Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 09:20
Behavioral task
behavioral1
Sample
78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe
-
Size
65KB
-
MD5
1d153d2c1756575f601e7bc0ef323e57
-
SHA1
7537b663257b3376e984bd6cf1d2bfa4186b03ab
-
SHA256
78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806
-
SHA512
7350142b190bc763ad1c71d888099abd0a40cf53605285cadaa43d8588ad00557e8a521f809f4406b8fb2b78ab655c6d3a95170159df42c675af319e6f792abe
-
SSDEEP
1536:tvQBeOGtrYS3srx93UBWfwC6Ggnouy8gA2l5CcSgui36:thOmTsF93UYfwC6GIoutgVocSr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2124-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/936-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1256-28-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1256-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-47-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2672-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-65-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2828-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1684-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-138-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1796-156-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/884-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-324-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2784-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-420-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1312-431-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1968-438-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1452-445-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1492-482-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2260-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-511-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2848-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-599-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2604-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/484-646-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/532-696-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/868-699-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-711-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-710-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/700-806-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2996-843-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2496-941-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/532-961-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2052-986-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1104-1019-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2372-1025-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2100-1033-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2740-1152-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 936 dpjdd.exe 1256 fxflrlr.exe 2844 3rlrxll.exe 2284 nbtthn.exe 2672 7xxxrrf.exe 2160 5hthth.exe 2828 tbhtbn.exe 3008 jjdjv.exe 2568 lllxfll.exe 2360 xxxffxl.exe 2224 9htbtt.exe 1284 jvppv.exe 1684 5dvdp.exe 1704 rlxlrxl.exe 2304 btnnnh.exe 1796 dvjpv.exe 1968 vpdvv.exe 884 pjdpp.exe 2028 lxlrrrf.exe 2248 nnbthh.exe 2200 hbnnbb.exe 2052 pjpjv.exe 1560 jvdjj.exe 1356 7dvpp.exe 1480 xxlxfrf.exe 1812 1hhnnn.exe 2128 1hbttb.exe 2460 dpvpv.exe 1844 9lrrxxl.exe 2896 xrllrrx.exe 2432 7thntb.exe 2000 nbhthh.exe 1588 vjpvv.exe 2300 lxffrrr.exe 2876 lrlfrfl.exe 2784 ththtn.exe 2816 nbnttt.exe 2716 dpjjp.exe 2888 dvdpp.exe 2736 rlxrrrx.exe 2792 rlrxxxf.exe 2588 3fxrfxx.exe 3012 nthhnt.exe 2632 5ntbtt.exe 1688 vpvpp.exe 1936 djjjd.exe 2364 lfxxxff.exe 2096 thnnbt.exe 1704 nbnntt.exe 2388 nbnbbh.exe 1436 jvjvp.exe 1312 5jjvj.exe 1968 frlrllr.exe 1452 llfllrf.exe 2608 nttntt.exe 2752 7bthbb.exe 2796 bntntb.exe 952 vvdpd.exe 2396 lxlrrrf.exe 1492 xflfllr.exe 1052 rfrrfxx.exe 2260 9thbtn.exe 1724 hnnnnt.exe 1612 vpvvj.exe -
resource yara_rule behavioral1/files/0x000c000000012281-7.dat upx behavioral1/memory/2124-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001600000001866f-17.dat upx behavioral1/memory/936-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1256-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001868b-29.dat upx behavioral1/memory/1256-27-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2844-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f8-39.dat upx behavioral1/files/0x0006000000018731-48.dat upx behavioral1/memory/2672-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018742-57.dat upx behavioral1/files/0x000800000001878c-66.dat upx behavioral1/memory/2828-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2160-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001942c-77.dat upx behavioral1/files/0x0005000000019438-84.dat upx behavioral1/memory/2568-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019456-95.dat upx behavioral1/files/0x000500000001945c-104.dat upx behavioral1/files/0x0005000000019467-112.dat upx behavioral1/files/0x0005000000019496-120.dat upx behavioral1/memory/1284-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1284-119-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1684-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ad-131.dat upx behavioral1/files/0x00050000000194d0-140.dat upx behavioral1/memory/1704-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-138-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000194ef-148.dat upx behavioral1/memory/1796-156-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000194fc-159.dat upx behavioral1/files/0x0005000000019506-166.dat upx behavioral1/files/0x000500000001957e-184.dat upx behavioral1/files/0x000500000001952f-177.dat upx behavioral1/memory/884-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2248-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-192.dat upx behavioral1/files/0x000500000001961d-212.dat upx behavioral1/memory/1560-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2052-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195e6-203.dat upx behavioral1/memory/2052-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961f-220.dat upx behavioral1/files/0x0005000000019621-229.dat upx behavioral1/files/0x0005000000019622-237.dat upx behavioral1/memory/1812-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-245.dat upx behavioral1/files/0x0005000000019625-253.dat upx behavioral1/files/0x0005000000019627-263.dat upx behavioral1/memory/2460-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019629-271.dat upx behavioral1/files/0x000500000001962b-279.dat upx behavioral1/files/0x000500000001963b-288.dat upx behavioral1/memory/2432-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2300-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-333-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 936 2124 78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe 31 PID 2124 wrote to memory of 936 2124 78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe 31 PID 2124 wrote to memory of 936 2124 78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe 31 PID 2124 wrote to memory of 936 2124 78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe 31 PID 936 wrote to memory of 1256 936 dpjdd.exe 32 PID 936 wrote to memory of 1256 936 dpjdd.exe 32 PID 936 wrote to memory of 1256 936 dpjdd.exe 32 PID 936 wrote to memory of 1256 936 dpjdd.exe 32 PID 1256 wrote to memory of 2844 1256 fxflrlr.exe 33 PID 1256 wrote to memory of 2844 1256 fxflrlr.exe 33 PID 1256 wrote to memory of 2844 1256 fxflrlr.exe 33 PID 1256 wrote to memory of 2844 1256 fxflrlr.exe 33 PID 2844 wrote to memory of 2284 2844 3rlrxll.exe 34 PID 2844 wrote to memory of 2284 2844 3rlrxll.exe 34 PID 2844 wrote to memory of 2284 2844 3rlrxll.exe 34 PID 2844 wrote to memory of 2284 2844 3rlrxll.exe 34 PID 2284 wrote to memory of 2672 2284 nbtthn.exe 35 PID 2284 wrote to memory of 2672 2284 nbtthn.exe 35 PID 2284 wrote to memory of 2672 2284 nbtthn.exe 35 PID 2284 wrote to memory of 2672 2284 nbtthn.exe 35 PID 2672 wrote to memory of 2160 2672 7xxxrrf.exe 36 PID 2672 wrote to memory of 2160 2672 7xxxrrf.exe 36 PID 2672 wrote to memory of 2160 2672 7xxxrrf.exe 36 PID 2672 wrote to memory of 2160 2672 7xxxrrf.exe 36 PID 2160 wrote to memory of 2828 2160 5hthth.exe 37 PID 2160 wrote to memory of 2828 2160 5hthth.exe 37 PID 2160 wrote to memory of 2828 2160 5hthth.exe 37 PID 2160 wrote to memory of 2828 2160 5hthth.exe 37 PID 2828 wrote to memory of 3008 2828 tbhtbn.exe 38 PID 2828 wrote to memory of 3008 2828 tbhtbn.exe 38 PID 2828 wrote to memory of 3008 2828 tbhtbn.exe 38 PID 2828 wrote to memory of 3008 2828 tbhtbn.exe 38 PID 3008 wrote to memory of 2568 3008 jjdjv.exe 39 PID 3008 wrote to memory of 2568 3008 jjdjv.exe 39 PID 3008 wrote to memory of 2568 3008 jjdjv.exe 39 PID 3008 wrote to memory of 2568 3008 jjdjv.exe 39 PID 2568 wrote to memory of 2360 2568 lllxfll.exe 40 PID 2568 wrote to memory of 2360 2568 lllxfll.exe 40 PID 2568 wrote to memory of 2360 2568 lllxfll.exe 40 PID 2568 wrote to memory of 2360 2568 lllxfll.exe 40 PID 2360 wrote to memory of 2224 2360 xxxffxl.exe 41 PID 2360 wrote to memory of 2224 2360 xxxffxl.exe 41 PID 2360 wrote to memory of 2224 2360 xxxffxl.exe 41 PID 2360 wrote to memory of 2224 2360 xxxffxl.exe 41 PID 2224 wrote to memory of 1284 2224 9htbtt.exe 42 PID 2224 wrote to memory of 1284 2224 9htbtt.exe 42 PID 2224 wrote to memory of 1284 2224 9htbtt.exe 42 PID 2224 wrote to memory of 1284 2224 9htbtt.exe 42 PID 1284 wrote to memory of 1684 1284 jvppv.exe 43 PID 1284 wrote to memory of 1684 1284 jvppv.exe 43 PID 1284 wrote to memory of 1684 1284 jvppv.exe 43 PID 1284 wrote to memory of 1684 1284 jvppv.exe 43 PID 1684 wrote to memory of 1704 1684 5dvdp.exe 44 PID 1684 wrote to memory of 1704 1684 5dvdp.exe 44 PID 1684 wrote to memory of 1704 1684 5dvdp.exe 44 PID 1684 wrote to memory of 1704 1684 5dvdp.exe 44 PID 1704 wrote to memory of 2304 1704 rlxlrxl.exe 45 PID 1704 wrote to memory of 2304 1704 rlxlrxl.exe 45 PID 1704 wrote to memory of 2304 1704 rlxlrxl.exe 45 PID 1704 wrote to memory of 2304 1704 rlxlrxl.exe 45 PID 2304 wrote to memory of 1796 2304 btnnnh.exe 46 PID 2304 wrote to memory of 1796 2304 btnnnh.exe 46 PID 2304 wrote to memory of 1796 2304 btnnnh.exe 46 PID 2304 wrote to memory of 1796 2304 btnnnh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe"C:\Users\Admin\AppData\Local\Temp\78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\dpjdd.exec:\dpjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\fxflrlr.exec:\fxflrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\3rlrxll.exec:\3rlrxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nbtthn.exec:\nbtthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\7xxxrrf.exec:\7xxxrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\5hthth.exec:\5hthth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\tbhtbn.exec:\tbhtbn.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jjdjv.exec:\jjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lllxfll.exec:\lllxfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\xxxffxl.exec:\xxxffxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\9htbtt.exec:\9htbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jvppv.exec:\jvppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\5dvdp.exec:\5dvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\btnnnh.exec:\btnnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\dvjpv.exec:\dvjpv.exe17⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vpdvv.exec:\vpdvv.exe18⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pjdpp.exec:\pjdpp.exe19⤵
- Executes dropped EXE
PID:884 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe20⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nnbthh.exec:\nnbthh.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hbnnbb.exec:\hbnnbb.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\pjpjv.exec:\pjpjv.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jvdjj.exec:\jvdjj.exe24⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7dvpp.exec:\7dvpp.exe25⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xxlxfrf.exec:\xxlxfrf.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\1hhnnn.exec:\1hhnnn.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1hbttb.exec:\1hbttb.exe28⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dpvpv.exec:\dpvpv.exe29⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9lrrxxl.exec:\9lrrxxl.exe30⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xrllrrx.exec:\xrllrrx.exe31⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7thntb.exec:\7thntb.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nbhthh.exec:\nbhthh.exe33⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vjpvv.exec:\vjpvv.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lxffrrr.exec:\lxffrrr.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lrlfrfl.exec:\lrlfrfl.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ththtn.exec:\ththtn.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nbnttt.exec:\nbnttt.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dpjjp.exec:\dpjjp.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dvdpp.exec:\dvdpp.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rlrxxxf.exec:\rlrxxxf.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3fxrfxx.exec:\3fxrfxx.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nthhnt.exec:\nthhnt.exe44⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5ntbtt.exec:\5ntbtt.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vpvpp.exec:\vpvpp.exe46⤵
- Executes dropped EXE
PID:1688 -
\??\c:\djjjd.exec:\djjjd.exe47⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lfxxxff.exec:\lfxxxff.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\thnnbt.exec:\thnnbt.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nbnntt.exec:\nbnntt.exe50⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nbnbbh.exec:\nbnbbh.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvjvp.exec:\jvjvp.exe52⤵
- Executes dropped EXE
PID:1436 -
\??\c:\5jjvj.exec:\5jjvj.exe53⤵
- Executes dropped EXE
PID:1312 -
\??\c:\frlrllr.exec:\frlrllr.exe54⤵
- Executes dropped EXE
PID:1968 -
\??\c:\llfllrf.exec:\llfllrf.exe55⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nttntt.exec:\nttntt.exe56⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7bthbb.exec:\7bthbb.exe57⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bntntb.exec:\bntntb.exe58⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vvdpd.exec:\vvdpd.exe59⤵
- Executes dropped EXE
PID:952 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xflfllr.exec:\xflfllr.exe61⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rfrrfxx.exec:\rfrrfxx.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9thbtn.exec:\9thbtn.exe63⤵
- Executes dropped EXE
PID:2260 -
\??\c:\hnnnnt.exec:\hnnnnt.exe64⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpvvj.exec:\vpvvj.exe65⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dpdjj.exec:\dpdjj.exe66⤵PID:1916
-
\??\c:\5rxlrlr.exec:\5rxlrlr.exe67⤵PID:1880
-
\??\c:\frflxrl.exec:\frflxrl.exe68⤵PID:900
-
\??\c:\rffxffx.exec:\rffxffx.exe69⤵
- System Location Discovery: System Language Discovery
PID:1592 -
\??\c:\nthnnh.exec:\nthnnh.exe70⤵PID:2240
-
\??\c:\7thtbt.exec:\7thtbt.exe71⤵PID:2652
-
\??\c:\3vdpp.exec:\3vdpp.exe72⤵PID:1256
-
\??\c:\jpvdj.exec:\jpvdj.exe73⤵PID:1512
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe74⤵PID:2848
-
\??\c:\9rffrll.exec:\9rffrll.exe75⤵PID:2760
-
\??\c:\nbhhhh.exec:\nbhhhh.exe76⤵PID:2996
-
\??\c:\hthhhh.exec:\hthhhh.exe77⤵PID:2284
-
\??\c:\nbbbhh.exec:\nbbbhh.exe78⤵PID:2836
-
\??\c:\pjdjp.exec:\pjdjp.exe79⤵PID:2728
-
\??\c:\vppvj.exec:\vppvj.exe80⤵PID:2692
-
\??\c:\xlxflll.exec:\xlxflll.exe81⤵PID:2604
-
\??\c:\5xfllfl.exec:\5xfllfl.exe82⤵PID:2564
-
\??\c:\nbnhnn.exec:\nbnhnn.exe83⤵PID:2792
-
\??\c:\nbhnnb.exec:\nbhnnb.exe84⤵PID:2580
-
\??\c:\5dvvp.exec:\5dvvp.exe85⤵PID:3012
-
\??\c:\dpjvv.exec:\dpjvv.exe86⤵PID:1992
-
\??\c:\xfflflr.exec:\xfflflr.exe87⤵PID:484
-
\??\c:\xlfflxr.exec:\xlfflxr.exe88⤵PID:2508
-
\??\c:\bhtbtn.exec:\bhtbtn.exe89⤵PID:2512
-
\??\c:\thntnt.exec:\thntnt.exe90⤵PID:796
-
\??\c:\pjvdj.exec:\pjvdj.exe91⤵PID:1952
-
\??\c:\vjpjd.exec:\vjpjd.exe92⤵PID:772
-
\??\c:\lflrllr.exec:\lflrllr.exe93⤵PID:2408
-
\??\c:\5rflrlr.exec:\5rflrlr.exe94⤵PID:1764
-
\??\c:\hntnhn.exec:\hntnhn.exe95⤵PID:532
-
\??\c:\htbbtt.exec:\htbbtt.exe96⤵PID:868
-
\??\c:\1pdvv.exec:\1pdvv.exe97⤵PID:2088
-
\??\c:\vjjdj.exec:\vjjdj.exe98⤵PID:1852
-
\??\c:\5fffxxx.exec:\5fffxxx.exe99⤵PID:408
-
\??\c:\htnbbt.exec:\htnbbt.exe100⤵PID:892
-
\??\c:\9nbbhh.exec:\9nbbhh.exe101⤵PID:1224
-
\??\c:\dvjpd.exec:\dvjpd.exe102⤵PID:1864
-
\??\c:\jdjpv.exec:\jdjpv.exe103⤵PID:2628
-
\??\c:\lrllfrr.exec:\lrllfrr.exe104⤵PID:1028
-
\??\c:\1xfrxxx.exec:\1xfrxxx.exe105⤵PID:1184
-
\??\c:\xllflll.exec:\xllflll.exe106⤵PID:2276
-
\??\c:\nnhnbh.exec:\nnhnbh.exe107⤵PID:2056
-
\??\c:\7pdjd.exec:\7pdjd.exe108⤵PID:1004
-
\??\c:\1pvvp.exec:\1pvvp.exe109⤵PID:2956
-
\??\c:\jvjpv.exec:\jvjpv.exe110⤵PID:2648
-
\??\c:\3rlllll.exec:\3rlllll.exe111⤵PID:2204
-
\??\c:\rlrxxrr.exec:\rlrxxrr.exe112⤵PID:700
-
\??\c:\nbtbbb.exec:\nbtbbb.exe113⤵PID:1336
-
\??\c:\bhhntb.exec:\bhhntb.exe114⤵PID:1580
-
\??\c:\vdvdv.exec:\vdvdv.exe115⤵PID:2524
-
\??\c:\pdjvv.exec:\pdjvv.exe116⤵PID:2712
-
\??\c:\fllllxf.exec:\fllllxf.exe117⤵PID:2424
-
\??\c:\xllllll.exec:\xllllll.exe118⤵PID:2996
-
\??\c:\xfrxrll.exec:\xfrxrll.exe119⤵PID:2284
-
\??\c:\hntbbt.exec:\hntbbt.exe120⤵PID:2700
-
\??\c:\bthhht.exec:\bthhht.exe121⤵PID:2824
-
\??\c:\5vjpp.exec:\5vjpp.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-