Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe
-
Size
347KB
-
MD5
f8ebff840a24842dee80e1bf8053cb30
-
SHA1
ffcb7dc4fac230b4dc019b94f4278a5a025cd354
-
SHA256
ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990
-
SHA512
df2abf6b126a7940cb72b4b51a6cba18d829a67c14a1ce0e212c558f07f10076ee1e8c661e8fa5cee1242652127b953d8422b87022fa5a70eeffd8ddd2333d49
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA8:l7TcbWXZshJX2VGd8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2136-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2700-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2872-22-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2872-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2760-38-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2900-47-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2632-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2776-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2624-74-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2160-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/576-92-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2208-103-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-130-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-128-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/1420-149-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2192-167-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1632-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3004-184-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1480-193-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/320-227-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/320-226-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2328-252-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2476-261-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2148-270-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2700-307-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2140-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2600-358-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2664-365-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/112-422-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/628-487-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/760-537-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3032-582-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/3032-581-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/1596-592-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2600-643-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2600-644-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2696-696-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/2796-704-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1876-775-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1052-836-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2416-849-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1804-1037-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1688-1062-0x0000000001B50000-0x0000000001B78000-memory.dmp family_blackmoon behavioral1/memory/1440-1085-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2392-1088-0x0000000000230000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1616-1271-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/2024-1272-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2336-1337-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2336-1336-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1756-1352-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2700 htnnnn.exe 2872 vpppv.exe 2760 lxfxxrr.exe 2900 fxffllx.exe 2632 tbtbtt.exe 2776 vpdjj.exe 2624 xrllrxl.exe 2160 bbttnt.exe 576 xrxxxfl.exe 2208 tntbnn.exe 1636 5vjdp.exe 2956 hhnbtb.exe 2668 3pdvv.exe 2960 3fxxffl.exe 1420 bntbtn.exe 1548 dvdjj.exe 2192 lllxxff.exe 1632 1nbtbb.exe 3004 pdjdd.exe 1480 rlxxflr.exe 2584 tnhntt.exe 1132 jvdjj.exe 1112 nnbnbt.exe 320 jdddd.exe 2300 frxxxxx.exe 2528 bhttbb.exe 2328 jjdvj.exe 2476 rlxxffl.exe 2148 thnhhh.exe 1036 ppddp.exe 284 rrllxxr.exe 2080 nnhntn.exe 2136 1hhtbb.exe 2700 vddjv.exe 2112 nhnhbt.exe 2140 jpvpp.exe 2732 1xfxlrx.exe 2348 htbttn.exe 2916 bhbnbn.exe 2184 pjjjd.exe 2632 3flfxxr.exe 2600 lffflrx.exe 2664 bthhhh.exe 2220 jjpvj.exe 2656 pddvv.exe 2464 rxfrlxx.exe 1784 lxlrrrr.exe 1144 5ttttn.exe 664 jvddd.exe 1396 ddppv.exe 2796 lfrffll.exe 112 btbtbh.exe 2816 3nttnn.exe 1096 jdppv.exe 1128 7vjdv.exe 1652 xxllrlr.exe 356 3nttbb.exe 584 btntbt.exe 2000 7vjjj.exe 2116 rflfxrx.exe 1604 xxxrrxx.exe 628 bhbtbb.exe 2320 nhnnnn.exe 1344 pjppd.exe -
resource yara_rule behavioral1/memory/2700-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2136-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2700-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2872-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2760-38-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2900-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2632-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2776-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2624-74-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2160-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/576-92-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2208-103-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2668-130-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1420-149-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2192-158-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2192-167-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1632-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3004-184-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1480-193-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/320-227-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2328-252-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2476-261-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2148-270-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2700-307-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2140-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-358-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2664-365-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2656-372-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/664-403-0x00000000002C0000-0x00000000002E8000-memory.dmp upx behavioral1/memory/112-422-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2000-461-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/628-487-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/760-537-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/976-576-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1956-593-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-644-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/664-681-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2796-697-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2796-704-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1268-718-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2252-750-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1876-775-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2880-871-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2760-884-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2168-891-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2880-894-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/532-948-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/532-969-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1804-1037-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1688-1062-0x0000000001B50000-0x0000000001B78000-memory.dmp upx behavioral1/memory/2392-1088-0x0000000000230000-0x0000000000258000-memory.dmp upx behavioral1/memory/2884-1135-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2624-1190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3064-1197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2340-1246-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2024-1272-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1804-1317-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2700 2136 ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe 30 PID 2136 wrote to memory of 2700 2136 ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe 30 PID 2136 wrote to memory of 2700 2136 ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe 30 PID 2136 wrote to memory of 2700 2136 ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe 30 PID 2700 wrote to memory of 2872 2700 htnnnn.exe 31 PID 2700 wrote to memory of 2872 2700 htnnnn.exe 31 PID 2700 wrote to memory of 2872 2700 htnnnn.exe 31 PID 2700 wrote to memory of 2872 2700 htnnnn.exe 31 PID 2872 wrote to memory of 2760 2872 vpppv.exe 32 PID 2872 wrote to memory of 2760 2872 vpppv.exe 32 PID 2872 wrote to memory of 2760 2872 vpppv.exe 32 PID 2872 wrote to memory of 2760 2872 vpppv.exe 32 PID 2760 wrote to memory of 2900 2760 lxfxxrr.exe 33 PID 2760 wrote to memory of 2900 2760 lxfxxrr.exe 33 PID 2760 wrote to memory of 2900 2760 lxfxxrr.exe 33 PID 2760 wrote to memory of 2900 2760 lxfxxrr.exe 33 PID 2900 wrote to memory of 2632 2900 fxffllx.exe 34 PID 2900 wrote to memory of 2632 2900 fxffllx.exe 34 PID 2900 wrote to memory of 2632 2900 fxffllx.exe 34 PID 2900 wrote to memory of 2632 2900 fxffllx.exe 34 PID 2632 wrote to memory of 2776 2632 tbtbtt.exe 35 PID 2632 wrote to memory of 2776 2632 tbtbtt.exe 35 PID 2632 wrote to memory of 2776 2632 tbtbtt.exe 35 PID 2632 wrote to memory of 2776 2632 tbtbtt.exe 35 PID 2776 wrote to memory of 2624 2776 vpdjj.exe 36 PID 2776 wrote to memory of 2624 2776 vpdjj.exe 36 PID 2776 wrote to memory of 2624 2776 vpdjj.exe 36 PID 2776 wrote to memory of 2624 2776 vpdjj.exe 36 PID 2624 wrote to memory of 2160 2624 xrllrxl.exe 37 PID 2624 wrote to memory of 2160 2624 xrllrxl.exe 37 PID 2624 wrote to memory of 2160 2624 xrllrxl.exe 37 PID 2624 wrote to memory of 2160 2624 xrllrxl.exe 37 PID 2160 wrote to memory of 576 2160 bbttnt.exe 38 PID 2160 wrote to memory of 576 2160 bbttnt.exe 38 PID 2160 wrote to memory of 576 2160 bbttnt.exe 38 PID 2160 wrote to memory of 576 2160 bbttnt.exe 38 PID 576 wrote to memory of 2208 576 xrxxxfl.exe 39 PID 576 wrote to memory of 2208 576 xrxxxfl.exe 39 PID 576 wrote to memory of 2208 576 xrxxxfl.exe 39 PID 576 wrote to memory of 2208 576 xrxxxfl.exe 39 PID 2208 wrote to memory of 1636 2208 tntbnn.exe 40 PID 2208 wrote to memory of 1636 2208 tntbnn.exe 40 PID 2208 wrote to memory of 1636 2208 tntbnn.exe 40 PID 2208 wrote to memory of 1636 2208 tntbnn.exe 40 PID 1636 wrote to memory of 2956 1636 5vjdp.exe 41 PID 1636 wrote to memory of 2956 1636 5vjdp.exe 41 PID 1636 wrote to memory of 2956 1636 5vjdp.exe 41 PID 1636 wrote to memory of 2956 1636 5vjdp.exe 41 PID 2956 wrote to memory of 2668 2956 hhnbtb.exe 42 PID 2956 wrote to memory of 2668 2956 hhnbtb.exe 42 PID 2956 wrote to memory of 2668 2956 hhnbtb.exe 42 PID 2956 wrote to memory of 2668 2956 hhnbtb.exe 42 PID 2668 wrote to memory of 2960 2668 3pdvv.exe 43 PID 2668 wrote to memory of 2960 2668 3pdvv.exe 43 PID 2668 wrote to memory of 2960 2668 3pdvv.exe 43 PID 2668 wrote to memory of 2960 2668 3pdvv.exe 43 PID 2960 wrote to memory of 1420 2960 3fxxffl.exe 44 PID 2960 wrote to memory of 1420 2960 3fxxffl.exe 44 PID 2960 wrote to memory of 1420 2960 3fxxffl.exe 44 PID 2960 wrote to memory of 1420 2960 3fxxffl.exe 44 PID 1420 wrote to memory of 1548 1420 bntbtn.exe 45 PID 1420 wrote to memory of 1548 1420 bntbtn.exe 45 PID 1420 wrote to memory of 1548 1420 bntbtn.exe 45 PID 1420 wrote to memory of 1548 1420 bntbtn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe"C:\Users\Admin\AppData\Local\Temp\ddaefb0873b8cf91f507398d23a57f33a850e10a0ae5c47358325775e1d34990N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\htnnnn.exec:\htnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vpppv.exec:\vpppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fxffllx.exec:\fxffllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tbtbtt.exec:\tbtbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vpdjj.exec:\vpdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrllrxl.exec:\xrllrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bbttnt.exec:\bbttnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\tntbnn.exec:\tntbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\5vjdp.exec:\5vjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\hhnbtb.exec:\hhnbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\3pdvv.exec:\3pdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3fxxffl.exec:\3fxxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bntbtn.exec:\bntbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\dvdjj.exec:\dvdjj.exe17⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lllxxff.exec:\lllxxff.exe18⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1nbtbb.exec:\1nbtbb.exe19⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pdjdd.exec:\pdjdd.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rlxxflr.exec:\rlxxflr.exe21⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tnhntt.exec:\tnhntt.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jvdjj.exec:\jvdjj.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nnbnbt.exec:\nnbnbt.exe24⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jdddd.exec:\jdddd.exe25⤵
- Executes dropped EXE
PID:320 -
\??\c:\frxxxxx.exec:\frxxxxx.exe26⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bhttbb.exec:\bhttbb.exe27⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jjdvj.exec:\jjdvj.exe28⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rlxxffl.exec:\rlxxffl.exe29⤵
- Executes dropped EXE
PID:2476 -
\??\c:\thnhhh.exec:\thnhhh.exe30⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ppddp.exec:\ppddp.exe31⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rrllxxr.exec:\rrllxxr.exe32⤵
- Executes dropped EXE
PID:284 -
\??\c:\nnhntn.exec:\nnhntn.exe33⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1hhtbb.exec:\1hhtbb.exe34⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vddjv.exec:\vddjv.exe35⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhnhbt.exec:\nhnhbt.exe36⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jpvpp.exec:\jpvpp.exe37⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1xfxlrx.exec:\1xfxlrx.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\htbttn.exec:\htbttn.exe39⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bhbnbn.exec:\bhbnbn.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjjjd.exec:\pjjjd.exe41⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3flfxxr.exec:\3flfxxr.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lffflrx.exec:\lffflrx.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bthhhh.exec:\bthhhh.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jjpvj.exec:\jjpvj.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pddvv.exec:\pddvv.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rxfrlxx.exec:\rxfrlxx.exe47⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe48⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5ttttn.exec:\5ttttn.exe49⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jvddd.exec:\jvddd.exe50⤵
- Executes dropped EXE
PID:664 -
\??\c:\ddppv.exec:\ddppv.exe51⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lfrffll.exec:\lfrffll.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\btbtbh.exec:\btbtbh.exe53⤵
- Executes dropped EXE
PID:112 -
\??\c:\3nttnn.exec:\3nttnn.exe54⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jdppv.exec:\jdppv.exe55⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7vjdv.exec:\7vjdv.exe56⤵
- Executes dropped EXE
PID:1128 -
\??\c:\xxllrlr.exec:\xxllrlr.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3nttbb.exec:\3nttbb.exe58⤵
- Executes dropped EXE
PID:356 -
\??\c:\btntbt.exec:\btntbt.exe59⤵
- Executes dropped EXE
PID:584 -
\??\c:\7vjjj.exec:\7vjjj.exe60⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rflfxrx.exec:\rflfxrx.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xxxrrxx.exec:\xxxrrxx.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bhbtbb.exec:\bhbtbb.exe63⤵
- Executes dropped EXE
PID:628 -
\??\c:\nhnnnn.exec:\nhnnnn.exe64⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pjppd.exec:\pjppd.exe65⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9rfxxrx.exec:\9rfxxrx.exe66⤵PID:292
-
\??\c:\7lxfrrx.exec:\7lxfrrx.exe67⤵PID:1336
-
\??\c:\7httbb.exec:\7httbb.exe68⤵PID:1772
-
\??\c:\7ppjd.exec:\7ppjd.exe69⤵PID:1576
-
\??\c:\vjvvd.exec:\vjvvd.exe70⤵PID:600
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe71⤵PID:760
-
\??\c:\1nttbn.exec:\1nttbn.exe72⤵PID:1252
-
\??\c:\htthbt.exec:\htthbt.exe73⤵PID:1892
-
\??\c:\dpdvv.exec:\dpdvv.exe74⤵PID:976
-
\??\c:\rxlfxff.exec:\rxlfxff.exe75⤵PID:1044
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe76⤵PID:284
-
\??\c:\nbhntb.exec:\nbhntb.exe77⤵PID:2264
-
\??\c:\jjddp.exec:\jjddp.exe78⤵PID:3032
-
\??\c:\dpvvj.exec:\dpvvj.exe79⤵PID:1596
-
\??\c:\xlfrrrx.exec:\xlfrrrx.exe80⤵PID:1956
-
\??\c:\tttbnt.exec:\tttbnt.exe81⤵PID:2888
-
\??\c:\djvvp.exec:\djvvp.exe82⤵PID:2764
-
\??\c:\dpvvv.exec:\dpvvv.exe83⤵PID:2708
-
\??\c:\fxllffl.exec:\fxllffl.exe84⤵PID:2976
-
\??\c:\nbbbhb.exec:\nbbbhb.exe85⤵PID:2184
-
\??\c:\nbhnnh.exec:\nbhnnh.exe86⤵PID:2636
-
\??\c:\jvjvv.exec:\jvjvv.exe87⤵PID:2600
-
\??\c:\dpddp.exec:\dpddp.exe88⤵PID:2016
-
\??\c:\frfxxff.exec:\frfxxff.exe89⤵PID:1944
-
\??\c:\hnbbtn.exec:\hnbbtn.exe90⤵PID:1676
-
\??\c:\hbtbbh.exec:\hbtbbh.exe91⤵PID:2124
-
\??\c:\vpvjv.exec:\vpvjv.exe92⤵PID:1784
-
\??\c:\rflfxrr.exec:\rflfxrr.exe93⤵PID:2572
-
\??\c:\xxflrrf.exec:\xxflrrf.exe94⤵PID:664
-
\??\c:\hhntnn.exec:\hhntnn.exe95⤵PID:2696
-
\??\c:\3djjj.exec:\3djjj.exe96⤵PID:2796
-
\??\c:\vjpvv.exec:\vjpvv.exe97⤵PID:2808
-
\??\c:\xrlflrr.exec:\xrlflrr.exe98⤵PID:764
-
\??\c:\httntt.exec:\httntt.exe99⤵PID:1268
-
\??\c:\ntbhhh.exec:\ntbhhh.exe100⤵PID:564
-
\??\c:\vpdjj.exec:\vpdjj.exe101⤵PID:1788
-
\??\c:\rfxxrrf.exec:\rfxxrrf.exe102⤵PID:832
-
\??\c:\rrllxxl.exec:\rrllxxl.exe103⤵PID:3004
-
\??\c:\hnbtbb.exec:\hnbtbb.exe104⤵PID:2252
-
\??\c:\9bbthh.exec:\9bbthh.exe105⤵PID:1480
-
\??\c:\jjvdp.exec:\jjvdp.exe106⤵PID:448
-
\??\c:\rrllrxl.exec:\rrllrxl.exe107⤵PID:1876
-
\??\c:\rlxxflr.exec:\rlxxflr.exe108⤵PID:1472
-
\??\c:\btbhnn.exec:\btbhnn.exe109⤵PID:1640
-
\??\c:\tntbtb.exec:\tntbtb.exe110⤵PID:2092
-
\??\c:\djvdd.exec:\djvdd.exe111⤵PID:1756
-
\??\c:\vvjjj.exec:\vvjjj.exe112⤵PID:652
-
\??\c:\fxxxflx.exec:\fxxxflx.exe113⤵PID:1568
-
\??\c:\nbtbbb.exec:\nbtbbb.exe114⤵PID:2088
-
\??\c:\tthnbt.exec:\tthnbt.exe115⤵PID:2156
-
\??\c:\9dvdj.exec:\9dvdj.exe116⤵PID:2936
-
\??\c:\vvjpv.exec:\vvjpv.exe117⤵PID:1052
-
\??\c:\fxllrxf.exec:\fxllrxf.exe118⤵PID:1040
-
\??\c:\tnhtbt.exec:\tnhtbt.exe119⤵PID:2416
-
\??\c:\hbnthn.exec:\hbnthn.exe120⤵PID:2444
-
\??\c:\vpdjp.exec:\vpdjp.exe121⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-