Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 02:49
Behavioral task
behavioral1
Sample
0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe
-
Size
97KB
-
MD5
747cc1402be9b0578d1744a1b2b517a0
-
SHA1
f4d1acb86564a0543570088925bc8cfce2a1da5e
-
SHA256
0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295
-
SHA512
9545436bf288832f6187ae545c4bb9eab97e34308f077970d1c55bf06845c80302bd40434615c20a11b6ccb8583db6fd60cfb0f1558b8f2583efcf757c4f095c
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgF:8cm4FmowdHoSgWrXUgF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-48-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-122-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2968-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-141-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1892-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1188-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/920-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-436-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1956-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-579-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2700-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/704-636-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2040-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-674-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1648-872-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2056-1211-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1752-7758-0x0000000076D80000-0x0000000076E9F000-memory.dmp family_blackmoon behavioral1/memory/1752-10414-0x0000000076C80000-0x0000000076D7A000-memory.dmp family_blackmoon behavioral1/memory/1752-10413-0x0000000076D80000-0x0000000076E9F000-memory.dmp family_blackmoon behavioral1/memory/1752-12345-0x0000000076C80000-0x0000000076D7A000-memory.dmp family_blackmoon behavioral1/memory/1752-14265-0x0000000076D80000-0x0000000076E9F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 bhhbbh.exe 2528 thnhnb.exe 2708 jppjj.exe 2220 7lflrxf.exe 2764 btbbbb.exe 2888 ppvvd.exe 2756 vvvjv.exe 2784 3bthtt.exe 2648 btnbnb.exe 2668 vpjpj.exe 2652 3pppj.exe 2356 9tntth.exe 552 nbbbhb.exe 572 7vvjv.exe 2968 xlffrlx.exe 2680 httbht.exe 752 bhhbhh.exe 332 jjdvd.exe 1892 xrfxrrf.exe 1164 1bhbtn.exe 2140 ppjvp.exe 2344 xflrxrl.exe 1012 5xlxllx.exe 1188 btnnth.exe 2572 btbbhn.exe 1912 dvjvd.exe 920 lfxxxxf.exe 2084 rfrfxfx.exe 3016 hbthnn.exe 688 7dpvj.exe 1928 frxxxxl.exe 1864 5rrrfrx.exe 1932 tnhthn.exe 1600 nnbbbh.exe 1252 pddjj.exe 1532 xrxllfx.exe 836 llfxffr.exe 2592 bbtbhh.exe 2160 5bnthh.exe 2804 pvpvv.exe 2488 1ddpv.exe 2776 fxlfllx.exe 2900 7xrfrxl.exe 3024 hbtbhn.exe 2756 hhthht.exe 2908 pvjdj.exe 2792 lfxrflr.exe 2372 1xffxxl.exe 2700 xxrxrxf.exe 2088 hthhbb.exe 476 ttnbht.exe 2504 vjddd.exe 552 vppdj.exe 812 rrxfxfl.exe 2964 1xlfrfr.exe 2976 nbnhnh.exe 2608 lfxrrrx.exe 588 lfrrlff.exe 752 bnhnbh.exe 2712 bhthbh.exe 1220 jjdjp.exe 1904 7lxrxxl.exe 2188 lllxxxx.exe 2092 1hnbtb.exe -
resource yara_rule behavioral1/memory/2532-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012029-6.dat upx behavioral1/memory/2532-3-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x0008000000019273-16.dat upx behavioral1/memory/2528-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2008-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000192f0-25.dat upx behavioral1/memory/2528-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001932a-32.dat upx behavioral1/memory/2708-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001933e-40.dat upx behavioral1/memory/2220-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019346-51.dat upx behavioral1/memory/2764-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019384-58.dat upx behavioral1/memory/2888-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194f6-67.dat upx behavioral1/files/0x000500000001a41a-73.dat upx behavioral1/files/0x000500000001a41b-82.dat upx behavioral1/memory/2648-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41c-89.dat upx behavioral1/memory/2668-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41d-96.dat upx behavioral1/files/0x000500000001a41e-107.dat upx behavioral1/memory/2356-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/552-114-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a455-115.dat upx behavioral1/files/0x000500000001a477-124.dat upx behavioral1/memory/572-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-131-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a478-134.dat upx behavioral1/memory/2968-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a486-140.dat upx behavioral1/files/0x000500000001a48a-149.dat upx behavioral1/memory/752-148-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000500000001a497-156.dat upx behavioral1/memory/1164-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1892-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a0-163.dat upx behavioral1/files/0x000500000001a4a2-172.dat upx behavioral1/files/0x000500000001a4a8-179.dat upx behavioral1/files/0x000500000001a4aa-188.dat upx behavioral1/memory/2344-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ac-197.dat upx behavioral1/memory/1188-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4af-204.dat upx behavioral1/files/0x000500000001a4b1-212.dat upx behavioral1/memory/1912-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-228.dat upx behavioral1/files/0x000500000001a4b3-220.dat upx behavioral1/memory/920-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b7-234.dat upx behavioral1/memory/3016-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b9-242.dat upx behavioral1/files/0x0008000000019234-249.dat upx behavioral1/memory/1928-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bb-258.dat upx behavioral1/memory/1600-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1532-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-297-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2008 2532 0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe 30 PID 2532 wrote to memory of 2008 2532 0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe 30 PID 2532 wrote to memory of 2008 2532 0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe 30 PID 2532 wrote to memory of 2008 2532 0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe 30 PID 2008 wrote to memory of 2528 2008 bhhbbh.exe 31 PID 2008 wrote to memory of 2528 2008 bhhbbh.exe 31 PID 2008 wrote to memory of 2528 2008 bhhbbh.exe 31 PID 2008 wrote to memory of 2528 2008 bhhbbh.exe 31 PID 2528 wrote to memory of 2708 2528 thnhnb.exe 32 PID 2528 wrote to memory of 2708 2528 thnhnb.exe 32 PID 2528 wrote to memory of 2708 2528 thnhnb.exe 32 PID 2528 wrote to memory of 2708 2528 thnhnb.exe 32 PID 2708 wrote to memory of 2220 2708 jppjj.exe 33 PID 2708 wrote to memory of 2220 2708 jppjj.exe 33 PID 2708 wrote to memory of 2220 2708 jppjj.exe 33 PID 2708 wrote to memory of 2220 2708 jppjj.exe 33 PID 2220 wrote to memory of 2764 2220 7lflrxf.exe 34 PID 2220 wrote to memory of 2764 2220 7lflrxf.exe 34 PID 2220 wrote to memory of 2764 2220 7lflrxf.exe 34 PID 2220 wrote to memory of 2764 2220 7lflrxf.exe 34 PID 2764 wrote to memory of 2888 2764 btbbbb.exe 35 PID 2764 wrote to memory of 2888 2764 btbbbb.exe 35 PID 2764 wrote to memory of 2888 2764 btbbbb.exe 35 PID 2764 wrote to memory of 2888 2764 btbbbb.exe 35 PID 2888 wrote to memory of 2756 2888 ppvvd.exe 36 PID 2888 wrote to memory of 2756 2888 ppvvd.exe 36 PID 2888 wrote to memory of 2756 2888 ppvvd.exe 36 PID 2888 wrote to memory of 2756 2888 ppvvd.exe 36 PID 2756 wrote to memory of 2784 2756 vvvjv.exe 37 PID 2756 wrote to memory of 2784 2756 vvvjv.exe 37 PID 2756 wrote to memory of 2784 2756 vvvjv.exe 37 PID 2756 wrote to memory of 2784 2756 vvvjv.exe 37 PID 2784 wrote to memory of 2648 2784 3bthtt.exe 38 PID 2784 wrote to memory of 2648 2784 3bthtt.exe 38 PID 2784 wrote to memory of 2648 2784 3bthtt.exe 38 PID 2784 wrote to memory of 2648 2784 3bthtt.exe 38 PID 2648 wrote to memory of 2668 2648 btnbnb.exe 39 PID 2648 wrote to memory of 2668 2648 btnbnb.exe 39 PID 2648 wrote to memory of 2668 2648 btnbnb.exe 39 PID 2648 wrote to memory of 2668 2648 btnbnb.exe 39 PID 2668 wrote to memory of 2652 2668 vpjpj.exe 40 PID 2668 wrote to memory of 2652 2668 vpjpj.exe 40 PID 2668 wrote to memory of 2652 2668 vpjpj.exe 40 PID 2668 wrote to memory of 2652 2668 vpjpj.exe 40 PID 2652 wrote to memory of 2356 2652 3pppj.exe 41 PID 2652 wrote to memory of 2356 2652 3pppj.exe 41 PID 2652 wrote to memory of 2356 2652 3pppj.exe 41 PID 2652 wrote to memory of 2356 2652 3pppj.exe 41 PID 2356 wrote to memory of 552 2356 9tntth.exe 42 PID 2356 wrote to memory of 552 2356 9tntth.exe 42 PID 2356 wrote to memory of 552 2356 9tntth.exe 42 PID 2356 wrote to memory of 552 2356 9tntth.exe 42 PID 552 wrote to memory of 572 552 nbbbhb.exe 43 PID 552 wrote to memory of 572 552 nbbbhb.exe 43 PID 552 wrote to memory of 572 552 nbbbhb.exe 43 PID 552 wrote to memory of 572 552 nbbbhb.exe 43 PID 572 wrote to memory of 2968 572 7vvjv.exe 44 PID 572 wrote to memory of 2968 572 7vvjv.exe 44 PID 572 wrote to memory of 2968 572 7vvjv.exe 44 PID 572 wrote to memory of 2968 572 7vvjv.exe 44 PID 2968 wrote to memory of 2680 2968 xlffrlx.exe 45 PID 2968 wrote to memory of 2680 2968 xlffrlx.exe 45 PID 2968 wrote to memory of 2680 2968 xlffrlx.exe 45 PID 2968 wrote to memory of 2680 2968 xlffrlx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe"C:\Users\Admin\AppData\Local\Temp\0ae88a47521e7decbbc43087e1eefddab210a90408de5bbb52775515b1bdd295N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bhhbbh.exec:\bhhbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\thnhnb.exec:\thnhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jppjj.exec:\jppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7lflrxf.exec:\7lflrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\btbbbb.exec:\btbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ppvvd.exec:\ppvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vvvjv.exec:\vvvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\3bthtt.exec:\3bthtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\btnbnb.exec:\btnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vpjpj.exec:\vpjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3pppj.exec:\3pppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\9tntth.exec:\9tntth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\nbbbhb.exec:\nbbbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\7vvjv.exec:\7vvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\xlffrlx.exec:\xlffrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\httbht.exec:\httbht.exe17⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bhhbhh.exec:\bhhbhh.exe18⤵
- Executes dropped EXE
PID:752 -
\??\c:\jjdvd.exec:\jjdvd.exe19⤵
- Executes dropped EXE
PID:332 -
\??\c:\xrfxrrf.exec:\xrfxrrf.exe20⤵
- Executes dropped EXE
PID:1892 -
\??\c:\1bhbtn.exec:\1bhbtn.exe21⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ppjvp.exec:\ppjvp.exe22⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xflrxrl.exec:\xflrxrl.exe23⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5xlxllx.exec:\5xlxllx.exe24⤵
- Executes dropped EXE
PID:1012 -
\??\c:\btnnth.exec:\btnnth.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\btbbhn.exec:\btbbhn.exe26⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvjvd.exec:\dvjvd.exe27⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\rfrfxfx.exec:\rfrfxfx.exe29⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbthnn.exec:\hbthnn.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7dpvj.exec:\7dpvj.exe31⤵
- Executes dropped EXE
PID:688 -
\??\c:\frxxxxl.exec:\frxxxxl.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5rrrfrx.exec:\5rrrfrx.exe33⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tnhthn.exec:\tnhthn.exe34⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nnbbbh.exec:\nnbbbh.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pddjj.exec:\pddjj.exe36⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xrxllfx.exec:\xrxllfx.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\llfxffr.exec:\llfxffr.exe38⤵
- Executes dropped EXE
PID:836 -
\??\c:\bbtbhh.exec:\bbtbhh.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5bnthh.exec:\5bnthh.exe40⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvpvv.exec:\pvpvv.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804 -
\??\c:\1ddpv.exec:\1ddpv.exe42⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxlfllx.exec:\fxlfllx.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7xrfrxl.exec:\7xrfrxl.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbtbhn.exec:\hbtbhn.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hhthht.exec:\hhthht.exe46⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pvjdj.exec:\pvjdj.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfxrflr.exec:\lfxrflr.exe48⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1xffxxl.exec:\1xffxxl.exe49⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xxrxrxf.exec:\xxrxrxf.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hthhbb.exec:\hthhbb.exe51⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ttnbht.exec:\ttnbht.exe52⤵
- Executes dropped EXE
PID:476 -
\??\c:\vjddd.exec:\vjddd.exe53⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vppdj.exec:\vppdj.exe54⤵
- Executes dropped EXE
PID:552 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe55⤵
- Executes dropped EXE
PID:812 -
\??\c:\1xlfrfr.exec:\1xlfrfr.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nbnhnh.exec:\nbnhnh.exe57⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe58⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lfrrlff.exec:\lfrrlff.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\bnhnbh.exec:\bnhnbh.exe60⤵
- Executes dropped EXE
PID:752 -
\??\c:\bhthbh.exec:\bhthbh.exe61⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jjdjp.exec:\jjdjp.exe62⤵
- Executes dropped EXE
PID:1220 -
\??\c:\7lxrxxl.exec:\7lxrxxl.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lllxxxx.exec:\lllxxxx.exe64⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1hnbtb.exec:\1hnbtb.exe65⤵
- Executes dropped EXE
PID:2092 -
\??\c:\tthbbh.exec:\tthbbh.exe66⤵PID:2288
-
\??\c:\ppdvv.exec:\ppdvv.exe67⤵PID:2420
-
\??\c:\rxfflxx.exec:\rxfflxx.exe68⤵PID:2388
-
\??\c:\lfrflrf.exec:\lfrflrf.exe69⤵PID:2400
-
\??\c:\bbhhht.exec:\bbhhht.exe70⤵PID:2208
-
\??\c:\hbnhht.exec:\hbnhht.exe71⤵PID:1680
-
\??\c:\jpdpv.exec:\jpdpv.exe72⤵PID:1912
-
\??\c:\jpvjp.exec:\jpvjp.exe73⤵PID:1488
-
\??\c:\flrlxll.exec:\flrlxll.exe74⤵PID:744
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe75⤵PID:3056
-
\??\c:\tnttbn.exec:\tnttbn.exe76⤵PID:1956
-
\??\c:\7bbnnt.exec:\7bbnnt.exe77⤵PID:2052
-
\??\c:\dpvvj.exec:\dpvvj.exe78⤵PID:1796
-
\??\c:\djppv.exec:\djppv.exe79⤵PID:1644
-
\??\c:\llfllxx.exec:\llfllxx.exe80⤵PID:2024
-
\??\c:\xllrfrf.exec:\xllrfrf.exe81⤵PID:2532
-
\??\c:\9ntbbn.exec:\9ntbbn.exe82⤵PID:1600
-
\??\c:\1nnbht.exec:\1nnbht.exe83⤵PID:1212
-
\??\c:\tbbtnh.exec:\tbbtnh.exe84⤵PID:1536
-
\??\c:\1dvvj.exec:\1dvvj.exe85⤵PID:1652
-
\??\c:\flfxlrx.exec:\flfxlrx.exe86⤵PID:2156
-
\??\c:\xlrrxfr.exec:\xlrrxfr.exe87⤵PID:2772
-
\??\c:\hhnthn.exec:\hhnthn.exe88⤵PID:2804
-
\??\c:\tbtnbn.exec:\tbtnbn.exe89⤵PID:2868
-
\??\c:\pppjj.exec:\pppjj.exe90⤵PID:2776
-
\??\c:\xfrllrl.exec:\xfrllrl.exe91⤵PID:2888
-
\??\c:\lxllrrx.exec:\lxllrrx.exe92⤵PID:2748
-
\??\c:\btbbtb.exec:\btbbtb.exe93⤵PID:2756
-
\??\c:\1nbhhn.exec:\1nbhhn.exe94⤵PID:2844
-
\??\c:\ddjdj.exec:\ddjdj.exe95⤵PID:2676
-
\??\c:\vpdjp.exec:\vpdjp.exe96⤵PID:2640
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe97⤵PID:2700
-
\??\c:\7tnhbn.exec:\7tnhbn.exe98⤵PID:1512
-
\??\c:\bnbthh.exec:\bnbthh.exe99⤵PID:1444
-
\??\c:\vdpjj.exec:\vdpjj.exe100⤵PID:2824
-
\??\c:\vvpdp.exec:\vvpdp.exe101⤵PID:704
-
\??\c:\ffrfllx.exec:\ffrfllx.exe102⤵PID:1588
-
\??\c:\5fflxrf.exec:\5fflxrf.exe103⤵PID:1064
-
\??\c:\nhnbbh.exec:\nhnbbh.exe104⤵PID:796
-
\??\c:\5bthth.exec:\5bthth.exe105⤵PID:328
-
\??\c:\djpdj.exec:\djpdj.exe106⤵PID:756
-
\??\c:\jjpdj.exec:\jjpdj.exe107⤵PID:2040
-
\??\c:\9pddj.exec:\9pddj.exe108⤵PID:2036
-
\??\c:\frlrrrx.exec:\frlrrrx.exe109⤵PID:1568
-
\??\c:\fxlrflr.exec:\fxlrflr.exe110⤵PID:2352
-
\??\c:\nnhtht.exec:\nnhtht.exe111⤵PID:2996
-
\??\c:\hnhbnb.exec:\hnhbnb.exe112⤵PID:2416
-
\??\c:\dvdvd.exec:\dvdvd.exe113⤵PID:2056
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe114⤵PID:1640
-
\??\c:\xrfrxxl.exec:\xrfrxxl.exe115⤵PID:1732
-
\??\c:\7bthhh.exec:\7bthhh.exe116⤵PID:2572
-
\??\c:\vddvp.exec:\vddvp.exe117⤵PID:956
-
\??\c:\ppjjp.exec:\ppjjp.exe118⤵PID:1612
-
\??\c:\lxfffrf.exec:\lxfffrf.exe119⤵PID:2920
-
\??\c:\5xrfxfr.exec:\5xrfxfr.exe120⤵PID:2484
-
\??\c:\1nnnhn.exec:\1nnnhn.exe121⤵PID:1700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-