Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:17
Behavioral task
behavioral1
Sample
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe
-
Size
333KB
-
MD5
b1eaf5db7e7eb52285d559606b0eb4ee
-
SHA1
87a979a408c4c8431d9393071f105cf1a01d6937
-
SHA256
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f
-
SHA512
7f902a6dfe676a3a268fb73e87ecab81da312872ace10ce1c8259049ffe28e647d44f5395b33542337de85ad9edea9309980da881983d64c68f065612408f40e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTb:R4wFHoSHYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1552-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-30-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2784-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-42-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2628-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-69-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2512-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-89-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2660-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1244-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-189-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1796-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1396-237-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3068-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-252-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/612-269-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/840-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-337-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2800-351-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2484-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-381-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2396-403-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/620-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-471-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/924-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-529-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/540-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-576-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-619-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2764-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-678-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-12980-0x0000000077460000-0x000000007757F000-memory.dmp family_blackmoon behavioral1/memory/1492-14974-0x0000000077460000-0x000000007757F000-memory.dmp family_blackmoon behavioral1/memory/1492-15835-0x0000000077460000-0x000000007757F000-memory.dmp family_blackmoon behavioral1/memory/1492-16122-0x0000000077460000-0x000000007757F000-memory.dmp family_blackmoon behavioral1/memory/1492-24064-0x0000000077460000-0x000000007757F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 1nbhhn.exe 2956 3pddv.exe 2420 nhtnbn.exe 2784 7djjv.exe 2628 9httbt.exe 2720 jdpvj.exe 3044 nhnhnn.exe 2512 jjvvd.exe 2660 lfflrxf.exe 2480 jdpdj.exe 1892 lfrxffl.exe 2944 nbtthb.exe 1604 pjvpp.exe 2396 fxlxxxf.exe 1244 nhntbb.exe 2412 jvjjp.exe 1584 fxxlflf.exe 1844 3hbbhh.exe 1692 jjppp.exe 1884 3llrxrr.exe 1232 tnhhnb.exe 2920 7lxxlrx.exe 856 ttttbn.exe 1796 5pvjp.exe 1660 7xlrfff.exe 1524 jdpvp.exe 1396 llfflrl.exe 884 3htnth.exe 3068 thbttt.exe 2144 3frfffl.exe 612 5bnnnt.exe 1404 3nnnbh.exe 840 1llrrlr.exe 2364 xlxfllr.exe 2896 nhtbhb.exe 1620 dpvvd.exe 2104 vppdp.exe 2968 xrlxlfl.exe 2840 bttttt.exe 1712 1hnbbt.exe 2616 jdpvj.exe 2692 vjvpp.exe 2644 lfrxffl.exe 2720 nhbntt.exe 2768 bntbnt.exe 2800 jvppv.exe 2656 9xrllrx.exe 2484 9bbbbb.exe 2748 hnbthh.exe 2984 vdjvp.exe 1312 fxfxlxx.exe 2948 fxllxrx.exe 1268 bthhhh.exe 1128 thhhhh.exe 2396 9pdjv.exe 620 9rxxrrr.exe 2404 rfffxfl.exe 2380 ttbhth.exe 1960 jvpvj.exe 1360 pdppp.exe 2216 fxrffrx.exe 780 bthhhb.exe 1956 tnbhnt.exe 1588 htnnbn.exe -
resource yara_rule behavioral1/memory/1552-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1552-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001227f-8.dat upx behavioral1/memory/1552-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000700000001925e-17.dat upx behavioral1/memory/2836-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019261-26.dat upx behavioral1/files/0x0006000000019334-34.dat upx behavioral1/memory/2420-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019350-43.dat upx behavioral1/memory/2628-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000193b4-53.dat upx behavioral1/files/0x00070000000193e1-62.dat upx behavioral1/memory/2720-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019611-71.dat upx behavioral1/memory/2512-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019613-81.dat upx behavioral1/memory/2512-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-89-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019615-88.dat upx behavioral1/memory/2660-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019617-97.dat upx behavioral1/files/0x0005000000019619-105.dat upx behavioral1/memory/1892-104-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001961b-113.dat upx behavioral1/memory/2944-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-121.dat upx behavioral1/files/0x000500000001961f-129.dat upx behavioral1/files/0x0005000000019621-140.dat upx behavioral1/memory/2412-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1244-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019622-148.dat upx behavioral1/memory/1844-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-157.dat upx behavioral1/memory/1692-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-165.dat upx behavioral1/files/0x000800000001878f-174.dat upx behavioral1/memory/1884-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019667-183.dat upx behavioral1/files/0x00050000000196b1-198.dat upx behavioral1/files/0x00050000000196af-191.dat upx behavioral1/memory/1232-189-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001977d-205.dat upx behavioral1/memory/1796-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197f8-213.dat upx behavioral1/files/0x0005000000019838-221.dat upx behavioral1/memory/1660-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000198f0-229.dat upx behavioral1/files/0x0005000000019c57-245.dat upx behavioral1/files/0x00050000000199bf-239.dat upx behavioral1/files/0x0005000000019c59-256.dat upx behavioral1/files/0x0005000000019c5b-263.dat upx behavioral1/memory/3068-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-253-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019cb9-271.dat upx behavioral1/memory/840-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-338-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1552 wrote to memory of 2836 1552 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 31 PID 1552 wrote to memory of 2836 1552 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 31 PID 1552 wrote to memory of 2836 1552 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 31 PID 1552 wrote to memory of 2836 1552 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 31 PID 2836 wrote to memory of 2956 2836 1nbhhn.exe 32 PID 2836 wrote to memory of 2956 2836 1nbhhn.exe 32 PID 2836 wrote to memory of 2956 2836 1nbhhn.exe 32 PID 2836 wrote to memory of 2956 2836 1nbhhn.exe 32 PID 2956 wrote to memory of 2420 2956 3pddv.exe 33 PID 2956 wrote to memory of 2420 2956 3pddv.exe 33 PID 2956 wrote to memory of 2420 2956 3pddv.exe 33 PID 2956 wrote to memory of 2420 2956 3pddv.exe 33 PID 2420 wrote to memory of 2784 2420 nhtnbn.exe 34 PID 2420 wrote to memory of 2784 2420 nhtnbn.exe 34 PID 2420 wrote to memory of 2784 2420 nhtnbn.exe 34 PID 2420 wrote to memory of 2784 2420 nhtnbn.exe 34 PID 2784 wrote to memory of 2628 2784 7djjv.exe 35 PID 2784 wrote to memory of 2628 2784 7djjv.exe 35 PID 2784 wrote to memory of 2628 2784 7djjv.exe 35 PID 2784 wrote to memory of 2628 2784 7djjv.exe 35 PID 2628 wrote to memory of 2720 2628 9httbt.exe 36 PID 2628 wrote to memory of 2720 2628 9httbt.exe 36 PID 2628 wrote to memory of 2720 2628 9httbt.exe 36 PID 2628 wrote to memory of 2720 2628 9httbt.exe 36 PID 2720 wrote to memory of 3044 2720 jdpvj.exe 37 PID 2720 wrote to memory of 3044 2720 jdpvj.exe 37 PID 2720 wrote to memory of 3044 2720 jdpvj.exe 37 PID 2720 wrote to memory of 3044 2720 jdpvj.exe 37 PID 3044 wrote to memory of 2512 3044 nhnhnn.exe 38 PID 3044 wrote to memory of 2512 3044 nhnhnn.exe 38 PID 3044 wrote to memory of 2512 3044 nhnhnn.exe 38 PID 3044 wrote to memory of 2512 3044 nhnhnn.exe 38 PID 2512 wrote to memory of 2660 2512 jjvvd.exe 39 PID 2512 wrote to memory of 2660 2512 jjvvd.exe 39 PID 2512 wrote to memory of 2660 2512 jjvvd.exe 39 PID 2512 wrote to memory of 2660 2512 jjvvd.exe 39 PID 2660 wrote to memory of 2480 2660 lfflrxf.exe 40 PID 2660 wrote to memory of 2480 2660 lfflrxf.exe 40 PID 2660 wrote to memory of 2480 2660 lfflrxf.exe 40 PID 2660 wrote to memory of 2480 2660 lfflrxf.exe 40 PID 2480 wrote to memory of 1892 2480 jdpdj.exe 41 PID 2480 wrote to memory of 1892 2480 jdpdj.exe 41 PID 2480 wrote to memory of 1892 2480 jdpdj.exe 41 PID 2480 wrote to memory of 1892 2480 jdpdj.exe 41 PID 1892 wrote to memory of 2944 1892 lfrxffl.exe 42 PID 1892 wrote to memory of 2944 1892 lfrxffl.exe 42 PID 1892 wrote to memory of 2944 1892 lfrxffl.exe 42 PID 1892 wrote to memory of 2944 1892 lfrxffl.exe 42 PID 2944 wrote to memory of 1604 2944 nbtthb.exe 43 PID 2944 wrote to memory of 1604 2944 nbtthb.exe 43 PID 2944 wrote to memory of 1604 2944 nbtthb.exe 43 PID 2944 wrote to memory of 1604 2944 nbtthb.exe 43 PID 1604 wrote to memory of 2396 1604 pjvpp.exe 44 PID 1604 wrote to memory of 2396 1604 pjvpp.exe 44 PID 1604 wrote to memory of 2396 1604 pjvpp.exe 44 PID 1604 wrote to memory of 2396 1604 pjvpp.exe 44 PID 2396 wrote to memory of 1244 2396 fxlxxxf.exe 45 PID 2396 wrote to memory of 1244 2396 fxlxxxf.exe 45 PID 2396 wrote to memory of 1244 2396 fxlxxxf.exe 45 PID 2396 wrote to memory of 1244 2396 fxlxxxf.exe 45 PID 1244 wrote to memory of 2412 1244 nhntbb.exe 46 PID 1244 wrote to memory of 2412 1244 nhntbb.exe 46 PID 1244 wrote to memory of 2412 1244 nhntbb.exe 46 PID 1244 wrote to memory of 2412 1244 nhntbb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe"C:\Users\Admin\AppData\Local\Temp\9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\1nbhhn.exec:\1nbhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\3pddv.exec:\3pddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nhtnbn.exec:\nhtnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\7djjv.exec:\7djjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\9httbt.exec:\9httbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jdpvj.exec:\jdpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhnhnn.exec:\nhnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\jjvvd.exec:\jjvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\lfflrxf.exec:\lfflrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\jdpdj.exec:\jdpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\lfrxffl.exec:\lfrxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\nbtthb.exec:\nbtthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\pjvpp.exec:\pjvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\fxlxxxf.exec:\fxlxxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nhntbb.exec:\nhntbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\jvjjp.exec:\jvjjp.exe17⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxxlflf.exec:\fxxlflf.exe18⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3hbbhh.exec:\3hbbhh.exe19⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjppp.exec:\jjppp.exe20⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3llrxrr.exec:\3llrxrr.exe21⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tnhhnb.exec:\tnhhnb.exe22⤵
- Executes dropped EXE
PID:1232 -
\??\c:\7lxxlrx.exec:\7lxxlrx.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ttttbn.exec:\ttttbn.exe24⤵
- Executes dropped EXE
PID:856 -
\??\c:\5pvjp.exec:\5pvjp.exe25⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7xlrfff.exec:\7xlrfff.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdpvp.exec:\jdpvp.exe27⤵
- Executes dropped EXE
PID:1524 -
\??\c:\llfflrl.exec:\llfflrl.exe28⤵
- Executes dropped EXE
PID:1396 -
\??\c:\3htnth.exec:\3htnth.exe29⤵
- Executes dropped EXE
PID:884 -
\??\c:\thbttt.exec:\thbttt.exe30⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3frfffl.exec:\3frfffl.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\5bnnnt.exec:\5bnnnt.exe32⤵
- Executes dropped EXE
PID:612 -
\??\c:\3nnnbh.exec:\3nnnbh.exe33⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1llrrlr.exec:\1llrrlr.exe34⤵
- Executes dropped EXE
PID:840 -
\??\c:\xlxfllr.exec:\xlxfllr.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nhtbhb.exec:\nhtbhb.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dpvvd.exec:\dpvvd.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vppdp.exec:\vppdp.exe38⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xrlxlfl.exec:\xrlxlfl.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bttttt.exec:\bttttt.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1hnbbt.exec:\1hnbbt.exe41⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jdpvj.exec:\jdpvj.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vjvpp.exec:\vjvpp.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfrxffl.exec:\lfrxffl.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nhbntt.exec:\nhbntt.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bntbnt.exec:\bntbnt.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvppv.exec:\jvppv.exe47⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9xrllrx.exec:\9xrllrx.exe48⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9bbbbb.exec:\9bbbbb.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hnbthh.exec:\hnbthh.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vdjvp.exec:\vdjvp.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fxfxlxx.exec:\fxfxlxx.exe52⤵
- Executes dropped EXE
PID:1312 -
\??\c:\fxllxrx.exec:\fxllxrx.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bthhhh.exec:\bthhhh.exe54⤵
- Executes dropped EXE
PID:1268 -
\??\c:\thhhhh.exec:\thhhhh.exe55⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9pdjv.exec:\9pdjv.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9rxxrrr.exec:\9rxxrrr.exe57⤵
- Executes dropped EXE
PID:620 -
\??\c:\rfffxfl.exec:\rfffxfl.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ttbhth.exec:\ttbhth.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jvpvj.exec:\jvpvj.exe60⤵
- Executes dropped EXE
PID:1960 -
\??\c:\pdppp.exec:\pdppp.exe61⤵
- Executes dropped EXE
PID:1360 -
\??\c:\fxrffrx.exec:\fxrffrx.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bthhhb.exec:\bthhhb.exe63⤵
- Executes dropped EXE
PID:780 -
\??\c:\tnbhnt.exec:\tnbhnt.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\htnnbn.exec:\htnnbn.exe65⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvpvd.exec:\dvpvd.exe66⤵PID:2928
-
\??\c:\9rflfxx.exec:\9rflfxx.exe67⤵PID:2920
-
\??\c:\rflxxrr.exec:\rflxxrr.exe68⤵PID:640
-
\??\c:\nhthnn.exec:\nhthnn.exe69⤵PID:856
-
\??\c:\9jpvd.exec:\9jpvd.exe70⤵PID:1632
-
\??\c:\1vjvp.exec:\1vjvp.exe71⤵PID:924
-
\??\c:\frffffl.exec:\frffffl.exe72⤵PID:940
-
\??\c:\thhhhb.exec:\thhhhb.exe73⤵PID:2196
-
\??\c:\httbhn.exec:\httbhn.exe74⤵PID:1572
-
\??\c:\pjvpp.exec:\pjvpp.exe75⤵PID:2980
-
\??\c:\pvdvv.exec:\pvdvv.exe76⤵PID:2880
-
\??\c:\llxrxxx.exec:\llxrxxx.exe77⤵PID:3064
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe78⤵PID:1724
-
\??\c:\hbnhhb.exec:\hbnhhb.exe79⤵PID:612
-
\??\c:\dvpdj.exec:\dvpdj.exe80⤵PID:1864
-
\??\c:\jvjdj.exec:\jvjdj.exe81⤵PID:1552
-
\??\c:\5flxxll.exec:\5flxxll.exe82⤵PID:2900
-
\??\c:\tnbbhb.exec:\tnbbhb.exe83⤵PID:2916
-
\??\c:\nhhbnh.exec:\nhhbnh.exe84⤵PID:1512
-
\??\c:\vpddj.exec:\vpddj.exe85⤵PID:540
-
\??\c:\djddj.exec:\djddj.exe86⤵PID:2968
-
\??\c:\fxlrxfx.exec:\fxlrxfx.exe87⤵PID:2316
-
\??\c:\1ttbtb.exec:\1ttbtb.exe88⤵PID:2784
-
\??\c:\bbtntt.exec:\bbtntt.exe89⤵PID:2616
-
\??\c:\3jvpp.exec:\3jvpp.exe90⤵PID:2692
-
\??\c:\1vvjj.exec:\1vvjj.exe91⤵PID:2644
-
\??\c:\1ffxlxl.exec:\1ffxlxl.exe92⤵PID:2520
-
\??\c:\3rlflll.exec:\3rlflll.exe93⤵PID:3044
-
\??\c:\7tbbhh.exec:\7tbbhh.exe94⤵PID:2764
-
\??\c:\pjvvv.exec:\pjvvv.exe95⤵PID:2600
-
\??\c:\vpvpp.exec:\vpvpp.exe96⤵PID:2552
-
\??\c:\rlfrffl.exec:\rlfrffl.exe97⤵PID:2660
-
\??\c:\lfffllr.exec:\lfffllr.exe98⤵PID:2984
-
\??\c:\bntbnh.exec:\bntbnh.exe99⤵PID:2932
-
\??\c:\bthhhh.exec:\bthhhh.exe100⤵PID:2948
-
\??\c:\9pdpd.exec:\9pdpd.exe101⤵PID:1604
-
\??\c:\jvppv.exec:\jvppv.exe102⤵PID:812
-
\??\c:\rflrxlr.exec:\rflrxlr.exe103⤵PID:2396
-
\??\c:\btbnbb.exec:\btbnbb.exe104⤵PID:2280
-
\??\c:\3jdvj.exec:\3jdvj.exe105⤵PID:2248
-
\??\c:\vjvpj.exec:\vjvpj.exe106⤵PID:2380
-
\??\c:\pdjdv.exec:\pdjdv.exe107⤵PID:1844
-
\??\c:\lxrxfff.exec:\lxrxfff.exe108⤵PID:1360
-
\??\c:\9rxlfrl.exec:\9rxlfrl.exe109⤵PID:2216
-
\??\c:\hhhnbt.exec:\hhhnbt.exe110⤵PID:780
-
\??\c:\vpvvv.exec:\vpvvv.exe111⤵PID:1356
-
\??\c:\1djdd.exec:\1djdd.exe112⤵PID:1232
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe113⤵PID:2952
-
\??\c:\3bbttt.exec:\3bbttt.exe114⤵PID:784
-
\??\c:\bbnnbh.exec:\bbnnbh.exe115⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\jdjpv.exec:\jdjpv.exe116⤵PID:2556
-
\??\c:\pjpjp.exec:\pjpjp.exe117⤵PID:1944
-
\??\c:\xlxfffl.exec:\xlxfffl.exe118⤵PID:1144
-
\??\c:\lfflllf.exec:\lfflllf.exe119⤵PID:1216
-
\??\c:\3nhhhb.exec:\3nhhhb.exe120⤵PID:3040
-
\??\c:\dpjjj.exec:\dpjjj.exe121⤵PID:492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-