Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe
-
Size
455KB
-
MD5
ae8ed63179165cc2083fc1a495eaa401
-
SHA1
82061d558fc26e2b6b982c094516bf138d149e4e
-
SHA256
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959
-
SHA512
3df7919f7e4bae3fcb55ff0892eaed46d0ac337431575d83c8d8e8f3e82dac5d232c0005d7519bcf1f2e3fa096ed1f4ee09eb871b85700be6029d5ab19f37ccb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRY:q7Tc2NYHUrAwfMp3CDRY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-74-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2600-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-188-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2892-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-240-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2440-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-321-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2744-358-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2736-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-374-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-388-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2588-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-417-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2144-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-455-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1148-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-366-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-861-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2864-935-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-950-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-1092-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-1095-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-1133-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2352 jjpjj.exe 2504 jpdvd.exe 2068 dpdvj.exe 2776 9btbhh.exe 320 rlffllx.exe 2804 bbthnt.exe 2600 1jvdj.exe 2876 3thhhh.exe 2728 btnntt.exe 2596 rrflrrx.exe 1832 lfrfflr.exe 3020 jdppj.exe 1652 xrxfffl.exe 1628 djvvp.exe 1684 pjvjv.exe 1944 rfllrlf.exe 1924 btnbhh.exe 2652 1jppv.exe 2468 hbtbhh.exe 596 bttbnt.exe 2892 xxlrffx.exe 2952 hbtntb.exe 1368 jvjjp.exe 612 5rxrlll.exe 1660 bnbnnt.exe 1340 pdppv.exe 2136 xrffrxl.exe 2440 nhtnnt.exe 1828 7tttbb.exe 984 pdvvj.exe 916 rlflxxr.exe 3044 hbnntb.exe 1560 dvjpd.exe 2528 lfllrrx.exe 2124 bnnbhn.exe 2112 htttbb.exe 2208 dvppd.exe 688 llxxrxl.exe 2732 rfllrrr.exe 2820 thbbbb.exe 2744 btttbb.exe 2736 vjdvv.exe 2860 dvjvp.exe 2864 lfxxrrf.exe 2592 thbbnn.exe 2588 nhbhnt.exe 2668 ppjvd.exe 2996 5xfllrr.exe 3020 rrffrrx.exe 1552 5thhnh.exe 1628 bhtntb.exe 1688 pjvdp.exe 2144 7fllllr.exe 2424 xxlxxxr.exe 1416 hhtbnt.exe 580 bbthnn.exe 2688 jpjjp.exe 2632 dppdj.exe 1376 1rffrxl.exe 776 nbhtht.exe 1148 thnnbn.exe 1360 ddvjv.exe 2576 xffllrf.exe 2904 xxxfllx.exe -
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-935-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2704-936-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-950-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-1100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-1213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-1238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-1259-0x00000000003B0000-0x00000000003DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2352 2508 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2508 wrote to memory of 2352 2508 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2508 wrote to memory of 2352 2508 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2508 wrote to memory of 2352 2508 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 30 PID 2352 wrote to memory of 2504 2352 jjpjj.exe 31 PID 2352 wrote to memory of 2504 2352 jjpjj.exe 31 PID 2352 wrote to memory of 2504 2352 jjpjj.exe 31 PID 2352 wrote to memory of 2504 2352 jjpjj.exe 31 PID 2504 wrote to memory of 2068 2504 jpdvd.exe 32 PID 2504 wrote to memory of 2068 2504 jpdvd.exe 32 PID 2504 wrote to memory of 2068 2504 jpdvd.exe 32 PID 2504 wrote to memory of 2068 2504 jpdvd.exe 32 PID 2068 wrote to memory of 2776 2068 dpdvj.exe 33 PID 2068 wrote to memory of 2776 2068 dpdvj.exe 33 PID 2068 wrote to memory of 2776 2068 dpdvj.exe 33 PID 2068 wrote to memory of 2776 2068 dpdvj.exe 33 PID 2776 wrote to memory of 320 2776 9btbhh.exe 34 PID 2776 wrote to memory of 320 2776 9btbhh.exe 34 PID 2776 wrote to memory of 320 2776 9btbhh.exe 34 PID 2776 wrote to memory of 320 2776 9btbhh.exe 34 PID 320 wrote to memory of 2804 320 rlffllx.exe 35 PID 320 wrote to memory of 2804 320 rlffllx.exe 35 PID 320 wrote to memory of 2804 320 rlffllx.exe 35 PID 320 wrote to memory of 2804 320 rlffllx.exe 35 PID 2804 wrote to memory of 2600 2804 bbthnt.exe 36 PID 2804 wrote to memory of 2600 2804 bbthnt.exe 36 PID 2804 wrote to memory of 2600 2804 bbthnt.exe 36 PID 2804 wrote to memory of 2600 2804 bbthnt.exe 36 PID 2600 wrote to memory of 2876 2600 1jvdj.exe 37 PID 2600 wrote to memory of 2876 2600 1jvdj.exe 37 PID 2600 wrote to memory of 2876 2600 1jvdj.exe 37 PID 2600 wrote to memory of 2876 2600 1jvdj.exe 37 PID 2876 wrote to memory of 2728 2876 3thhhh.exe 38 PID 2876 wrote to memory of 2728 2876 3thhhh.exe 38 PID 2876 wrote to memory of 2728 2876 3thhhh.exe 38 PID 2876 wrote to memory of 2728 2876 3thhhh.exe 38 PID 2728 wrote to memory of 2596 2728 btnntt.exe 39 PID 2728 wrote to memory of 2596 2728 btnntt.exe 39 PID 2728 wrote to memory of 2596 2728 btnntt.exe 39 PID 2728 wrote to memory of 2596 2728 btnntt.exe 39 PID 2596 wrote to memory of 1832 2596 rrflrrx.exe 40 PID 2596 wrote to memory of 1832 2596 rrflrrx.exe 40 PID 2596 wrote to memory of 1832 2596 rrflrrx.exe 40 PID 2596 wrote to memory of 1832 2596 rrflrrx.exe 40 PID 1832 wrote to memory of 3020 1832 lfrfflr.exe 41 PID 1832 wrote to memory of 3020 1832 lfrfflr.exe 41 PID 1832 wrote to memory of 3020 1832 lfrfflr.exe 41 PID 1832 wrote to memory of 3020 1832 lfrfflr.exe 41 PID 3020 wrote to memory of 1652 3020 jdppj.exe 42 PID 3020 wrote to memory of 1652 3020 jdppj.exe 42 PID 3020 wrote to memory of 1652 3020 jdppj.exe 42 PID 3020 wrote to memory of 1652 3020 jdppj.exe 42 PID 1652 wrote to memory of 1628 1652 xrxfffl.exe 43 PID 1652 wrote to memory of 1628 1652 xrxfffl.exe 43 PID 1652 wrote to memory of 1628 1652 xrxfffl.exe 43 PID 1652 wrote to memory of 1628 1652 xrxfffl.exe 43 PID 1628 wrote to memory of 1684 1628 djvvp.exe 44 PID 1628 wrote to memory of 1684 1628 djvvp.exe 44 PID 1628 wrote to memory of 1684 1628 djvvp.exe 44 PID 1628 wrote to memory of 1684 1628 djvvp.exe 44 PID 1684 wrote to memory of 1944 1684 pjvjv.exe 45 PID 1684 wrote to memory of 1944 1684 pjvjv.exe 45 PID 1684 wrote to memory of 1944 1684 pjvjv.exe 45 PID 1684 wrote to memory of 1944 1684 pjvjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe"C:\Users\Admin\AppData\Local\Temp\ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jjpjj.exec:\jjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jpdvd.exec:\jpdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dpdvj.exec:\dpdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9btbhh.exec:\9btbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rlffllx.exec:\rlffllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\bbthnt.exec:\bbthnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\1jvdj.exec:\1jvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\3thhhh.exec:\3thhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\btnntt.exec:\btnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rrflrrx.exec:\rrflrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lfrfflr.exec:\lfrfflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\jdppj.exec:\jdppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xrxfffl.exec:\xrxfffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\djvvp.exec:\djvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\pjvjv.exec:\pjvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rfllrlf.exec:\rfllrlf.exe17⤵
- Executes dropped EXE
PID:1944 -
\??\c:\btnbhh.exec:\btnbhh.exe18⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1jppv.exec:\1jppv.exe19⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbtbhh.exec:\hbtbhh.exe20⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bttbnt.exec:\bttbnt.exe21⤵
- Executes dropped EXE
PID:596 -
\??\c:\xxlrffx.exec:\xxlrffx.exe22⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hbtntb.exec:\hbtntb.exe23⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jvjjp.exec:\jvjjp.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5rxrlll.exec:\5rxrlll.exe25⤵
- Executes dropped EXE
PID:612 -
\??\c:\bnbnnt.exec:\bnbnnt.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdppv.exec:\pdppv.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xrffrxl.exec:\xrffrxl.exe28⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nhtnnt.exec:\nhtnnt.exe29⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7tttbb.exec:\7tttbb.exe30⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pdvvj.exec:\pdvvj.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\rlflxxr.exec:\rlflxxr.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\hbnntb.exec:\hbnntb.exe33⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvjpd.exec:\dvjpd.exe34⤵
- Executes dropped EXE
PID:1560 -
\??\c:\lfllrrx.exec:\lfllrrx.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bnnbhn.exec:\bnnbhn.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\htttbb.exec:\htttbb.exe37⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dvppd.exec:\dvppd.exe38⤵
- Executes dropped EXE
PID:2208 -
\??\c:\llxxrxl.exec:\llxxrxl.exe39⤵
- Executes dropped EXE
PID:688 -
\??\c:\rfllrrr.exec:\rfllrrr.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\thbbbb.exec:\thbbbb.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\btttbb.exec:\btttbb.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vjdvv.exec:\vjdvv.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dvjvp.exec:\dvjvp.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe45⤵
- Executes dropped EXE
PID:2864 -
\??\c:\thbbnn.exec:\thbbnn.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nhbhnt.exec:\nhbhnt.exe47⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ppjvd.exec:\ppjvd.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5xfllrr.exec:\5xfllrr.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rrffrrx.exec:\rrffrrx.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5thhnh.exec:\5thhnh.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bhtntb.exec:\bhtntb.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pjvdp.exec:\pjvdp.exe53⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7fllllr.exec:\7fllllr.exe54⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xxlxxxr.exec:\xxlxxxr.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hhtbnt.exec:\hhtbnt.exe56⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bbthnn.exec:\bbthnn.exe57⤵
- Executes dropped EXE
PID:580 -
\??\c:\jpjjp.exec:\jpjjp.exe58⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dppdj.exec:\dppdj.exe59⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1rffrxl.exec:\1rffrxl.exe60⤵
- Executes dropped EXE
PID:1376 -
\??\c:\nbhtht.exec:\nbhtht.exe61⤵
- Executes dropped EXE
PID:776 -
\??\c:\thnnbn.exec:\thnnbn.exe62⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ddvjv.exec:\ddvjv.exe63⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xffllrf.exec:\xffllrf.exe64⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxxfllx.exec:\xxxfllx.exe65⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bbnntt.exec:\bbnntt.exe66⤵PID:2304
-
\??\c:\vpjpp.exec:\vpjpp.exe67⤵PID:1660
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe68⤵PID:1748
-
\??\c:\7thntb.exec:\7thntb.exe69⤵PID:2052
-
\??\c:\tnhhnt.exec:\tnhhnt.exe70⤵PID:2896
-
\??\c:\pppvj.exec:\pppvj.exe71⤵PID:1708
-
\??\c:\llxfrlf.exec:\llxfrlf.exe72⤵PID:2200
-
\??\c:\vpddp.exec:\vpddp.exe73⤵PID:2520
-
\??\c:\1jdjd.exec:\1jdjd.exe74⤵PID:2384
-
\??\c:\nhbbnn.exec:\nhbbnn.exe75⤵PID:3044
-
\??\c:\pdvvj.exec:\pdvvj.exe76⤵PID:3040
-
\??\c:\dvjpp.exec:\dvjpp.exe77⤵PID:1492
-
\??\c:\1xlllrx.exec:\1xlllrx.exe78⤵PID:2556
-
\??\c:\thtttt.exec:\thtttt.exe79⤵PID:1252
-
\??\c:\5nhhtt.exec:\5nhhtt.exe80⤵PID:2184
-
\??\c:\9dvjv.exec:\9dvjv.exe81⤵PID:2156
-
\??\c:\lxfxllr.exec:\lxfxllr.exe82⤵PID:2748
-
\??\c:\nbnnbb.exec:\nbnnbb.exe83⤵PID:2732
-
\??\c:\dvddp.exec:\dvddp.exe84⤵PID:2416
-
\??\c:\jdvvp.exec:\jdvvp.exe85⤵PID:2960
-
\??\c:\frffrxl.exec:\frffrxl.exe86⤵PID:2600
-
\??\c:\9ntntt.exec:\9ntntt.exe87⤵PID:2640
-
\??\c:\7nbbbt.exec:\7nbbbt.exe88⤵PID:2756
-
\??\c:\3jppv.exec:\3jppv.exe89⤵PID:2656
-
\??\c:\9lxxffl.exec:\9lxxffl.exe90⤵PID:2868
-
\??\c:\xlxxrrf.exec:\xlxxrrf.exe91⤵PID:2752
-
\??\c:\5htntb.exec:\5htntb.exe92⤵PID:844
-
\??\c:\3bbbhh.exec:\3bbbhh.exe93⤵PID:824
-
\??\c:\pdppv.exec:\pdppv.exe94⤵PID:1040
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe95⤵PID:1852
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe96⤵PID:1964
-
\??\c:\1ttttt.exec:\1ttttt.exe97⤵PID:1688
-
\??\c:\jdjjv.exec:\jdjjv.exe98⤵PID:1924
-
\??\c:\jdppv.exec:\jdppv.exe99⤵PID:2116
-
\??\c:\rrlrflx.exec:\rrlrflx.exe100⤵PID:108
-
\??\c:\hhbhbh.exec:\hhbhbh.exe101⤵PID:1740
-
\??\c:\9btntn.exec:\9btntn.exe102⤵PID:2464
-
\??\c:\vpdpv.exec:\vpdpv.exe103⤵PID:1648
-
\??\c:\jvjpd.exec:\jvjpd.exe104⤵PID:2432
-
\??\c:\xrflrxf.exec:\xrflrxf.exe105⤵PID:2032
-
\??\c:\nhbbhh.exec:\nhbbhh.exe106⤵PID:828
-
\??\c:\pjvdp.exec:\pjvdp.exe107⤵PID:992
-
\??\c:\jdvvj.exec:\jdvvj.exe108⤵PID:2188
-
\??\c:\3rfrrxl.exec:\3rfrrxl.exe109⤵PID:612
-
\??\c:\btnnhh.exec:\btnnhh.exe110⤵PID:900
-
\??\c:\bthnbh.exec:\bthnbh.exe111⤵PID:304
-
\??\c:\9dvdd.exec:\9dvdd.exe112⤵PID:2948
-
\??\c:\3pppj.exec:\3pppj.exe113⤵PID:2492
-
\??\c:\xlffrxl.exec:\xlffrxl.exe114⤵PID:2104
-
\??\c:\ntnthn.exec:\ntnthn.exe115⤵PID:2500
-
\??\c:\bnhhth.exec:\bnhhth.exe116⤵PID:884
-
\??\c:\pvjpv.exec:\pvjpv.exe117⤵PID:2564
-
\??\c:\xrllxxl.exec:\xrllxxl.exe118⤵PID:2672
-
\??\c:\xfrrrrf.exec:\xfrrrrf.exe119⤵PID:2992
-
\??\c:\bbntnn.exec:\bbntnn.exe120⤵PID:3056
-
\??\c:\5jvvv.exec:\5jvvv.exe121⤵PID:2528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-