Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe
-
Size
454KB
-
MD5
7a912f215898b4563e5c31abd6104900
-
SHA1
9c7f3a944de31a9e981424053c2a2fff2f11b168
-
SHA256
53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3
-
SHA512
8636322cec27a3ca8c2282fa02c0b070c5e3a0ab4857c4a70226ce554871744994e2a204ce8331224e0d481a7366db688a8b3e236d55532d6fb4f4ff31376efd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbemj:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2508-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-70-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2908-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-90-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2440-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-125-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1628-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-332-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-409-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1040-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-786-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1636-794-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2648-942-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2668-987-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-988-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2128-995-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/876-1026-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-1034-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1328-1048-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1496-1087-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2456-1106-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2264-1135-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2732-1165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-1171-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-1179-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-1210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-1212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/668-1219-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1320 1pvdj.exe 2540 xllrrxr.exe 2124 nhnttb.exe 2008 vddpv.exe 2864 rlllffl.exe 2740 1ttbbb.exe 2924 5dvpp.exe 2992 vjvpv.exe 2908 1vvvd.exe 2660 ttnbhn.exe 2440 3jpdd.exe 840 lfxrfxf.exe 1628 vpvdv.exe 2300 nhbhbb.exe 2936 vpjjv.exe 1844 lxflxxf.exe 1740 jjjjd.exe 624 lrxrrfl.exe 2024 jjjvj.exe 1704 ddvvd.exe 576 rrlflfl.exe 1028 rxfrxrx.exe 1524 hnbnnh.exe 672 1xllrxr.exe 1684 tnhhtt.exe 1764 djdpj.exe 768 hhbntb.exe 2260 jjvvj.exe 2932 rxrxlfr.exe 2192 1bntbn.exe 2144 xxrlrlx.exe 1692 vdvjd.exe 2508 xxxxllf.exe 1320 tnhnbh.exe 1588 pjdjd.exe 1812 1lllxfr.exe 2384 xxrfrfl.exe 2092 bbbbth.exe 2748 ppjpj.exe 2888 fllxlrx.exe 2896 fflrflx.exe 2892 htnnnb.exe 1288 pvvpp.exe 2608 rrrlxfr.exe 2644 fflrrxf.exe 2664 tttnbn.exe 2156 7ddvd.exe 2032 pppdp.exe 2812 rlxxflx.exe 2208 bhbnbh.exe 1628 bbthnb.exe 2828 3dvdp.exe 1040 fxxxfrl.exe 2656 7ttbnt.exe 2128 djdpd.exe 2252 xrllffr.exe 1508 fxrxllr.exe 2000 5tntbn.exe 2024 dvvpv.exe 1828 djddp.exe 632 rxrxrfx.exe 1256 1htbnt.exe 2312 vpjpv.exe 2424 7pjdj.exe -
resource yara_rule behavioral1/memory/2508-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-90-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2440-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-499-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1496-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-794-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/2824-949-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-987-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-988-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1088-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-1087-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1748-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-1120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-1135-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2008-1146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-1165-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1944-1210-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2828-1239-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1320 2508 53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe 30 PID 2508 wrote to memory of 1320 2508 53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe 30 PID 2508 wrote to memory of 1320 2508 53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe 30 PID 2508 wrote to memory of 1320 2508 53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe 30 PID 1320 wrote to memory of 2540 1320 1pvdj.exe 31 PID 1320 wrote to memory of 2540 1320 1pvdj.exe 31 PID 1320 wrote to memory of 2540 1320 1pvdj.exe 31 PID 1320 wrote to memory of 2540 1320 1pvdj.exe 31 PID 2540 wrote to memory of 2124 2540 xllrrxr.exe 32 PID 2540 wrote to memory of 2124 2540 xllrrxr.exe 32 PID 2540 wrote to memory of 2124 2540 xllrrxr.exe 32 PID 2540 wrote to memory of 2124 2540 xllrrxr.exe 32 PID 2124 wrote to memory of 2008 2124 nhnttb.exe 33 PID 2124 wrote to memory of 2008 2124 nhnttb.exe 33 PID 2124 wrote to memory of 2008 2124 nhnttb.exe 33 PID 2124 wrote to memory of 2008 2124 nhnttb.exe 33 PID 2008 wrote to memory of 2864 2008 vddpv.exe 34 PID 2008 wrote to memory of 2864 2008 vddpv.exe 34 PID 2008 wrote to memory of 2864 2008 vddpv.exe 34 PID 2008 wrote to memory of 2864 2008 vddpv.exe 34 PID 2864 wrote to memory of 2740 2864 rlllffl.exe 35 PID 2864 wrote to memory of 2740 2864 rlllffl.exe 35 PID 2864 wrote to memory of 2740 2864 rlllffl.exe 35 PID 2864 wrote to memory of 2740 2864 rlllffl.exe 35 PID 2740 wrote to memory of 2924 2740 1ttbbb.exe 36 PID 2740 wrote to memory of 2924 2740 1ttbbb.exe 36 PID 2740 wrote to memory of 2924 2740 1ttbbb.exe 36 PID 2740 wrote to memory of 2924 2740 1ttbbb.exe 36 PID 2924 wrote to memory of 2992 2924 5dvpp.exe 37 PID 2924 wrote to memory of 2992 2924 5dvpp.exe 37 PID 2924 wrote to memory of 2992 2924 5dvpp.exe 37 PID 2924 wrote to memory of 2992 2924 5dvpp.exe 37 PID 2992 wrote to memory of 2908 2992 vjvpv.exe 38 PID 2992 wrote to memory of 2908 2992 vjvpv.exe 38 PID 2992 wrote to memory of 2908 2992 vjvpv.exe 38 PID 2992 wrote to memory of 2908 2992 vjvpv.exe 38 PID 2908 wrote to memory of 2660 2908 1vvvd.exe 39 PID 2908 wrote to memory of 2660 2908 1vvvd.exe 39 PID 2908 wrote to memory of 2660 2908 1vvvd.exe 39 PID 2908 wrote to memory of 2660 2908 1vvvd.exe 39 PID 2660 wrote to memory of 2440 2660 ttnbhn.exe 40 PID 2660 wrote to memory of 2440 2660 ttnbhn.exe 40 PID 2660 wrote to memory of 2440 2660 ttnbhn.exe 40 PID 2660 wrote to memory of 2440 2660 ttnbhn.exe 40 PID 2440 wrote to memory of 840 2440 3jpdd.exe 41 PID 2440 wrote to memory of 840 2440 3jpdd.exe 41 PID 2440 wrote to memory of 840 2440 3jpdd.exe 41 PID 2440 wrote to memory of 840 2440 3jpdd.exe 41 PID 840 wrote to memory of 1628 840 lfxrfxf.exe 42 PID 840 wrote to memory of 1628 840 lfxrfxf.exe 42 PID 840 wrote to memory of 1628 840 lfxrfxf.exe 42 PID 840 wrote to memory of 1628 840 lfxrfxf.exe 42 PID 1628 wrote to memory of 2300 1628 vpvdv.exe 43 PID 1628 wrote to memory of 2300 1628 vpvdv.exe 43 PID 1628 wrote to memory of 2300 1628 vpvdv.exe 43 PID 1628 wrote to memory of 2300 1628 vpvdv.exe 43 PID 2300 wrote to memory of 2936 2300 nhbhbb.exe 44 PID 2300 wrote to memory of 2936 2300 nhbhbb.exe 44 PID 2300 wrote to memory of 2936 2300 nhbhbb.exe 44 PID 2300 wrote to memory of 2936 2300 nhbhbb.exe 44 PID 2936 wrote to memory of 1844 2936 vpjjv.exe 45 PID 2936 wrote to memory of 1844 2936 vpjjv.exe 45 PID 2936 wrote to memory of 1844 2936 vpjjv.exe 45 PID 2936 wrote to memory of 1844 2936 vpjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe"C:\Users\Admin\AppData\Local\Temp\53c1ce720fd1063a019575474f8668cb5ca70524374437dc8611cb360a2f79e3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\1pvdj.exec:\1pvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\xllrrxr.exec:\xllrrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhnttb.exec:\nhnttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vddpv.exec:\vddpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rlllffl.exec:\rlllffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\1ttbbb.exec:\1ttbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5dvpp.exec:\5dvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vjvpv.exec:\vjvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\1vvvd.exec:\1vvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ttnbhn.exec:\ttnbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3jpdd.exec:\3jpdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\lfxrfxf.exec:\lfxrfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\vpvdv.exec:\vpvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\nhbhbb.exec:\nhbhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\vpjjv.exec:\vpjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxflxxf.exec:\lxflxxf.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjjjd.exec:\jjjjd.exe18⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lrxrrfl.exec:\lrxrrfl.exe19⤵
- Executes dropped EXE
PID:624 -
\??\c:\jjjvj.exec:\jjjvj.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ddvvd.exec:\ddvvd.exe21⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rrlflfl.exec:\rrlflfl.exe22⤵
- Executes dropped EXE
PID:576 -
\??\c:\rxfrxrx.exec:\rxfrxrx.exe23⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hnbnnh.exec:\hnbnnh.exe24⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1xllrxr.exec:\1xllrxr.exe25⤵
- Executes dropped EXE
PID:672 -
\??\c:\tnhhtt.exec:\tnhhtt.exe26⤵
- Executes dropped EXE
PID:1684 -
\??\c:\djdpj.exec:\djdpj.exe27⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hhbntb.exec:\hhbntb.exe28⤵
- Executes dropped EXE
PID:768 -
\??\c:\jjvvj.exec:\jjvvj.exe29⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rxrxlfr.exec:\rxrxlfr.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1bntbn.exec:\1bntbn.exe31⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxrlrlx.exec:\xxrlrlx.exe32⤵
- Executes dropped EXE
PID:2144 -
\??\c:\vdvjd.exec:\vdvjd.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xxxxllf.exec:\xxxxllf.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tnhnbh.exec:\tnhnbh.exe35⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pjdjd.exec:\pjdjd.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\1lllxfr.exec:\1lllxfr.exe37⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xxrfrfl.exec:\xxrfrfl.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bbbbth.exec:\bbbbth.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ppjpj.exec:\ppjpj.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\fllxlrx.exec:\fllxlrx.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\fflrflx.exec:\fflrflx.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\htnnnb.exec:\htnnnb.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pvvpp.exec:\pvvpp.exe44⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rrrlxfr.exec:\rrrlxfr.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\fflrrxf.exec:\fflrrxf.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tttnbn.exec:\tttnbn.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7ddvd.exec:\7ddvd.exe48⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pppdp.exec:\pppdp.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlxxflx.exec:\rlxxflx.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bhbnbh.exec:\bhbnbh.exe51⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bbthnb.exec:\bbthnb.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3dvdp.exec:\3dvdp.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fxxxfrl.exec:\fxxxfrl.exe54⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7ttbnt.exec:\7ttbnt.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\djdpd.exec:\djdpd.exe56⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xrllffr.exec:\xrllffr.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\fxrxllr.exec:\fxrxllr.exe58⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5tntbn.exec:\5tntbn.exe59⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dvvpv.exec:\dvvpv.exe60⤵
- Executes dropped EXE
PID:2024 -
\??\c:\djddp.exec:\djddp.exe61⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rxrxrfx.exec:\rxrxrfx.exe62⤵
- Executes dropped EXE
PID:632 -
\??\c:\1htbnt.exec:\1htbnt.exe63⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vpjpv.exec:\vpjpv.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7pjdj.exec:\7pjdj.exe65⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5rlxlff.exec:\5rlxlff.exe66⤵PID:1660
-
\??\c:\9hhnht.exec:\9hhnht.exe67⤵PID:2428
-
\??\c:\jvvvd.exec:\jvvvd.exe68⤵PID:1776
-
\??\c:\ppjvj.exec:\ppjvj.exe69⤵PID:692
-
\??\c:\llfrllf.exec:\llfrllf.exe70⤵PID:2004
-
\??\c:\bbthnt.exec:\bbthnt.exe71⤵PID:1496
-
\??\c:\vjpvj.exec:\vjpvj.exe72⤵PID:348
-
\??\c:\llxfrrf.exec:\llxfrrf.exe73⤵PID:2180
-
\??\c:\xfflxfr.exec:\xfflxfr.exe74⤵PID:1652
-
\??\c:\bbbntb.exec:\bbbntb.exe75⤵PID:2336
-
\??\c:\5dddj.exec:\5dddj.exe76⤵PID:1816
-
\??\c:\ffflxfl.exec:\ffflxfl.exe77⤵PID:1260
-
\??\c:\5tttbb.exec:\5tttbb.exe78⤵PID:1592
-
\??\c:\ttthtb.exec:\ttthtb.exe79⤵PID:2108
-
\??\c:\dvjvj.exec:\dvjvj.exe80⤵PID:2352
-
\??\c:\xrfxffr.exec:\xrfxffr.exe81⤵PID:1144
-
\??\c:\tttbhn.exec:\tttbhn.exe82⤵PID:2868
-
\??\c:\9tbhtb.exec:\9tbhtb.exe83⤵PID:3016
-
\??\c:\7jjjp.exec:\7jjjp.exe84⤵PID:2752
-
\??\c:\5flllrx.exec:\5flllrx.exe85⤵PID:3012
-
\??\c:\9bnnbb.exec:\9bnnbb.exe86⤵PID:2924
-
\??\c:\1dvjj.exec:\1dvjj.exe87⤵PID:2772
-
\??\c:\1pvdp.exec:\1pvdp.exe88⤵PID:2768
-
\??\c:\1rlxlrf.exec:\1rlxlrf.exe89⤵PID:2908
-
\??\c:\3bthtb.exec:\3bthtb.exe90⤵PID:2204
-
\??\c:\htnnnn.exec:\htnnnn.exe91⤵PID:648
-
\??\c:\jvjdj.exec:\jvjdj.exe92⤵PID:2820
-
\??\c:\rllrxlr.exec:\rllrxlr.exe93⤵PID:2952
-
\??\c:\ntbntn.exec:\ntbntn.exe94⤵PID:2356
-
\??\c:\nbnntt.exec:\nbnntt.exe95⤵PID:2956
-
\??\c:\vvdpp.exec:\vvdpp.exe96⤵PID:2844
-
\??\c:\3lflffr.exec:\3lflffr.exe97⤵PID:844
-
\??\c:\9nbhnt.exec:\9nbhnt.exe98⤵PID:2120
-
\??\c:\pjppd.exec:\pjppd.exe99⤵PID:1956
-
\??\c:\7vjdd.exec:\7vjdd.exe100⤵PID:1740
-
\??\c:\ffffllx.exec:\ffffllx.exe101⤵PID:2064
-
\??\c:\nnhtth.exec:\nnhtth.exe102⤵PID:2696
-
\??\c:\tthtbh.exec:\tthtbh.exe103⤵PID:948
-
\??\c:\pvddd.exec:\pvddd.exe104⤵PID:1076
-
\??\c:\llflxfr.exec:\llflxfr.exe105⤵PID:2068
-
\??\c:\bnhhth.exec:\bnhhth.exe106⤵PID:2488
-
\??\c:\hnhhnt.exec:\hnhhnt.exe107⤵PID:408
-
\??\c:\pjjjv.exec:\pjjjv.exe108⤵PID:1952
-
\??\c:\xrxxlrf.exec:\xrxxlrf.exe109⤵PID:1784
-
\??\c:\7rlxflx.exec:\7rlxflx.exe110⤵PID:2572
-
\??\c:\9bttbh.exec:\9bttbh.exe111⤵PID:1636
-
\??\c:\jdpdv.exec:\jdpdv.exe112⤵PID:1680
-
\??\c:\llrrfrr.exec:\llrrfrr.exe113⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\hhbbbb.exec:\hhbbbb.exe114⤵PID:1884
-
\??\c:\9nbtbb.exec:\9nbtbb.exe115⤵PID:2192
-
\??\c:\jppjp.exec:\jppjp.exe116⤵PID:300
-
\??\c:\9dddj.exec:\9dddj.exe117⤵PID:1908
-
\??\c:\9xlxlxl.exec:\9xlxlxl.exe118⤵PID:2520
-
\??\c:\hhhthn.exec:\hhhthn.exe119⤵PID:2096
-
\??\c:\bbbhth.exec:\bbbhth.exe120⤵PID:1816
-
\??\c:\pjjjj.exec:\pjjjj.exe121⤵PID:2504
-
\??\c:\fxlrffr.exec:\fxlrffr.exe122⤵PID:1864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-