Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
-
Size
453KB
-
MD5
754089979729cc9c5832818547315a06
-
SHA1
7e234f66e8c0ff49ea0ff5c2aad5ec2b963756b0
-
SHA256
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4
-
SHA512
ef310ffeee73e80a1afee43bc121128cf43c2e0008e6d2b8a0b01451c3b1c8da53b11e4236e7029332e7fcca02aa8f4e61cf29eab62a1876f605abb51a9c8573
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-96-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-188-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1300-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-401-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1372-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-546-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/996-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-645-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1072-702-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2768-866-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 9hnbtt.exe 2752 jvpjj.exe 2792 vpdjp.exe 2576 frllflf.exe 2604 nbnnht.exe 2580 ddvjd.exe 2184 7xxlrxf.exe 1492 ttbnth.exe 2336 5jvjj.exe 2728 flrflxx.exe 2888 ddjdj.exe 1392 frrfrxl.exe 2588 btttht.exe 1968 fffrrff.exe 2016 jvppj.exe 320 ffxlrxx.exe 2100 5pjdj.exe 2092 nnhttb.exe 2976 dvpvd.exe 2436 7tnbbt.exe 1300 tnhnhn.exe 896 xrrfxrl.exe 752 5hhtbh.exe 2508 7vdjd.exe 1780 5hbnbh.exe 268 3jjjj.exe 2484 3bbbth.exe 2180 vpdvp.exe 1520 rllrfrf.exe 1748 xrlrflf.exe 2452 3tbtnb.exe 2512 3xxlfxl.exe 2760 tthnbn.exe 1576 vdjdv.exe 2696 xfrfxff.exe 2752 1hhtnt.exe 2744 vvvpj.exe 2720 xxlxlxl.exe 2592 1tttbb.exe 2620 hbbhnt.exe 3040 jjjpj.exe 1108 tnhntb.exe 3032 nnhtbh.exe 2956 dddjv.exe 2564 fxlllrf.exe 2140 1nhnbh.exe 1052 3jdjp.exe 2448 xrrrffr.exe 1216 5fxfrrx.exe 2000 1bntnn.exe 1372 1vpvd.exe 1076 7xxflrl.exe 2352 tthtnt.exe 2016 5tnnnn.exe 1760 jvpvp.exe 2372 rlrfxrl.exe 1068 7hbbhn.exe 2940 5dppv.exe 1932 fxlxxxr.exe 280 nhhhnt.exe 880 vpddv.exe 848 1dvdd.exe 904 9lxxrrx.exe 752 hbtnbb.exe -
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-645-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1944-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-702-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/780-722-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2412-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-879-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxlfrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2696 2196 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 30 PID 2196 wrote to memory of 2696 2196 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 30 PID 2196 wrote to memory of 2696 2196 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 30 PID 2196 wrote to memory of 2696 2196 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 30 PID 2696 wrote to memory of 2752 2696 9hnbtt.exe 31 PID 2696 wrote to memory of 2752 2696 9hnbtt.exe 31 PID 2696 wrote to memory of 2752 2696 9hnbtt.exe 31 PID 2696 wrote to memory of 2752 2696 9hnbtt.exe 31 PID 2752 wrote to memory of 2792 2752 jvpjj.exe 32 PID 2752 wrote to memory of 2792 2752 jvpjj.exe 32 PID 2752 wrote to memory of 2792 2752 jvpjj.exe 32 PID 2752 wrote to memory of 2792 2752 jvpjj.exe 32 PID 2792 wrote to memory of 2576 2792 vpdjp.exe 33 PID 2792 wrote to memory of 2576 2792 vpdjp.exe 33 PID 2792 wrote to memory of 2576 2792 vpdjp.exe 33 PID 2792 wrote to memory of 2576 2792 vpdjp.exe 33 PID 2576 wrote to memory of 2604 2576 frllflf.exe 34 PID 2576 wrote to memory of 2604 2576 frllflf.exe 34 PID 2576 wrote to memory of 2604 2576 frllflf.exe 34 PID 2576 wrote to memory of 2604 2576 frllflf.exe 34 PID 2604 wrote to memory of 2580 2604 nbnnht.exe 35 PID 2604 wrote to memory of 2580 2604 nbnnht.exe 35 PID 2604 wrote to memory of 2580 2604 nbnnht.exe 35 PID 2604 wrote to memory of 2580 2604 nbnnht.exe 35 PID 2580 wrote to memory of 2184 2580 ddvjd.exe 36 PID 2580 wrote to memory of 2184 2580 ddvjd.exe 36 PID 2580 wrote to memory of 2184 2580 ddvjd.exe 36 PID 2580 wrote to memory of 2184 2580 ddvjd.exe 36 PID 2184 wrote to memory of 1492 2184 7xxlrxf.exe 37 PID 2184 wrote to memory of 1492 2184 7xxlrxf.exe 37 PID 2184 wrote to memory of 1492 2184 7xxlrxf.exe 37 PID 2184 wrote to memory of 1492 2184 7xxlrxf.exe 37 PID 1492 wrote to memory of 2336 1492 ttbnth.exe 38 PID 1492 wrote to memory of 2336 1492 ttbnth.exe 38 PID 1492 wrote to memory of 2336 1492 ttbnth.exe 38 PID 1492 wrote to memory of 2336 1492 ttbnth.exe 38 PID 2336 wrote to memory of 2728 2336 5jvjj.exe 39 PID 2336 wrote to memory of 2728 2336 5jvjj.exe 39 PID 2336 wrote to memory of 2728 2336 5jvjj.exe 39 PID 2336 wrote to memory of 2728 2336 5jvjj.exe 39 PID 2728 wrote to memory of 2888 2728 flrflxx.exe 40 PID 2728 wrote to memory of 2888 2728 flrflxx.exe 40 PID 2728 wrote to memory of 2888 2728 flrflxx.exe 40 PID 2728 wrote to memory of 2888 2728 flrflxx.exe 40 PID 2888 wrote to memory of 1392 2888 ddjdj.exe 41 PID 2888 wrote to memory of 1392 2888 ddjdj.exe 41 PID 2888 wrote to memory of 1392 2888 ddjdj.exe 41 PID 2888 wrote to memory of 1392 2888 ddjdj.exe 41 PID 1392 wrote to memory of 2588 1392 frrfrxl.exe 42 PID 1392 wrote to memory of 2588 1392 frrfrxl.exe 42 PID 1392 wrote to memory of 2588 1392 frrfrxl.exe 42 PID 1392 wrote to memory of 2588 1392 frrfrxl.exe 42 PID 2588 wrote to memory of 1968 2588 btttht.exe 43 PID 2588 wrote to memory of 1968 2588 btttht.exe 43 PID 2588 wrote to memory of 1968 2588 btttht.exe 43 PID 2588 wrote to memory of 1968 2588 btttht.exe 43 PID 1968 wrote to memory of 2016 1968 fffrrff.exe 44 PID 1968 wrote to memory of 2016 1968 fffrrff.exe 44 PID 1968 wrote to memory of 2016 1968 fffrrff.exe 44 PID 1968 wrote to memory of 2016 1968 fffrrff.exe 44 PID 2016 wrote to memory of 320 2016 jvppj.exe 45 PID 2016 wrote to memory of 320 2016 jvppj.exe 45 PID 2016 wrote to memory of 320 2016 jvppj.exe 45 PID 2016 wrote to memory of 320 2016 jvppj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\9hnbtt.exec:\9hnbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jvpjj.exec:\jvpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vpdjp.exec:\vpdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\frllflf.exec:\frllflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nbnnht.exec:\nbnnht.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ddvjd.exec:\ddvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\7xxlrxf.exec:\7xxlrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\ttbnth.exec:\ttbnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\5jvjj.exec:\5jvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\flrflxx.exec:\flrflxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ddjdj.exec:\ddjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\frrfrxl.exec:\frrfrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\btttht.exec:\btttht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\fffrrff.exec:\fffrrff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jvppj.exec:\jvppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\ffxlrxx.exec:\ffxlrxx.exe17⤵
- Executes dropped EXE
PID:320 -
\??\c:\5pjdj.exec:\5pjdj.exe18⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nnhttb.exec:\nnhttb.exe19⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dvpvd.exec:\dvpvd.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7tnbbt.exec:\7tnbbt.exe21⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tnhnhn.exec:\tnhnhn.exe22⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe23⤵
- Executes dropped EXE
PID:896 -
\??\c:\5hhtbh.exec:\5hhtbh.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\7vdjd.exec:\7vdjd.exe25⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5hbnbh.exec:\5hbnbh.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3jjjj.exec:\3jjjj.exe27⤵
- Executes dropped EXE
PID:268 -
\??\c:\3bbbth.exec:\3bbbth.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpdvp.exec:\vpdvp.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rllrfrf.exec:\rllrfrf.exe30⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xrlrflf.exec:\xrlrflf.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3tbtnb.exec:\3tbtnb.exe32⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3xxlfxl.exec:\3xxlfxl.exe33⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tthnbn.exec:\tthnbn.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vdjdv.exec:\vdjdv.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xfrfxff.exec:\xfrfxff.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1hhtnt.exec:\1hhtnt.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vvvpj.exec:\vvvpj.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xxlxlxl.exec:\xxlxlxl.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1tttbb.exec:\1tttbb.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbbhnt.exec:\hbbhnt.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jjjpj.exec:\jjjpj.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tnhntb.exec:\tnhntb.exe43⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nnhtbh.exec:\nnhtbh.exe44⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dddjv.exec:\dddjv.exe45⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxlllrf.exec:\fxlllrf.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1nhnbh.exec:\1nhnbh.exe47⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3jdjp.exec:\3jdjp.exe48⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xrrrffr.exec:\xrrrffr.exe49⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5fxfrrx.exec:\5fxfrrx.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1bntnn.exec:\1bntnn.exe51⤵
- Executes dropped EXE
PID:2000 -
\??\c:\1vpvd.exec:\1vpvd.exe52⤵
- Executes dropped EXE
PID:1372 -
\??\c:\7xxflrl.exec:\7xxflrl.exe53⤵
- Executes dropped EXE
PID:1076 -
\??\c:\tthtnt.exec:\tthtnt.exe54⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5tnnnn.exec:\5tnnnn.exe55⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jvpvp.exec:\jvpvp.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rlrfxrl.exec:\rlrfxrl.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\7hbbhn.exec:\7hbbhn.exe58⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5dppv.exec:\5dppv.exe59⤵
- Executes dropped EXE
PID:2940 -
\??\c:\fxlxxxr.exec:\fxlxxxr.exe60⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nhhhnt.exec:\nhhhnt.exe61⤵
- Executes dropped EXE
PID:280 -
\??\c:\vpddv.exec:\vpddv.exe62⤵
- Executes dropped EXE
PID:880 -
\??\c:\1dvdd.exec:\1dvdd.exe63⤵
- Executes dropped EXE
PID:848 -
\??\c:\9lxxrrx.exec:\9lxxrrx.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\hbtnbb.exec:\hbtnbb.exe65⤵
- Executes dropped EXE
PID:752 -
\??\c:\ppddj.exec:\ppddj.exe66⤵PID:2520
-
\??\c:\vdvjv.exec:\vdvjv.exe67⤵PID:1804
-
\??\c:\rxlrfrx.exec:\rxlrfrx.exe68⤵PID:268
-
\??\c:\tbtbhh.exec:\tbtbhh.exe69⤵PID:1912
-
\??\c:\jjddj.exec:\jjddj.exe70⤵PID:2032
-
\??\c:\1djjp.exec:\1djjp.exe71⤵PID:996
-
\??\c:\3ffllrf.exec:\3ffllrf.exe72⤵PID:2260
-
\??\c:\tnnbht.exec:\tnnbht.exe73⤵PID:308
-
\??\c:\3vjjp.exec:\3vjjp.exe74⤵PID:608
-
\??\c:\vpjjp.exec:\vpjjp.exe75⤵PID:2452
-
\??\c:\rlllrxf.exec:\rlllrxf.exe76⤵PID:2756
-
\??\c:\hbhnhh.exec:\hbhnhh.exe77⤵PID:2760
-
\??\c:\9vppp.exec:\9vppp.exe78⤵PID:2796
-
\??\c:\jjjvp.exec:\jjjvp.exe79⤵PID:2948
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe80⤵PID:2808
-
\??\c:\tntbbb.exec:\tntbbb.exe81⤵PID:1992
-
\??\c:\ddvdp.exec:\ddvdp.exe82⤵PID:2856
-
\??\c:\xxxlflx.exec:\xxxlflx.exe83⤵PID:2604
-
\??\c:\rrlxflf.exec:\rrlxflf.exe84⤵PID:2036
-
\??\c:\7thnth.exec:\7thnth.exe85⤵PID:2184
-
\??\c:\9vdvv.exec:\9vdvv.exe86⤵PID:3048
-
\??\c:\fflrxfx.exec:\fflrxfx.exe87⤵PID:2960
-
\??\c:\7hhntb.exec:\7hhntb.exe88⤵PID:2944
-
\??\c:\ddjjj.exec:\ddjjj.exe89⤵PID:2148
-
\??\c:\fllxrxx.exec:\fllxrxx.exe90⤵PID:1944
-
\??\c:\hnbnht.exec:\hnbnht.exe91⤵PID:2068
-
\??\c:\hhhbnb.exec:\hhhbnb.exe92⤵PID:2264
-
\??\c:\vppvj.exec:\vppvj.exe93⤵PID:1988
-
\??\c:\5lxlrrf.exec:\5lxlrrf.exe94⤵PID:1072
-
\??\c:\nnbhnb.exec:\nnbhnb.exe95⤵PID:408
-
\??\c:\tnbnnb.exec:\tnbnnb.exe96⤵PID:1448
-
\??\c:\jdjvj.exec:\jdjvj.exe97⤵PID:780
-
\??\c:\fflxrxl.exec:\fflxrxl.exe98⤵PID:1508
-
\??\c:\1fflxxl.exec:\1fflxxl.exe99⤵PID:2364
-
\??\c:\7tthth.exec:\7tthth.exe100⤵PID:1040
-
\??\c:\9jdpd.exec:\9jdpd.exe101⤵PID:2104
-
\??\c:\3rffllr.exec:\3rffllr.exe102⤵PID:2236
-
\??\c:\hhhnht.exec:\hhhnht.exe103⤵PID:2436
-
\??\c:\vvpvj.exec:\vvpvj.exe104⤵PID:2328
-
\??\c:\dvppd.exec:\dvppd.exe105⤵PID:2916
-
\??\c:\lrrxflx.exec:\lrrxflx.exe106⤵PID:1692
-
\??\c:\jpjpp.exec:\jpjpp.exe107⤵PID:1896
-
\??\c:\rlxxflr.exec:\rlxxflr.exe108⤵PID:2412
-
\??\c:\hbtnbn.exec:\hbtnbn.exe109⤵PID:1516
-
\??\c:\ttttbh.exec:\ttttbh.exe110⤵PID:1704
-
\??\c:\pjjpd.exec:\pjjpd.exe111⤵PID:376
-
\??\c:\5xrlrfx.exec:\5xrlrfx.exe112⤵PID:372
-
\??\c:\tbbthb.exec:\tbbthb.exe113⤵PID:2492
-
\??\c:\7vpvj.exec:\7vpvj.exe114⤵PID:1656
-
\??\c:\lfxfxlx.exec:\lfxfxlx.exe115⤵PID:564
-
\??\c:\1nnhnt.exec:\1nnhnt.exe116⤵PID:2260
-
\??\c:\9tntth.exec:\9tntth.exe117⤵PID:1808
-
\??\c:\3djpp.exec:\3djpp.exe118⤵PID:2688
-
\??\c:\lxxrxxf.exec:\lxxrxxf.exe119⤵PID:2768
-
\??\c:\3nhtbn.exec:\3nhtbn.exe120⤵PID:1552
-
\??\c:\dvddv.exec:\dvddv.exe121⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-