx.exec:\frxxxrx.exe62⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hhbbnn.exec:\hhbbnn.exe63⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5pdjp.exec:\5pdjp.exe64⤵
- Executes dropped EXE
PID:648 -
\??\c:\jdpjd.exec:\jdpjd.exe65⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xlfrxrx.exec:\xlfrxrx.exe66⤵PID:1868
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe67⤵PID:2008
-
\??\c:\nhbhtt.exec:\nhbhtt.exe68⤵PID:628
-
\??\c:\1vddd.exec:\1vddd.exe69⤵PID:2228
-
\??\c:\pdjjj.exec:\pdjjj.exe70⤵PID:288
-
\??\c:\lxllrxf.exec:\lxllrxf.exe71⤵PID:1512
-
\??\c:\htnttn.exec:\htnttn.exe72⤵PID:2412
-
\??\c:\nbhbhn.exec:\nbhbhn.exe73⤵PID:2492
-
\??\c:\7pddj.exec:\7pddj.exe74⤵PID:2988
-
\??\c:\7ffflrf.exec:\7ffflrf.exe75⤵PID:2308
-
\??\c:\xlxlllx.exec:\xlxlllx.exe76⤵PID:2404
-
\??\c:\9ntbtt.exec:\9ntbtt.exe77⤵PID:2064
-
\??\c:\jpvvv.exec:\jpvvv.exe78⤵PID:1864
-
\??\c:\5djdj.exec:\5djdj.exe79⤵PID:2944
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe80⤵PID:2220
-
\??\c:\xfrrrxf.exec:\xfrrrxf.exe81⤵PID:2868
-
\??\c:\hbnhnh.exec:\hbnhnh.exe82⤵PID:2744
-
\??\c:\vjvvv.exec:\vjvvv.exe83⤵PID:2888
-
\??\c:\dvjdj.exec:\dvjdj.exe84⤵PID:2904
-
\??\c:\lxfflfl.exec:\lxfflfl.exe85⤵PID:2972
-
\??\c:\nhtntn.exec:\nhtntn.exe86⤵PID:2640
-
\??\c:\5bhhhh.exec:\5bhhhh.exe87⤵PID:2628
-
\??\c:\9jjjv.exec:\9jjjv.exe88⤵PID:2636
-
\??\c:\jvddp.exec:\jvddp.exe89⤵PID:2740
-
\??\c:\xrllxfl.exec:\xrllxfl.exe90⤵PID:1788
-
\??\c:\1hbbhn.exec:\1hbbhn.exe91⤵PID:1400
-
\??\c:\9nhhnn.exec:\9nhhnn.exe92⤵PID:1936
-
\??\c:\1vjpv.exec:\1vjpv.exe93⤵PID:1488
-
\??\c:\9jpjd.exec:\9jpjd.exe94⤵PID:1044
-
\??\c:\9rfflff.exec:\9rfflff.exe95⤵
- System Location Discovery: System Language Discovery
PID:1428 -
\??\c:\7nnhbt.exec:\7nnhbt.exe96⤵PID:2040
-
\??\c:\bbbbnn.exec:\bbbbnn.exe97⤵PID:2000
-
\??\c:\9dvpp.exec:\9dvpp.exe98⤵PID:2604
-
\??\c:\vpddd.exec:\vpddd.exe99⤵PID:1568
-
\??\c:\1llfxxf.exec:\1llfxxf.exe100⤵PID:2180
-
\??\c:\ttnnbh.exec:\ttnnbh.exe101⤵PID:2800
-
\??\c:\hthbhh.exec:\hthbhh.exe102⤵PID:2128
-
\??\c:\jvdjp.exec:\jvdjp.exe103⤵PID:2484
-
\??\c:\ffrrrlf.exec:\ffrrrlf.exe104⤵PID:2356
-
\??\c:\lfrllrx.exec:\lfrllrx.exe105⤵PID:2372
-
\??\c:\htnhht.exec:\htnhht.exe106⤵PID:2596
-
\??\c:\ddvvj.exec:\ddvvj.exe107⤵PID:1780
-
\??\c:\jvdpp.exec:\jvdpp.exe108⤵PID:1804
-
\??\c:\lfrxffr.exec:\lfrxffr.exe109⤵PID:1104
-
\??\c:\btntbb.exec:\btntbb.exe110⤵PID:1868
-
\??\c:\bthbhn.exec:\bthbhn.exe111⤵PID:1772
-
\??\c:\jvdvd.exec:\jvdvd.exe112⤵PID:2072
-
\??\c:\3pvvj.exec:\3pvvj.exe113⤵PID:2572
-
\??\c:\fxlfllf.exec:\fxlfllf.exe114⤵PID:1508
-
\??\c:\bnttbb.exec:\bnttbb.exe115⤵PID:2232
-
\??\c:\bthnnn.exec:\bthnnn.exe116⤵PID:2552
-
\??\c:\1dpvv.exec:\1dpvv.exe117⤵PID:2532
-
\??\c:\rffxllx.exec:\rffxllx.exe118⤵PID:264
-
\??\c:\7flfllr.exec:\7flfllr.exe119⤵PID:2068
-
\??\c:\btbbhh.exec:\btbbhh.exe120⤵PID:2376
-
\??\c:\bthntt.exec:\bthntt.exe121⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-