Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe
-
Size
453KB
-
MD5
649c4192a242d7162a70baf2eeff2bf0
-
SHA1
2883eb2173b05c490367dcd9c0c20af9ddbdabac
-
SHA256
48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09
-
SHA512
54600462fedcf7b92dd33e7febc82bc642a33d46d81e7bb3d5463fc95da30f7f8e46d21acfd12633531d2aa5d4569c8f3ae8ca6f7d824c102fb4dd3e360065cc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-38-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-102-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1676-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-152-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2848-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-171-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-181-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2576-185-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-369-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3048-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-440-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1672-459-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1048-475-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-566-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2356-569-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2356-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-589-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1168-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-705-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-735-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1608-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-762-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-770-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-777-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1256-1013-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2328 vdjdp.exe 2124 rfxlxrf.exe 2168 vvjvd.exe 2660 nnhtnb.exe 2684 3xflrlr.exe 2760 djvjp.exe 2712 1rrxrxl.exe 2704 1btbbh.exe 2548 5lrxfff.exe 3000 nthnhn.exe 1676 flxfrfr.exe 1732 5pppp.exe 1680 9rxfxfx.exe 1708 bhnthn.exe 2848 9bbnht.exe 1628 vvjpv.exe 264 tbthtb.exe 1484 5frrxfr.exe 2576 7thbtn.exe 2272 vjvvd.exe 1256 djdjv.exe 1632 9fxlxlx.exe 2208 djpvj.exe 1456 llxxlrf.exe 1788 9ppjd.exe 388 1rxllfx.exe 1240 jdpjp.exe 2964 jvvdj.exe 2336 hnbtbh.exe 1936 djjjp.exe 2908 tbbhtb.exe 2448 3jjdv.exe 1596 bhtnbb.exe 2724 ddjpd.exe 1504 jpdjj.exe 2168 5lxlrfr.exe 2804 nnhnnt.exe 2788 hnhntb.exe 2692 jpjjp.exe 2668 5lxlxlx.exe 3040 bhhnnn.exe 2536 pjvvd.exe 2600 djjdj.exe 2060 flxxxfl.exe 3048 thttbh.exe 1524 nnbhnt.exe 2872 ppdjv.exe 2800 lfxxrxr.exe 2840 5tnnbn.exe 1968 pvjjj.exe 2508 7jppv.exe 2300 xxfflrx.exe 1672 bbhhnt.exe 964 pjddj.exe 2888 rrlflrr.exe 1012 rrxxrrf.exe 496 7nnbnt.exe 1048 vvppp.exe 1624 flxffrx.exe 2028 ffllflx.exe 900 bbntbh.exe 2064 5dpvv.exe 1644 9fxxfrx.exe 2832 flfrfll.exe -
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-46-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2684-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-102-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1676-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-185-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2208-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-306-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1596-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-346-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2536-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-369-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/3048-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-475-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2356-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-589-0x0000000001C60000-0x0000000001C8A000-memory.dmp upx behavioral1/memory/1168-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-602-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2648-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-705-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2880-735-0x0000000000350000-0x000000000037A000-memory.dmp upx behavioral1/memory/1608-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2328 2488 48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe 31 PID 2488 wrote to memory of 2328 2488 48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe 31 PID 2488 wrote to memory of 2328 2488 48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe 31 PID 2488 wrote to memory of 2328 2488 48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe 31 PID 2328 wrote to memory of 2124 2328 vdjdp.exe 32 PID 2328 wrote to memory of 2124 2328 vdjdp.exe 32 PID 2328 wrote to memory of 2124 2328 vdjdp.exe 32 PID 2328 wrote to memory of 2124 2328 vdjdp.exe 32 PID 2124 wrote to memory of 2168 2124 rfxlxrf.exe 33 PID 2124 wrote to memory of 2168 2124 rfxlxrf.exe 33 PID 2124 wrote to memory of 2168 2124 rfxlxrf.exe 33 PID 2124 wrote to memory of 2168 2124 rfxlxrf.exe 33 PID 2168 wrote to memory of 2660 2168 vvjvd.exe 34 PID 2168 wrote to memory of 2660 2168 vvjvd.exe 34 PID 2168 wrote to memory of 2660 2168 vvjvd.exe 34 PID 2168 wrote to memory of 2660 2168 vvjvd.exe 34 PID 2660 wrote to memory of 2684 2660 nnhtnb.exe 35 PID 2660 wrote to memory of 2684 2660 nnhtnb.exe 35 PID 2660 wrote to memory of 2684 2660 nnhtnb.exe 35 PID 2660 wrote to memory of 2684 2660 nnhtnb.exe 35 PID 2684 wrote to memory of 2760 2684 3xflrlr.exe 36 PID 2684 wrote to memory of 2760 2684 3xflrlr.exe 36 PID 2684 wrote to memory of 2760 2684 3xflrlr.exe 36 PID 2684 wrote to memory of 2760 2684 3xflrlr.exe 36 PID 2760 wrote to memory of 2712 2760 djvjp.exe 37 PID 2760 wrote to memory of 2712 2760 djvjp.exe 37 PID 2760 wrote to memory of 2712 2760 djvjp.exe 37 PID 2760 wrote to memory of 2712 2760 djvjp.exe 37 PID 2712 wrote to memory of 2704 2712 1rrxrxl.exe 38 PID 2712 wrote to memory of 2704 2712 1rrxrxl.exe 38 PID 2712 wrote to memory of 2704 2712 1rrxrxl.exe 38 PID 2712 wrote to memory of 2704 2712 1rrxrxl.exe 38 PID 2704 wrote to memory of 2548 2704 1btbbh.exe 39 PID 2704 wrote to memory of 2548 2704 1btbbh.exe 39 PID 2704 wrote to memory of 2548 2704 1btbbh.exe 39 PID 2704 wrote to memory of 2548 2704 1btbbh.exe 39 PID 2548 wrote to memory of 3000 2548 5lrxfff.exe 40 PID 2548 wrote to memory of 3000 2548 5lrxfff.exe 40 PID 2548 wrote to memory of 3000 2548 5lrxfff.exe 40 PID 2548 wrote to memory of 3000 2548 5lrxfff.exe 40 PID 3000 wrote to memory of 1676 3000 nthnhn.exe 41 PID 3000 wrote to memory of 1676 3000 nthnhn.exe 41 PID 3000 wrote to memory of 1676 3000 nthnhn.exe 41 PID 3000 wrote to memory of 1676 3000 nthnhn.exe 41 PID 1676 wrote to memory of 1732 1676 flxfrfr.exe 42 PID 1676 wrote to memory of 1732 1676 flxfrfr.exe 42 PID 1676 wrote to memory of 1732 1676 flxfrfr.exe 42 PID 1676 wrote to memory of 1732 1676 flxfrfr.exe 42 PID 1732 wrote to memory of 1680 1732 5pppp.exe 43 PID 1732 wrote to memory of 1680 1732 5pppp.exe 43 PID 1732 wrote to memory of 1680 1732 5pppp.exe 43 PID 1732 wrote to memory of 1680 1732 5pppp.exe 43 PID 1680 wrote to memory of 1708 1680 9rxfxfx.exe 44 PID 1680 wrote to memory of 1708 1680 9rxfxfx.exe 44 PID 1680 wrote to memory of 1708 1680 9rxfxfx.exe 44 PID 1680 wrote to memory of 1708 1680 9rxfxfx.exe 44 PID 1708 wrote to memory of 2848 1708 bhnthn.exe 45 PID 1708 wrote to memory of 2848 1708 bhnthn.exe 45 PID 1708 wrote to memory of 2848 1708 bhnthn.exe 45 PID 1708 wrote to memory of 2848 1708 bhnthn.exe 45 PID 2848 wrote to memory of 1628 2848 9bbnht.exe 46 PID 2848 wrote to memory of 1628 2848 9bbnht.exe 46 PID 2848 wrote to memory of 1628 2848 9bbnht.exe 46 PID 2848 wrote to memory of 1628 2848 9bbnht.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe"C:\Users\Admin\AppData\Local\Temp\48b52a531bb1cf147bb9a60e7fb7bcc5b24b2b81bf45c8ff3bbc5986c2d93b09N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vdjdp.exec:\vdjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vvjvd.exec:\vvjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nnhtnb.exec:\nnhtnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3xflrlr.exec:\3xflrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\djvjp.exec:\djvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\1rrxrxl.exec:\1rrxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1btbbh.exec:\1btbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5lrxfff.exec:\5lrxfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\nthnhn.exec:\nthnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\flxfrfr.exec:\flxfrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\5pppp.exec:\5pppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\9rxfxfx.exec:\9rxfxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\bhnthn.exec:\bhnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\9bbnht.exec:\9bbnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vvjpv.exec:\vvjpv.exe17⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tbthtb.exec:\tbthtb.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\5frrxfr.exec:\5frrxfr.exe19⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7thbtn.exec:\7thbtn.exe20⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vjvvd.exec:\vjvvd.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\djdjv.exec:\djdjv.exe22⤵
- Executes dropped EXE
PID:1256 -
\??\c:\9fxlxlx.exec:\9fxlxlx.exe23⤵
- Executes dropped EXE
PID:1632 -
\??\c:\djpvj.exec:\djpvj.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\llxxlrf.exec:\llxxlrf.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\9ppjd.exec:\9ppjd.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1rxllfx.exec:\1rxllfx.exe27⤵
- Executes dropped EXE
PID:388 -
\??\c:\jdpjp.exec:\jdpjp.exe28⤵
- Executes dropped EXE
PID:1240 -
\??\c:\jvvdj.exec:\jvvdj.exe29⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hnbtbh.exec:\hnbtbh.exe30⤵
- Executes dropped EXE
PID:2336 -
\??\c:\djjjp.exec:\djjjp.exe31⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tbbhtb.exec:\tbbhtb.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3jjdv.exec:\3jjdv.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bhtnbb.exec:\bhtnbb.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ddjpd.exec:\ddjpd.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jpdjj.exec:\jpdjj.exe36⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5lxlrfr.exec:\5lxlrfr.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nnhnnt.exec:\nnhnnt.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hnhntb.exec:\hnhntb.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jpjjp.exec:\jpjjp.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5lxlxlx.exec:\5lxlxlx.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bhhnnn.exec:\bhhnnn.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pjvvd.exec:\pjvvd.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\djjdj.exec:\djjdj.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\flxxxfl.exec:\flxxxfl.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\thttbh.exec:\thttbh.exe46⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nnbhnt.exec:\nnbhnt.exe47⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ppdjv.exec:\ppdjv.exe48⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lfxxrxr.exec:\lfxxrxr.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5tnnbn.exec:\5tnnbn.exe50⤵
- Executes dropped EXE
PID:2840 -
\??\c:\pvjjj.exec:\pvjjj.exe51⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7jppv.exec:\7jppv.exe52⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xxfflrx.exec:\xxfflrx.exe53⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bbhhnt.exec:\bbhhnt.exe54⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pjddj.exec:\pjddj.exe55⤵
- Executes dropped EXE
PID:964 -
\??\c:\rrlflrr.exec:\rrlflrr.exe56⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rrxxrrf.exec:\rrxxrrf.exe57⤵
- Executes dropped EXE
PID:1012 -
\??\c:\7nnbnt.exec:\7nnbnt.exe58⤵
- Executes dropped EXE
PID:496 -
\??\c:\vvppp.exec:\vvppp.exe59⤵
- Executes dropped EXE
PID:1048 -
\??\c:\flxffrx.exec:\flxffrx.exe60⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ffllflx.exec:\ffllflx.exe61⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bbntbh.exec:\bbntbh.exe62⤵
- Executes dropped EXE
PID:900 -
\??\c:\5dpvv.exec:\5dpvv.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9fxxfrx.exec:\9fxxfrx.exe64⤵
- Executes dropped EXE
PID:1644 -
\??\c:\flfrfll.exec:\flfrfll.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\nnbbhn.exec:\nnbbhn.exe66⤵PID:1964
-
\??\c:\pvjpv.exec:\pvjpv.exe67⤵PID:2372
-
\??\c:\rxfllll.exec:\rxfllll.exe68⤵PID:2268
-
\??\c:\5xlllll.exec:\5xlllll.exe69⤵PID:1000
-
\??\c:\ntnbnt.exec:\ntnbnt.exe70⤵PID:2336
-
\??\c:\vpddd.exec:\vpddd.exe71⤵PID:2008
-
\??\c:\djjpv.exec:\djjpv.exe72⤵PID:1412
-
\??\c:\1lrlrxx.exec:\1lrlrxx.exe73⤵PID:2468
-
\??\c:\bbtthn.exec:\bbtthn.exe74⤵PID:2356
-
\??\c:\nhtbht.exec:\nhtbht.exe75⤵PID:1596
-
\??\c:\ddpvj.exec:\ddpvj.exe76⤵PID:1168
-
\??\c:\fflfllr.exec:\fflfllr.exe77⤵PID:2756
-
\??\c:\7btbbb.exec:\7btbbb.exe78⤵PID:2636
-
\??\c:\ddddv.exec:\ddddv.exe79⤵PID:2772
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe80⤵PID:2648
-
\??\c:\bnhnbt.exec:\bnhnbt.exe81⤵PID:2824
-
\??\c:\hhhhnn.exec:\hhhhnn.exe82⤵PID:2668
-
\??\c:\djpjj.exec:\djpjj.exe83⤵PID:2556
-
\??\c:\rxrlxrx.exec:\rxrlxrx.exe84⤵PID:2548
-
\??\c:\xxfxllr.exec:\xxfxllr.exe85⤵PID:2512
-
\??\c:\bbnnhn.exec:\bbnnhn.exe86⤵PID:468
-
\??\c:\ddpvp.exec:\ddpvp.exe87⤵PID:1888
-
\??\c:\lrffxfl.exec:\lrffxfl.exe88⤵PID:1524
-
\??\c:\nhnntt.exec:\nhnntt.exe89⤵PID:1076
-
\??\c:\7nbbht.exec:\7nbbht.exe90⤵PID:1852
-
\??\c:\9jddj.exec:\9jddj.exe91⤵PID:1884
-
\??\c:\frxxlrx.exec:\frxxlrx.exe92⤵PID:2708
-
\??\c:\bttbnn.exec:\bttbnn.exe93⤵PID:2848
-
\??\c:\vvjpj.exec:\vvjpj.exe94⤵PID:2876
-
\??\c:\jpjjv.exec:\jpjjv.exe95⤵PID:536
-
\??\c:\rxlrxfr.exec:\rxlrxfr.exe96⤵PID:1856
-
\??\c:\ttbtht.exec:\ttbtht.exe97⤵PID:2364
-
\??\c:\jdvdp.exec:\jdvdp.exe98⤵PID:2520
-
\??\c:\pjvvp.exec:\pjvvp.exe99⤵PID:2880
-
\??\c:\3xxfxlr.exec:\3xxfxlr.exe100⤵PID:1608
-
\??\c:\hnbbnb.exec:\hnbbnb.exe101⤵PID:988
-
\??\c:\pjdpj.exec:\pjdpj.exe102⤵PID:2200
-
\??\c:\ppddd.exec:\ppddd.exe103⤵PID:1536
-
\??\c:\rrlfflf.exec:\rrlfflf.exe104⤵PID:2208
-
\??\c:\hntbht.exec:\hntbht.exe105⤵PID:1532
-
\??\c:\jpdpv.exec:\jpdpv.exe106⤵
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\rrlrflr.exec:\rrlrflr.exe107⤵PID:3020
-
\??\c:\5llrxxl.exec:\5llrxxl.exe108⤵PID:2496
-
\??\c:\djdjp.exec:\djdjp.exe109⤵PID:2372
-
\??\c:\lrflrxf.exec:\lrflrxf.exe110⤵PID:2964
-
\??\c:\1nbhnh.exec:\1nbhnh.exe111⤵PID:1000
-
\??\c:\hhtbbb.exec:\hhtbbb.exe112⤵PID:2108
-
\??\c:\jpdpv.exec:\jpdpv.exe113⤵PID:2480
-
\??\c:\xxllxfl.exec:\xxllxfl.exe114⤵PID:2932
-
\??\c:\3hbhtt.exec:\3hbhtt.exe115⤵PID:2100
-
\??\c:\bbhnnb.exec:\bbhnnb.exe116⤵PID:1600
-
\??\c:\3dpdp.exec:\3dpdp.exe117⤵
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\xfrrflr.exec:\xfrrflr.exe118⤵PID:608
-
\??\c:\xflfxff.exec:\xflfxff.exe119⤵PID:2776
-
\??\c:\bntbbt.exec:\bntbbt.exe120⤵PID:2544
-
\??\c:\jpvpd.exec:\jpvpd.exe121⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-