Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe
-
Size
454KB
-
MD5
0fdf248b7a23f8d34edd70196f9dd55d
-
SHA1
9ea5d4caf8f1cef00128bde43c21d2a5a7c042a0
-
SHA256
dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df
-
SHA512
ab124149e3600569a245af5718b5e509ae9690c3dac313fb57731793b074aece0ad525ab6a0f0bee3b6971c9ef60ec3aef9fc3629adf2ea1ec0cdde90b410d7b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTS:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2856-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-12-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1784-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-74-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2756-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-179-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2336-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1704-555-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2200-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-608-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2640-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-656-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1984-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-720-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/912-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-837-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-901-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1784 7dvpp.exe 2784 xllxxlf.exe 2652 5jpdp.exe 2688 9jjpd.exe 2696 fxrrffl.exe 1736 tnnbtb.exe 1652 5frllrl.exe 1152 nhttnn.exe 1820 7tbtbt.exe 336 fflffxx.exe 2756 tnbhnh.exe 2624 3xxfrfr.exe 2896 nhnbht.exe 2772 7vdjd.exe 2908 bttbtn.exe 1556 7ttnnb.exe 2128 nhbnhn.exe 956 pdpdv.exe 264 5xxlxfx.exe 2336 pjjvj.exe 2172 rlrrfxf.exe 2060 7ddpv.exe 1288 7xrfxfl.exe 2052 bthttt.exe 636 rxrfxfl.exe 1688 nhbbbh.exe 1728 xxxrlxr.exe 2948 hbtntn.exe 1212 rxfxrxx.exe 1248 btttnt.exe 696 dvpvp.exe 1008 ppjvp.exe 2456 llflxfx.exe 2288 hntnbb.exe 2632 tbnhhn.exe 2828 ddvjd.exe 2656 5fxfrxf.exe 2684 9tthbh.exe 2840 vpjpd.exe 2820 3dvdj.exe 2568 7rxfrrf.exe 2584 bttthn.exe 2528 htntnt.exe 2592 vvjjv.exe 2712 rlflrlf.exe 1152 1nhtnt.exe 1084 5bbtbh.exe 2136 vdvdp.exe 1440 lrfflxl.exe 2256 tbhttb.exe 1076 5ddpd.exe 2596 3pdpd.exe 2724 9rrfflf.exe 2588 bhhthn.exe 2908 ttbtht.exe 2132 pjdpd.exe 2776 1frxflr.exe 1044 9nhhnt.exe 2344 dvdpv.exe 2232 fxxfrxl.exe 2208 xxrrfrl.exe 2992 bhbhtt.exe 3060 vpjpd.exe 1216 rlffxfx.exe -
resource yara_rule behavioral1/memory/2856-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-720-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2108-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-823-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1784 2856 dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe 30 PID 2856 wrote to memory of 1784 2856 dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe 30 PID 2856 wrote to memory of 1784 2856 dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe 30 PID 2856 wrote to memory of 1784 2856 dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe 30 PID 1784 wrote to memory of 2784 1784 7dvpp.exe 31 PID 1784 wrote to memory of 2784 1784 7dvpp.exe 31 PID 1784 wrote to memory of 2784 1784 7dvpp.exe 31 PID 1784 wrote to memory of 2784 1784 7dvpp.exe 31 PID 2784 wrote to memory of 2652 2784 xllxxlf.exe 32 PID 2784 wrote to memory of 2652 2784 xllxxlf.exe 32 PID 2784 wrote to memory of 2652 2784 xllxxlf.exe 32 PID 2784 wrote to memory of 2652 2784 xllxxlf.exe 32 PID 2652 wrote to memory of 2688 2652 5jpdp.exe 33 PID 2652 wrote to memory of 2688 2652 5jpdp.exe 33 PID 2652 wrote to memory of 2688 2652 5jpdp.exe 33 PID 2652 wrote to memory of 2688 2652 5jpdp.exe 33 PID 2688 wrote to memory of 2696 2688 9jjpd.exe 34 PID 2688 wrote to memory of 2696 2688 9jjpd.exe 34 PID 2688 wrote to memory of 2696 2688 9jjpd.exe 34 PID 2688 wrote to memory of 2696 2688 9jjpd.exe 34 PID 2696 wrote to memory of 1736 2696 fxrrffl.exe 35 PID 2696 wrote to memory of 1736 2696 fxrrffl.exe 35 PID 2696 wrote to memory of 1736 2696 fxrrffl.exe 35 PID 2696 wrote to memory of 1736 2696 fxrrffl.exe 35 PID 1736 wrote to memory of 1652 1736 tnnbtb.exe 36 PID 1736 wrote to memory of 1652 1736 tnnbtb.exe 36 PID 1736 wrote to memory of 1652 1736 tnnbtb.exe 36 PID 1736 wrote to memory of 1652 1736 tnnbtb.exe 36 PID 1652 wrote to memory of 1152 1652 5frllrl.exe 37 PID 1652 wrote to memory of 1152 1652 5frllrl.exe 37 PID 1652 wrote to memory of 1152 1652 5frllrl.exe 37 PID 1652 wrote to memory of 1152 1652 5frllrl.exe 37 PID 1152 wrote to memory of 1820 1152 nhttnn.exe 38 PID 1152 wrote to memory of 1820 1152 nhttnn.exe 38 PID 1152 wrote to memory of 1820 1152 nhttnn.exe 38 PID 1152 wrote to memory of 1820 1152 nhttnn.exe 38 PID 1820 wrote to memory of 336 1820 7tbtbt.exe 39 PID 1820 wrote to memory of 336 1820 7tbtbt.exe 39 PID 1820 wrote to memory of 336 1820 7tbtbt.exe 39 PID 1820 wrote to memory of 336 1820 7tbtbt.exe 39 PID 336 wrote to memory of 2756 336 fflffxx.exe 40 PID 336 wrote to memory of 2756 336 fflffxx.exe 40 PID 336 wrote to memory of 2756 336 fflffxx.exe 40 PID 336 wrote to memory of 2756 336 fflffxx.exe 40 PID 2756 wrote to memory of 2624 2756 tnbhnh.exe 41 PID 2756 wrote to memory of 2624 2756 tnbhnh.exe 41 PID 2756 wrote to memory of 2624 2756 tnbhnh.exe 41 PID 2756 wrote to memory of 2624 2756 tnbhnh.exe 41 PID 2624 wrote to memory of 2896 2624 3xxfrfr.exe 42 PID 2624 wrote to memory of 2896 2624 3xxfrfr.exe 42 PID 2624 wrote to memory of 2896 2624 3xxfrfr.exe 42 PID 2624 wrote to memory of 2896 2624 3xxfrfr.exe 42 PID 2896 wrote to memory of 2772 2896 nhnbht.exe 43 PID 2896 wrote to memory of 2772 2896 nhnbht.exe 43 PID 2896 wrote to memory of 2772 2896 nhnbht.exe 43 PID 2896 wrote to memory of 2772 2896 nhnbht.exe 43 PID 2772 wrote to memory of 2908 2772 7vdjd.exe 44 PID 2772 wrote to memory of 2908 2772 7vdjd.exe 44 PID 2772 wrote to memory of 2908 2772 7vdjd.exe 44 PID 2772 wrote to memory of 2908 2772 7vdjd.exe 44 PID 2908 wrote to memory of 1556 2908 bttbtn.exe 45 PID 2908 wrote to memory of 1556 2908 bttbtn.exe 45 PID 2908 wrote to memory of 1556 2908 bttbtn.exe 45 PID 2908 wrote to memory of 1556 2908 bttbtn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe"C:\Users\Admin\AppData\Local\Temp\dbf61c2ac9ea6f02bba3b5c98678a647c0bc4d6516e2407f73cb2738433283df.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\7dvpp.exec:\7dvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\xllxxlf.exec:\xllxxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\5jpdp.exec:\5jpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\9jjpd.exec:\9jjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxrrffl.exec:\fxrrffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tnnbtb.exec:\tnnbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\5frllrl.exec:\5frllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\nhttnn.exec:\nhttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\7tbtbt.exec:\7tbtbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\fflffxx.exec:\fflffxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\tnbhnh.exec:\tnbhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\3xxfrfr.exec:\3xxfrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nhnbht.exec:\nhnbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\7vdjd.exec:\7vdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bttbtn.exec:\bttbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\7ttnnb.exec:\7ttnnb.exe17⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nhbnhn.exec:\nhbnhn.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pdpdv.exec:\pdpdv.exe19⤵
- Executes dropped EXE
PID:956 -
\??\c:\5xxlxfx.exec:\5xxlxfx.exe20⤵
- Executes dropped EXE
PID:264 -
\??\c:\pjjvj.exec:\pjjvj.exe21⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe22⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7ddpv.exec:\7ddpv.exe23⤵
- Executes dropped EXE
PID:2060 -
\??\c:\7xrfxfl.exec:\7xrfxfl.exe24⤵
- Executes dropped EXE
PID:1288 -
\??\c:\bthttt.exec:\bthttt.exe25⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rxrfxfl.exec:\rxrfxfl.exe26⤵
- Executes dropped EXE
PID:636 -
\??\c:\nhbbbh.exec:\nhbbbh.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxxrlxr.exec:\xxxrlxr.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbtntn.exec:\hbtntn.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rxfxrxx.exec:\rxfxrxx.exe30⤵
- Executes dropped EXE
PID:1212 -
\??\c:\btttnt.exec:\btttnt.exe31⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dvpvp.exec:\dvpvp.exe32⤵
- Executes dropped EXE
PID:696 -
\??\c:\ppjvp.exec:\ppjvp.exe33⤵
- Executes dropped EXE
PID:1008 -
\??\c:\llflxfx.exec:\llflxfx.exe34⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hntnbb.exec:\hntnbb.exe35⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tbnhhn.exec:\tbnhhn.exe36⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ddvjd.exec:\ddvjd.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5fxfrxf.exec:\5fxfrxf.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9tthbh.exec:\9tthbh.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vpjpd.exec:\vpjpd.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3dvdj.exec:\3dvdj.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7rxfrrf.exec:\7rxfrrf.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bttthn.exec:\bttthn.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\htntnt.exec:\htntnt.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vvjjv.exec:\vvjjv.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rlflrlf.exec:\rlflrlf.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1nhtnt.exec:\1nhtnt.exe47⤵
- Executes dropped EXE
PID:1152 -
\??\c:\5bbtbh.exec:\5bbtbh.exe48⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vdvdp.exec:\vdvdp.exe49⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lrfflxl.exec:\lrfflxl.exe50⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tbhttb.exec:\tbhttb.exe51⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5ddpd.exec:\5ddpd.exe52⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3pdpd.exec:\3pdpd.exe53⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9rrfflf.exec:\9rrfflf.exe54⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bhhthn.exec:\bhhthn.exe55⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ttbtht.exec:\ttbtht.exe56⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pjdpd.exec:\pjdpd.exe57⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1frxflr.exec:\1frxflr.exe58⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9nhhnt.exec:\9nhhnt.exe59⤵
- Executes dropped EXE
PID:1044 -
\??\c:\dvdpv.exec:\dvdpv.exe60⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xxrrfrl.exec:\xxrrfrl.exe62⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bhbhtt.exec:\bhbhtt.exe63⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rlffxfx.exec:\rlffxfx.exe65⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nnnbnt.exec:\nnnbnt.exe66⤵PID:1288
-
\??\c:\htnnnt.exec:\htnnnt.exe67⤵PID:316
-
\??\c:\dvpvp.exec:\dvpvp.exe68⤵PID:1968
-
\??\c:\frrxlrf.exec:\frrxlrf.exe69⤵PID:1704
-
\??\c:\3ttbbn.exec:\3ttbbn.exe70⤵PID:1700
-
\??\c:\nnhtnn.exec:\nnhtnn.exe71⤵PID:1856
-
\??\c:\vvvjv.exec:\vvvjv.exe72⤵PID:3068
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe73⤵PID:992
-
\??\c:\fffrfrl.exec:\fffrfrl.exe74⤵PID:2400
-
\??\c:\vpddv.exec:\vpddv.exe75⤵PID:2200
-
\??\c:\3ppvv.exec:\3ppvv.exe76⤵PID:2480
-
\??\c:\htthth.exec:\htthth.exe77⤵PID:1008
-
\??\c:\ttnbht.exec:\ttnbht.exe78⤵PID:2464
-
\??\c:\djpdv.exec:\djpdv.exe79⤵PID:2188
-
\??\c:\rrrrxlr.exec:\rrrrxlr.exe80⤵PID:1656
-
\??\c:\thbbtt.exec:\thbbtt.exe81⤵PID:2832
-
\??\c:\jppvp.exec:\jppvp.exe82⤵PID:2788
-
\??\c:\flrrrll.exec:\flrrrll.exe83⤵PID:2800
-
\??\c:\5hthbn.exec:\5hthbn.exe84⤵PID:2796
-
\??\c:\ttnbnt.exec:\ttnbnt.exe85⤵PID:2564
-
\??\c:\pjddp.exec:\pjddp.exe86⤵PID:2532
-
\??\c:\rrxllxf.exec:\rrxllxf.exe87⤵PID:2640
-
\??\c:\1hbnbn.exec:\1hbnbn.exe88⤵PID:2604
-
\??\c:\5pppp.exec:\5pppp.exe89⤵PID:2816
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe90⤵PID:752
-
\??\c:\bbbbhn.exec:\bbbbhn.exe91⤵PID:444
-
\??\c:\btbbhh.exec:\btbbhh.exe92⤵PID:1176
-
\??\c:\3dddj.exec:\3dddj.exe93⤵PID:2508
-
\??\c:\llxfrxl.exec:\llxfrxl.exe94⤵PID:1984
-
\??\c:\ttbhbb.exec:\ttbhbb.exe95⤵PID:2904
-
\??\c:\ttntnb.exec:\ttntnb.exe96⤵PID:1824
-
\??\c:\jjjpj.exec:\jjjpj.exe97⤵PID:2616
-
\??\c:\1lrrxxf.exec:\1lrrxxf.exe98⤵PID:2928
-
\??\c:\bttbtt.exec:\bttbtt.exe99⤵PID:3052
-
\??\c:\5bttbb.exec:\5bttbb.exe100⤵PID:2108
-
\??\c:\7jjpd.exec:\7jjpd.exe101⤵PID:668
-
\??\c:\9xxxxff.exec:\9xxxxff.exe102⤵PID:1768
-
\??\c:\7hnbnb.exec:\7hnbnb.exe103⤵PID:480
-
\??\c:\vdjdv.exec:\vdjdv.exe104⤵PID:2072
-
\??\c:\llrllrr.exec:\llrllrr.exe105⤵PID:2168
-
\??\c:\hhhnbh.exec:\hhhnbh.exe106⤵PID:912
-
\??\c:\7hhntb.exec:\7hhntb.exe107⤵PID:1636
-
\??\c:\ppjjd.exec:\ppjjd.exe108⤵PID:2356
-
\??\c:\fllxrxr.exec:\fllxrxr.exe109⤵PID:960
-
\??\c:\htnthn.exec:\htnthn.exe110⤵PID:1576
-
\??\c:\jddjd.exec:\jddjd.exe111⤵PID:1860
-
\??\c:\llflrxr.exec:\llflrxr.exe112⤵PID:680
-
\??\c:\nnhhbn.exec:\nnhhbn.exe113⤵PID:1148
-
\??\c:\hbhnbh.exec:\hbhnbh.exe114⤵PID:1720
-
\??\c:\llfrlrr.exec:\llfrlrr.exe115⤵PID:2260
-
\??\c:\xrxfrlf.exec:\xrxfrlf.exe116⤵PID:3068
-
\??\c:\9nnbtb.exec:\9nnbtb.exe117⤵PID:792
-
\??\c:\pvvvv.exec:\pvvvv.exe118⤵PID:2444
-
\??\c:\lllrfxx.exec:\lllrfxx.exe119⤵PID:1248
-
\??\c:\5rfxlxx.exec:\5rfxlxx.exe120⤵PID:1828
-
\??\c:\bnthbt.exec:\bnthbt.exe121⤵PID:828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-