Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe
-
Size
454KB
-
MD5
adc3ad1c52a585c3b9baddbcbd136284
-
SHA1
d1e7d4839522c581ac5f5105e7d4f2d50426f0e0
-
SHA256
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16
-
SHA512
df3b5b10b50f767073d118ede156d86539b9bd5774def1401b2908d1e645bb641788145634980e2b4e54b95ed453d8ef47da896acb34cacb4e3a911baa05e84f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbej:q7Tc2NYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1628-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-37-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2900-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-89-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-438-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/3020-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-50-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2328-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-533-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2284-540-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-550-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1972-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-627-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2668-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-677-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1624-691-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 tnhhbn.exe 2520 vdvdp.exe 2272 jjddv.exe 2900 fxlrxxr.exe 2768 nnhtht.exe 2916 pppvj.exe 2664 3rlfflf.exe 2640 7tntnt.exe 2764 1vjjj.exe 2000 7fxlrxl.exe 1560 nhnttb.exe 2960 vddjp.exe 780 bthntb.exe 332 nnhnnn.exe 2732 rffxrxr.exe 1356 ttnthn.exe 3020 jjvdv.exe 1332 fxxlrrr.exe 636 9hbbhh.exe 1084 xlrfxff.exe 2832 5nthth.exe 1372 ddvpj.exe 1320 llffrrf.exe 2292 hbnntb.exe 1812 5jdjp.exe 2304 fllfflr.exe 2560 thbtbn.exe 2396 vvddd.exe 1760 lxlfrrx.exe 2564 vpvjv.exe 2368 xrllrxr.exe 2612 3fxxrxl.exe 1732 vpdjv.exe 2084 ppjjp.exe 1796 xrlrflx.exe 2772 ntbbtn.exe 3044 5hhhnn.exe 2752 vpjpv.exe 2672 vvddj.exe 2936 fxxxfll.exe 2812 btbbbb.exe 2648 bbthnb.exe 2644 jjvpv.exe 1984 pddvv.exe 2764 flrxxfr.exe 1608 nbnbbt.exe 3004 btnthh.exe 2024 vjppp.exe 1148 rlxxrrf.exe 980 3lfrrxf.exe 1016 nnbhtb.exe 2984 jpvvv.exe 888 jjvdj.exe 1508 xfrxflx.exe 2712 nhbnbt.exe 3020 nhhhnb.exe 1840 jvjvv.exe 1776 xrlrffr.exe 1140 rrfxfrr.exe 1084 hbnbhb.exe 1364 hhhtht.exe 672 7djdj.exe 1784 rfrxllr.exe 1320 jjvpj.exe -
resource yara_rule behavioral1/memory/1628-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-540-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2524-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-627-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2668-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-677-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2432-732-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2700-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-980-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-999-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-1012-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-1150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-1157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-1256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-1269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-1276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-1296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-1303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-1310-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxlxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lflrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1628 2612 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 30 PID 2612 wrote to memory of 1628 2612 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 30 PID 2612 wrote to memory of 1628 2612 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 30 PID 2612 wrote to memory of 1628 2612 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 30 PID 1628 wrote to memory of 2520 1628 tnhhbn.exe 31 PID 1628 wrote to memory of 2520 1628 tnhhbn.exe 31 PID 1628 wrote to memory of 2520 1628 tnhhbn.exe 31 PID 1628 wrote to memory of 2520 1628 tnhhbn.exe 31 PID 2520 wrote to memory of 2272 2520 vdvdp.exe 32 PID 2520 wrote to memory of 2272 2520 vdvdp.exe 32 PID 2520 wrote to memory of 2272 2520 vdvdp.exe 32 PID 2520 wrote to memory of 2272 2520 vdvdp.exe 32 PID 2272 wrote to memory of 2900 2272 jjddv.exe 33 PID 2272 wrote to memory of 2900 2272 jjddv.exe 33 PID 2272 wrote to memory of 2900 2272 jjddv.exe 33 PID 2272 wrote to memory of 2900 2272 jjddv.exe 33 PID 2900 wrote to memory of 2768 2900 fxlrxxr.exe 34 PID 2900 wrote to memory of 2768 2900 fxlrxxr.exe 34 PID 2900 wrote to memory of 2768 2900 fxlrxxr.exe 34 PID 2900 wrote to memory of 2768 2900 fxlrxxr.exe 34 PID 2768 wrote to memory of 2916 2768 nnhtht.exe 35 PID 2768 wrote to memory of 2916 2768 nnhtht.exe 35 PID 2768 wrote to memory of 2916 2768 nnhtht.exe 35 PID 2768 wrote to memory of 2916 2768 nnhtht.exe 35 PID 2916 wrote to memory of 2664 2916 pppvj.exe 36 PID 2916 wrote to memory of 2664 2916 pppvj.exe 36 PID 2916 wrote to memory of 2664 2916 pppvj.exe 36 PID 2916 wrote to memory of 2664 2916 pppvj.exe 36 PID 2664 wrote to memory of 2640 2664 3rlfflf.exe 37 PID 2664 wrote to memory of 2640 2664 3rlfflf.exe 37 PID 2664 wrote to memory of 2640 2664 3rlfflf.exe 37 PID 2664 wrote to memory of 2640 2664 3rlfflf.exe 37 PID 2640 wrote to memory of 2764 2640 7tntnt.exe 74 PID 2640 wrote to memory of 2764 2640 7tntnt.exe 74 PID 2640 wrote to memory of 2764 2640 7tntnt.exe 74 PID 2640 wrote to memory of 2764 2640 7tntnt.exe 74 PID 2764 wrote to memory of 2000 2764 1vjjj.exe 39 PID 2764 wrote to memory of 2000 2764 1vjjj.exe 39 PID 2764 wrote to memory of 2000 2764 1vjjj.exe 39 PID 2764 wrote to memory of 2000 2764 1vjjj.exe 39 PID 2000 wrote to memory of 1560 2000 7fxlrxl.exe 40 PID 2000 wrote to memory of 1560 2000 7fxlrxl.exe 40 PID 2000 wrote to memory of 1560 2000 7fxlrxl.exe 40 PID 2000 wrote to memory of 1560 2000 7fxlrxl.exe 40 PID 1560 wrote to memory of 2960 1560 nhnttb.exe 41 PID 1560 wrote to memory of 2960 1560 nhnttb.exe 41 PID 1560 wrote to memory of 2960 1560 nhnttb.exe 41 PID 1560 wrote to memory of 2960 1560 nhnttb.exe 41 PID 2960 wrote to memory of 780 2960 vddjp.exe 42 PID 2960 wrote to memory of 780 2960 vddjp.exe 42 PID 2960 wrote to memory of 780 2960 vddjp.exe 42 PID 2960 wrote to memory of 780 2960 vddjp.exe 42 PID 780 wrote to memory of 332 780 bthntb.exe 43 PID 780 wrote to memory of 332 780 bthntb.exe 43 PID 780 wrote to memory of 332 780 bthntb.exe 43 PID 780 wrote to memory of 332 780 bthntb.exe 43 PID 332 wrote to memory of 2732 332 nnhnnn.exe 44 PID 332 wrote to memory of 2732 332 nnhnnn.exe 44 PID 332 wrote to memory of 2732 332 nnhnnn.exe 44 PID 332 wrote to memory of 2732 332 nnhnnn.exe 44 PID 2732 wrote to memory of 1356 2732 rffxrxr.exe 45 PID 2732 wrote to memory of 1356 2732 rffxrxr.exe 45 PID 2732 wrote to memory of 1356 2732 rffxrxr.exe 45 PID 2732 wrote to memory of 1356 2732 rffxrxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe"C:\Users\Admin\AppData\Local\Temp\ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tnhhbn.exec:\tnhhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vdvdp.exec:\vdvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\jjddv.exec:\jjddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\fxlrxxr.exec:\fxlrxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nnhtht.exec:\nnhtht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\pppvj.exec:\pppvj.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\3rlfflf.exec:\3rlfflf.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7tntnt.exec:\7tntnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1vjjj.exec:\1vjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\7fxlrxl.exec:\7fxlrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nhnttb.exec:\nhnttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\vddjp.exec:\vddjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bthntb.exec:\bthntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\nnhnnn.exec:\nnhnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\rffxrxr.exec:\rffxrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ttnthn.exec:\ttnthn.exe17⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jjvdv.exec:\jjvdv.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\fxxlrrr.exec:\fxxlrrr.exe19⤵
- Executes dropped EXE
PID:1332 -
\??\c:\9hbbhh.exec:\9hbbhh.exe20⤵
- Executes dropped EXE
PID:636 -
\??\c:\xlrfxff.exec:\xlrfxff.exe21⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5nthth.exec:\5nthth.exe22⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ddvpj.exec:\ddvpj.exe23⤵
- Executes dropped EXE
PID:1372 -
\??\c:\llffrrf.exec:\llffrrf.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1320 -
\??\c:\hbnntb.exec:\hbnntb.exe25⤵
- Executes dropped EXE
PID:2292 -
\??\c:\5jdjp.exec:\5jdjp.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\fllfflr.exec:\fllfflr.exe27⤵
- Executes dropped EXE
PID:2304 -
\??\c:\thbtbn.exec:\thbtbn.exe28⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vvddd.exec:\vvddd.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\lxlfrrx.exec:\lxlfrrx.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\vpvjv.exec:\vpvjv.exe31⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xrllrxr.exec:\xrllrxr.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3fxxrxl.exec:\3fxxrxl.exe33⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vpdjv.exec:\vpdjv.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\ppjjp.exec:\ppjjp.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\xrlrflx.exec:\xrlrflx.exe36⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ntbbtn.exec:\ntbbtn.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5hhhnn.exec:\5hhhnn.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpjpv.exec:\vpjpv.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vvddj.exec:\vvddj.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\fxxxfll.exec:\fxxxfll.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\btbbbb.exec:\btbbbb.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bbthnb.exec:\bbthnb.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jjvpv.exec:\jjvpv.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pddvv.exec:\pddvv.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\flrxxfr.exec:\flrxxfr.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764 -
\??\c:\nbnbbt.exec:\nbnbbt.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\btnthh.exec:\btnthh.exe48⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vjppp.exec:\vjppp.exe49⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlxxrrf.exec:\rlxxrrf.exe50⤵
- Executes dropped EXE
PID:1148 -
\??\c:\3lfrrxf.exec:\3lfrrxf.exe51⤵
- Executes dropped EXE
PID:980 -
\??\c:\nnbhtb.exec:\nnbhtb.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jpvvv.exec:\jpvvv.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jjvdj.exec:\jjvdj.exe54⤵
- Executes dropped EXE
PID:888 -
\??\c:\xfrxflx.exec:\xfrxflx.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\nhbnbt.exec:\nhbnbt.exe56⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhhhnb.exec:\nhhhnb.exe57⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jvjvv.exec:\jvjvv.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xrlrffr.exec:\xrlrffr.exe59⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrfxfrr.exec:\rrfxfrr.exe60⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hbnbhb.exec:\hbnbhb.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hhhtht.exec:\hhhtht.exe62⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7djdj.exec:\7djdj.exe63⤵
- Executes dropped EXE
PID:672 -
\??\c:\rfrxllr.exec:\rfrxllr.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jjvpj.exec:\jjvpj.exe65⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pjvjd.exec:\pjvjd.exe66⤵PID:2988
-
\??\c:\nhhhtb.exec:\nhhhtb.exe67⤵PID:1924
-
\??\c:\nhbtbb.exec:\nhbtbb.exe68⤵PID:1956
-
\??\c:\rlllrrf.exec:\rlllrrf.exe69⤵PID:2328
-
\??\c:\nhnbnt.exec:\nhnbnt.exe70⤵PID:2284
-
\??\c:\vpdpv.exec:\vpdpv.exe71⤵PID:2396
-
\??\c:\djpvv.exec:\djpvv.exe72⤵PID:2524
-
\??\c:\xxrfllf.exec:\xxrfllf.exe73⤵PID:1972
-
\??\c:\bhbhnn.exec:\bhbhnn.exe74⤵PID:1280
-
\??\c:\djjjd.exec:\djjjd.exe75⤵PID:2368
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe76⤵PID:340
-
\??\c:\1nhnnb.exec:\1nhnnb.exe77⤵
- System Location Discovery: System Language Discovery
PID:2080 -
\??\c:\3btbtt.exec:\3btbtt.exe78⤵PID:2480
-
\??\c:\xxflflx.exec:\xxflflx.exe79⤵
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\nnnhbh.exec:\nnnhbh.exe80⤵PID:2796
-
\??\c:\7rlflfl.exec:\7rlflfl.exe81⤵PID:2900
-
\??\c:\5xlfxxf.exec:\5xlfxxf.exe82⤵PID:3036
-
\??\c:\hhhnbb.exec:\hhhnbb.exe83⤵PID:2820
-
\??\c:\hbnntt.exec:\hbnntt.exe84⤵
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\vvpvp.exec:\vvpvp.exe85⤵PID:2760
-
\??\c:\xxrllrx.exec:\xxrllrx.exe86⤵
- System Location Discovery: System Language Discovery
PID:2668 -
\??\c:\9xflfll.exec:\9xflfll.exe87⤵PID:2928
-
\??\c:\bbhttt.exec:\bbhttt.exe88⤵
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\vpdpp.exec:\vpdpp.exe89⤵PID:2688
-
\??\c:\fxrxflx.exec:\fxrxflx.exe90⤵PID:2680
-
\??\c:\ttthhh.exec:\ttthhh.exe91⤵PID:872
-
\??\c:\ttnthn.exec:\ttnthn.exe92⤵
- System Location Discovery: System Language Discovery
PID:1236 -
\??\c:\ppjpj.exec:\ppjpj.exe93⤵
- System Location Discovery: System Language Discovery
PID:1624 -
\??\c:\rlxflrf.exec:\rlxflrf.exe94⤵PID:1804
-
\??\c:\1rrflrx.exec:\1rrflrx.exe95⤵PID:2992
-
\??\c:\bhhnhh.exec:\bhhnhh.exe96⤵PID:484
-
\??\c:\7dpvd.exec:\7dpvd.exe97⤵PID:1220
-
\??\c:\pvpdj.exec:\pvpdj.exe98⤵PID:2044
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe99⤵PID:1508
-
\??\c:\tnhhnt.exec:\tnhhnt.exe100⤵PID:2432
-
\??\c:\hbthht.exec:\hbthht.exe101⤵PID:800
-
\??\c:\7dpdj.exec:\7dpdj.exe102⤵PID:1808
-
\??\c:\7rfrxxl.exec:\7rfrxxl.exe103⤵PID:1920
-
\??\c:\hhbbhh.exec:\hhbbhh.exe104⤵PID:3064
-
\??\c:\hthnnh.exec:\hthnnh.exe105⤵PID:1936
-
\??\c:\pjpdv.exec:\pjpdv.exe106⤵PID:1724
-
\??\c:\ffrrffl.exec:\ffrrffl.exe107⤵PID:1828
-
\??\c:\rrxrxfr.exec:\rrxrxfr.exe108⤵PID:1784
-
\??\c:\hhhbnt.exec:\hhhbnt.exe109⤵PID:856
-
\??\c:\vjdjj.exec:\vjdjj.exe110⤵PID:944
-
\??\c:\dpdvp.exec:\dpdvp.exe111⤵
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\rrllllx.exec:\rrllllx.exe112⤵PID:1544
-
\??\c:\5nntbb.exec:\5nntbb.exe113⤵PID:608
-
\??\c:\bnbnbb.exec:\bnbnbb.exe114⤵
- System Location Discovery: System Language Discovery
PID:2236 -
\??\c:\jdvjp.exec:\jdvjp.exe115⤵PID:1756
-
\??\c:\frrxxfr.exec:\frrxxfr.exe116⤵PID:1700
-
\??\c:\9rlllll.exec:\9rlllll.exe117⤵PID:1832
-
\??\c:\5bthnn.exec:\5bthnn.exe118⤵PID:1044
-
\??\c:\pdvpp.exec:\pdvpp.exe119⤵PID:2388
-
\??\c:\5lflrll.exec:\5lflrll.exe120⤵
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\5ffxxxx.exec:\5ffxxxx.exe121⤵PID:1672
-
\??\c:\7nhbnt.exec:\7nhbnt.exe122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-