Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:38
Behavioral task
behavioral1
Sample
c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe
-
Size
335KB
-
MD5
92268ac5d4ad9953d3ad64c6fec54977
-
SHA1
3baffdf8d0f134a049b0ef1ceaf58a411dd38d9f
-
SHA256
c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161
-
SHA512
9f49c9245046eb0e446b92fbb3b664a21747d5f5df68bc53ab3c994c09fc4b9ce4f87e5e7a28f6973b055205aef06ded86178ba6f3bb18276a1a0c44b9673be6
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRt:R4wFHoSHYHUrAwfMp3CDRt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/3000-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-41-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/796-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-199-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1764-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-327-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2860-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-340-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1828-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-476-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2348-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1420-521-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2744-573-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2340-653-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1504-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-720-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3056-751-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2308-818-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2424-824-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-948-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1840-1021-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-1040-0x00000000773F0000-0x000000007750F000-memory.dmp family_blackmoon behavioral1/memory/2760-1107-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2276-1214-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1672-1231-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2256-1242-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2176-8070-0x00000000773F0000-0x000000007750F000-memory.dmp family_blackmoon behavioral1/memory/2176-25217-0x00000000773F0000-0x000000007750F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3060 httbbn.exe 2524 dddpj.exe 1316 fxfrxfx.exe 2684 vpvdj.exe 2740 hhtbnt.exe 2968 ddpjv.exe 2832 tnhbbn.exe 2708 pvppd.exe 2272 7xfrffr.exe 2648 7hbtth.exe 2664 pppdp.exe 3044 nhbhtt.exe 1400 pdjjd.exe 2004 9pjpp.exe 1992 flrrxlx.exe 1620 1jvvj.exe 796 lffxxfr.exe 1592 9bnthh.exe 2888 1nhttb.exe 2900 lfxlfrl.exe 2876 bthhhh.exe 1184 djpdd.exe 1624 rrlxlxr.exe 2276 hhhtbn.exe 1764 3ppdv.exe 1712 fffrflf.exe 1788 djdpj.exe 844 7rlfrlf.exe 980 hhhtth.exe 1912 1pjvj.exe 768 lrlflfr.exe 1680 flflrfl.exe 2560 lfxfxlr.exe 940 lxrfrxl.exe 2104 tnhnbh.exe 3068 dvppd.exe 1496 dvpdp.exe 2464 ffxfrxx.exe 2376 5rflrfl.exe 2524 9nhnbn.exe 2428 vpjvj.exe 2732 3dddj.exe 2804 ffflfxl.exe 2740 7ffffrf.exe 2860 tbtthn.exe 2124 dvvvj.exe 2620 pjdjp.exe 2636 3xrxlxf.exe 2588 1tbhnn.exe 2168 1nbbhh.exe 3032 pvvpp.exe 3048 jjdjj.exe 2320 xrllrrf.exe 1864 nhhtnt.exe 2412 nhbbhh.exe 1948 jjdvp.exe 1344 lrfxrlr.exe 620 xrrfrfr.exe 1428 3hhbth.exe 1540 vvpjd.exe 1584 pvvjv.exe 1828 ffxfllr.exe 2888 5xlrffr.exe 824 tbthth.exe -
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d0000000122e4-9.dat upx behavioral1/memory/3000-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000016d58-17.dat upx behavioral1/memory/1316-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016db5-23.dat upx behavioral1/memory/2524-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dd0-34.dat upx behavioral1/memory/1316-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016de4-42.dat upx behavioral1/memory/2684-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016de8-50.dat upx behavioral1/memory/2740-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016eb8-58.dat upx behavioral1/memory/2832-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018697-66.dat upx behavioral1/files/0x00050000000187a2-73.dat upx behavioral1/memory/2708-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c34-82.dat upx behavioral1/memory/2272-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c44-89.dat upx behavioral1/memory/2664-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f65-98.dat upx behavioral1/files/0x000600000001904c-106.dat upx behavioral1/memory/3044-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190e1-114.dat upx behavioral1/memory/2004-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191d2-121.dat upx behavioral1/files/0x00050000000191f6-130.dat upx behavioral1/memory/1992-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019217-137.dat upx behavioral1/memory/1620-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/796-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019240-147.dat upx behavioral1/memory/1592-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-155.dat upx behavioral1/files/0x0009000000016d36-163.dat upx behavioral1/files/0x0005000000019268-170.dat upx behavioral1/files/0x000500000001926c-177.dat upx behavioral1/files/0x0005000000019275-184.dat upx behavioral1/memory/1624-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-192.dat upx behavioral1/files/0x000500000001929a-202.dat upx behavioral1/memory/1764-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019319-209.dat upx behavioral1/memory/1712-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019365-217.dat upx behavioral1/files/0x0005000000019377-224.dat upx behavioral1/files/0x0005000000019387-231.dat upx behavioral1/memory/980-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a4-239.dat upx behavioral1/files/0x00050000000193c1-255.dat upx behavioral1/files/0x00050000000193b3-249.dat upx behavioral1/memory/1788-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/940-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2376-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2376-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-326-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2860-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-371-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3060 3000 c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe 30 PID 3000 wrote to memory of 3060 3000 c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe 30 PID 3000 wrote to memory of 3060 3000 c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe 30 PID 3000 wrote to memory of 3060 3000 c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe 30 PID 3060 wrote to memory of 2524 3060 httbbn.exe 31 PID 3060 wrote to memory of 2524 3060 httbbn.exe 31 PID 3060 wrote to memory of 2524 3060 httbbn.exe 31 PID 3060 wrote to memory of 2524 3060 httbbn.exe 31 PID 2524 wrote to memory of 1316 2524 dddpj.exe 32 PID 2524 wrote to memory of 1316 2524 dddpj.exe 32 PID 2524 wrote to memory of 1316 2524 dddpj.exe 32 PID 2524 wrote to memory of 1316 2524 dddpj.exe 32 PID 1316 wrote to memory of 2684 1316 fxfrxfx.exe 33 PID 1316 wrote to memory of 2684 1316 fxfrxfx.exe 33 PID 1316 wrote to memory of 2684 1316 fxfrxfx.exe 33 PID 1316 wrote to memory of 2684 1316 fxfrxfx.exe 33 PID 2684 wrote to memory of 2740 2684 vpvdj.exe 34 PID 2684 wrote to memory of 2740 2684 vpvdj.exe 34 PID 2684 wrote to memory of 2740 2684 vpvdj.exe 34 PID 2684 wrote to memory of 2740 2684 vpvdj.exe 34 PID 2740 wrote to memory of 2968 2740 hhtbnt.exe 35 PID 2740 wrote to memory of 2968 2740 hhtbnt.exe 35 PID 2740 wrote to memory of 2968 2740 hhtbnt.exe 35 PID 2740 wrote to memory of 2968 2740 hhtbnt.exe 35 PID 2968 wrote to memory of 2832 2968 ddpjv.exe 36 PID 2968 wrote to memory of 2832 2968 ddpjv.exe 36 PID 2968 wrote to memory of 2832 2968 ddpjv.exe 36 PID 2968 wrote to memory of 2832 2968 ddpjv.exe 36 PID 2832 wrote to memory of 2708 2832 tnhbbn.exe 37 PID 2832 wrote to memory of 2708 2832 tnhbbn.exe 37 PID 2832 wrote to memory of 2708 2832 tnhbbn.exe 37 PID 2832 wrote to memory of 2708 2832 tnhbbn.exe 37 PID 2708 wrote to memory of 2272 2708 pvppd.exe 38 PID 2708 wrote to memory of 2272 2708 pvppd.exe 38 PID 2708 wrote to memory of 2272 2708 pvppd.exe 38 PID 2708 wrote to memory of 2272 2708 pvppd.exe 38 PID 2272 wrote to memory of 2648 2272 7xfrffr.exe 39 PID 2272 wrote to memory of 2648 2272 7xfrffr.exe 39 PID 2272 wrote to memory of 2648 2272 7xfrffr.exe 39 PID 2272 wrote to memory of 2648 2272 7xfrffr.exe 39 PID 2648 wrote to memory of 2664 2648 7hbtth.exe 40 PID 2648 wrote to memory of 2664 2648 7hbtth.exe 40 PID 2648 wrote to memory of 2664 2648 7hbtth.exe 40 PID 2648 wrote to memory of 2664 2648 7hbtth.exe 40 PID 2664 wrote to memory of 3044 2664 pppdp.exe 41 PID 2664 wrote to memory of 3044 2664 pppdp.exe 41 PID 2664 wrote to memory of 3044 2664 pppdp.exe 41 PID 2664 wrote to memory of 3044 2664 pppdp.exe 41 PID 3044 wrote to memory of 1400 3044 nhbhtt.exe 42 PID 3044 wrote to memory of 1400 3044 nhbhtt.exe 42 PID 3044 wrote to memory of 1400 3044 nhbhtt.exe 42 PID 3044 wrote to memory of 1400 3044 nhbhtt.exe 42 PID 1400 wrote to memory of 2004 1400 pdjjd.exe 43 PID 1400 wrote to memory of 2004 1400 pdjjd.exe 43 PID 1400 wrote to memory of 2004 1400 pdjjd.exe 43 PID 1400 wrote to memory of 2004 1400 pdjjd.exe 43 PID 2004 wrote to memory of 1992 2004 9pjpp.exe 44 PID 2004 wrote to memory of 1992 2004 9pjpp.exe 44 PID 2004 wrote to memory of 1992 2004 9pjpp.exe 44 PID 2004 wrote to memory of 1992 2004 9pjpp.exe 44 PID 1992 wrote to memory of 1620 1992 flrrxlx.exe 45 PID 1992 wrote to memory of 1620 1992 flrrxlx.exe 45 PID 1992 wrote to memory of 1620 1992 flrrxlx.exe 45 PID 1992 wrote to memory of 1620 1992 flrrxlx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe"C:\Users\Admin\AppData\Local\Temp\c6ac3075a86ba33ca902eebdd98cdd910c26f62354e00b3376f8d5daa9758161.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\httbbn.exec:\httbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\dddpj.exec:\dddpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\fxfrxfx.exec:\fxfrxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\vpvdj.exec:\vpvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hhtbnt.exec:\hhtbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ddpjv.exec:\ddpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\tnhbbn.exec:\tnhbbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\pvppd.exec:\pvppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7xfrffr.exec:\7xfrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\7hbtth.exec:\7hbtth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pppdp.exec:\pppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nhbhtt.exec:\nhbhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pdjjd.exec:\pdjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\9pjpp.exec:\9pjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\flrrxlx.exec:\flrrxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\1jvvj.exec:\1jvvj.exe17⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lffxxfr.exec:\lffxxfr.exe18⤵
- Executes dropped EXE
PID:796 -
\??\c:\9bnthh.exec:\9bnthh.exe19⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1nhttb.exec:\1nhttb.exe20⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lfxlfrl.exec:\lfxlfrl.exe21⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bthhhh.exec:\bthhhh.exe22⤵
- Executes dropped EXE
PID:2876 -
\??\c:\djpdd.exec:\djpdd.exe23⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rrlxlxr.exec:\rrlxlxr.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hhhtbn.exec:\hhhtbn.exe25⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3ppdv.exec:\3ppdv.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fffrflf.exec:\fffrflf.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\djdpj.exec:\djdpj.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7rlfrlf.exec:\7rlfrlf.exe29⤵
- Executes dropped EXE
PID:844 -
\??\c:\hhhtth.exec:\hhhtth.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\1pjvj.exec:\1pjvj.exe31⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lrlflfr.exec:\lrlflfr.exe32⤵
- Executes dropped EXE
PID:768 -
\??\c:\flflrfl.exec:\flflrfl.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lfxfxlr.exec:\lfxfxlr.exe34⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lxrfrxl.exec:\lxrfrxl.exe35⤵
- Executes dropped EXE
PID:940 -
\??\c:\tnhnbh.exec:\tnhnbh.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dvppd.exec:\dvppd.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dvpdp.exec:\dvpdp.exe38⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ffxfrxx.exec:\ffxfrxx.exe39⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5rflrfl.exec:\5rflrfl.exe40⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9nhnbn.exec:\9nhnbn.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vpjvj.exec:\vpjvj.exe42⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3dddj.exec:\3dddj.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ffflfxl.exec:\ffflfxl.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7ffffrf.exec:\7ffffrf.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tbtthn.exec:\tbtthn.exe46⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvvvj.exec:\dvvvj.exe47⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjdjp.exec:\pjdjp.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\3xrxlxf.exec:\3xrxlxf.exe49⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1tbhnn.exec:\1tbhnn.exe50⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1nbbhh.exec:\1nbbhh.exe51⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pvvpp.exec:\pvvpp.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjdjj.exec:\jjdjj.exe53⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrllrrf.exec:\xrllrrf.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhhtnt.exec:\nhhtnt.exe55⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nhbbhh.exec:\nhbbhh.exe56⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjdvp.exec:\jjdvp.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948 -
\??\c:\lrfxrlr.exec:\lrfxrlr.exe58⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe59⤵
- Executes dropped EXE
PID:620 -
\??\c:\3hhbth.exec:\3hhbth.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vvpjd.exec:\vvpjd.exe61⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pvvjv.exec:\pvvjv.exe62⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ffxfllr.exec:\ffxfllr.exe63⤵
- Executes dropped EXE
PID:1828 -
\??\c:\5xlrffr.exec:\5xlrffr.exe64⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tbthth.exec:\tbthth.exe65⤵
- Executes dropped EXE
PID:824 -
\??\c:\vvddj.exec:\vvddj.exe66⤵PID:2876
-
\??\c:\ppddv.exec:\ppddv.exe67⤵PID:2188
-
\??\c:\xxrfffx.exec:\xxrfffx.exe68⤵PID:2564
-
\??\c:\1frflfx.exec:\1frflfx.exe69⤵PID:2688
-
\??\c:\tnbhnn.exec:\tnbhnn.exe70⤵PID:1084
-
\??\c:\bbbnht.exec:\bbbnht.exe71⤵PID:1164
-
\??\c:\ppjvj.exec:\ppjvj.exe72⤵PID:848
-
\??\c:\3rxffrf.exec:\3rxffrf.exe73⤵PID:1952
-
\??\c:\xlxfflr.exec:\xlxfflr.exe74⤵PID:1468
-
\??\c:\tnhnbb.exec:\tnhnbb.exe75⤵PID:2256
-
\??\c:\3jvjj.exec:\3jvjj.exe76⤵PID:392
-
\??\c:\vpjvv.exec:\vpjvv.exe77⤵PID:2348
-
\??\c:\lxxrxfx.exec:\lxxrxfx.exe78⤵PID:1200
-
\??\c:\fxrxxfx.exec:\fxrxxfx.exe79⤵PID:2988
-
\??\c:\bthhht.exec:\bthhht.exe80⤵PID:676
-
\??\c:\ppdpd.exec:\ppdpd.exe81⤵PID:872
-
\??\c:\vvvpj.exec:\vvvpj.exe82⤵PID:1420
-
\??\c:\1rfrxlr.exec:\1rfrxlr.exe83⤵PID:2532
-
\??\c:\tbhhtt.exec:\tbhhtt.exe84⤵PID:1728
-
\??\c:\hbbntt.exec:\hbbntt.exe85⤵PID:1512
-
\??\c:\5pjpd.exec:\5pjpd.exe86⤵PID:2844
-
\??\c:\frlflfr.exec:\frlflfr.exe87⤵PID:1868
-
\??\c:\tnnbtt.exec:\tnnbtt.exe88⤵PID:2092
-
\??\c:\nthtbh.exec:\nthtbh.exe89⤵PID:2840
-
\??\c:\1vdvd.exec:\1vdvd.exe90⤵PID:2880
-
\??\c:\1pvvp.exec:\1pvvp.exe91⤵PID:2800
-
\??\c:\rlrfflf.exec:\rlrfflf.exe92⤵PID:2744
-
\??\c:\bttbht.exec:\bttbht.exe93⤵PID:2856
-
\??\c:\nhnnnn.exec:\nhnnnn.exe94⤵PID:2852
-
\??\c:\3vjjj.exec:\3vjjj.exe95⤵PID:2832
-
\??\c:\1rlrxxf.exec:\1rlrxxf.exe96⤵PID:2708
-
\??\c:\9xlllrf.exec:\9xlllrf.exe97⤵PID:2760
-
\??\c:\9hhtbt.exec:\9hhtbt.exe98⤵PID:2608
-
\??\c:\pjpvv.exec:\pjpvv.exe99⤵PID:2648
-
\??\c:\djdjd.exec:\djdjd.exe100⤵PID:2668
-
\??\c:\7lfrxfx.exec:\7lfrxfx.exe101⤵PID:3032
-
\??\c:\llxxflr.exec:\llxxflr.exe102⤵PID:1668
-
\??\c:\1hhthb.exec:\1hhthb.exe103⤵PID:2032
-
\??\c:\9jdjj.exec:\9jdjj.exe104⤵PID:2660
-
\??\c:\vpjjp.exec:\vpjjp.exe105⤵PID:704
-
\??\c:\rlllxfx.exec:\rlllxfx.exe106⤵PID:1956
-
\??\c:\ffxflrl.exec:\ffxflrl.exe107⤵PID:2340
-
\??\c:\7bttht.exec:\7bttht.exe108⤵PID:1020
-
\??\c:\1vjvv.exec:\1vjvv.exe109⤵PID:2896
-
\??\c:\vpjjj.exec:\vpjjj.exe110⤵PID:300
-
\??\c:\rlxxxll.exec:\rlxxxll.exe111⤵PID:1504
-
\??\c:\3lfxffx.exec:\3lfxffx.exe112⤵PID:1572
-
\??\c:\tthtnn.exec:\tthtnn.exe113⤵PID:2632
-
\??\c:\dpdpd.exec:\dpdpd.exe114⤵PID:1988
-
\??\c:\pdvdp.exec:\pdvdp.exe115⤵PID:2372
-
\??\c:\9llfrrl.exec:\9llfrrl.exe116⤵PID:2352
-
\??\c:\nnbhbh.exec:\nnbhbh.exe117⤵PID:2564
-
\??\c:\9hnntb.exec:\9hnntb.exe118⤵PID:2688
-
\??\c:\djjvj.exec:\djjvj.exe119⤵PID:2080
-
\??\c:\xlxlrlf.exec:\xlxlrlf.exe120⤵PID:2012
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe121⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-