Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:30
Behavioral task
behavioral1
Sample
97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe
-
Size
142KB
-
MD5
d85e723e5943ab83a3945187ce79fa5c
-
SHA1
0f1691f8b0df2a9750270d3be24a88473283848f
-
SHA256
97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109
-
SHA512
f7a71c29d383b260bdb3238bd32ccbe80f1acd95cc592a1a7db1ee7973cb41f2ceeb37f7990cf23cb1471a1dfd4cf8e666e3f90652d99191ade5e3a9299979f4
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BfDKPeGrR+i:kcm4FmowdHoSphraHcpOaKHci
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1172-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-123-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2164-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-173-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2908-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-166-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2188-186-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2188-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-222-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1640-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/548-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-369-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-376-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-397-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-416-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1660-455-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2188-474-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2200-481-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/768-507-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1972-557-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/872-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-598-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2964-605-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2704-629-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-638-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1168-670-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2204-716-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-749-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-770-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1040-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/824-785-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2040-796-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1300-885-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1300 9xxflxl.exe 2000 hbnbnt.exe 2812 pvjvv.exe 2832 tnbhnt.exe 3004 vdjvp.exe 2728 9rrfxlx.exe 2996 nnbhbn.exe 2772 tbbbnn.exe 2172 ffrxlfr.exe 3060 xfrllrl.exe 2476 tntthh.exe 1996 jjjvp.exe 3048 bbnthh.exe 2164 5bnbhn.exe 2924 rrxlxrl.exe 2940 5hthht.exe 1960 vpdjd.exe 2908 ddjpd.exe 264 xxllflx.exe 2188 bhhnnb.exe 2140 jpddj.exe 2208 ffllxxl.exe 2380 bthntb.exe 896 dvdjj.exe 2580 lrfrrfr.exe 1640 ffrflrx.exe 1704 bhnhtn.exe 980 vjpdv.exe 1064 5nbtnb.exe 376 ddpdd.exe 548 rrllffr.exe 1856 1hntnn.exe 576 3vvdp.exe 1548 xllxlxr.exe 2816 xlflrrr.exe 2964 7bhhtn.exe 2956 lxxrfrr.exe 2824 xfrfrrx.exe 2732 1nhttb.exe 2740 9jjpd.exe 2796 vppjj.exe 776 lrflxfr.exe 1636 ttbbhh.exe 2764 tbthnt.exe 2268 9dvvd.exe 2236 xxfrxfr.exe 2468 lrxrflx.exe 2288 3hntnt.exe 1988 vjddv.exe 1952 vjdvd.exe 2280 3flxrll.exe 2904 5ffllfr.exe 1292 tnbhbn.exe 1288 ddppj.exe 1016 vvvdv.exe 1660 1xrxfll.exe 844 1nthnh.exe 2184 nbtbht.exe 2188 dpvjd.exe 2200 lrxxllr.exe 2416 tnntnt.exe 2208 hbnnth.exe 824 jjpvp.exe 768 vvjdj.exe -
resource yara_rule behavioral1/memory/1172-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fd-5.dat upx behavioral1/memory/1172-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1300-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019608-15.dat upx behavioral1/files/0x000700000001960a-25.dat upx behavioral1/memory/2000-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001961c-36.dat upx behavioral1/memory/2832-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019667-43.dat upx behavioral1/files/0x00060000000196a1-53.dat upx behavioral1/memory/3004-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019926-63.dat upx behavioral1/memory/2996-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019c34-72.dat upx behavioral1/files/0x0008000000019c3c-80.dat upx behavioral1/files/0x000500000001a4c7-88.dat upx behavioral1/files/0x000500000001a4c9-96.dat upx behavioral1/memory/3060-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4cb-107.dat upx behavioral1/memory/2476-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4cd-115.dat upx behavioral1/files/0x000500000001a4cf-125.dat upx behavioral1/memory/2164-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4d1-133.dat upx behavioral1/memory/2924-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4d3-142.dat upx behavioral1/files/0x000500000001a4d5-151.dat upx behavioral1/files/0x000500000001a4d7-159.dat upx behavioral1/files/0x000500000001a4db-178.dat upx behavioral1/files/0x000500000001a4d9-170.dat upx behavioral1/memory/2908-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4de-187.dat upx behavioral1/memory/2188-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2140-192-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a4e0-197.dat upx behavioral1/files/0x002e000000019604-206.dat upx behavioral1/memory/2208-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4e2-215.dat upx behavioral1/files/0x000500000001a4e4-226.dat upx behavioral1/memory/896-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4e6-234.dat upx behavioral1/memory/1704-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4e8-243.dat upx behavioral1/files/0x000500000001a4eb-251.dat upx behavioral1/files/0x000500000001a4ed-260.dat upx behavioral1/memory/980-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ef-268.dat upx behavioral1/files/0x000500000001a4f1-276.dat upx behavioral1/memory/1856-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/548-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4f7-284.dat upx behavioral1/memory/1856-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1548-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/776-362-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1300 1172 97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe 30 PID 1172 wrote to memory of 1300 1172 97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe 30 PID 1172 wrote to memory of 1300 1172 97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe 30 PID 1172 wrote to memory of 1300 1172 97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe 30 PID 1300 wrote to memory of 2000 1300 9xxflxl.exe 31 PID 1300 wrote to memory of 2000 1300 9xxflxl.exe 31 PID 1300 wrote to memory of 2000 1300 9xxflxl.exe 31 PID 1300 wrote to memory of 2000 1300 9xxflxl.exe 31 PID 2000 wrote to memory of 2812 2000 hbnbnt.exe 32 PID 2000 wrote to memory of 2812 2000 hbnbnt.exe 32 PID 2000 wrote to memory of 2812 2000 hbnbnt.exe 32 PID 2000 wrote to memory of 2812 2000 hbnbnt.exe 32 PID 2812 wrote to memory of 2832 2812 pvjvv.exe 33 PID 2812 wrote to memory of 2832 2812 pvjvv.exe 33 PID 2812 wrote to memory of 2832 2812 pvjvv.exe 33 PID 2812 wrote to memory of 2832 2812 pvjvv.exe 33 PID 2832 wrote to memory of 3004 2832 tnbhnt.exe 34 PID 2832 wrote to memory of 3004 2832 tnbhnt.exe 34 PID 2832 wrote to memory of 3004 2832 tnbhnt.exe 34 PID 2832 wrote to memory of 3004 2832 tnbhnt.exe 34 PID 3004 wrote to memory of 2728 3004 vdjvp.exe 35 PID 3004 wrote to memory of 2728 3004 vdjvp.exe 35 PID 3004 wrote to memory of 2728 3004 vdjvp.exe 35 PID 3004 wrote to memory of 2728 3004 vdjvp.exe 35 PID 2728 wrote to memory of 2996 2728 9rrfxlx.exe 36 PID 2728 wrote to memory of 2996 2728 9rrfxlx.exe 36 PID 2728 wrote to memory of 2996 2728 9rrfxlx.exe 36 PID 2728 wrote to memory of 2996 2728 9rrfxlx.exe 36 PID 2996 wrote to memory of 2772 2996 nnbhbn.exe 37 PID 2996 wrote to memory of 2772 2996 nnbhbn.exe 37 PID 2996 wrote to memory of 2772 2996 nnbhbn.exe 37 PID 2996 wrote to memory of 2772 2996 nnbhbn.exe 37 PID 2772 wrote to memory of 2172 2772 tbbbnn.exe 38 PID 2772 wrote to memory of 2172 2772 tbbbnn.exe 38 PID 2772 wrote to memory of 2172 2772 tbbbnn.exe 38 PID 2772 wrote to memory of 2172 2772 tbbbnn.exe 38 PID 2172 wrote to memory of 3060 2172 ffrxlfr.exe 39 PID 2172 wrote to memory of 3060 2172 ffrxlfr.exe 39 PID 2172 wrote to memory of 3060 2172 ffrxlfr.exe 39 PID 2172 wrote to memory of 3060 2172 ffrxlfr.exe 39 PID 3060 wrote to memory of 2476 3060 xfrllrl.exe 40 PID 3060 wrote to memory of 2476 3060 xfrllrl.exe 40 PID 3060 wrote to memory of 2476 3060 xfrllrl.exe 40 PID 3060 wrote to memory of 2476 3060 xfrllrl.exe 40 PID 2476 wrote to memory of 1996 2476 tntthh.exe 41 PID 2476 wrote to memory of 1996 2476 tntthh.exe 41 PID 2476 wrote to memory of 1996 2476 tntthh.exe 41 PID 2476 wrote to memory of 1996 2476 tntthh.exe 41 PID 1996 wrote to memory of 3048 1996 jjjvp.exe 42 PID 1996 wrote to memory of 3048 1996 jjjvp.exe 42 PID 1996 wrote to memory of 3048 1996 jjjvp.exe 42 PID 1996 wrote to memory of 3048 1996 jjjvp.exe 42 PID 3048 wrote to memory of 2164 3048 bbnthh.exe 43 PID 3048 wrote to memory of 2164 3048 bbnthh.exe 43 PID 3048 wrote to memory of 2164 3048 bbnthh.exe 43 PID 3048 wrote to memory of 2164 3048 bbnthh.exe 43 PID 2164 wrote to memory of 2924 2164 5bnbhn.exe 44 PID 2164 wrote to memory of 2924 2164 5bnbhn.exe 44 PID 2164 wrote to memory of 2924 2164 5bnbhn.exe 44 PID 2164 wrote to memory of 2924 2164 5bnbhn.exe 44 PID 2924 wrote to memory of 2940 2924 rrxlxrl.exe 45 PID 2924 wrote to memory of 2940 2924 rrxlxrl.exe 45 PID 2924 wrote to memory of 2940 2924 rrxlxrl.exe 45 PID 2924 wrote to memory of 2940 2924 rrxlxrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe"C:\Users\Admin\AppData\Local\Temp\97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\9xxflxl.exec:\9xxflxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\hbnbnt.exec:\hbnbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\pvjvv.exec:\pvjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tnbhnt.exec:\tnbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vdjvp.exec:\vdjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\9rrfxlx.exec:\9rrfxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nnbhbn.exec:\nnbhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tbbbnn.exec:\tbbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ffrxlfr.exec:\ffrxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xfrllrl.exec:\xfrllrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\tntthh.exec:\tntthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jjjvp.exec:\jjjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\bbnthh.exec:\bbnthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\5bnbhn.exec:\5bnbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\rrxlxrl.exec:\rrxlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\5hthht.exec:\5hthht.exe17⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vpdjd.exec:\vpdjd.exe18⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ddjpd.exec:\ddjpd.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xxllflx.exec:\xxllflx.exe20⤵
- Executes dropped EXE
PID:264 -
\??\c:\bhhnnb.exec:\bhhnnb.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jpddj.exec:\jpddj.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140 -
\??\c:\ffllxxl.exec:\ffllxxl.exe23⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bthntb.exec:\bthntb.exe24⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dvdjj.exec:\dvdjj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\lrfrrfr.exec:\lrfrrfr.exe26⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ffrflrx.exec:\ffrflrx.exe27⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bhnhtn.exec:\bhnhtn.exe28⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vjpdv.exec:\vjpdv.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980 -
\??\c:\5nbtnb.exec:\5nbtnb.exe30⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ddpdd.exec:\ddpdd.exe31⤵
- Executes dropped EXE
PID:376 -
\??\c:\rrllffr.exec:\rrllffr.exe32⤵
- Executes dropped EXE
PID:548 -
\??\c:\1hntnn.exec:\1hntnn.exe33⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3vvdp.exec:\3vvdp.exe34⤵
- Executes dropped EXE
PID:576 -
\??\c:\xllxlxr.exec:\xllxlxr.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xlflrrr.exec:\xlflrrr.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7bhhtn.exec:\7bhhtn.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lxxrfrr.exec:\lxxrfrr.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xfrfrrx.exec:\xfrfrrx.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1nhttb.exec:\1nhttb.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9jjpd.exec:\9jjpd.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vppjj.exec:\vppjj.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lrflxfr.exec:\lrflxfr.exe43⤵
- Executes dropped EXE
PID:776 -
\??\c:\ttbbhh.exec:\ttbbhh.exe44⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tbthnt.exec:\tbthnt.exe45⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9dvvd.exec:\9dvvd.exe46⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxfrxfr.exec:\xxfrxfr.exe47⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lrxrflx.exec:\lrxrflx.exe48⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3hntnt.exec:\3hntnt.exe49⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vjddv.exec:\vjddv.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vjdvd.exec:\vjdvd.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3flxrll.exec:\3flxrll.exe52⤵
- Executes dropped EXE
PID:2280 -
\??\c:\5ffllfr.exec:\5ffllfr.exe53⤵
- Executes dropped EXE
PID:2904 -
\??\c:\tnbhbn.exec:\tnbhbn.exe54⤵
- Executes dropped EXE
PID:1292 -
\??\c:\ddppj.exec:\ddppj.exe55⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vvvdv.exec:\vvvdv.exe56⤵
- Executes dropped EXE
PID:1016 -
\??\c:\1xrxfll.exec:\1xrxfll.exe57⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1nthnh.exec:\1nthnh.exe58⤵
- Executes dropped EXE
PID:844 -
\??\c:\nbtbht.exec:\nbtbht.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dpvjd.exec:\dpvjd.exe60⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lrxxllr.exec:\lrxxllr.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tnntnt.exec:\tnntnt.exe62⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hbnnth.exec:\hbnnth.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jjpvp.exec:\jjpvp.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\vvjdj.exec:\vvjdj.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\ffxxxfl.exec:\ffxxxfl.exe66⤵PID:800
-
\??\c:\tthnbn.exec:\tthnbn.exe67⤵PID:2152
-
\??\c:\ppvdj.exec:\ppvdj.exe68⤵PID:1916
-
\??\c:\7vpjv.exec:\7vpjv.exe69⤵PID:988
-
\??\c:\lrxfxlr.exec:\lrxfxlr.exe70⤵PID:2680
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe71⤵PID:980
-
\??\c:\9bnhtt.exec:\9bnhtt.exe72⤵PID:1148
-
\??\c:\jpjpd.exec:\jpjpd.exe73⤵PID:1972
-
\??\c:\pjvvj.exec:\pjvvj.exe74⤵PID:872
-
\??\c:\rxlrllr.exec:\rxlrllr.exe75⤵PID:1156
-
\??\c:\hthbnn.exec:\hthbnn.exe76⤵PID:2248
-
\??\c:\pvpvp.exec:\pvpvp.exe77⤵PID:1300
-
\??\c:\jpppj.exec:\jpppj.exe78⤵PID:2960
-
\??\c:\rrfxfrx.exec:\rrfxfrx.exe79⤵PID:2992
-
\??\c:\5thbth.exec:\5thbth.exe80⤵PID:2964
-
\??\c:\jpvdd.exec:\jpvdd.exe81⤵PID:2224
-
\??\c:\9dvdv.exec:\9dvdv.exe82⤵PID:2824
-
\??\c:\fflrfxl.exec:\fflrfxl.exe83⤵PID:2880
-
\??\c:\bntnth.exec:\bntnth.exe84⤵PID:2704
-
\??\c:\hthbnb.exec:\hthbnb.exe85⤵PID:2796
-
\??\c:\dpdjj.exec:\dpdjj.exe86⤵PID:776
-
\??\c:\1lxxllx.exec:\1lxxllx.exe87⤵PID:1352
-
\??\c:\7hbhnt.exec:\7hbhnt.exe88⤵PID:1668
-
\??\c:\ntnttb.exec:\ntnttb.exe89⤵PID:2464
-
\??\c:\vvdjv.exec:\vvdjv.exe90⤵PID:1168
-
\??\c:\3rflxlx.exec:\3rflxlx.exe91⤵PID:2476
-
\??\c:\1hbbht.exec:\1hbbht.exe92⤵PID:2120
-
\??\c:\1hbhnh.exec:\1hbhnh.exe93⤵PID:2132
-
\??\c:\ppjpv.exec:\ppjpv.exe94⤵PID:2204
-
\??\c:\lrflrlx.exec:\lrflrlx.exe95⤵PID:3056
-
\??\c:\1tntht.exec:\1tntht.exe96⤵PID:2948
-
\??\c:\vvjvp.exec:\vvjvp.exe97⤵PID:1256
-
\??\c:\rxlflrx.exec:\rxlflrx.exe98⤵PID:1960
-
\??\c:\tntnhh.exec:\tntnhh.exe99⤵PID:1016
-
\??\c:\bnnnbn.exec:\bnnnbn.exe100⤵PID:1660
-
\??\c:\vvvvd.exec:\vvvvd.exe101⤵PID:2392
-
\??\c:\lffrxff.exec:\lffrxff.exe102⤵PID:2196
-
\??\c:\tbtbbb.exec:\tbtbbb.exe103⤵PID:2188
-
\??\c:\hhtbnb.exec:\hhtbnb.exe104⤵PID:3024
-
\??\c:\jpjpp.exec:\jpjpp.exe105⤵PID:1040
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe106⤵PID:2060
-
\??\c:\3tnhtb.exec:\3tnhtb.exe107⤵PID:824
-
\??\c:\vjjdd.exec:\vjjdd.exe108⤵PID:2580
-
\??\c:\djpjd.exec:\djpjd.exe109⤵PID:2040
-
\??\c:\frrxxrr.exec:\frrxxrr.exe110⤵PID:2344
-
\??\c:\3ttbtb.exec:\3ttbtb.exe111⤵PID:1704
-
\??\c:\vvpdp.exec:\vvpdp.exe112⤵PID:2516
-
\??\c:\jvvjd.exec:\jvvjd.exe113⤵PID:2928
-
\??\c:\lrlllxr.exec:\lrlllxr.exe114⤵PID:1400
-
\??\c:\7bttnt.exec:\7bttnt.exe115⤵PID:884
-
\??\c:\ppjvv.exec:\ppjvv.exe116⤵PID:1956
-
\??\c:\ppdpv.exec:\ppdpv.exe117⤵PID:2892
-
\??\c:\rffxlff.exec:\rffxlff.exe118⤵PID:2944
-
\??\c:\tbhtnt.exec:\tbhtnt.exe119⤵PID:2836
-
\??\c:\tnnbbb.exec:\tnnbbb.exe120⤵PID:1300
-
\??\c:\vpdpj.exec:\vpdpj.exe121⤵PID:2952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-