Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe
-
Size
453KB
-
MD5
d39bb7af27f102defd19429d31a5fa5c
-
SHA1
b2f1643aff977d2f033b7abbdda630dbb6e99b3f
-
SHA256
3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319
-
SHA512
d1a6cc077666f1586b5193d6ae3d66c68830b90142b04cce8a2b82d2f64b62bab7225a886038f899251ee4a5af6865641cd8c707cc08fb74f21fa505d24dd391
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/1628-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-132-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1036-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-192-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1564-208-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1564-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1300-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-227-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/3024-248-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2432-262-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2496-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-373-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-501-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/348-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-546-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-635-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2564-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-708-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/968-777-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1120-922-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1120-923-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-949-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-981-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2264-1036-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-1142-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2860-1163-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1976-1219-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2036-1377-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/848-1386-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1868 hbtbht.exe 2364 tbbhnt.exe 2740 ddjjj.exe 2272 ppdpd.exe 2852 flrxflx.exe 2568 5jvjj.exe 2828 lxlfllf.exe 3068 nnhbnt.exe 2560 vjdjp.exe 2680 xlrxffl.exe 3048 5hntth.exe 2628 hbbtnt.exe 2884 5frxflr.exe 1660 9rxxflf.exe 2780 btthtn.exe 2892 5dvvp.exe 2000 rlfxrxl.exe 1036 ntthtt.exe 2176 vpjdv.exe 2056 fxxlxxl.exe 2444 tnhnhh.exe 1564 7pppd.exe 1300 lfxfllr.exe 1408 3ddjp.exe 968 ppjpd.exe 3024 xfxlrfr.exe 348 5vpjp.exe 2432 rflxrll.exe 2752 hbnhnn.exe 1280 dddpd.exe 2496 9thhtn.exe 1540 thttbt.exe 2468 vjvdp.exe 2360 3rlrflx.exe 2900 hntntn.exe 3064 jpvvj.exe 2860 vvdvj.exe 2868 nbthbn.exe 2880 9thnhh.exe 2744 djvvv.exe 2828 rlflxlf.exe 2556 rffrlrl.exe 2584 thttbn.exe 2084 vdjpd.exe 1120 lxllfxf.exe 3048 xlxllfr.exe 652 nhtbnn.exe 1672 bhbthh.exe 2784 pjjdd.exe 2768 9rlxrrx.exe 2788 flxrfll.exe 2804 hbtbnt.exe 1728 hnhtnt.exe 3056 3jjvd.exe 2452 xfrxrfr.exe 2532 lffxxxl.exe 2208 hnntbb.exe 1584 dvpvp.exe 2204 htthnt.exe 860 htnnbt.exe 1496 5fxfrxl.exe 1856 rrlxllx.exe 688 nthnbh.exe 1928 dvpvj.exe -
resource yara_rule behavioral1/memory/1868-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-873-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-1318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-1359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-1372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-1386-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1868 1628 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 31 PID 1628 wrote to memory of 1868 1628 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 31 PID 1628 wrote to memory of 1868 1628 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 31 PID 1628 wrote to memory of 1868 1628 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 31 PID 1868 wrote to memory of 2364 1868 hbtbht.exe 32 PID 1868 wrote to memory of 2364 1868 hbtbht.exe 32 PID 1868 wrote to memory of 2364 1868 hbtbht.exe 32 PID 1868 wrote to memory of 2364 1868 hbtbht.exe 32 PID 2364 wrote to memory of 2740 2364 tbbhnt.exe 33 PID 2364 wrote to memory of 2740 2364 tbbhnt.exe 33 PID 2364 wrote to memory of 2740 2364 tbbhnt.exe 33 PID 2364 wrote to memory of 2740 2364 tbbhnt.exe 33 PID 2740 wrote to memory of 2272 2740 ddjjj.exe 34 PID 2740 wrote to memory of 2272 2740 ddjjj.exe 34 PID 2740 wrote to memory of 2272 2740 ddjjj.exe 34 PID 2740 wrote to memory of 2272 2740 ddjjj.exe 34 PID 2272 wrote to memory of 2852 2272 ppdpd.exe 35 PID 2272 wrote to memory of 2852 2272 ppdpd.exe 35 PID 2272 wrote to memory of 2852 2272 ppdpd.exe 35 PID 2272 wrote to memory of 2852 2272 ppdpd.exe 35 PID 2852 wrote to memory of 2568 2852 flrxflx.exe 36 PID 2852 wrote to memory of 2568 2852 flrxflx.exe 36 PID 2852 wrote to memory of 2568 2852 flrxflx.exe 36 PID 2852 wrote to memory of 2568 2852 flrxflx.exe 36 PID 2568 wrote to memory of 2828 2568 5jvjj.exe 37 PID 2568 wrote to memory of 2828 2568 5jvjj.exe 37 PID 2568 wrote to memory of 2828 2568 5jvjj.exe 37 PID 2568 wrote to memory of 2828 2568 5jvjj.exe 37 PID 2828 wrote to memory of 3068 2828 lxlfllf.exe 38 PID 2828 wrote to memory of 3068 2828 lxlfllf.exe 38 PID 2828 wrote to memory of 3068 2828 lxlfllf.exe 38 PID 2828 wrote to memory of 3068 2828 lxlfllf.exe 38 PID 3068 wrote to memory of 2560 3068 nnhbnt.exe 39 PID 3068 wrote to memory of 2560 3068 nnhbnt.exe 39 PID 3068 wrote to memory of 2560 3068 nnhbnt.exe 39 PID 3068 wrote to memory of 2560 3068 nnhbnt.exe 39 PID 2560 wrote to memory of 2680 2560 vjdjp.exe 40 PID 2560 wrote to memory of 2680 2560 vjdjp.exe 40 PID 2560 wrote to memory of 2680 2560 vjdjp.exe 40 PID 2560 wrote to memory of 2680 2560 vjdjp.exe 40 PID 2680 wrote to memory of 3048 2680 xlrxffl.exe 41 PID 2680 wrote to memory of 3048 2680 xlrxffl.exe 41 PID 2680 wrote to memory of 3048 2680 xlrxffl.exe 41 PID 2680 wrote to memory of 3048 2680 xlrxffl.exe 41 PID 3048 wrote to memory of 2628 3048 5hntth.exe 42 PID 3048 wrote to memory of 2628 3048 5hntth.exe 42 PID 3048 wrote to memory of 2628 3048 5hntth.exe 42 PID 3048 wrote to memory of 2628 3048 5hntth.exe 42 PID 2628 wrote to memory of 2884 2628 hbbtnt.exe 43 PID 2628 wrote to memory of 2884 2628 hbbtnt.exe 43 PID 2628 wrote to memory of 2884 2628 hbbtnt.exe 43 PID 2628 wrote to memory of 2884 2628 hbbtnt.exe 43 PID 2884 wrote to memory of 1660 2884 5frxflr.exe 44 PID 2884 wrote to memory of 1660 2884 5frxflr.exe 44 PID 2884 wrote to memory of 1660 2884 5frxflr.exe 44 PID 2884 wrote to memory of 1660 2884 5frxflr.exe 44 PID 1660 wrote to memory of 2780 1660 9rxxflf.exe 45 PID 1660 wrote to memory of 2780 1660 9rxxflf.exe 45 PID 1660 wrote to memory of 2780 1660 9rxxflf.exe 45 PID 1660 wrote to memory of 2780 1660 9rxxflf.exe 45 PID 2780 wrote to memory of 2892 2780 btthtn.exe 46 PID 2780 wrote to memory of 2892 2780 btthtn.exe 46 PID 2780 wrote to memory of 2892 2780 btthtn.exe 46 PID 2780 wrote to memory of 2892 2780 btthtn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe"C:\Users\Admin\AppData\Local\Temp\3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\hbtbht.exec:\hbtbht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\tbbhnt.exec:\tbbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\ddjjj.exec:\ddjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ppdpd.exec:\ppdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\flrxflx.exec:\flrxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5jvjj.exec:\5jvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lxlfllf.exec:\lxlfllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nnhbnt.exec:\nnhbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\vjdjp.exec:\vjdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xlrxffl.exec:\xlrxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5hntth.exec:\5hntth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hbbtnt.exec:\hbbtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5frxflr.exec:\5frxflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\9rxxflf.exec:\9rxxflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\btthtn.exec:\btthtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\5dvvp.exec:\5dvvp.exe17⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlfxrxl.exec:\rlfxrxl.exe18⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ntthtt.exec:\ntthtt.exe19⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vpjdv.exec:\vpjdv.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxxlxxl.exec:\fxxlxxl.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tnhnhh.exec:\tnhnhh.exe22⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7pppd.exec:\7pppd.exe23⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lfxfllr.exec:\lfxfllr.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3ddjp.exec:\3ddjp.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\ppjpd.exec:\ppjpd.exe26⤵
- Executes dropped EXE
PID:968 -
\??\c:\xfxlrfr.exec:\xfxlrfr.exe27⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5vpjp.exec:\5vpjp.exe28⤵
- Executes dropped EXE
PID:348 -
\??\c:\rflxrll.exec:\rflxrll.exe29⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbnhnn.exec:\hbnhnn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\dddpd.exec:\dddpd.exe31⤵
- Executes dropped EXE
PID:1280 -
\??\c:\9thhtn.exec:\9thhtn.exe32⤵
- Executes dropped EXE
PID:2496 -
\??\c:\thttbt.exec:\thttbt.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vjvdp.exec:\vjvdp.exe34⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3rlrflx.exec:\3rlrflx.exe35⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hntntn.exec:\hntntn.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jpvvj.exec:\jpvvj.exe37⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vvdvj.exec:\vvdvj.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nbthbn.exec:\nbthbn.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9thnhh.exec:\9thnhh.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\djvvv.exec:\djvvv.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rlflxlf.exec:\rlflxlf.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rffrlrl.exec:\rffrlrl.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\thttbn.exec:\thttbn.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vdjpd.exec:\vdjpd.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\lxllfxf.exec:\lxllfxf.exe46⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xlxllfr.exec:\xlxllfr.exe47⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nhtbnn.exec:\nhtbnn.exe48⤵
- Executes dropped EXE
PID:652 -
\??\c:\bhbthh.exec:\bhbthh.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pjjdd.exec:\pjjdd.exe50⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9rlxrrx.exec:\9rlxrrx.exe51⤵
- Executes dropped EXE
PID:2768 -
\??\c:\flxrfll.exec:\flxrfll.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbtbnt.exec:\hbtbnt.exe53⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hnhtnt.exec:\hnhtnt.exe54⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3jjvd.exec:\3jjvd.exe55⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xfrxrfr.exec:\xfrxrfr.exe56⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lffxxxl.exec:\lffxxxl.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hnntbb.exec:\hnntbb.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dvpvp.exec:\dvpvp.exe59⤵
- Executes dropped EXE
PID:1584 -
\??\c:\htthnt.exec:\htthnt.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\htnnbt.exec:\htnnbt.exe61⤵
- Executes dropped EXE
PID:860 -
\??\c:\5fxfrxl.exec:\5fxfrxl.exe62⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rrlxllx.exec:\rrlxllx.exe63⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nthnbh.exec:\nthnbh.exe64⤵
- Executes dropped EXE
PID:688 -
\??\c:\dvpvj.exec:\dvpvj.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1llflxr.exec:\1llflxr.exe66⤵PID:916
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe67⤵PID:852
-
\??\c:\3hbbhn.exec:\3hbbhn.exe68⤵PID:1524
-
\??\c:\vvjdp.exec:\vvjdp.exe69⤵PID:348
-
\??\c:\rllxlxl.exec:\rllxlxl.exe70⤵PID:1604
-
\??\c:\bbbnht.exec:\bbbnht.exe71⤵PID:2164
-
\??\c:\ppddj.exec:\ppddj.exe72⤵PID:2996
-
\??\c:\jjvpj.exec:\jjvpj.exe73⤵PID:1536
-
\??\c:\3lfflxx.exec:\3lfflxx.exe74⤵PID:3000
-
\??\c:\xfxlfrf.exec:\xfxlfrf.exe75⤵PID:2512
-
\??\c:\hthntb.exec:\hthntb.exe76⤵PID:2536
-
\??\c:\pjvvv.exec:\pjvvv.exe77⤵PID:2492
-
\??\c:\jpvvd.exec:\jpvvd.exe78⤵PID:2956
-
\??\c:\xfllrfx.exec:\xfllrfx.exe79⤵PID:2848
-
\??\c:\tnbhhn.exec:\tnbhhn.exe80⤵PID:2836
-
\??\c:\ddjpp.exec:\ddjpp.exe81⤵PID:2852
-
\??\c:\9rrxffx.exec:\9rrxffx.exe82⤵PID:2644
-
\??\c:\xlfrlrl.exec:\xlfrlrl.exe83⤵PID:2012
-
\??\c:\bbbtht.exec:\bbbtht.exe84⤵PID:1556
-
\??\c:\jjjvd.exec:\jjjvd.exe85⤵PID:2572
-
\??\c:\djpvp.exec:\djpvp.exe86⤵PID:2564
-
\??\c:\fxrxffr.exec:\fxrxffr.exe87⤵PID:2428
-
\??\c:\bthhtb.exec:\bthhtb.exe88⤵PID:2084
-
\??\c:\9jddv.exec:\9jddv.exe89⤵PID:2920
-
\??\c:\5xrlrxr.exec:\5xrlrxr.exe90⤵PID:2628
-
\??\c:\hnhbth.exec:\hnhbth.exe91⤵PID:652
-
\??\c:\3btthh.exec:\3btthh.exe92⤵PID:1672
-
\??\c:\pvddv.exec:\pvddv.exe93⤵PID:2784
-
\??\c:\rllfxlr.exec:\rllfxlr.exe94⤵PID:2924
-
\??\c:\3hbhnb.exec:\3hbhnb.exe95⤵PID:2780
-
\??\c:\5dddj.exec:\5dddj.exe96⤵PID:840
-
\??\c:\ddvjd.exec:\ddvjd.exe97⤵PID:2000
-
\??\c:\fffrxxl.exec:\fffrxxl.exe98⤵PID:536
-
\??\c:\bnhhnh.exec:\bnhhnh.exe99⤵PID:2008
-
\??\c:\9jjvd.exec:\9jjvd.exe100⤵PID:2532
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe101⤵PID:2208
-
\??\c:\ntbhtt.exec:\ntbhtt.exe102⤵PID:2280
-
\??\c:\nbnbht.exec:\nbnbht.exe103⤵PID:2444
-
\??\c:\pjvjp.exec:\pjvjp.exe104⤵PID:1932
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe105⤵PID:1496
-
\??\c:\5htbhh.exec:\5htbhh.exe106⤵PID:1300
-
\??\c:\hbbhnt.exec:\hbbhnt.exe107⤵PID:688
-
\??\c:\9pddp.exec:\9pddp.exe108⤵PID:968
-
\??\c:\xrfrfxr.exec:\xrfrfxr.exe109⤵PID:1444
-
\??\c:\9lffrrf.exec:\9lffrrf.exe110⤵PID:604
-
\??\c:\hntbnt.exec:\hntbnt.exe111⤵PID:2424
-
\??\c:\vvjdp.exec:\vvjdp.exe112⤵PID:1524
-
\??\c:\7frrrrx.exec:\7frrrrx.exe113⤵PID:280
-
\??\c:\lfflxxf.exec:\lfflxxf.exe114⤵PID:2948
-
\??\c:\nhtnnt.exec:\nhtnnt.exe115⤵PID:1972
-
\??\c:\jjvdv.exec:\jjvdv.exe116⤵PID:1456
-
\??\c:\fxlrflr.exec:\fxlrflr.exe117⤵PID:1532
-
\??\c:\lxxfrrl.exec:\lxxfrrl.exe118⤵PID:2472
-
\??\c:\nhbbbn.exec:\nhbbbn.exe119⤵PID:2360
-
\??\c:\7vddd.exec:\7vddd.exe120⤵PID:2688
-
\??\c:\ppdjv.exec:\ppdjv.exe121⤵PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-