Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/12/2024, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe
-
Size
452KB
-
MD5
30d5fa3c3b1fd3c9be8aae0543b7c740
-
SHA1
b5adca0ffdb69e67eef7af0a2d5ea06ba58d3216
-
SHA256
b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573a
-
SHA512
0f59e67e7ca294adae6e8be2bcbe06b243a51becc2e66f45f5f1fe0cbe62442cc7950e6deee330fbf3e2da90e38e7aef0c3ccce8db33825fda1737c5800e95e7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeu:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2124-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-246-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-287-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2668-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-300-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1952-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-538-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1860-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-608-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2172-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2432-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-700-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-798-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1356-805-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2936-818-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1860-863-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2356-882-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2172-908-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/108-921-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-928-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-948-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1600-1227-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 jvvpp.exe 2032 fflxrff.exe 2444 hnhbtb.exe 2300 pdjdv.exe 2912 xfflfrr.exe 2416 rxrlxll.exe 2352 vdvdd.exe 2704 jvvjj.exe 2640 ttthbt.exe 2168 vjpdd.exe 2772 rlrllrf.exe 2536 9dvjv.exe 2532 flxlfrl.exe 2152 jjdjp.exe 1960 rrrlxfx.exe 1520 pppdp.exe 1948 frxlxrr.exe 1028 1pdpv.exe 1304 fxrrlrf.exe 2824 pjddj.exe 3012 lffrxfr.exe 1424 1rrrflr.exe 288 ntbnbn.exe 1120 rrxlxff.exe 1140 7bhnht.exe 944 nhttbb.exe 1540 9ttbth.exe 1708 3hhtnt.exe 636 tthnbh.exe 2668 htbntn.exe 1972 ntbhtb.exe 2888 bbttbb.exe 880 ttbtnb.exe 1016 xxxlxlf.exe 1628 1bnbnh.exe 2212 djddd.exe 2264 pppjv.exe 2308 3xxfflx.exe 1952 3nbntb.exe 1596 tbtbtb.exe 2928 jjvvj.exe 2420 rrfxrll.exe 2576 5bhntb.exe 2148 9nnthh.exe 2636 dpjdj.exe 2712 1lflfff.exe 2620 ntbnbh.exe 2604 hhtnth.exe 2168 pddjp.exe 2600 lfflxfl.exe 2492 tttbtt.exe 2608 nnntbh.exe 2532 pdvvv.exe 572 xfxrfrl.exe 1744 htbbbb.exe 1920 djjdj.exe 1864 xxrlxlf.exe 1004 tthntt.exe 1280 7ttthh.exe 2848 dvvdp.exe 2800 rxllffx.exe 2840 hnntnb.exe 2332 vvvpd.exe 2852 jjpjv.exe -
resource yara_rule behavioral1/memory/1628-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-1042-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1720-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-1202-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1628 2124 b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe 28 PID 2124 wrote to memory of 1628 2124 b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe 28 PID 2124 wrote to memory of 1628 2124 b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe 28 PID 2124 wrote to memory of 1628 2124 b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe 28 PID 1628 wrote to memory of 2032 1628 jvvpp.exe 29 PID 1628 wrote to memory of 2032 1628 jvvpp.exe 29 PID 1628 wrote to memory of 2032 1628 jvvpp.exe 29 PID 1628 wrote to memory of 2032 1628 jvvpp.exe 29 PID 2032 wrote to memory of 2444 2032 fflxrff.exe 30 PID 2032 wrote to memory of 2444 2032 fflxrff.exe 30 PID 2032 wrote to memory of 2444 2032 fflxrff.exe 30 PID 2032 wrote to memory of 2444 2032 fflxrff.exe 30 PID 2444 wrote to memory of 2300 2444 hnhbtb.exe 31 PID 2444 wrote to memory of 2300 2444 hnhbtb.exe 31 PID 2444 wrote to memory of 2300 2444 hnhbtb.exe 31 PID 2444 wrote to memory of 2300 2444 hnhbtb.exe 31 PID 2300 wrote to memory of 2912 2300 pdjdv.exe 32 PID 2300 wrote to memory of 2912 2300 pdjdv.exe 32 PID 2300 wrote to memory of 2912 2300 pdjdv.exe 32 PID 2300 wrote to memory of 2912 2300 pdjdv.exe 32 PID 2912 wrote to memory of 2416 2912 xfflfrr.exe 33 PID 2912 wrote to memory of 2416 2912 xfflfrr.exe 33 PID 2912 wrote to memory of 2416 2912 xfflfrr.exe 33 PID 2912 wrote to memory of 2416 2912 xfflfrr.exe 33 PID 2416 wrote to memory of 2352 2416 rxrlxll.exe 34 PID 2416 wrote to memory of 2352 2416 rxrlxll.exe 34 PID 2416 wrote to memory of 2352 2416 rxrlxll.exe 34 PID 2416 wrote to memory of 2352 2416 rxrlxll.exe 34 PID 2352 wrote to memory of 2704 2352 vdvdd.exe 35 PID 2352 wrote to memory of 2704 2352 vdvdd.exe 35 PID 2352 wrote to memory of 2704 2352 vdvdd.exe 35 PID 2352 wrote to memory of 2704 2352 vdvdd.exe 35 PID 2704 wrote to memory of 2640 2704 jvvjj.exe 36 PID 2704 wrote to memory of 2640 2704 jvvjj.exe 36 PID 2704 wrote to memory of 2640 2704 jvvjj.exe 36 PID 2704 wrote to memory of 2640 2704 jvvjj.exe 36 PID 2640 wrote to memory of 2168 2640 ttthbt.exe 37 PID 2640 wrote to memory of 2168 2640 ttthbt.exe 37 PID 2640 wrote to memory of 2168 2640 ttthbt.exe 37 PID 2640 wrote to memory of 2168 2640 ttthbt.exe 37 PID 2168 wrote to memory of 2772 2168 vjpdd.exe 38 PID 2168 wrote to memory of 2772 2168 vjpdd.exe 38 PID 2168 wrote to memory of 2772 2168 vjpdd.exe 38 PID 2168 wrote to memory of 2772 2168 vjpdd.exe 38 PID 2772 wrote to memory of 2536 2772 rlrllrf.exe 39 PID 2772 wrote to memory of 2536 2772 rlrllrf.exe 39 PID 2772 wrote to memory of 2536 2772 rlrllrf.exe 39 PID 2772 wrote to memory of 2536 2772 rlrllrf.exe 39 PID 2536 wrote to memory of 2532 2536 9dvjv.exe 40 PID 2536 wrote to memory of 2532 2536 9dvjv.exe 40 PID 2536 wrote to memory of 2532 2536 9dvjv.exe 40 PID 2536 wrote to memory of 2532 2536 9dvjv.exe 40 PID 2532 wrote to memory of 2152 2532 flxlfrl.exe 41 PID 2532 wrote to memory of 2152 2532 flxlfrl.exe 41 PID 2532 wrote to memory of 2152 2532 flxlfrl.exe 41 PID 2532 wrote to memory of 2152 2532 flxlfrl.exe 41 PID 2152 wrote to memory of 1960 2152 jjdjp.exe 42 PID 2152 wrote to memory of 1960 2152 jjdjp.exe 42 PID 2152 wrote to memory of 1960 2152 jjdjp.exe 42 PID 2152 wrote to memory of 1960 2152 jjdjp.exe 42 PID 1960 wrote to memory of 1520 1960 rrrlxfx.exe 43 PID 1960 wrote to memory of 1520 1960 rrrlxfx.exe 43 PID 1960 wrote to memory of 1520 1960 rrrlxfx.exe 43 PID 1960 wrote to memory of 1520 1960 rrrlxfx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe"C:\Users\Admin\AppData\Local\Temp\b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\jvvpp.exec:\jvvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\fflxrff.exec:\fflxrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\hnhbtb.exec:\hnhbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pdjdv.exec:\pdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\xfflfrr.exec:\xfflfrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rxrlxll.exec:\rxrlxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vdvdd.exec:\vdvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jvvjj.exec:\jvvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\ttthbt.exec:\ttthbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vjpdd.exec:\vjpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rlrllrf.exec:\rlrllrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9dvjv.exec:\9dvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\flxlfrl.exec:\flxlfrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjdjp.exec:\jjdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\rrrlxfx.exec:\rrrlxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\pppdp.exec:\pppdp.exe17⤵
- Executes dropped EXE
PID:1520 -
\??\c:\frxlxrr.exec:\frxlxrr.exe18⤵
- Executes dropped EXE
PID:1948 -
\??\c:\1pdpv.exec:\1pdpv.exe19⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fxrrlrf.exec:\fxrrlrf.exe20⤵
- Executes dropped EXE
PID:1304 -
\??\c:\pjddj.exec:\pjddj.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lffrxfr.exec:\lffrxfr.exe22⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1rrrflr.exec:\1rrrflr.exe23⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ntbnbn.exec:\ntbnbn.exe24⤵
- Executes dropped EXE
PID:288 -
\??\c:\rrxlxff.exec:\rrxlxff.exe25⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7bhnht.exec:\7bhnht.exe26⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nhttbb.exec:\nhttbb.exe27⤵
- Executes dropped EXE
PID:944 -
\??\c:\9ttbth.exec:\9ttbth.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3hhtnt.exec:\3hhtnt.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tthnbh.exec:\tthnbh.exe30⤵
- Executes dropped EXE
PID:636 -
\??\c:\htbntn.exec:\htbntn.exe31⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ntbhtb.exec:\ntbhtb.exe32⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bbttbb.exec:\bbttbb.exe33⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ttbtnb.exec:\ttbtnb.exe34⤵
- Executes dropped EXE
PID:880 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe35⤵
- Executes dropped EXE
PID:1016 -
\??\c:\1bnbnh.exec:\1bnbnh.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\djddd.exec:\djddd.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pppjv.exec:\pppjv.exe38⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3xxfflx.exec:\3xxfflx.exe39⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3nbntb.exec:\3nbntb.exe40⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tbtbtb.exec:\tbtbtb.exe41⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jjvvj.exec:\jjvvj.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rrfxrll.exec:\rrfxrll.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5bhntb.exec:\5bhntb.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9nnthh.exec:\9nnthh.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dpjdj.exec:\dpjdj.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1lflfff.exec:\1lflfff.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ntbnbh.exec:\ntbnbh.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hhtnth.exec:\hhtnth.exe49⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pddjp.exec:\pddjp.exe50⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lfflxfl.exec:\lfflxfl.exe51⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tttbtt.exec:\tttbtt.exe52⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nnntbh.exec:\nnntbh.exe53⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pdvvv.exec:\pdvvv.exe54⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xfxrfrl.exec:\xfxrfrl.exe55⤵
- Executes dropped EXE
PID:572 -
\??\c:\htbbbb.exec:\htbbbb.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djjdj.exec:\djjdj.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xxrlxlf.exec:\xxrlxlf.exe58⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tthntt.exec:\tthntt.exe59⤵
- Executes dropped EXE
PID:1004 -
\??\c:\7ttthh.exec:\7ttthh.exe60⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dvvdp.exec:\dvvdp.exe61⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rxllffx.exec:\rxllffx.exe62⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hnntnb.exec:\hnntnb.exe63⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vvvpd.exec:\vvvpd.exe64⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jjpjv.exec:\jjpjv.exe65⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1llrxlf.exec:\1llrxlf.exe66⤵PID:2572
-
\??\c:\hhhbnt.exec:\hhhbnt.exe67⤵PID:404
-
\??\c:\9dppv.exec:\9dppv.exe68⤵PID:532
-
\??\c:\5frrlrx.exec:\5frrlrx.exe69⤵PID:1120
-
\??\c:\9lflrxr.exec:\9lflrxr.exe70⤵PID:1860
-
\??\c:\tttthn.exec:\tttthn.exe71⤵PID:308
-
\??\c:\vjvvd.exec:\vjvvd.exe72⤵PID:1288
-
\??\c:\rrrxflr.exec:\rrrxflr.exe73⤵PID:828
-
\??\c:\7lflrff.exec:\7lflrff.exe74⤵PID:1336
-
\??\c:\httthh.exec:\httthh.exe75⤵PID:1040
-
\??\c:\vpjjv.exec:\vpjjv.exe76⤵PID:2356
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe77⤵
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\9xrxlrr.exec:\9xrxlrr.exe78⤵PID:1020
-
\??\c:\bbtbtt.exec:\bbtbtt.exe79⤵PID:2260
-
\??\c:\7jppd.exec:\7jppd.exe80⤵PID:2172
-
\??\c:\3ffxlxl.exec:\3ffxlxl.exe81⤵PID:2324
-
\??\c:\1fxlrxr.exec:\1fxlrxr.exe82⤵PID:2288
-
\??\c:\bhntnb.exec:\bhntnb.exe83⤵PID:2452
-
\??\c:\pvjvv.exec:\pvjvv.exe84⤵PID:2396
-
\??\c:\xrflrfl.exec:\xrflrfl.exe85⤵PID:2432
-
\??\c:\xllxxlx.exec:\xllxxlx.exe86⤵PID:1572
-
\??\c:\bbthbn.exec:\bbthbn.exe87⤵PID:2932
-
\??\c:\9ppvd.exec:\9ppvd.exe88⤵PID:2408
-
\??\c:\llflrfx.exec:\llflrfx.exe89⤵PID:2756
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe90⤵PID:2596
-
\??\c:\nhbhtt.exec:\nhbhtt.exe91⤵PID:2716
-
\??\c:\ppppd.exec:\ppppd.exe92⤵PID:2744
-
\??\c:\pjjdp.exec:\pjjdp.exe93⤵PID:2700
-
\??\c:\lfrflxf.exec:\lfrflxf.exe94⤵PID:2644
-
\??\c:\nththn.exec:\nththn.exe95⤵PID:3020
-
\??\c:\9dvvd.exec:\9dvvd.exe96⤵PID:2480
-
\??\c:\7rxlrxl.exec:\7rxlrxl.exe97⤵PID:2496
-
\??\c:\5fxxxlr.exec:\5fxxxlr.exe98⤵PID:2560
-
\??\c:\nnhtbn.exec:\nnhtbn.exe99⤵PID:2108
-
\??\c:\pvjpd.exec:\pvjpd.exe100⤵PID:980
-
\??\c:\5frrfrx.exec:\5frrfrx.exe101⤵PID:628
-
\??\c:\7xlrxfr.exec:\7xlrxfr.exe102⤵PID:1720
-
\??\c:\thnnht.exec:\thnnht.exe103⤵PID:1696
-
\??\c:\pjvdp.exec:\pjvdp.exe104⤵PID:1692
-
\??\c:\vdppv.exec:\vdppv.exe105⤵PID:1864
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe106⤵PID:1028
-
\??\c:\hhhnhn.exec:\hhhnhn.exe107⤵PID:1280
-
\??\c:\vvvjp.exec:\vvvjp.exe108⤵PID:2836
-
\??\c:\ddvjv.exec:\ddvjv.exe109⤵PID:2588
-
\??\c:\xfffrrf.exec:\xfffrrf.exe110⤵PID:2520
-
\??\c:\ntthht.exec:\ntthht.exe111⤵PID:1356
-
\??\c:\7vvdj.exec:\7vvdj.exe112⤵PID:2960
-
\??\c:\rrfflfr.exec:\rrfflfr.exe113⤵PID:2936
-
\??\c:\tntnbn.exec:\tntnbn.exe114⤵PID:444
-
\??\c:\dvdvj.exec:\dvdvj.exe115⤵PID:532
-
\??\c:\lllxlxx.exec:\lllxlxx.exe116⤵PID:2816
-
\??\c:\hhntnb.exec:\hhntnb.exe117⤵PID:1860
-
\??\c:\7nbhnn.exec:\7nbhnn.exe118⤵PID:308
-
\??\c:\vppdv.exec:\vppdv.exe119⤵PID:772
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe120⤵PID:876
-
\??\c:\thttbb.exec:\thttbb.exe121⤵PID:1336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-