Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 06:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe
-
Size
454KB
-
MD5
17962242910e85ff3b8ed6723e72cb30
-
SHA1
276766fb1af728e03e0672b868bae7024c3d21b1
-
SHA256
470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9
-
SHA512
4f3aeed5f9ff18e8367cf96fd8aa685036c434f4418b81c03d21636a5cdbb2d1a70a8f91a68d3cae71c37eb1641275bbdea4778e0b46a5e01449f026b2c77f3f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-234-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-547-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2996-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-691-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1496-768-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2720-798-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 djpjp.exe 2760 xfrxlrf.exe 2664 lfxlxfx.exe 2820 tthhbh.exe 2276 5dvvd.exe 2756 7jvvj.exe 2616 lxllxlr.exe 2332 nbhtbt.exe 2196 ffrfrlf.exe 1104 ddddj.exe 2904 frxxxxf.exe 1228 rrxxxxl.exe 864 7bttht.exe 2012 xflrfrr.exe 944 ntbhhn.exe 2364 ffllffx.exe 1632 bthtnh.exe 2304 nbtnnh.exe 2100 dppdv.exe 1944 bbhntb.exe 2856 pvjdd.exe 816 jjvdp.exe 1916 xfrllrf.exe 1928 5hbhbh.exe 1448 bhbhnb.exe 2456 ffrxlxf.exe 2144 hnbbnn.exe 1052 bbnnhn.exe 2492 pdjdd.exe 1528 hhthnt.exe 2328 xxffflf.exe 1604 hnbhtb.exe 2776 vvvpd.exe 2876 lrlrfrf.exe 2200 tbtbht.exe 2784 ddjjp.exe 2752 lrxxllr.exe 2652 7hbbtb.exe 2536 bbhhth.exe 2960 vvddp.exe 2288 xxlrxlf.exe 464 ntnhth.exe 2332 jvjdp.exe 2980 7rlrxll.exe 2896 thnhtb.exe 1424 3nnhht.exe 2428 3pppv.exe 1228 rxfxxfl.exe 296 3thhnb.exe 1092 ppvvj.exe 432 xfrxfrf.exe 1952 ttntbh.exe 3044 btnntb.exe 688 vdppd.exe 3012 1lfflrx.exe 2344 pvjpj.exe 1904 jddpj.exe 632 flxxxfl.exe 912 hnnbnt.exe 1324 jdpvv.exe 2092 fflxrlf.exe 1660 1htbhn.exe 1368 ddpvj.exe 1064 7jjvd.exe -
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-144-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2364-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-234-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2456-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-777-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 3052 2488 470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe 30 PID 2488 wrote to memory of 3052 2488 470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe 30 PID 2488 wrote to memory of 3052 2488 470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe 30 PID 2488 wrote to memory of 3052 2488 470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe 30 PID 3052 wrote to memory of 2760 3052 djpjp.exe 31 PID 3052 wrote to memory of 2760 3052 djpjp.exe 31 PID 3052 wrote to memory of 2760 3052 djpjp.exe 31 PID 3052 wrote to memory of 2760 3052 djpjp.exe 31 PID 2760 wrote to memory of 2664 2760 xfrxlrf.exe 32 PID 2760 wrote to memory of 2664 2760 xfrxlrf.exe 32 PID 2760 wrote to memory of 2664 2760 xfrxlrf.exe 32 PID 2760 wrote to memory of 2664 2760 xfrxlrf.exe 32 PID 2664 wrote to memory of 2820 2664 lfxlxfx.exe 33 PID 2664 wrote to memory of 2820 2664 lfxlxfx.exe 33 PID 2664 wrote to memory of 2820 2664 lfxlxfx.exe 33 PID 2664 wrote to memory of 2820 2664 lfxlxfx.exe 33 PID 2820 wrote to memory of 2276 2820 tthhbh.exe 34 PID 2820 wrote to memory of 2276 2820 tthhbh.exe 34 PID 2820 wrote to memory of 2276 2820 tthhbh.exe 34 PID 2820 wrote to memory of 2276 2820 tthhbh.exe 34 PID 2276 wrote to memory of 2756 2276 5dvvd.exe 35 PID 2276 wrote to memory of 2756 2276 5dvvd.exe 35 PID 2276 wrote to memory of 2756 2276 5dvvd.exe 35 PID 2276 wrote to memory of 2756 2276 5dvvd.exe 35 PID 2756 wrote to memory of 2616 2756 7jvvj.exe 36 PID 2756 wrote to memory of 2616 2756 7jvvj.exe 36 PID 2756 wrote to memory of 2616 2756 7jvvj.exe 36 PID 2756 wrote to memory of 2616 2756 7jvvj.exe 36 PID 2616 wrote to memory of 2332 2616 lxllxlr.exe 37 PID 2616 wrote to memory of 2332 2616 lxllxlr.exe 37 PID 2616 wrote to memory of 2332 2616 lxllxlr.exe 37 PID 2616 wrote to memory of 2332 2616 lxllxlr.exe 37 PID 2332 wrote to memory of 2196 2332 nbhtbt.exe 38 PID 2332 wrote to memory of 2196 2332 nbhtbt.exe 38 PID 2332 wrote to memory of 2196 2332 nbhtbt.exe 38 PID 2332 wrote to memory of 2196 2332 nbhtbt.exe 38 PID 2196 wrote to memory of 1104 2196 ffrfrlf.exe 39 PID 2196 wrote to memory of 1104 2196 ffrfrlf.exe 39 PID 2196 wrote to memory of 1104 2196 ffrfrlf.exe 39 PID 2196 wrote to memory of 1104 2196 ffrfrlf.exe 39 PID 1104 wrote to memory of 2904 1104 ddddj.exe 40 PID 1104 wrote to memory of 2904 1104 ddddj.exe 40 PID 1104 wrote to memory of 2904 1104 ddddj.exe 40 PID 1104 wrote to memory of 2904 1104 ddddj.exe 40 PID 2904 wrote to memory of 1228 2904 frxxxxf.exe 41 PID 2904 wrote to memory of 1228 2904 frxxxxf.exe 41 PID 2904 wrote to memory of 1228 2904 frxxxxf.exe 41 PID 2904 wrote to memory of 1228 2904 frxxxxf.exe 41 PID 1228 wrote to memory of 864 1228 rrxxxxl.exe 42 PID 1228 wrote to memory of 864 1228 rrxxxxl.exe 42 PID 1228 wrote to memory of 864 1228 rrxxxxl.exe 42 PID 1228 wrote to memory of 864 1228 rrxxxxl.exe 42 PID 864 wrote to memory of 2012 864 7bttht.exe 43 PID 864 wrote to memory of 2012 864 7bttht.exe 43 PID 864 wrote to memory of 2012 864 7bttht.exe 43 PID 864 wrote to memory of 2012 864 7bttht.exe 43 PID 2012 wrote to memory of 944 2012 xflrfrr.exe 44 PID 2012 wrote to memory of 944 2012 xflrfrr.exe 44 PID 2012 wrote to memory of 944 2012 xflrfrr.exe 44 PID 2012 wrote to memory of 944 2012 xflrfrr.exe 44 PID 944 wrote to memory of 2364 944 ntbhhn.exe 45 PID 944 wrote to memory of 2364 944 ntbhhn.exe 45 PID 944 wrote to memory of 2364 944 ntbhhn.exe 45 PID 944 wrote to memory of 2364 944 ntbhhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe"C:\Users\Admin\AppData\Local\Temp\470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\djpjp.exec:\djpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\xfrxlrf.exec:\xfrxlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tthhbh.exec:\tthhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\5dvvd.exec:\5dvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\7jvvj.exec:\7jvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lxllxlr.exec:\lxllxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nbhtbt.exec:\nbhtbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\ffrfrlf.exec:\ffrfrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ddddj.exec:\ddddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\frxxxxf.exec:\frxxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rrxxxxl.exec:\rrxxxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\7bttht.exec:\7bttht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\xflrfrr.exec:\xflrfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\ntbhhn.exec:\ntbhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\ffllffx.exec:\ffllffx.exe17⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bthtnh.exec:\bthtnh.exe18⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nbtnnh.exec:\nbtnnh.exe19⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dppdv.exec:\dppdv.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bbhntb.exec:\bbhntb.exe21⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pvjdd.exec:\pvjdd.exe22⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jjvdp.exec:\jjvdp.exe23⤵
- Executes dropped EXE
PID:816 -
\??\c:\xfrllrf.exec:\xfrllrf.exe24⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5hbhbh.exec:\5hbhbh.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bhbhnb.exec:\bhbhnb.exe26⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ffrxlxf.exec:\ffrxlxf.exe27⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hnbbnn.exec:\hnbbnn.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\bbnnhn.exec:\bbnnhn.exe29⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pdjdd.exec:\pdjdd.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hhthnt.exec:\hhthnt.exe31⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xxffflf.exec:\xxffflf.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hnbhtb.exec:\hnbhtb.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vvvpd.exec:\vvvpd.exe34⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lrlrfrf.exec:\lrlrfrf.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tbtbht.exec:\tbtbht.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ddjjp.exec:\ddjjp.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lrxxllr.exec:\lrxxllr.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7hbbtb.exec:\7hbbtb.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bbhhth.exec:\bbhhth.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vvddp.exec:\vvddp.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xxlrxlf.exec:\xxlrxlf.exe42⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ntnhth.exec:\ntnhth.exe43⤵
- Executes dropped EXE
PID:464 -
\??\c:\jvjdp.exec:\jvjdp.exe44⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7rlrxll.exec:\7rlrxll.exe45⤵
- Executes dropped EXE
PID:2980 -
\??\c:\thnhtb.exec:\thnhtb.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3nnhht.exec:\3nnhht.exe47⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3pppv.exec:\3pppv.exe48⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rxfxxfl.exec:\rxfxxfl.exe49⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3thhnb.exec:\3thhnb.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:296 -
\??\c:\ppvvj.exec:\ppvvj.exe51⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xfrxfrf.exec:\xfrxfrf.exe52⤵
- Executes dropped EXE
PID:432 -
\??\c:\ttntbh.exec:\ttntbh.exe53⤵
- Executes dropped EXE
PID:1952 -
\??\c:\btnntb.exec:\btnntb.exe54⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vdppd.exec:\vdppd.exe55⤵
- Executes dropped EXE
PID:688 -
\??\c:\1lfflrx.exec:\1lfflrx.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pvjpj.exec:\pvjpj.exe57⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jddpj.exec:\jddpj.exe58⤵
- Executes dropped EXE
PID:1904 -
\??\c:\flxxxfl.exec:\flxxxfl.exe59⤵
- Executes dropped EXE
PID:632 -
\??\c:\hnnbnt.exec:\hnnbnt.exe60⤵
- Executes dropped EXE
PID:912 -
\??\c:\jdpvv.exec:\jdpvv.exe61⤵
- Executes dropped EXE
PID:1324 -
\??\c:\fflxrlf.exec:\fflxrlf.exe62⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1htbhn.exec:\1htbhn.exe63⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ddpvj.exec:\ddpvj.exe64⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7jjvd.exec:\7jjvd.exe65⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rxxrflx.exec:\rxxrflx.exe66⤵PID:3036
-
\??\c:\tbhnbn.exec:\tbhnbn.exe67⤵PID:2500
-
\??\c:\djdpd.exec:\djdpd.exe68⤵PID:2416
-
\??\c:\jjdpj.exec:\jjdpj.exe69⤵PID:756
-
\??\c:\xlrxrlx.exec:\xlrxrlx.exe70⤵PID:2148
-
\??\c:\nthntb.exec:\nthntb.exe71⤵PID:1640
-
\??\c:\djppv.exec:\djppv.exe72⤵PID:2492
-
\??\c:\lxflxlf.exec:\lxflxlf.exe73⤵PID:2260
-
\??\c:\tbtbnt.exec:\tbtbnt.exe74⤵PID:2744
-
\??\c:\vddpj.exec:\vddpj.exe75⤵PID:2328
-
\??\c:\lxrxflx.exec:\lxrxflx.exe76⤵PID:3052
-
\??\c:\tttbtt.exec:\tttbtt.exe77⤵PID:2792
-
\??\c:\1ddjp.exec:\1ddjp.exe78⤵PID:2672
-
\??\c:\5lfxfrf.exec:\5lfxfrf.exe79⤵PID:2944
-
\??\c:\fxxxffr.exec:\fxxxffr.exe80⤵PID:2832
-
\??\c:\nbhttt.exec:\nbhttt.exe81⤵PID:2996
-
\??\c:\jvjpd.exec:\jvjpd.exe82⤵PID:2676
-
\??\c:\7fxxxfl.exec:\7fxxxfl.exe83⤵PID:3008
-
\??\c:\3tthhh.exec:\3tthhh.exe84⤵PID:2600
-
\??\c:\ddjjp.exec:\ddjjp.exe85⤵PID:1896
-
\??\c:\1fflrfr.exec:\1fflrfr.exe86⤵PID:1380
-
\??\c:\fxxllrl.exec:\fxxllrl.exe87⤵PID:1416
-
\??\c:\7hhhbt.exec:\7hhhbt.exe88⤵PID:2096
-
\??\c:\vvvjp.exec:\vvvjp.exe89⤵PID:1104
-
\??\c:\7llxflx.exec:\7llxflx.exe90⤵PID:3020
-
\??\c:\ntbhhn.exec:\ntbhhn.exe91⤵PID:2436
-
\??\c:\vvjjj.exec:\vvjjj.exe92⤵PID:648
-
\??\c:\llxrxxx.exec:\llxrxxx.exe93⤵PID:864
-
\??\c:\bbnntb.exec:\bbnntb.exe94⤵PID:1752
-
\??\c:\9vpdj.exec:\9vpdj.exe95⤵PID:1524
-
\??\c:\vvjvj.exec:\vvjvj.exe96⤵PID:1328
-
\??\c:\ntnthn.exec:\ntnthn.exe97⤵PID:1624
-
\??\c:\ddvdd.exec:\ddvdd.exe98⤵PID:1080
-
\??\c:\9fxrrrr.exec:\9fxrrrr.exe99⤵PID:1652
-
\??\c:\hhntbh.exec:\hhntbh.exe100⤵PID:1628
-
\??\c:\ppvvv.exec:\ppvvv.exe101⤵
- System Location Discovery: System Language Discovery
PID:1596 -
\??\c:\vdvvj.exec:\vdvvj.exe102⤵PID:928
-
\??\c:\ffxxflr.exec:\ffxxflr.exe103⤵PID:1496
-
\??\c:\hnbnbn.exec:\hnbnbn.exe104⤵PID:2720
-
\??\c:\ddvpv.exec:\ddvpv.exe105⤵PID:820
-
\??\c:\lfxlrrl.exec:\lfxlrrl.exe106⤵PID:2092
-
\??\c:\lrflxlr.exec:\lrflxlr.exe107⤵PID:1660
-
\??\c:\tthtnt.exec:\tthtnt.exe108⤵PID:1368
-
\??\c:\9rfrrff.exec:\9rfrrff.exe109⤵PID:696
-
\??\c:\5fflflr.exec:\5fflflr.exe110⤵PID:2464
-
\??\c:\3btbnt.exec:\3btbnt.exe111⤵PID:2920
-
\??\c:\1vppv.exec:\1vppv.exe112⤵PID:2472
-
\??\c:\vvdjv.exec:\vvdjv.exe113⤵PID:1432
-
\??\c:\rxfxffl.exec:\rxfxffl.exe114⤵PID:1892
-
\??\c:\3bnthn.exec:\3bnthn.exe115⤵PID:1484
-
\??\c:\ppjvp.exec:\ppjvp.exe116⤵PID:1528
-
\??\c:\xxxffff.exec:\xxxffff.exe117⤵PID:2260
-
\??\c:\7htbhn.exec:\7htbhn.exe118⤵PID:2648
-
\??\c:\htnthn.exec:\htnthn.exe119⤵PID:2680
-
\??\c:\9vppj.exec:\9vppj.exe120⤵PID:2128
-
\??\c:\9lxrrxf.exec:\9lxrrxf.exe121⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-