Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe
-
Size
455KB
-
MD5
4a95c4737c3d2d34c68cdbe7e841e547
-
SHA1
708ed77fef0fa022195701f9ef380b1abcfc727e
-
SHA256
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7
-
SHA512
db0b439d24847574c9d2dca6c2c8011402d1fc3848c4924ecaf4fe02b9229668bc7b5026a6b3c84950baf4e4dc1b47fcab9dbc67aedeaf8c68aead663fcc5fe9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRc:q7Tc2NYHUrAwfMp3CDRc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-132-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-182-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1608-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-335-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2732-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-591-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2860-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-808-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-290-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/796-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-170-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2504-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-1069-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2720-1158-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2592-1271-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1200-1358-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 rlrxllr.exe 2516 dvdjp.exe 2684 ddpvp.exe 1972 5nbhhh.exe 2812 7dvvd.exe 2752 xlxxxrf.exe 1736 3bttbb.exe 2632 5jvvv.exe 2604 7rllxfl.exe 1704 hbtbhh.exe 2356 9ntthn.exe 540 1ffxxlr.exe 1456 tntntb.exe 1992 pvppv.exe 2504 bthhbb.exe 1764 7dpvv.exe 1984 9jvjd.exe 1488 rlrlllr.exe 2196 jdvjv.exe 1608 frrlxxx.exe 1772 hbtbhn.exe 2588 jjvvv.exe 1464 lxlfrrl.exe 2988 1ntnnn.exe 2780 vpddp.exe 2224 rflrrlr.exe 1780 tnthhb.exe 1204 5pvdp.exe 2060 fxllllr.exe 796 hbhtbt.exe 2476 1ntttt.exe 2392 frxxxxl.exe 2104 ntntbb.exe 352 nhtbhb.exe 2704 xrrrxrf.exe 2040 3lllrll.exe 2732 vvppv.exe 2900 xrxfrlf.exe 1856 hbnnhh.exe 2764 vpjdd.exe 2632 rlflxfr.exe 1548 9llflrx.exe 2648 nhhnbt.exe 1404 tnhnbb.exe 1412 1jjdj.exe 2804 xxlrllx.exe 2676 3frrxfr.exe 1452 nbtbhh.exe 1956 1jpvd.exe 772 ddvvd.exe 1980 rrflxfx.exe 2668 3rrlrff.exe 1016 7htbhn.exe 2168 pdjpv.exe 3044 jdvjp.exe 1056 xfrlxfr.exe 2252 nhtbbn.exe 2176 bththh.exe 1180 jjddp.exe 2992 fflrffl.exe 1284 lfxfxxl.exe 2988 nnhnhh.exe 2780 djdvj.exe 1036 jvppv.exe -
resource yara_rule behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-922-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-960-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-1144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-1278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-1358-0x00000000003B0000-0x00000000003DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1628 2348 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 30 PID 2348 wrote to memory of 1628 2348 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 30 PID 2348 wrote to memory of 1628 2348 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 30 PID 2348 wrote to memory of 1628 2348 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 30 PID 1628 wrote to memory of 2516 1628 rlrxllr.exe 103 PID 1628 wrote to memory of 2516 1628 rlrxllr.exe 103 PID 1628 wrote to memory of 2516 1628 rlrxllr.exe 103 PID 1628 wrote to memory of 2516 1628 rlrxllr.exe 103 PID 2516 wrote to memory of 2684 2516 dvdjp.exe 32 PID 2516 wrote to memory of 2684 2516 dvdjp.exe 32 PID 2516 wrote to memory of 2684 2516 dvdjp.exe 32 PID 2516 wrote to memory of 2684 2516 dvdjp.exe 32 PID 2684 wrote to memory of 1972 2684 ddpvp.exe 33 PID 2684 wrote to memory of 1972 2684 ddpvp.exe 33 PID 2684 wrote to memory of 1972 2684 ddpvp.exe 33 PID 2684 wrote to memory of 1972 2684 ddpvp.exe 33 PID 1972 wrote to memory of 2812 1972 5nbhhh.exe 34 PID 1972 wrote to memory of 2812 1972 5nbhhh.exe 34 PID 1972 wrote to memory of 2812 1972 5nbhhh.exe 34 PID 1972 wrote to memory of 2812 1972 5nbhhh.exe 34 PID 2812 wrote to memory of 2752 2812 7dvvd.exe 35 PID 2812 wrote to memory of 2752 2812 7dvvd.exe 35 PID 2812 wrote to memory of 2752 2812 7dvvd.exe 35 PID 2812 wrote to memory of 2752 2812 7dvvd.exe 35 PID 2752 wrote to memory of 1736 2752 xlxxxrf.exe 36 PID 2752 wrote to memory of 1736 2752 xlxxxrf.exe 36 PID 2752 wrote to memory of 1736 2752 xlxxxrf.exe 36 PID 2752 wrote to memory of 1736 2752 xlxxxrf.exe 36 PID 1736 wrote to memory of 2632 1736 3bttbb.exe 37 PID 1736 wrote to memory of 2632 1736 3bttbb.exe 37 PID 1736 wrote to memory of 2632 1736 3bttbb.exe 37 PID 1736 wrote to memory of 2632 1736 3bttbb.exe 37 PID 2632 wrote to memory of 2604 2632 5jvvv.exe 38 PID 2632 wrote to memory of 2604 2632 5jvvv.exe 38 PID 2632 wrote to memory of 2604 2632 5jvvv.exe 38 PID 2632 wrote to memory of 2604 2632 5jvvv.exe 38 PID 2604 wrote to memory of 1704 2604 7rllxfl.exe 115 PID 2604 wrote to memory of 1704 2604 7rllxfl.exe 115 PID 2604 wrote to memory of 1704 2604 7rllxfl.exe 115 PID 2604 wrote to memory of 1704 2604 7rllxfl.exe 115 PID 1704 wrote to memory of 2356 1704 hbtbhh.exe 40 PID 1704 wrote to memory of 2356 1704 hbtbhh.exe 40 PID 1704 wrote to memory of 2356 1704 hbtbhh.exe 40 PID 1704 wrote to memory of 2356 1704 hbtbhh.exe 40 PID 2356 wrote to memory of 540 2356 9ntthn.exe 41 PID 2356 wrote to memory of 540 2356 9ntthn.exe 41 PID 2356 wrote to memory of 540 2356 9ntthn.exe 41 PID 2356 wrote to memory of 540 2356 9ntthn.exe 41 PID 540 wrote to memory of 1456 540 1ffxxlr.exe 42 PID 540 wrote to memory of 1456 540 1ffxxlr.exe 42 PID 540 wrote to memory of 1456 540 1ffxxlr.exe 42 PID 540 wrote to memory of 1456 540 1ffxxlr.exe 42 PID 1456 wrote to memory of 1992 1456 tntntb.exe 43 PID 1456 wrote to memory of 1992 1456 tntntb.exe 43 PID 1456 wrote to memory of 1992 1456 tntntb.exe 43 PID 1456 wrote to memory of 1992 1456 tntntb.exe 43 PID 1992 wrote to memory of 2504 1992 pvppv.exe 44 PID 1992 wrote to memory of 2504 1992 pvppv.exe 44 PID 1992 wrote to memory of 2504 1992 pvppv.exe 44 PID 1992 wrote to memory of 2504 1992 pvppv.exe 44 PID 2504 wrote to memory of 1764 2504 bthhbb.exe 45 PID 2504 wrote to memory of 1764 2504 bthhbb.exe 45 PID 2504 wrote to memory of 1764 2504 bthhbb.exe 45 PID 2504 wrote to memory of 1764 2504 bthhbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe"C:\Users\Admin\AppData\Local\Temp\b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rlrxllr.exec:\rlrxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\dvdjp.exec:\dvdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ddpvp.exec:\ddpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\5nbhhh.exec:\5nbhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\7dvvd.exec:\7dvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xlxxxrf.exec:\xlxxxrf.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3bttbb.exec:\3bttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\5jvvv.exec:\5jvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\7rllxfl.exec:\7rllxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hbtbhh.exec:\hbtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\9ntthn.exec:\9ntthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\1ffxxlr.exec:\1ffxxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\tntntb.exec:\tntntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\pvppv.exec:\pvppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\bthhbb.exec:\bthhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\7dpvv.exec:\7dpvv.exe17⤵
- Executes dropped EXE
PID:1764 -
\??\c:\9jvjd.exec:\9jvjd.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rlrlllr.exec:\rlrlllr.exe19⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jdvjv.exec:\jdvjv.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\frrlxxx.exec:\frrlxxx.exe21⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbtbhn.exec:\hbtbhn.exe22⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jjvvv.exec:\jjvvv.exe23⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe24⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1ntnnn.exec:\1ntnnn.exe25⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpddp.exec:\vpddp.exe26⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rflrrlr.exec:\rflrrlr.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tnthhb.exec:\tnthhb.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5pvdp.exec:\5pvdp.exe29⤵
- Executes dropped EXE
PID:1204 -
\??\c:\fxllllr.exec:\fxllllr.exe30⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbhtbt.exec:\hbhtbt.exe31⤵
- Executes dropped EXE
PID:796 -
\??\c:\1ntttt.exec:\1ntttt.exe32⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jjvvj.exec:\jjvvj.exe33⤵PID:2528
-
\??\c:\frxxxxl.exec:\frxxxxl.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ntntbb.exec:\ntntbb.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nhtbhb.exec:\nhtbhb.exe36⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrrrxrf.exec:\xrrrxrf.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3lllrll.exec:\3lllrll.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvppv.exec:\vvppv.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrxfrlf.exec:\xrxfrlf.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbnnhh.exec:\hbnnhh.exe41⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vpjdd.exec:\vpjdd.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rlflxfr.exec:\rlflxfr.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9llflrx.exec:\9llflrx.exe44⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nhhnbt.exec:\nhhnbt.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnhnbb.exec:\tnhnbb.exe46⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1jjdj.exec:\1jjdj.exe47⤵
- Executes dropped EXE
PID:1412 -
\??\c:\xxlrllx.exec:\xxlrllx.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3frrxfr.exec:\3frrxfr.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nbtbhh.exec:\nbtbhh.exe50⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1jpvd.exec:\1jpvd.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ddvvd.exec:\ddvvd.exe52⤵
- Executes dropped EXE
PID:772 -
\??\c:\rrflxfx.exec:\rrflxfx.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3rrlrff.exec:\3rrlrff.exe54⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7htbhn.exec:\7htbhn.exe55⤵
- Executes dropped EXE
PID:1016 -
\??\c:\pdjpv.exec:\pdjpv.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdvjp.exec:\jdvjp.exe57⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xfrlxfr.exec:\xfrlxfr.exe58⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nhtbbn.exec:\nhtbbn.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bththh.exec:\bththh.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jjddp.exec:\jjddp.exe61⤵
- Executes dropped EXE
PID:1180 -
\??\c:\fflrffl.exec:\fflrffl.exe62⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lfxfxxl.exec:\lfxfxxl.exe63⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nnhnhh.exec:\nnhnhh.exe64⤵
- Executes dropped EXE
PID:2988 -
\??\c:\djdvj.exec:\djdvj.exe65⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jvppv.exec:\jvppv.exe66⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe67⤵PID:2472
-
\??\c:\lfrfxrf.exec:\lfrfxrf.exe68⤵PID:2264
-
\??\c:\nhhntb.exec:\nhhntb.exe69⤵PID:3020
-
\??\c:\9jvvv.exec:\9jvvv.exe70⤵PID:896
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe71⤵PID:1100
-
\??\c:\9rfxllx.exec:\9rfxllx.exe72⤵PID:2364
-
\??\c:\tnbhnt.exec:\tnbhnt.exe73⤵PID:2320
-
\??\c:\nnbbbh.exec:\nnbbbh.exe74⤵PID:2572
-
\??\c:\djjdv.exec:\djjdv.exe75⤵PID:2516
-
\??\c:\pjjpv.exec:\pjjpv.exe76⤵PID:2228
-
\??\c:\frxxfrl.exec:\frxxfrl.exe77⤵PID:2192
-
\??\c:\bhtbhb.exec:\bhtbhb.exe78⤵
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\htbtnn.exec:\htbtnn.exe79⤵PID:2040
-
\??\c:\1jddj.exec:\1jddj.exe80⤵PID:2752
-
\??\c:\5vjdd.exec:\5vjdd.exe81⤵PID:3056
-
\??\c:\ffflrlr.exec:\ffflrlr.exe82⤵PID:2640
-
\??\c:\tntbtb.exec:\tntbtb.exe83⤵PID:1712
-
\??\c:\pppvd.exec:\pppvd.exe84⤵PID:2736
-
\??\c:\vpjvd.exec:\vpjvd.exe85⤵PID:2316
-
\??\c:\pjpvd.exec:\pjpvd.exe86⤵PID:2808
-
\??\c:\xlflxfx.exec:\xlflxfx.exe87⤵PID:1704
-
\??\c:\lfxxffl.exec:\lfxxffl.exe88⤵PID:2068
-
\??\c:\5nnntb.exec:\5nnntb.exe89⤵PID:2124
-
\??\c:\7pddv.exec:\7pddv.exe90⤵PID:2948
-
\??\c:\jjdjd.exec:\jjdjd.exe91⤵PID:2836
-
\??\c:\3rfffxf.exec:\3rfffxf.exe92⤵PID:2676
-
\??\c:\1fxflfr.exec:\1fxflfr.exe93⤵PID:1452
-
\??\c:\1hbbbh.exec:\1hbbbh.exe94⤵PID:1956
-
\??\c:\tbnbhh.exec:\tbnbhh.exe95⤵PID:772
-
\??\c:\pvppd.exec:\pvppd.exe96⤵
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\9pvdd.exec:\9pvdd.exe97⤵PID:1652
-
\??\c:\bthnbb.exec:\bthnbb.exe98⤵PID:3048
-
\??\c:\tnbtnt.exec:\tnbtnt.exe99⤵PID:2672
-
\??\c:\9dvvd.exec:\9dvvd.exe100⤵PID:1744
-
\??\c:\ppvvj.exec:\ppvvj.exe101⤵PID:2968
-
\??\c:\xxxllrf.exec:\xxxllrf.exe102⤵PID:1560
-
\??\c:\xrllrxf.exec:\xrllrxf.exe103⤵PID:2256
-
\??\c:\tnbnhh.exec:\tnbnhh.exe104⤵PID:2940
-
\??\c:\nnhbtt.exec:\nnhbtt.exe105⤵PID:1232
-
\??\c:\jpjvj.exec:\jpjvj.exe106⤵PID:2992
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe107⤵PID:1832
-
\??\c:\flrxxff.exec:\flrxxff.exe108⤵PID:1592
-
\??\c:\3nbbnn.exec:\3nbbnn.exe109⤵PID:2148
-
\??\c:\ttnbth.exec:\ttnbth.exe110⤵PID:784
-
\??\c:\jdpvj.exec:\jdpvj.exe111⤵PID:2360
-
\??\c:\ddjjj.exec:\ddjjj.exe112⤵PID:1960
-
\??\c:\llxxxxx.exec:\llxxxxx.exe113⤵PID:2132
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe114⤵PID:2960
-
\??\c:\nnhbtt.exec:\nnhbtt.exe115⤵PID:2476
-
\??\c:\pjvvd.exec:\pjvvd.exe116⤵PID:2536
-
\??\c:\jjdvv.exec:\jjdvv.exe117⤵PID:2320
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe118⤵PID:2572
-
\??\c:\rrlxxfr.exec:\rrlxxfr.exe119⤵PID:2516
-
\??\c:\nhtbhh.exec:\nhtbhh.exe120⤵PID:2828
-
\??\c:\vjvpp.exec:\vjvpp.exe121⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-