Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe
-
Size
454KB
-
MD5
bf8dd92f65db3a8656792528570d83c3
-
SHA1
9e3e7fcad8132949cf40be9335f45250efc02374
-
SHA256
a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78
-
SHA512
558bd9edc52c79d8625f131248d0a14328296ad0d7aeb314c8faa364d27608e9ae909de1766a548d0de5a79a5d27f82d6ed81cc838800e325f4772418a002ab2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2180-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2180-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-66-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2220-65-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2716-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-77-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2956-75-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2732-96-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2732-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-107-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2680-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-153-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1408-151-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/264-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-214-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1292-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1152-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/404-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-622-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1812-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-803-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/900-810-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/440-1047-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2280-1149-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1056-1265-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1292 rllrxlf.exe 2016 vddvp.exe 2180 jvpjj.exe 2868 ffrxrrx.exe 2716 hthhtn.exe 2220 nhtthb.exe 2956 jvpdv.exe 2892 1nhnbb.exe 2732 hhhnnt.exe 2228 tbbhtb.exe 1808 jjpvd.exe 2680 nhhnnb.exe 2980 ppvpd.exe 1736 5pvdd.exe 1408 1fflfxl.exe 2136 djpjd.exe 264 3vvjp.exe 2076 dddjv.exe 704 rxfxxfr.exe 1496 vddpp.exe 2792 xxrxfxf.exe 2324 ddvvj.exe 2584 djvpp.exe 2200 3ppjp.exe 1528 dvjdp.exe 1708 tttbhn.exe 2448 djvpd.exe 2196 nbtbbb.exe 2236 rxllrfx.exe 1256 3tthtb.exe 884 1tnnbh.exe 1396 djpdv.exe 1292 hhttbh.exe 2396 llxfxfr.exe 1788 9lxrxlx.exe 1152 tttnht.exe 2180 pdjpd.exe 2868 rxfxlxr.exe 2768 hhbnht.exe 2772 tbhttn.exe 2636 vdddv.exe 1952 xxxfxfx.exe 2608 hhtbnt.exe 2676 hhbnht.exe 1928 pvpvp.exe 1800 lxfrxrr.exe 1916 ttnbbt.exe 2960 jjdjd.exe 2924 3jvdj.exe 2680 1fxllff.exe 2708 nhhntt.exe 1612 vjvjj.exe 1640 xffrlxl.exe 2568 llfxrxl.exe 480 ttbhhh.exe 928 jjddv.exe 264 vvdjd.exe 796 lfxfxfx.exe 2060 bhtbth.exe 352 3ttbhn.exe 404 5jjpv.exe 1332 5xrrlrf.exe 1956 hbhtbh.exe 2068 hbbntb.exe -
resource yara_rule behavioral1/memory/768-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-35-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2868-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-153-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1408-151-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/264-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-214-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2584-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-771-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1812-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-876-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2220-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-1251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-1259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-1316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-1329-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 1292 768 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 768 wrote to memory of 1292 768 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 768 wrote to memory of 1292 768 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 768 wrote to memory of 1292 768 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 1292 wrote to memory of 2016 1292 rllrxlf.exe 31 PID 1292 wrote to memory of 2016 1292 rllrxlf.exe 31 PID 1292 wrote to memory of 2016 1292 rllrxlf.exe 31 PID 1292 wrote to memory of 2016 1292 rllrxlf.exe 31 PID 2016 wrote to memory of 2180 2016 vddvp.exe 32 PID 2016 wrote to memory of 2180 2016 vddvp.exe 32 PID 2016 wrote to memory of 2180 2016 vddvp.exe 32 PID 2016 wrote to memory of 2180 2016 vddvp.exe 32 PID 2180 wrote to memory of 2868 2180 jvpjj.exe 33 PID 2180 wrote to memory of 2868 2180 jvpjj.exe 33 PID 2180 wrote to memory of 2868 2180 jvpjj.exe 33 PID 2180 wrote to memory of 2868 2180 jvpjj.exe 33 PID 2868 wrote to memory of 2716 2868 ffrxrrx.exe 34 PID 2868 wrote to memory of 2716 2868 ffrxrrx.exe 34 PID 2868 wrote to memory of 2716 2868 ffrxrrx.exe 34 PID 2868 wrote to memory of 2716 2868 ffrxrrx.exe 34 PID 2716 wrote to memory of 2220 2716 hthhtn.exe 35 PID 2716 wrote to memory of 2220 2716 hthhtn.exe 35 PID 2716 wrote to memory of 2220 2716 hthhtn.exe 35 PID 2716 wrote to memory of 2220 2716 hthhtn.exe 35 PID 2220 wrote to memory of 2956 2220 nhtthb.exe 36 PID 2220 wrote to memory of 2956 2220 nhtthb.exe 36 PID 2220 wrote to memory of 2956 2220 nhtthb.exe 36 PID 2220 wrote to memory of 2956 2220 nhtthb.exe 36 PID 2956 wrote to memory of 2892 2956 jvpdv.exe 37 PID 2956 wrote to memory of 2892 2956 jvpdv.exe 37 PID 2956 wrote to memory of 2892 2956 jvpdv.exe 37 PID 2956 wrote to memory of 2892 2956 jvpdv.exe 37 PID 2892 wrote to memory of 2732 2892 1nhnbb.exe 38 PID 2892 wrote to memory of 2732 2892 1nhnbb.exe 38 PID 2892 wrote to memory of 2732 2892 1nhnbb.exe 38 PID 2892 wrote to memory of 2732 2892 1nhnbb.exe 38 PID 2732 wrote to memory of 2228 2732 hhhnnt.exe 39 PID 2732 wrote to memory of 2228 2732 hhhnnt.exe 39 PID 2732 wrote to memory of 2228 2732 hhhnnt.exe 39 PID 2732 wrote to memory of 2228 2732 hhhnnt.exe 39 PID 2228 wrote to memory of 1808 2228 tbbhtb.exe 40 PID 2228 wrote to memory of 1808 2228 tbbhtb.exe 40 PID 2228 wrote to memory of 1808 2228 tbbhtb.exe 40 PID 2228 wrote to memory of 1808 2228 tbbhtb.exe 40 PID 1808 wrote to memory of 2680 1808 jjpvd.exe 41 PID 1808 wrote to memory of 2680 1808 jjpvd.exe 41 PID 1808 wrote to memory of 2680 1808 jjpvd.exe 41 PID 1808 wrote to memory of 2680 1808 jjpvd.exe 41 PID 2680 wrote to memory of 2980 2680 nhhnnb.exe 42 PID 2680 wrote to memory of 2980 2680 nhhnnb.exe 42 PID 2680 wrote to memory of 2980 2680 nhhnnb.exe 42 PID 2680 wrote to memory of 2980 2680 nhhnnb.exe 42 PID 2980 wrote to memory of 1736 2980 ppvpd.exe 43 PID 2980 wrote to memory of 1736 2980 ppvpd.exe 43 PID 2980 wrote to memory of 1736 2980 ppvpd.exe 43 PID 2980 wrote to memory of 1736 2980 ppvpd.exe 43 PID 1736 wrote to memory of 1408 1736 5pvdd.exe 44 PID 1736 wrote to memory of 1408 1736 5pvdd.exe 44 PID 1736 wrote to memory of 1408 1736 5pvdd.exe 44 PID 1736 wrote to memory of 1408 1736 5pvdd.exe 44 PID 1408 wrote to memory of 2136 1408 1fflfxl.exe 45 PID 1408 wrote to memory of 2136 1408 1fflfxl.exe 45 PID 1408 wrote to memory of 2136 1408 1fflfxl.exe 45 PID 1408 wrote to memory of 2136 1408 1fflfxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe"C:\Users\Admin\AppData\Local\Temp\a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\rllrxlf.exec:\rllrxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\vddvp.exec:\vddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jvpjj.exec:\jvpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\ffrxrrx.exec:\ffrxrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\hthhtn.exec:\hthhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nhtthb.exec:\nhtthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jvpdv.exec:\jvpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1nhnbb.exec:\1nhnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hhhnnt.exec:\hhhnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tbbhtb.exec:\tbbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\jjpvd.exec:\jjpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nhhnnb.exec:\nhhnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ppvpd.exec:\ppvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5pvdd.exec:\5pvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\1fflfxl.exec:\1fflfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\djpjd.exec:\djpjd.exe17⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3vvjp.exec:\3vvjp.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\dddjv.exec:\dddjv.exe19⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rxfxxfr.exec:\rxfxxfr.exe20⤵
- Executes dropped EXE
PID:704 -
\??\c:\vddpp.exec:\vddpp.exe21⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xxrxfxf.exec:\xxrxfxf.exe22⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ddvvj.exec:\ddvvj.exe23⤵
- Executes dropped EXE
PID:2324 -
\??\c:\djvpp.exec:\djvpp.exe24⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3ppjp.exec:\3ppjp.exe25⤵
- Executes dropped EXE
PID:2200 -
\??\c:\dvjdp.exec:\dvjdp.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tttbhn.exec:\tttbhn.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\djvpd.exec:\djvpd.exe28⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nbtbbb.exec:\nbtbbb.exe29⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rxllrfx.exec:\rxllrfx.exe30⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3tthtb.exec:\3tthtb.exe31⤵
- Executes dropped EXE
PID:1256 -
\??\c:\1tnnbh.exec:\1tnnbh.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\djpdv.exec:\djpdv.exe33⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hhttbh.exec:\hhttbh.exe34⤵
- Executes dropped EXE
PID:1292 -
\??\c:\llxfxfr.exec:\llxfxfr.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9lxrxlx.exec:\9lxrxlx.exe36⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tttnht.exec:\tttnht.exe37⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pdjpd.exec:\pdjpd.exe38⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rxfxlxr.exec:\rxfxlxr.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hhbnht.exec:\hhbnht.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\tbhttn.exec:\tbhttn.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vdddv.exec:\vdddv.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe43⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hhtbnt.exec:\hhtbnt.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hhbnht.exec:\hhbnht.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pvpvp.exec:\pvpvp.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1928 -
\??\c:\lxfrxrr.exec:\lxfrxrr.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ttnbbt.exec:\ttnbbt.exe48⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jjdjd.exec:\jjdjd.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3jvdj.exec:\3jvdj.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1fxllff.exec:\1fxllff.exe51⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nhhntt.exec:\nhhntt.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vjvjj.exec:\vjvjj.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xffrlxl.exec:\xffrlxl.exe54⤵
- Executes dropped EXE
PID:1640 -
\??\c:\llfxrxl.exec:\llfxrxl.exe55⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ttbhhh.exec:\ttbhhh.exe56⤵
- Executes dropped EXE
PID:480 -
\??\c:\jjddv.exec:\jjddv.exe57⤵
- Executes dropped EXE
PID:928 -
\??\c:\vvdjd.exec:\vvdjd.exe58⤵
- Executes dropped EXE
PID:264 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe59⤵
- Executes dropped EXE
PID:796 -
\??\c:\bhtbth.exec:\bhtbth.exe60⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3ttbhn.exec:\3ttbhn.exe61⤵
- Executes dropped EXE
PID:352 -
\??\c:\5jjpv.exec:\5jjpv.exe62⤵
- Executes dropped EXE
PID:404 -
\??\c:\5xrrlrf.exec:\5xrrlrf.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hbhtbh.exec:\hbhtbh.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hbbntb.exec:\hbbntb.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ddpdp.exec:\ddpdp.exe66⤵PID:1140
-
\??\c:\xxxffrf.exec:\xxxffrf.exe67⤵PID:1852
-
\??\c:\xrfxlrx.exec:\xrfxlrx.exe68⤵PID:760
-
\??\c:\hnnhhb.exec:\hnnhhb.exe69⤵PID:1784
-
\??\c:\jdjdp.exec:\jdjdp.exe70⤵PID:2500
-
\??\c:\1xxflrl.exec:\1xxflrl.exe71⤵PID:1972
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe72⤵PID:2356
-
\??\c:\nhnbnt.exec:\nhnbnt.exe73⤵PID:692
-
\??\c:\dvppd.exec:\dvppd.exe74⤵PID:2332
-
\??\c:\3ffrxxf.exec:\3ffrxxf.exe75⤵PID:1616
-
\??\c:\7fxfflr.exec:\7fxfflr.exe76⤵PID:2288
-
\??\c:\5hhbnb.exec:\5hhbnb.exe77⤵PID:1776
-
\??\c:\vvvjd.exec:\vvvjd.exe78⤵PID:1552
-
\??\c:\xfxflrx.exec:\xfxflrx.exe79⤵PID:1296
-
\??\c:\hhhtbb.exec:\hhhtbb.exe80⤵PID:2936
-
\??\c:\nnbbhn.exec:\nnbbhn.exe81⤵PID:2800
-
\??\c:\vdvjv.exec:\vdvjv.exe82⤵PID:2704
-
\??\c:\flxflrf.exec:\flxflrf.exe83⤵PID:2908
-
\??\c:\3flxlrf.exec:\3flxlrf.exe84⤵PID:2720
-
\??\c:\7btbhn.exec:\7btbhn.exe85⤵PID:2620
-
\??\c:\dvvpp.exec:\dvvpp.exe86⤵PID:2220
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe87⤵PID:2660
-
\??\c:\1xrxxfl.exec:\1xrxxfl.exe88⤵PID:2624
-
\??\c:\bhhthn.exec:\bhhthn.exe89⤵PID:2644
-
\??\c:\vppvj.exec:\vppvj.exe90⤵PID:2348
-
\??\c:\7jdjp.exec:\7jdjp.exe91⤵PID:2732
-
\??\c:\xrxlrrf.exec:\xrxlrrf.exe92⤵PID:2024
-
\??\c:\bhhtnt.exec:\bhhtnt.exe93⤵PID:2208
-
\??\c:\5vvjv.exec:\5vvjv.exe94⤵PID:672
-
\??\c:\fffrflf.exec:\fffrflf.exe95⤵PID:2972
-
\??\c:\xrrxlrr.exec:\xrrxlrr.exe96⤵PID:3000
-
\??\c:\hhnntt.exec:\hhnntt.exe97⤵PID:1056
-
\??\c:\jjpdd.exec:\jjpdd.exe98⤵PID:2328
-
\??\c:\7pdjp.exec:\7pdjp.exe99⤵PID:1612
-
\??\c:\3lfxlxr.exec:\3lfxlxr.exe100⤵PID:2100
-
\??\c:\nnnnhn.exec:\nnnnhn.exe101⤵PID:2136
-
\??\c:\jjdjd.exec:\jjdjd.exe102⤵PID:480
-
\??\c:\pvpjd.exec:\pvpjd.exe103⤵PID:2320
-
\??\c:\llllxfr.exec:\llllxfr.exe104⤵PID:2076
-
\??\c:\nhhnbh.exec:\nhhnbh.exe105⤵PID:636
-
\??\c:\tttbth.exec:\tttbth.exe106⤵PID:1924
-
\??\c:\pvjdd.exec:\pvjdd.exe107⤵PID:1132
-
\??\c:\fxrxllf.exec:\fxrxllf.exe108⤵PID:1540
-
\??\c:\btnthh.exec:\btnthh.exe109⤵PID:2324
-
\??\c:\vdvvp.exec:\vdvvp.exe110⤵PID:1144
-
\??\c:\dddjv.exec:\dddjv.exe111⤵PID:2820
-
\??\c:\lrllxlx.exec:\lrllxlx.exe112⤵PID:1812
-
\??\c:\nbhtnt.exec:\nbhtnt.exe113⤵
- System Location Discovery: System Language Discovery
PID:900 -
\??\c:\pvvdv.exec:\pvvdv.exe114⤵PID:1708
-
\??\c:\fllxrll.exec:\fllxrll.exe115⤵PID:2452
-
\??\c:\nhnbnb.exec:\nhnbnb.exe116⤵PID:2148
-
\??\c:\ppvjp.exec:\ppvjp.exe117⤵PID:2856
-
\??\c:\frxlrfl.exec:\frxlrfl.exe118⤵PID:692
-
\??\c:\rrllflr.exec:\rrllflr.exe119⤵PID:1984
-
\??\c:\bbbhth.exec:\bbbhth.exe120⤵PID:1616
-
\??\c:\jdvvj.exec:\jdvvj.exe121⤵PID:1396
-
\??\c:\ffffrrf.exec:\ffffrrf.exe122⤵PID:2380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-