Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe
-
Size
456KB
-
MD5
1119c688ff66ca8d5c04346142140725
-
SHA1
3ff1e047fb156195b34036cde680c2fa00a0a947
-
SHA256
e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855
-
SHA512
13c4703528da6201c5750d780b90ad1f3b0aa1cc5f4acabcf9b059b48f580462b91c9923bd95500d871c81aadeec6c806a1414e08a0d9f68870139b19e0490b5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRv:q7Tc2NYHUrAwfMp3CDRv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2356-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-16-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2820-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-142-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1260-170-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1980-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-284-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2752-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-413-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-455-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/1292-467-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1292-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-597-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2760-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-618-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-619-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/236-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-733-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1304-746-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1304-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-805-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-857-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1052 rrxxlxr.exe 2908 hhbhtt.exe 2820 rlxxxrx.exe 2380 tnhhtb.exe 2824 rlfrfrl.exe 2800 bnhbhh.exe 2992 dpdpp.exe 2564 3fxxflr.exe 2544 1bnthh.exe 2668 vvppd.exe 2936 3tbhnt.exe 324 jjpdj.exe 604 7btbhh.exe 2016 httttt.exe 1688 fxrrllf.exe 1236 rllfrlx.exe 1260 vpvjp.exe 1980 vjjjv.exe 1896 lrrffrr.exe 1676 5jjpd.exe 1796 ffxfllx.exe 1948 dvvvp.exe 1884 frffrfl.exe 2976 thnhhn.exe 2300 5vpvp.exe 3000 rrfrlfx.exe 568 hhtbhn.exe 2352 vjjpd.exe 1472 lfxxflx.exe 904 3bnhtn.exe 2356 xxllrxf.exe 2160 7xllllx.exe 2336 3thbnn.exe 3016 jjjvd.exe 2988 rrflrrx.exe 2928 bhtbhn.exe 3008 bhbhth.exe 2752 rflrxxf.exe 2704 5thnnn.exe 2672 pvpjp.exe 2568 vjpvv.exe 2660 5lrflrr.exe 2564 bbntbh.exe 2620 bnhtbh.exe 2616 vjvvj.exe 2456 rrlflll.exe 2428 fxrlrrx.exe 2368 bhtttb.exe 324 7pvpp.exe 1588 9vjdv.exe 1316 xrxxllr.exe 1748 nnhnhn.exe 1148 hbnbtt.exe 264 jjvvd.exe 1740 lrxlxlf.exe 1980 bbttbh.exe 2196 nnntnn.exe 1292 ddpvp.exe 1792 5lxlrxl.exe 1796 nnhnbh.exe 1664 9bttnn.exe 948 vjpjd.exe 1468 fffrlrx.exe 1216 fxfflfl.exe -
resource yara_rule behavioral1/memory/2356-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-541-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2624-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-597-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2760-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-973-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-1065-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1052 2356 e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe 31 PID 2356 wrote to memory of 1052 2356 e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe 31 PID 2356 wrote to memory of 1052 2356 e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe 31 PID 2356 wrote to memory of 1052 2356 e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe 31 PID 1052 wrote to memory of 2908 1052 rrxxlxr.exe 32 PID 1052 wrote to memory of 2908 1052 rrxxlxr.exe 32 PID 1052 wrote to memory of 2908 1052 rrxxlxr.exe 32 PID 1052 wrote to memory of 2908 1052 rrxxlxr.exe 32 PID 2908 wrote to memory of 2820 2908 hhbhtt.exe 33 PID 2908 wrote to memory of 2820 2908 hhbhtt.exe 33 PID 2908 wrote to memory of 2820 2908 hhbhtt.exe 33 PID 2908 wrote to memory of 2820 2908 hhbhtt.exe 33 PID 2820 wrote to memory of 2380 2820 rlxxxrx.exe 34 PID 2820 wrote to memory of 2380 2820 rlxxxrx.exe 34 PID 2820 wrote to memory of 2380 2820 rlxxxrx.exe 34 PID 2820 wrote to memory of 2380 2820 rlxxxrx.exe 34 PID 2380 wrote to memory of 2824 2380 tnhhtb.exe 35 PID 2380 wrote to memory of 2824 2380 tnhhtb.exe 35 PID 2380 wrote to memory of 2824 2380 tnhhtb.exe 35 PID 2380 wrote to memory of 2824 2380 tnhhtb.exe 35 PID 2824 wrote to memory of 2800 2824 rlfrfrl.exe 36 PID 2824 wrote to memory of 2800 2824 rlfrfrl.exe 36 PID 2824 wrote to memory of 2800 2824 rlfrfrl.exe 36 PID 2824 wrote to memory of 2800 2824 rlfrfrl.exe 36 PID 2800 wrote to memory of 2992 2800 bnhbhh.exe 37 PID 2800 wrote to memory of 2992 2800 bnhbhh.exe 37 PID 2800 wrote to memory of 2992 2800 bnhbhh.exe 37 PID 2800 wrote to memory of 2992 2800 bnhbhh.exe 37 PID 2992 wrote to memory of 2564 2992 dpdpp.exe 38 PID 2992 wrote to memory of 2564 2992 dpdpp.exe 38 PID 2992 wrote to memory of 2564 2992 dpdpp.exe 38 PID 2992 wrote to memory of 2564 2992 dpdpp.exe 38 PID 2564 wrote to memory of 2544 2564 3fxxflr.exe 39 PID 2564 wrote to memory of 2544 2564 3fxxflr.exe 39 PID 2564 wrote to memory of 2544 2564 3fxxflr.exe 39 PID 2564 wrote to memory of 2544 2564 3fxxflr.exe 39 PID 2544 wrote to memory of 2668 2544 1bnthh.exe 40 PID 2544 wrote to memory of 2668 2544 1bnthh.exe 40 PID 2544 wrote to memory of 2668 2544 1bnthh.exe 40 PID 2544 wrote to memory of 2668 2544 1bnthh.exe 40 PID 2668 wrote to memory of 2936 2668 vvppd.exe 41 PID 2668 wrote to memory of 2936 2668 vvppd.exe 41 PID 2668 wrote to memory of 2936 2668 vvppd.exe 41 PID 2668 wrote to memory of 2936 2668 vvppd.exe 41 PID 2936 wrote to memory of 324 2936 3tbhnt.exe 42 PID 2936 wrote to memory of 324 2936 3tbhnt.exe 42 PID 2936 wrote to memory of 324 2936 3tbhnt.exe 42 PID 2936 wrote to memory of 324 2936 3tbhnt.exe 42 PID 324 wrote to memory of 604 324 jjpdj.exe 43 PID 324 wrote to memory of 604 324 jjpdj.exe 43 PID 324 wrote to memory of 604 324 jjpdj.exe 43 PID 324 wrote to memory of 604 324 jjpdj.exe 43 PID 604 wrote to memory of 2016 604 7btbhh.exe 44 PID 604 wrote to memory of 2016 604 7btbhh.exe 44 PID 604 wrote to memory of 2016 604 7btbhh.exe 44 PID 604 wrote to memory of 2016 604 7btbhh.exe 44 PID 2016 wrote to memory of 1688 2016 httttt.exe 45 PID 2016 wrote to memory of 1688 2016 httttt.exe 45 PID 2016 wrote to memory of 1688 2016 httttt.exe 45 PID 2016 wrote to memory of 1688 2016 httttt.exe 45 PID 1688 wrote to memory of 1236 1688 fxrrllf.exe 46 PID 1688 wrote to memory of 1236 1688 fxrrllf.exe 46 PID 1688 wrote to memory of 1236 1688 fxrrllf.exe 46 PID 1688 wrote to memory of 1236 1688 fxrrllf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe"C:\Users\Admin\AppData\Local\Temp\e3195bd6dd562cca4bf36d1703763564111271cd4ccc945b59c5e28231c3d855.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\rrxxlxr.exec:\rrxxlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\hhbhtt.exec:\hhbhtt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tnhhtb.exec:\tnhhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\rlfrfrl.exec:\rlfrfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bnhbhh.exec:\bnhbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dpdpp.exec:\dpdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\3fxxflr.exec:\3fxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\1bnthh.exec:\1bnthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vvppd.exec:\vvppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3tbhnt.exec:\3tbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jjpdj.exec:\jjpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\7btbhh.exec:\7btbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\httttt.exec:\httttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\fxrrllf.exec:\fxrrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\rllfrlx.exec:\rllfrlx.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vpvjp.exec:\vpvjp.exe18⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vjjjv.exec:\vjjjv.exe19⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lrrffrr.exec:\lrrffrr.exe20⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5jjpd.exec:\5jjpd.exe21⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ffxfllx.exec:\ffxfllx.exe22⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dvvvp.exec:\dvvvp.exe23⤵
- Executes dropped EXE
PID:1948 -
\??\c:\frffrfl.exec:\frffrfl.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\thnhhn.exec:\thnhhn.exe25⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5vpvp.exec:\5vpvp.exe26⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rrfrlfx.exec:\rrfrlfx.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hhtbhn.exec:\hhtbhn.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\vjjpd.exec:\vjjpd.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lfxxflx.exec:\lfxxflx.exe30⤵
- Executes dropped EXE
PID:1472 -
\??\c:\3bnhtn.exec:\3bnhtn.exe31⤵
- Executes dropped EXE
PID:904 -
\??\c:\xxllrxf.exec:\xxllrxf.exe32⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7xllllx.exec:\7xllllx.exe33⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3thbnn.exec:\3thbnn.exe34⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jjjvd.exec:\jjjvd.exe35⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rrflrrx.exec:\rrflrrx.exe36⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bhtbhn.exec:\bhtbhn.exe37⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bhbhth.exec:\bhbhth.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rflrxxf.exec:\rflrxxf.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5thnnn.exec:\5thnnn.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pvpjp.exec:\pvpjp.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vjpvv.exec:\vjpvv.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5lrflrr.exec:\5lrflrr.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bbntbh.exec:\bbntbh.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bnhtbh.exec:\bnhtbh.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vjvvj.exec:\vjvvj.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rrlflll.exec:\rrlflll.exe47⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe48⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bhtttb.exec:\bhtttb.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2368 -
\??\c:\7pvpp.exec:\7pvpp.exe50⤵
- Executes dropped EXE
PID:324 -
\??\c:\9vjdv.exec:\9vjdv.exe51⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xrxxllr.exec:\xrxxllr.exe52⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nnhnhn.exec:\nnhnhn.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hbnbtt.exec:\hbnbtt.exe54⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jjvvd.exec:\jjvvd.exe55⤵
- Executes dropped EXE
PID:264 -
\??\c:\lrxlxlf.exec:\lrxlxlf.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740 -
\??\c:\bbttbh.exec:\bbttbh.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nnntnn.exec:\nnntnn.exe58⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ddpvp.exec:\ddpvp.exe59⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5lxlrxl.exec:\5lxlrxl.exe60⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nnhnbh.exec:\nnhnbh.exe61⤵
- Executes dropped EXE
PID:1796 -
\??\c:\9bttnn.exec:\9bttnn.exe62⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vjpjd.exec:\vjpjd.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\fffrlrx.exec:\fffrlrx.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fxfflfl.exec:\fxfflfl.exe65⤵
- Executes dropped EXE
PID:1216 -
\??\c:\hbnnbh.exec:\hbnnbh.exe66⤵PID:1368
-
\??\c:\9jddd.exec:\9jddd.exe67⤵PID:1408
-
\??\c:\5jjpj.exec:\5jjpj.exe68⤵PID:1124
-
\??\c:\5xrfxfl.exec:\5xrfxfl.exe69⤵PID:1016
-
\??\c:\hnnbtn.exec:\hnnbtn.exe70⤵PID:2624
-
\??\c:\tnbbnn.exec:\tnbbnn.exe71⤵PID:2180
-
\??\c:\pjdvv.exec:\pjdvv.exe72⤵PID:2172
-
\??\c:\9lxrxff.exec:\9lxrxff.exe73⤵PID:1840
-
\??\c:\tnbbbb.exec:\tnbbbb.exe74⤵PID:1544
-
\??\c:\tbhbnb.exec:\tbhbnb.exe75⤵PID:2896
-
\??\c:\vpddj.exec:\vpddj.exe76⤵PID:2336
-
\??\c:\frlllff.exec:\frlllff.exe77⤵PID:2836
-
\??\c:\7xrxxxx.exec:\7xrxxxx.exe78⤵PID:2652
-
\??\c:\bnbhnn.exec:\bnbhnn.exe79⤵PID:1592
-
\??\c:\7vddj.exec:\7vddj.exe80⤵PID:2780
-
\??\c:\1jvvj.exec:\1jvvj.exe81⤵PID:2760
-
\??\c:\5lxxlrf.exec:\5lxxlrf.exe82⤵PID:2824
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe83⤵PID:2452
-
\??\c:\nhbbnn.exec:\nhbbnn.exe84⤵PID:2784
-
\??\c:\pjvpd.exec:\pjvpd.exe85⤵PID:2660
-
\??\c:\rffflxf.exec:\rffflxf.exe86⤵PID:2544
-
\??\c:\thnntt.exec:\thnntt.exe87⤵PID:2620
-
\??\c:\nhtbbh.exec:\nhtbbh.exe88⤵PID:484
-
\??\c:\jdvdj.exec:\jdvdj.exe89⤵PID:236
-
\??\c:\vjvpd.exec:\vjvpd.exe90⤵PID:2312
-
\??\c:\ffffffl.exec:\ffffffl.exe91⤵PID:1604
-
\??\c:\nntnbh.exec:\nntnbh.exe92⤵PID:900
-
\??\c:\ttbthb.exec:\ttbthb.exe93⤵PID:2016
-
\??\c:\djppj.exec:\djppj.exe94⤵PID:2040
-
\??\c:\3rxxflf.exec:\3rxxflf.exe95⤵PID:1748
-
\??\c:\xlrlfxf.exec:\xlrlfxf.exe96⤵PID:1148
-
\??\c:\hbtbtb.exec:\hbtbtb.exe97⤵PID:1976
-
\??\c:\djddd.exec:\djddd.exe98⤵PID:1188
-
\??\c:\jdpvv.exec:\jdpvv.exe99⤵PID:2148
-
\??\c:\5rlxffl.exec:\5rlxffl.exe100⤵PID:2032
-
\??\c:\tthntt.exec:\tthntt.exe101⤵PID:1304
-
\??\c:\hhnbhh.exec:\hhnbhh.exe102⤵PID:1792
-
\??\c:\dvpdp.exec:\dvpdp.exe103⤵PID:1668
-
\??\c:\lfrrxff.exec:\lfrrxff.exe104⤵PID:1480
-
\??\c:\5xrrllf.exec:\5xrrllf.exe105⤵PID:2260
-
\??\c:\3htnnn.exec:\3htnnn.exe106⤵PID:3052
-
\??\c:\vvddd.exec:\vvddd.exe107⤵PID:844
-
\??\c:\xfxlrrr.exec:\xfxlrrr.exe108⤵PID:2476
-
\??\c:\5frlxrx.exec:\5frlxrx.exe109⤵PID:568
-
\??\c:\9nbhtt.exec:\9nbhtt.exe110⤵PID:2116
-
\??\c:\1pvjj.exec:\1pvjj.exe111⤵PID:1424
-
\??\c:\dvjjp.exec:\dvjjp.exe112⤵PID:2972
-
\??\c:\rflrxfl.exec:\rflrxfl.exe113⤵PID:2044
-
\??\c:\lrlrxff.exec:\lrlrxff.exe114⤵PID:2948
-
\??\c:\hbthnn.exec:\hbthnn.exe115⤵PID:1052
-
\??\c:\1dppp.exec:\1dppp.exe116⤵PID:2448
-
\??\c:\jdvvj.exec:\jdvvj.exe117⤵PID:2176
-
\??\c:\rlfllrf.exec:\rlfllrf.exe118⤵PID:3016
-
\??\c:\hbnntt.exec:\hbnntt.exe119⤵PID:2988
-
\??\c:\nhttbb.exec:\nhttbb.exe120⤵PID:2380
-
\??\c:\3jpvd.exec:\3jpvd.exe121⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-