Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe
-
Size
455KB
-
MD5
57c35dd5c7d4d634fca2a36d462aeae7
-
SHA1
e7c53a3840dd49a90f3e63ff8fcdbc43f7877c11
-
SHA256
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410
-
SHA512
f5d7e2ed266661665200e02a6ffe6ad9c96c75ffb5c17974f12c78644ee8e3fc846bfab0f18fdcc63627bcd3fae8a469dceb55310fade1dae66233b39afc6271
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2216-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-34-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2552-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-71-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-171-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-225-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2500-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-368-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-532-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2268-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-742-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1436-837-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 jdppv.exe 2688 9frxlxf.exe 2068 jppvj.exe 2872 9lxxfxf.exe 2644 vjvdp.exe 2552 nhbbhh.exe 2584 dpjvd.exe 1300 7bnhnb.exe 2956 5rlflrf.exe 2108 hbtbhh.exe 2844 vpjjp.exe 864 1bnthn.exe 1900 pjdpd.exe 592 nhbnhh.exe 2768 vvdjj.exe 2236 lfxflfr.exe 2360 pdvdj.exe 1100 xrxrflr.exe 2020 jvjjp.exe 1620 xrllffl.exe 912 vjpvp.exe 1112 fxffllr.exe 2396 vpjvd.exe 2500 hhbbnh.exe 1968 1vdvj.exe 1788 lfxxxff.exe 2964 hhbnbb.exe 1632 rlxxlff.exe 1004 bbhbth.exe 2816 5jjdv.exe 2468 xrlfxrr.exe 2280 rrflrlr.exe 1708 ffxlrrx.exe 2796 tnhntt.exe 2712 9dppv.exe 2568 fxllxrx.exe 2696 nnbhnn.exe 2700 pjdvd.exe 2644 fxllrrf.exe 2140 1btthn.exe 3056 jjppp.exe 2920 pdvdd.exe 2384 lflffxf.exe 3028 bttbht.exe 2504 fffrlrf.exe 1672 tnbhnt.exe 1252 5jjvj.exe 2248 1rrfrfr.exe 484 ttnbnt.exe 2896 5vvdj.exe 2600 3rfllrf.exe 1332 hbntbh.exe 2196 jddpv.exe 2320 xxlrxfl.exe 2352 dvppv.exe 1100 5lxrxfl.exe 1372 bbthnn.exe 792 5jpvj.exe 1852 frlflrx.exe 1648 xrxflrf.exe 1820 tnhnhb.exe 2856 ppvpp.exe 1640 rlflrrl.exe 2136 ttntth.exe -
resource yara_rule behavioral1/memory/2216-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-151-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-189-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/912-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-931-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2744 2216 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 30 PID 2216 wrote to memory of 2744 2216 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 30 PID 2216 wrote to memory of 2744 2216 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 30 PID 2216 wrote to memory of 2744 2216 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 30 PID 2744 wrote to memory of 2688 2744 jdppv.exe 31 PID 2744 wrote to memory of 2688 2744 jdppv.exe 31 PID 2744 wrote to memory of 2688 2744 jdppv.exe 31 PID 2744 wrote to memory of 2688 2744 jdppv.exe 31 PID 2688 wrote to memory of 2068 2688 9frxlxf.exe 32 PID 2688 wrote to memory of 2068 2688 9frxlxf.exe 32 PID 2688 wrote to memory of 2068 2688 9frxlxf.exe 32 PID 2688 wrote to memory of 2068 2688 9frxlxf.exe 32 PID 2068 wrote to memory of 2872 2068 jppvj.exe 33 PID 2068 wrote to memory of 2872 2068 jppvj.exe 33 PID 2068 wrote to memory of 2872 2068 jppvj.exe 33 PID 2068 wrote to memory of 2872 2068 jppvj.exe 33 PID 2872 wrote to memory of 2644 2872 9lxxfxf.exe 34 PID 2872 wrote to memory of 2644 2872 9lxxfxf.exe 34 PID 2872 wrote to memory of 2644 2872 9lxxfxf.exe 34 PID 2872 wrote to memory of 2644 2872 9lxxfxf.exe 34 PID 2644 wrote to memory of 2552 2644 vjvdp.exe 35 PID 2644 wrote to memory of 2552 2644 vjvdp.exe 35 PID 2644 wrote to memory of 2552 2644 vjvdp.exe 35 PID 2644 wrote to memory of 2552 2644 vjvdp.exe 35 PID 2552 wrote to memory of 2584 2552 nhbbhh.exe 36 PID 2552 wrote to memory of 2584 2552 nhbbhh.exe 36 PID 2552 wrote to memory of 2584 2552 nhbbhh.exe 36 PID 2552 wrote to memory of 2584 2552 nhbbhh.exe 36 PID 2584 wrote to memory of 1300 2584 dpjvd.exe 37 PID 2584 wrote to memory of 1300 2584 dpjvd.exe 37 PID 2584 wrote to memory of 1300 2584 dpjvd.exe 37 PID 2584 wrote to memory of 1300 2584 dpjvd.exe 37 PID 1300 wrote to memory of 2956 1300 7bnhnb.exe 38 PID 1300 wrote to memory of 2956 1300 7bnhnb.exe 38 PID 1300 wrote to memory of 2956 1300 7bnhnb.exe 38 PID 1300 wrote to memory of 2956 1300 7bnhnb.exe 38 PID 2956 wrote to memory of 2108 2956 5rlflrf.exe 39 PID 2956 wrote to memory of 2108 2956 5rlflrf.exe 39 PID 2956 wrote to memory of 2108 2956 5rlflrf.exe 39 PID 2956 wrote to memory of 2108 2956 5rlflrf.exe 39 PID 2108 wrote to memory of 2844 2108 hbtbhh.exe 40 PID 2108 wrote to memory of 2844 2108 hbtbhh.exe 40 PID 2108 wrote to memory of 2844 2108 hbtbhh.exe 40 PID 2108 wrote to memory of 2844 2108 hbtbhh.exe 40 PID 2844 wrote to memory of 864 2844 vpjjp.exe 41 PID 2844 wrote to memory of 864 2844 vpjjp.exe 41 PID 2844 wrote to memory of 864 2844 vpjjp.exe 41 PID 2844 wrote to memory of 864 2844 vpjjp.exe 41 PID 864 wrote to memory of 1900 864 1bnthn.exe 42 PID 864 wrote to memory of 1900 864 1bnthn.exe 42 PID 864 wrote to memory of 1900 864 1bnthn.exe 42 PID 864 wrote to memory of 1900 864 1bnthn.exe 42 PID 1900 wrote to memory of 592 1900 pjdpd.exe 43 PID 1900 wrote to memory of 592 1900 pjdpd.exe 43 PID 1900 wrote to memory of 592 1900 pjdpd.exe 43 PID 1900 wrote to memory of 592 1900 pjdpd.exe 43 PID 592 wrote to memory of 2768 592 nhbnhh.exe 44 PID 592 wrote to memory of 2768 592 nhbnhh.exe 44 PID 592 wrote to memory of 2768 592 nhbnhh.exe 44 PID 592 wrote to memory of 2768 592 nhbnhh.exe 44 PID 2768 wrote to memory of 2236 2768 vvdjj.exe 45 PID 2768 wrote to memory of 2236 2768 vvdjj.exe 45 PID 2768 wrote to memory of 2236 2768 vvdjj.exe 45 PID 2768 wrote to memory of 2236 2768 vvdjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe"C:\Users\Admin\AppData\Local\Temp\ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jdppv.exec:\jdppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9frxlxf.exec:\9frxlxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jppvj.exec:\jppvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9lxxfxf.exec:\9lxxfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vjvdp.exec:\vjvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nhbbhh.exec:\nhbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dpjvd.exec:\dpjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\7bnhnb.exec:\7bnhnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\5rlflrf.exec:\5rlflrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\hbtbhh.exec:\hbtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vpjjp.exec:\vpjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1bnthn.exec:\1bnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\pjdpd.exec:\pjdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\nhbnhh.exec:\nhbnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\vvdjj.exec:\vvdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lfxflfr.exec:\lfxflfr.exe17⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pdvdj.exec:\pdvdj.exe18⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xrxrflr.exec:\xrxrflr.exe19⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jvjjp.exec:\jvjjp.exe20⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xrllffl.exec:\xrllffl.exe21⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vjpvp.exec:\vjpvp.exe22⤵
- Executes dropped EXE
PID:912 -
\??\c:\fxffllr.exec:\fxffllr.exe23⤵
- Executes dropped EXE
PID:1112 -
\??\c:\vpjvd.exec:\vpjvd.exe24⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hhbbnh.exec:\hhbbnh.exe25⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1vdvj.exec:\1vdvj.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lfxxxff.exec:\lfxxxff.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hhbnbb.exec:\hhbnbb.exe28⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rlxxlff.exec:\rlxxlff.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bbhbth.exec:\bbhbth.exe30⤵
- Executes dropped EXE
PID:1004 -
\??\c:\5jjdv.exec:\5jjdv.exe31⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrlfxrr.exec:\xrlfxrr.exe32⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rrflrlr.exec:\rrflrlr.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nbtbhb.exec:\nbtbhb.exe34⤵PID:1592
-
\??\c:\ffxlrrx.exec:\ffxlrrx.exe35⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tnhntt.exec:\tnhntt.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9dppv.exec:\9dppv.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fxllxrx.exec:\fxllxrx.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nnbhnn.exec:\nnbhnn.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjdvd.exec:\pjdvd.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fxllrrf.exec:\fxllrrf.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1btthn.exec:\1btthn.exe42⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jjppp.exec:\jjppp.exe43⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pdvdd.exec:\pdvdd.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lflffxf.exec:\lflffxf.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bttbht.exec:\bttbht.exe46⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fffrlrf.exec:\fffrlrf.exe47⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbhnt.exec:\tnbhnt.exe48⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5jjvj.exec:\5jjvj.exe49⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1rrfrfr.exec:\1rrfrfr.exe50⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ttnbnt.exec:\ttnbnt.exe51⤵
- Executes dropped EXE
PID:484 -
\??\c:\5vvdj.exec:\5vvdj.exe52⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3rfllrf.exec:\3rfllrf.exe53⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbntbh.exec:\hbntbh.exe54⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jddpv.exec:\jddpv.exe55⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe56⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dvppv.exec:\dvppv.exe57⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5lxrxfl.exec:\5lxrxfl.exe58⤵
- Executes dropped EXE
PID:1100 -
\??\c:\bbthnn.exec:\bbthnn.exe59⤵
- Executes dropped EXE
PID:1372 -
\??\c:\5jpvj.exec:\5jpvj.exe60⤵
- Executes dropped EXE
PID:792 -
\??\c:\frlflrx.exec:\frlflrx.exe61⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xrxflrf.exec:\xrxflrf.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tnhnhb.exec:\tnhnhb.exe63⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ppvpp.exec:\ppvpp.exe64⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rlflrrl.exec:\rlflrrl.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ttntth.exec:\ttntth.exe66⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ddvpv.exec:\ddvpv.exe67⤵PID:1388
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe68⤵PID:2508
-
\??\c:\thhttb.exec:\thhttb.exe69⤵PID:1804
-
\??\c:\jpppj.exec:\jpppj.exe70⤵PID:2268
-
\??\c:\llflrxf.exec:\llflrxf.exe71⤵PID:2884
-
\??\c:\nnhhtt.exec:\nnhhtt.exe72⤵PID:1028
-
\??\c:\5vdjp.exec:\5vdjp.exe73⤵PID:1240
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe74⤵PID:2660
-
\??\c:\9nbbhb.exec:\9nbbhb.exe75⤵PID:2468
-
\??\c:\vpjpj.exec:\vpjpj.exe76⤵PID:1576
-
\??\c:\lxfxffl.exec:\lxfxffl.exe77⤵PID:2684
-
\??\c:\hnntbh.exec:\hnntbh.exe78⤵PID:2688
-
\??\c:\ppjpv.exec:\ppjpv.exe79⤵PID:2784
-
\??\c:\1lxlrxr.exec:\1lxlrxr.exe80⤵PID:2068
-
\??\c:\nttnht.exec:\nttnht.exe81⤵PID:2568
-
\??\c:\9vpdj.exec:\9vpdj.exe82⤵PID:2800
-
\??\c:\xxflfrf.exec:\xxflfrf.exe83⤵PID:2700
-
\??\c:\3hhhnt.exec:\3hhhnt.exe84⤵PID:2104
-
\??\c:\jjdjv.exec:\jjdjv.exe85⤵PID:1304
-
\??\c:\3fllfrl.exec:\3fllfrl.exe86⤵PID:3056
-
\??\c:\3bhtbh.exec:\3bhtbh.exe87⤵PID:2932
-
\??\c:\djpjd.exec:\djpjd.exe88⤵PID:2384
-
\??\c:\vvvjv.exec:\vvvjv.exe89⤵PID:2956
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe90⤵PID:2504
-
\??\c:\htnhtt.exec:\htnhtt.exe91⤵PID:1684
-
\??\c:\ppvdv.exec:\ppvdv.exe92⤵PID:1000
-
\??\c:\jjvjv.exec:\jjvjv.exe93⤵PID:1976
-
\??\c:\1ffflfr.exec:\1ffflfr.exe94⤵PID:808
-
\??\c:\nnntnb.exec:\nnntnb.exe95⤵PID:2892
-
\??\c:\vvdpv.exec:\vvdpv.exe96⤵PID:1624
-
\??\c:\ttbhbh.exec:\ttbhbh.exe97⤵PID:2768
-
\??\c:\1xxrlxf.exec:\1xxrlxf.exe98⤵PID:1660
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe99⤵PID:2344
-
\??\c:\tbhbnt.exec:\tbhbnt.exe100⤵PID:2320
-
\??\c:\djjvj.exec:\djjvj.exe101⤵PID:1284
-
\??\c:\xrrfflx.exec:\xrrfflx.exe102⤵PID:1100
-
\??\c:\tbhbbb.exec:\tbhbbb.exe103⤵PID:2312
-
\??\c:\vjdpj.exec:\vjdpj.exe104⤵PID:2052
-
\??\c:\flfrffx.exec:\flfrffx.exe105⤵PID:1852
-
\??\c:\bttbnh.exec:\bttbnh.exe106⤵PID:1648
-
\??\c:\ppjpv.exec:\ppjpv.exe107⤵PID:1820
-
\??\c:\ppjpv.exec:\ppjpv.exe108⤵PID:1716
-
\??\c:\fxrxlff.exec:\fxrxlff.exe109⤵PID:2032
-
\??\c:\tttbth.exec:\tttbth.exe110⤵PID:604
-
\??\c:\ppvpd.exec:\ppvpd.exe111⤵PID:2308
-
\??\c:\3frxfrl.exec:\3frxfrl.exe112⤵PID:2276
-
\??\c:\ttthtn.exec:\ttthtn.exe113⤵PID:2364
-
\??\c:\nnhbnt.exec:\nnhbnt.exe114⤵PID:3000
-
\??\c:\dvpvj.exec:\dvpvj.exe115⤵PID:1436
-
\??\c:\3fxxffx.exec:\3fxxffx.exe116⤵PID:1836
-
\??\c:\ttnbhn.exec:\ttnbhn.exe117⤵PID:2612
-
\??\c:\3pdpv.exec:\3pdpv.exe118⤵PID:2216
-
\??\c:\rlrxlxr.exec:\rlrxlxr.exe119⤵PID:2496
-
\??\c:\bbbbnt.exec:\bbbbnt.exe120⤵PID:1600
-
\??\c:\hnhbhh.exec:\hnhbhh.exe121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-