Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe
-
Size
453KB
-
MD5
142798714da101a030f0e3d0d44bc62d
-
SHA1
3a84dd84be087ae132e3cad9fc337ae7f17db3e9
-
SHA256
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b
-
SHA512
16fbfbfb73266e4c2b569c9190870405c2fde5ad41eeed68f11472f39755e6e54157e3d8bcd84c2bc8123fa4c6a71253f5d7a9927bd6a8aa14eb5e7404a988a8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2936-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-93-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2680-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-135-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1880-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2176-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-186-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2176-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-196-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2960-201-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2504-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/884-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-287-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/384-416-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2020-423-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1320-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-447-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/3012-453-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2552-470-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1276-509-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2240-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-535-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/684-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-549-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2440-556-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2076-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-577-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2032-614-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-633-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2764-639-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-648-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1372-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-680-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1548-688-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1548-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-799-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/1728-818-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-831-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-838-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1580-852-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2128-851-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-885-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2996 5rrrflx.exe 2976 vpddv.exe 1804 xfllfrl.exe 2696 vddvv.exe 2820 nhnnnh.exe 2752 pddvj.exe 2940 3djpd.exe 2628 lrlxrfr.exe 1500 jvvvd.exe 2680 xxffrfr.exe 1240 1dvpp.exe 1860 vjdpv.exe 1308 rlfflrl.exe 1880 bhbbnh.exe 1072 nthhnb.exe 1736 jdvvv.exe 2788 hhnthn.exe 2480 jpddd.exe 2176 nnnbtn.exe 2960 7vdvp.exe 2784 9nnnbh.exe 1280 frxrrlr.exe 2504 7vvjv.exe 1728 5jddj.exe 1696 jpjdv.exe 1940 jjpjd.exe 2572 tbhbtb.exe 2576 1lrxffr.exe 1748 tbnbht.exe 1688 3pvpj.exe 884 tbbtbn.exe 2936 pvjdj.exe 3008 vvvjv.exe 2932 vvvjd.exe 2316 fllxxrf.exe 2216 xrxxlxl.exe 1804 hnntbn.exe 2760 7ddvp.exe 2832 flxxllr.exe 2736 hnnhbt.exe 2844 dvdvv.exe 2640 vppvp.exe 2768 llfrxlf.exe 2816 nnhnhn.exe 2656 vpvjv.exe 2404 rrxlfrl.exe 2664 3bbnht.exe 1900 thbhth.exe 384 pddpp.exe 2020 xfffrxr.exe 1404 tnbnhn.exe 1356 vvdvv.exe 1936 frfffxx.exe 1320 bbbhth.exe 3012 5bthhb.exe 2304 jdvjv.exe 2552 rfxrrfl.exe 2292 hhhnhh.exe 1196 dpdvv.exe 1544 fxxlxfr.exe 596 ttthbt.exe 980 hhhnnb.exe 1276 9ppdv.exe 292 xxlxrrl.exe -
resource yara_rule behavioral1/memory/2996-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-286-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/884-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/384-416-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2020-423-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1936-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-453-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/596-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-509-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2240-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-633-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/2764-639-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2764-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-680-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1548-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-838-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2744-884-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2996 2936 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 30 PID 2936 wrote to memory of 2996 2936 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 30 PID 2936 wrote to memory of 2996 2936 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 30 PID 2936 wrote to memory of 2996 2936 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 30 PID 2996 wrote to memory of 2976 2996 5rrrflx.exe 31 PID 2996 wrote to memory of 2976 2996 5rrrflx.exe 31 PID 2996 wrote to memory of 2976 2996 5rrrflx.exe 31 PID 2996 wrote to memory of 2976 2996 5rrrflx.exe 31 PID 2976 wrote to memory of 1804 2976 vpddv.exe 32 PID 2976 wrote to memory of 1804 2976 vpddv.exe 32 PID 2976 wrote to memory of 1804 2976 vpddv.exe 32 PID 2976 wrote to memory of 1804 2976 vpddv.exe 32 PID 1804 wrote to memory of 2696 1804 xfllfrl.exe 33 PID 1804 wrote to memory of 2696 1804 xfllfrl.exe 33 PID 1804 wrote to memory of 2696 1804 xfllfrl.exe 33 PID 1804 wrote to memory of 2696 1804 xfllfrl.exe 33 PID 2696 wrote to memory of 2820 2696 vddvv.exe 34 PID 2696 wrote to memory of 2820 2696 vddvv.exe 34 PID 2696 wrote to memory of 2820 2696 vddvv.exe 34 PID 2696 wrote to memory of 2820 2696 vddvv.exe 34 PID 2820 wrote to memory of 2752 2820 nhnnnh.exe 35 PID 2820 wrote to memory of 2752 2820 nhnnnh.exe 35 PID 2820 wrote to memory of 2752 2820 nhnnnh.exe 35 PID 2820 wrote to memory of 2752 2820 nhnnnh.exe 35 PID 2752 wrote to memory of 2940 2752 pddvj.exe 36 PID 2752 wrote to memory of 2940 2752 pddvj.exe 36 PID 2752 wrote to memory of 2940 2752 pddvj.exe 36 PID 2752 wrote to memory of 2940 2752 pddvj.exe 36 PID 2940 wrote to memory of 2628 2940 3djpd.exe 37 PID 2940 wrote to memory of 2628 2940 3djpd.exe 37 PID 2940 wrote to memory of 2628 2940 3djpd.exe 37 PID 2940 wrote to memory of 2628 2940 3djpd.exe 37 PID 2628 wrote to memory of 1500 2628 lrlxrfr.exe 38 PID 2628 wrote to memory of 1500 2628 lrlxrfr.exe 38 PID 2628 wrote to memory of 1500 2628 lrlxrfr.exe 38 PID 2628 wrote to memory of 1500 2628 lrlxrfr.exe 38 PID 1500 wrote to memory of 2680 1500 jvvvd.exe 39 PID 1500 wrote to memory of 2680 1500 jvvvd.exe 39 PID 1500 wrote to memory of 2680 1500 jvvvd.exe 39 PID 1500 wrote to memory of 2680 1500 jvvvd.exe 39 PID 2680 wrote to memory of 1240 2680 xxffrfr.exe 40 PID 2680 wrote to memory of 1240 2680 xxffrfr.exe 40 PID 2680 wrote to memory of 1240 2680 xxffrfr.exe 40 PID 2680 wrote to memory of 1240 2680 xxffrfr.exe 40 PID 1240 wrote to memory of 1860 1240 1dvpp.exe 41 PID 1240 wrote to memory of 1860 1240 1dvpp.exe 41 PID 1240 wrote to memory of 1860 1240 1dvpp.exe 41 PID 1240 wrote to memory of 1860 1240 1dvpp.exe 41 PID 1860 wrote to memory of 1308 1860 vjdpv.exe 42 PID 1860 wrote to memory of 1308 1860 vjdpv.exe 42 PID 1860 wrote to memory of 1308 1860 vjdpv.exe 42 PID 1860 wrote to memory of 1308 1860 vjdpv.exe 42 PID 1308 wrote to memory of 1880 1308 rlfflrl.exe 43 PID 1308 wrote to memory of 1880 1308 rlfflrl.exe 43 PID 1308 wrote to memory of 1880 1308 rlfflrl.exe 43 PID 1308 wrote to memory of 1880 1308 rlfflrl.exe 43 PID 1880 wrote to memory of 1072 1880 bhbbnh.exe 44 PID 1880 wrote to memory of 1072 1880 bhbbnh.exe 44 PID 1880 wrote to memory of 1072 1880 bhbbnh.exe 44 PID 1880 wrote to memory of 1072 1880 bhbbnh.exe 44 PID 1072 wrote to memory of 1736 1072 nthhnb.exe 45 PID 1072 wrote to memory of 1736 1072 nthhnb.exe 45 PID 1072 wrote to memory of 1736 1072 nthhnb.exe 45 PID 1072 wrote to memory of 1736 1072 nthhnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe"C:\Users\Admin\AppData\Local\Temp\feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5rrrflx.exec:\5rrrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vpddv.exec:\vpddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xfllfrl.exec:\xfllfrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\vddvv.exec:\vddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nhnnnh.exec:\nhnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pddvj.exec:\pddvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3djpd.exec:\3djpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lrlxrfr.exec:\lrlxrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jvvvd.exec:\jvvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\xxffrfr.exec:\xxffrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1dvpp.exec:\1dvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\vjdpv.exec:\vjdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\rlfflrl.exec:\rlfflrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\bhbbnh.exec:\bhbbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\nthhnb.exec:\nthhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\jdvvv.exec:\jdvvv.exe17⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hhnthn.exec:\hhnthn.exe18⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jpddd.exec:\jpddd.exe19⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nnnbtn.exec:\nnnbtn.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7vdvp.exec:\7vdvp.exe21⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9nnnbh.exec:\9nnnbh.exe22⤵
- Executes dropped EXE
PID:2784 -
\??\c:\frxrrlr.exec:\frxrrlr.exe23⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7vvjv.exec:\7vvjv.exe24⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5jddj.exec:\5jddj.exe25⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jpjdv.exec:\jpjdv.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jjpjd.exec:\jjpjd.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tbhbtb.exec:\tbhbtb.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1lrxffr.exec:\1lrxffr.exe29⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tbnbht.exec:\tbnbht.exe30⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3pvpj.exec:\3pvpj.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\tbbtbn.exec:\tbbtbn.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\pvjdj.exec:\pvjdj.exe33⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vvvjv.exec:\vvvjv.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vvvjd.exec:\vvvjd.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fllxxrf.exec:\fllxxrf.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xrxxlxl.exec:\xrxxlxl.exe37⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hnntbn.exec:\hnntbn.exe38⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7ddvp.exec:\7ddvp.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\flxxllr.exec:\flxxllr.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hnnhbt.exec:\hnnhbt.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dvdvv.exec:\dvdvv.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vppvp.exec:\vppvp.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\llfrxlf.exec:\llfrxlf.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nnhnhn.exec:\nnhnhn.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vpvjv.exec:\vpvjv.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rrxlfrl.exec:\rrxlfrl.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3bbnht.exec:\3bbnht.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\thbhth.exec:\thbhth.exe49⤵
- Executes dropped EXE
PID:1900 -
\??\c:\pddpp.exec:\pddpp.exe50⤵
- Executes dropped EXE
PID:384 -
\??\c:\xfffrxr.exec:\xfffrxr.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tnbnhn.exec:\tnbnhn.exe52⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vvdvv.exec:\vvdvv.exe53⤵
- Executes dropped EXE
PID:1356 -
\??\c:\frfffxx.exec:\frfffxx.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1936 -
\??\c:\bbbhth.exec:\bbbhth.exe55⤵
- Executes dropped EXE
PID:1320 -
\??\c:\5bthhb.exec:\5bthhb.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jdvjv.exec:\jdvjv.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rfxrrfl.exec:\rfxrrfl.exe58⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hhhnhh.exec:\hhhnhh.exe59⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dpdvv.exec:\dpdvv.exe60⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe61⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ttthbt.exec:\ttthbt.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\hhhnnb.exec:\hhhnnb.exe63⤵
- Executes dropped EXE
PID:980 -
\??\c:\9ppdv.exec:\9ppdv.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xxlxrrl.exec:\xxlxrrl.exe65⤵
- Executes dropped EXE
PID:292 -
\??\c:\3hbhnt.exec:\3hbhnt.exe66⤵PID:1700
-
\??\c:\btthtb.exec:\btthtb.exe67⤵PID:2240
-
\??\c:\jddpv.exec:\jddpv.exe68⤵PID:2440
-
\??\c:\lrrlrll.exec:\lrrlrll.exe69⤵PID:684
-
\??\c:\3nbttn.exec:\3nbttn.exe70⤵PID:2136
-
\??\c:\7djvp.exec:\7djvp.exe71⤵PID:1792
-
\??\c:\lrlrffx.exec:\lrlrffx.exe72⤵PID:2412
-
\??\c:\1hhtnt.exec:\1hhtnt.exe73⤵PID:2076
-
\??\c:\9vdvv.exec:\9vdvv.exe74⤵PID:2428
-
\??\c:\frxrrll.exec:\frxrrll.exe75⤵PID:1628
-
\??\c:\xxrfflx.exec:\xxrfflx.exe76⤵PID:3068
-
\??\c:\tthnhb.exec:\tthnhb.exe77⤵PID:2032
-
\??\c:\pjjvj.exec:\pjjvj.exe78⤵PID:2976
-
\??\c:\5rlrxfl.exec:\5rlrxfl.exe79⤵PID:2444
-
\??\c:\1rrxlrf.exec:\1rrxlrf.exe80⤵PID:2184
-
\??\c:\nbhtbt.exec:\nbhtbt.exe81⤵PID:2824
-
\??\c:\pjdjp.exec:\pjdjp.exe82⤵PID:2712
-
\??\c:\xxlfxlr.exec:\xxlfxlr.exe83⤵PID:2840
-
\??\c:\hhhhhh.exec:\hhhhhh.exe84⤵PID:2764
-
\??\c:\bhhbnh.exec:\bhhbnh.exe85⤵PID:2904
-
\??\c:\jppvd.exec:\jppvd.exe86⤵PID:2916
-
\??\c:\llllrlf.exec:\llllrlf.exe87⤵PID:2660
-
\??\c:\hnnbht.exec:\hnnbht.exe88⤵PID:1372
-
\??\c:\nhbnht.exec:\nhbnht.exe89⤵PID:1624
-
\??\c:\7jvjj.exec:\7jvjj.exe90⤵PID:1596
-
\??\c:\lrxfrxl.exec:\lrxfrxl.exe91⤵PID:1548
-
\??\c:\hhhnbb.exec:\hhhnbb.exe92⤵PID:1860
-
\??\c:\dpddd.exec:\dpddd.exe93⤵PID:1396
-
\??\c:\xrxrrff.exec:\xrxrrff.exe94⤵PID:2892
-
\??\c:\xflrlxx.exec:\xflrlxx.exe95⤵PID:1244
-
\??\c:\tthhbh.exec:\tthhbh.exe96⤵PID:1204
-
\??\c:\vvdvp.exec:\vvdvp.exe97⤵PID:2468
-
\??\c:\lrfrlff.exec:\lrfrlff.exe98⤵PID:2920
-
\??\c:\dpdpd.exec:\dpdpd.exe99⤵PID:2488
-
\??\c:\rrlrlfx.exec:\rrlrlfx.exe100⤵PID:2480
-
\??\c:\fxrfrrl.exec:\fxrfrrl.exe101⤵PID:2188
-
\??\c:\hnttnt.exec:\hnttnt.exe102⤵PID:2964
-
\??\c:\jpdvd.exec:\jpdvd.exe103⤵PID:1908
-
\??\c:\llxflxx.exec:\llxflxx.exe104⤵PID:1612
-
\??\c:\hnnhhn.exec:\hnnhhn.exe105⤵PID:1732
-
\??\c:\tnhttt.exec:\tnhttt.exe106⤵PID:3048
-
\??\c:\rrrfxll.exec:\rrrfxll.exe107⤵PID:828
-
\??\c:\ffrxllf.exec:\ffrxllf.exe108⤵PID:1728
-
\??\c:\1bttbh.exec:\1bttbh.exe109⤵PID:1560
-
\??\c:\vjpjj.exec:\vjpjj.exe110⤵PID:1760
-
\??\c:\fxxrllf.exec:\fxxrllf.exe111⤵PID:2364
-
\??\c:\tbhbbb.exec:\tbhbbb.exe112⤵PID:1888
-
\??\c:\bbntnt.exec:\bbntnt.exe113⤵PID:2128
-
\??\c:\jpppd.exec:\jpppd.exe114⤵PID:2436
-
\??\c:\fflxrff.exec:\fflxrff.exe115⤵PID:1820
-
\??\c:\bhnhnb.exec:\bhnhnb.exe116⤵PID:1580
-
\??\c:\jdjpp.exec:\jdjpp.exe117⤵PID:1740
-
\??\c:\rrrlrxr.exec:\rrrlrxr.exe118⤵PID:2396
-
\??\c:\bbnbtb.exec:\bbnbtb.exe119⤵PID:1368
-
\??\c:\3nttnb.exec:\3nttnb.exe120⤵PID:2096
-
\??\c:\jjpjp.exec:\jjpjp.exe121⤵PID:2744
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-