Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe
-
Size
453KB
-
MD5
0e73d3ca2faabc9ba0edaaba7bfa7e80
-
SHA1
ddacec81e9e6a2912a435fe79d48577b698c04f2
-
SHA256
9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520
-
SHA512
820890d580d47724654fcce581283535210e596197e273d714229873a12dc03fdd9558e64be6ffdf5b96a0524e3ab90dc761df64175baf462a5358bc948dd800
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2024-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-95-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-195-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2512-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-269-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1908-274-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1908-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-387-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2848-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-470-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1016-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-487-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1380-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-549-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2304-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-566-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2656-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-609-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2632-660-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1632-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-923-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-998-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2128 5rlrxfr.exe 800 tthhtt.exe 2156 9ffrrff.exe 2740 lfxfxff.exe 2636 ntntnt.exe 2648 djddp.exe 3004 tnntbn.exe 2724 rrxrlxr.exe 2608 1hhbhb.exe 1960 lxrlrrx.exe 1112 bbtbtb.exe 2760 jpjdv.exe 996 tthhhh.exe 304 jjvjd.exe 2344 5nhhnt.exe 2036 vpddv.exe 1352 bbthtt.exe 2880 pjdjv.exe 2028 ntntnn.exe 2340 pjdpj.exe 1016 nhbhnt.exe 2512 pjddj.exe 1700 lxxxlrf.exe 1304 pdddp.exe 2292 tttbhh.exe 2976 1pjpj.exe 3016 1hthtb.exe 2412 djjpp.exe 1908 bhhhbh.exe 2916 pvvjv.exe 1052 7nhnhh.exe 2508 dvvvj.exe 280 bhnbbh.exe 3044 pjjvj.exe 2744 xxlllrf.exe 2684 bnhbbt.exe 3060 9bhttt.exe 2840 ppddj.exe 2872 5rfrxlr.exe 2704 5tnthh.exe 2528 pjvvd.exe 2988 jddpd.exe 2608 rxrlfxx.exe 1848 1hhnbb.exe 2848 9jpvv.exe 2776 lfrfxxl.exe 1948 thtntn.exe 2780 jjdpv.exe 1220 vppvj.exe 1632 lfrrxxl.exe 1980 btnnbb.exe 2856 vpdjv.exe 2416 fxrlrrf.exe 2348 nnhnnb.exe 2100 7vdjj.exe 1484 rrlrxxr.exe 564 3ttbbh.exe 1016 nhtbtb.exe 908 1jjpj.exe 1680 xfrxrxr.exe 1380 hhthth.exe 2060 3ppjv.exe 2032 7jddj.exe 1576 1flxlrl.exe -
resource yara_rule behavioral1/memory/2024-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-269-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1908-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-448-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2348-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-463-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1484-470-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1016-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-487-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1380-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-566-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2656-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-635-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2632-660-0x0000000000260000-0x000000000028A000-memory.dmp upx behavioral1/memory/1632-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-923-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1516-930-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2380-973-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2128 2024 9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe 31 PID 2024 wrote to memory of 2128 2024 9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe 31 PID 2024 wrote to memory of 2128 2024 9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe 31 PID 2024 wrote to memory of 2128 2024 9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe 31 PID 2128 wrote to memory of 800 2128 5rlrxfr.exe 32 PID 2128 wrote to memory of 800 2128 5rlrxfr.exe 32 PID 2128 wrote to memory of 800 2128 5rlrxfr.exe 32 PID 2128 wrote to memory of 800 2128 5rlrxfr.exe 32 PID 800 wrote to memory of 2156 800 tthhtt.exe 33 PID 800 wrote to memory of 2156 800 tthhtt.exe 33 PID 800 wrote to memory of 2156 800 tthhtt.exe 33 PID 800 wrote to memory of 2156 800 tthhtt.exe 33 PID 2156 wrote to memory of 2740 2156 9ffrrff.exe 34 PID 2156 wrote to memory of 2740 2156 9ffrrff.exe 34 PID 2156 wrote to memory of 2740 2156 9ffrrff.exe 34 PID 2156 wrote to memory of 2740 2156 9ffrrff.exe 34 PID 2740 wrote to memory of 2636 2740 lfxfxff.exe 35 PID 2740 wrote to memory of 2636 2740 lfxfxff.exe 35 PID 2740 wrote to memory of 2636 2740 lfxfxff.exe 35 PID 2740 wrote to memory of 2636 2740 lfxfxff.exe 35 PID 2636 wrote to memory of 2648 2636 ntntnt.exe 36 PID 2636 wrote to memory of 2648 2636 ntntnt.exe 36 PID 2636 wrote to memory of 2648 2636 ntntnt.exe 36 PID 2636 wrote to memory of 2648 2636 ntntnt.exe 36 PID 2648 wrote to memory of 3004 2648 djddp.exe 37 PID 2648 wrote to memory of 3004 2648 djddp.exe 37 PID 2648 wrote to memory of 3004 2648 djddp.exe 37 PID 2648 wrote to memory of 3004 2648 djddp.exe 37 PID 3004 wrote to memory of 2724 3004 tnntbn.exe 38 PID 3004 wrote to memory of 2724 3004 tnntbn.exe 38 PID 3004 wrote to memory of 2724 3004 tnntbn.exe 38 PID 3004 wrote to memory of 2724 3004 tnntbn.exe 38 PID 2724 wrote to memory of 2608 2724 rrxrlxr.exe 39 PID 2724 wrote to memory of 2608 2724 rrxrlxr.exe 39 PID 2724 wrote to memory of 2608 2724 rrxrlxr.exe 39 PID 2724 wrote to memory of 2608 2724 rrxrlxr.exe 39 PID 2608 wrote to memory of 1960 2608 1hhbhb.exe 40 PID 2608 wrote to memory of 1960 2608 1hhbhb.exe 40 PID 2608 wrote to memory of 1960 2608 1hhbhb.exe 40 PID 2608 wrote to memory of 1960 2608 1hhbhb.exe 40 PID 1960 wrote to memory of 1112 1960 lxrlrrx.exe 41 PID 1960 wrote to memory of 1112 1960 lxrlrrx.exe 41 PID 1960 wrote to memory of 1112 1960 lxrlrrx.exe 41 PID 1960 wrote to memory of 1112 1960 lxrlrrx.exe 41 PID 1112 wrote to memory of 2760 1112 bbtbtb.exe 42 PID 1112 wrote to memory of 2760 1112 bbtbtb.exe 42 PID 1112 wrote to memory of 2760 1112 bbtbtb.exe 42 PID 1112 wrote to memory of 2760 1112 bbtbtb.exe 42 PID 2760 wrote to memory of 996 2760 jpjdv.exe 43 PID 2760 wrote to memory of 996 2760 jpjdv.exe 43 PID 2760 wrote to memory of 996 2760 jpjdv.exe 43 PID 2760 wrote to memory of 996 2760 jpjdv.exe 43 PID 996 wrote to memory of 304 996 tthhhh.exe 44 PID 996 wrote to memory of 304 996 tthhhh.exe 44 PID 996 wrote to memory of 304 996 tthhhh.exe 44 PID 996 wrote to memory of 304 996 tthhhh.exe 44 PID 304 wrote to memory of 2344 304 jjvjd.exe 45 PID 304 wrote to memory of 2344 304 jjvjd.exe 45 PID 304 wrote to memory of 2344 304 jjvjd.exe 45 PID 304 wrote to memory of 2344 304 jjvjd.exe 45 PID 2344 wrote to memory of 2036 2344 5nhhnt.exe 46 PID 2344 wrote to memory of 2036 2344 5nhhnt.exe 46 PID 2344 wrote to memory of 2036 2344 5nhhnt.exe 46 PID 2344 wrote to memory of 2036 2344 5nhhnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe"C:\Users\Admin\AppData\Local\Temp\9ae46914fe157432acfb03c34205e73a89ac3c2273027cd35985c521fcad4520N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5rlrxfr.exec:\5rlrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\tthhtt.exec:\tthhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\9ffrrff.exec:\9ffrrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\lfxfxff.exec:\lfxfxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ntntnt.exec:\ntntnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\djddp.exec:\djddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tnntbn.exec:\tnntbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rrxrlxr.exec:\rrxrlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1hhbhb.exec:\1hhbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\lxrlrrx.exec:\lxrlrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\bbtbtb.exec:\bbtbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\jpjdv.exec:\jpjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tthhhh.exec:\tthhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\jjvjd.exec:\jjvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\5nhhnt.exec:\5nhhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vpddv.exec:\vpddv.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bbthtt.exec:\bbthtt.exe18⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pjdjv.exec:\pjdjv.exe19⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ntntnn.exec:\ntntnn.exe20⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pjdpj.exec:\pjdpj.exe21⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhbhnt.exec:\nhbhnt.exe22⤵
- Executes dropped EXE
PID:1016 -
\??\c:\pjddj.exec:\pjddj.exe23⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lxxxlrf.exec:\lxxxlrf.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pdddp.exec:\pdddp.exe25⤵
- Executes dropped EXE
PID:1304 -
\??\c:\tttbhh.exec:\tttbhh.exe26⤵
- Executes dropped EXE
PID:2292 -
\??\c:\1pjpj.exec:\1pjpj.exe27⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1hthtb.exec:\1hthtb.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\djjpp.exec:\djjpp.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bhhhbh.exec:\bhhhbh.exe30⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pvvjv.exec:\pvvjv.exe31⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7nhnhh.exec:\7nhnhh.exe32⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dvvvj.exec:\dvvvj.exe33⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bhnbbh.exec:\bhnbbh.exe34⤵
- Executes dropped EXE
PID:280 -
\??\c:\pjjvj.exec:\pjjvj.exe35⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xxlllrf.exec:\xxlllrf.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bnhbbt.exec:\bnhbbt.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9bhttt.exec:\9bhttt.exe38⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ppddj.exec:\ppddj.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5rfrxlr.exec:\5rfrxlr.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5tnthh.exec:\5tnthh.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjvvd.exec:\pjvvd.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jddpd.exec:\jddpd.exe43⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rxrlfxx.exec:\rxrlfxx.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1hhnbb.exec:\1hhnbb.exe45⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9jpvv.exec:\9jpvv.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lfrfxxl.exec:\lfrfxxl.exe47⤵
- Executes dropped EXE
PID:2776 -
\??\c:\thtntn.exec:\thtntn.exe48⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jjdpv.exec:\jjdpv.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vppvj.exec:\vppvj.exe50⤵
- Executes dropped EXE
PID:1220 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\btnnbb.exec:\btnnbb.exe52⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vpdjv.exec:\vpdjv.exe53⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxrlrrf.exec:\fxrlrrf.exe54⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nnhnnb.exec:\nnhnnb.exe55⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7vdjj.exec:\7vdjj.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rrlrxxr.exec:\rrlrxxr.exe57⤵
- Executes dropped EXE
PID:1484 -
\??\c:\3ttbbh.exec:\3ttbbh.exe58⤵
- Executes dropped EXE
PID:564 -
\??\c:\nhtbtb.exec:\nhtbtb.exe59⤵
- Executes dropped EXE
PID:1016 -
\??\c:\1jjpj.exec:\1jjpj.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\xfrxrxr.exec:\xfrxrxr.exe61⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hhthth.exec:\hhthth.exe62⤵
- Executes dropped EXE
PID:1380 -
\??\c:\3ppjv.exec:\3ppjv.exe63⤵
- Executes dropped EXE
PID:2060 -
\??\c:\7jddj.exec:\7jddj.exe64⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1flxlrl.exec:\1flxlrl.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bhbhbn.exec:\bhbhbn.exe66⤵PID:3036
-
\??\c:\9vppv.exec:\9vppv.exe67⤵PID:3016
-
\??\c:\jdvjv.exec:\jdvjv.exe68⤵PID:1696
-
\??\c:\fxrxrfr.exec:\fxrxrfr.exe69⤵PID:2304
-
\??\c:\ntbbhb.exec:\ntbbhb.exe70⤵
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\9jdjv.exec:\9jdjv.exe71⤵PID:2004
-
\??\c:\xlrlxfr.exec:\xlrlxfr.exe72⤵PID:1596
-
\??\c:\bhnhhh.exec:\bhnhhh.exe73⤵PID:1760
-
\??\c:\djdpj.exec:\djdpj.exe74⤵PID:1964
-
\??\c:\jdvvj.exec:\jdvvj.exe75⤵PID:2732
-
\??\c:\xrrxflf.exec:\xrrxflf.exe76⤵PID:2792
-
\??\c:\3btbht.exec:\3btbht.exe77⤵PID:2656
-
\??\c:\5pvdj.exec:\5pvdj.exe78⤵PID:2820
-
\??\c:\7fxrfrl.exec:\7fxrfrl.exe79⤵PID:2540
-
\??\c:\hhhthh.exec:\hhhthh.exe80⤵PID:2576
-
\??\c:\9ntnbt.exec:\9ntnbt.exe81⤵PID:2548
-
\??\c:\pjddp.exec:\pjddp.exe82⤵PID:2532
-
\??\c:\fxrrflx.exec:\fxrrflx.exe83⤵PID:2716
-
\??\c:\tnhhhh.exec:\tnhhhh.exe84⤵PID:768
-
\??\c:\dvpdp.exec:\dvpdp.exe85⤵PID:1840
-
\??\c:\jdpvj.exec:\jdpvj.exe86⤵PID:2632
-
\??\c:\xfrxrff.exec:\xfrxrff.exe87⤵PID:1232
-
\??\c:\5bttbh.exec:\5bttbh.exe88⤵PID:2776
-
\??\c:\jdvvj.exec:\jdvvj.exe89⤵PID:1948
-
\??\c:\jddpp.exec:\jddpp.exe90⤵PID:304
-
\??\c:\xrrrxfx.exec:\xrrrxfx.exe91⤵PID:1912
-
\??\c:\tnbbhh.exec:\tnbbhh.exe92⤵PID:1632
-
\??\c:\1vpdv.exec:\1vpdv.exe93⤵PID:1628
-
\??\c:\fxlxllf.exec:\fxlxllf.exe94⤵PID:1768
-
\??\c:\rlffxlr.exec:\rlffxlr.exe95⤵PID:1780
-
\??\c:\nnnbhb.exec:\nnnbhb.exe96⤵PID:2356
-
\??\c:\5pdpv.exec:\5pdpv.exe97⤵PID:2360
-
\??\c:\lfxxffl.exec:\lfxxffl.exe98⤵PID:2940
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe99⤵PID:1452
-
\??\c:\nnnbnb.exec:\nnnbnb.exe100⤵PID:2148
-
\??\c:\vpdjj.exec:\vpdjj.exe101⤵PID:2056
-
\??\c:\xrxlrrf.exec:\xrxlrrf.exe102⤵PID:764
-
\??\c:\1tthtb.exec:\1tthtb.exe103⤵PID:2720
-
\??\c:\hhtbhn.exec:\hhtbhn.exe104⤵PID:2972
-
\??\c:\vpjvd.exec:\vpjvd.exe105⤵PID:2292
-
\??\c:\1lfxxxl.exec:\1lfxxxl.exe106⤵PID:1504
-
\??\c:\bbbtnt.exec:\bbbtnt.exe107⤵PID:876
-
\??\c:\xrrxflx.exec:\xrrxflx.exe108⤵PID:1004
-
\??\c:\tttbnt.exec:\tttbnt.exe109⤵PID:1856
-
\??\c:\hhbnbh.exec:\hhbnbh.exe110⤵PID:1756
-
\??\c:\pjjpd.exec:\pjjpd.exe111⤵PID:1440
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe112⤵
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\3rlfllr.exec:\3rlfllr.exe113⤵PID:1736
-
\??\c:\hhhnbh.exec:\hhhnbh.exe114⤵PID:1600
-
\??\c:\vdjvj.exec:\vdjvj.exe115⤵PID:2640
-
\??\c:\xrflrrf.exec:\xrflrrf.exe116⤵PID:2156
-
\??\c:\3lfxflr.exec:\3lfxflr.exe117⤵PID:2736
-
\??\c:\5hbhbb.exec:\5hbhbb.exe118⤵PID:2796
-
\??\c:\bbhtbh.exec:\bbhtbh.exe119⤵PID:2752
-
\??\c:\vdpdj.exec:\vdpdj.exe120⤵PID:2860
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe121⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-