Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe
-
Size
454KB
-
MD5
5bdb15a4f914b7ce8d6859308024c80f
-
SHA1
34dffca373535f5cb4c97a085eb0feadfe343e64
-
SHA256
fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9
-
SHA512
67f76913a83e0b45d397acd3adaa23950236cb9e8aee178cb794e996f75861f0e47199788805dfcfd09821ed60b2f2db4a48f809f855a65e22df74b9b7c458d3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2872-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-17-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-112-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2652-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-285-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1496-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-380-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-475-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2472-488-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/464-577-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-703-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-728-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-749-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-921-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-1024-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2820-1167-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-1173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/788-1185-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-1225-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2556-1297-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1776-1318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 9rrfxll.exe 2448 rrfrlrl.exe 1664 vjdjd.exe 2108 lllrfrf.exe 284 hbtttb.exe 1536 pppjj.exe 1656 1bntnt.exe 2984 rxrlxlf.exe 2816 tbtthh.exe 2700 dvjpd.exe 2572 rxxxrfr.exe 2652 bbbnhn.exe 2504 rxflfrf.exe 2532 9hhtnb.exe 1876 jdvvv.exe 2020 rxxfrfr.exe 1944 pvpvj.exe 1292 hthhtt.exe 2308 dvjpd.exe 1704 7tthtn.exe 2784 jjjpj.exe 2320 lffflrf.exe 2180 7hbbtb.exe 684 fllfxfx.exe 1768 bnttbb.exe 944 rrflxfx.exe 376 nhbbnb.exe 1800 bhttbh.exe 1232 7rfrflf.exe 940 jjdvj.exe 3040 3xrfxfr.exe 3016 rllrxfx.exe 624 pppvd.exe 1496 bttnht.exe 2872 jjvjv.exe 884 vvvpd.exe 1588 xrrxrfx.exe 296 5hhtht.exe 2272 bbbhtb.exe 2076 ddpvj.exe 2092 flxlllx.exe 2296 5fxlxlf.exe 284 htbttn.exe 2340 vddvj.exe 2948 djpjj.exe 2688 lxrxfrx.exe 2752 tbttth.exe 2672 1vjvv.exe 2760 3flflxl.exe 2520 rlfrxfx.exe 2280 bbtthn.exe 2556 jjjpj.exe 2928 pjddv.exe 2892 5llrlrx.exe 2444 bbttbb.exe 1708 dvvdv.exe 2900 vdvdd.exe 752 xrrxrxr.exe 1804 ntnnnt.exe 316 ntnbth.exe 1284 pppjv.exe 2472 ffxfxff.exe 1640 nnhhbh.exe 2716 3dvvd.exe -
resource yara_rule behavioral1/memory/2872-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-165-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2308-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-233-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1232-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-380-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2688-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-749-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1852-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-998-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-1025-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-1188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-1227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-1252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-1318-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2916 2872 fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe 28 PID 2872 wrote to memory of 2916 2872 fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe 28 PID 2872 wrote to memory of 2916 2872 fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe 28 PID 2872 wrote to memory of 2916 2872 fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe 28 PID 2916 wrote to memory of 2448 2916 9rrfxll.exe 29 PID 2916 wrote to memory of 2448 2916 9rrfxll.exe 29 PID 2916 wrote to memory of 2448 2916 9rrfxll.exe 29 PID 2916 wrote to memory of 2448 2916 9rrfxll.exe 29 PID 2448 wrote to memory of 1664 2448 rrfrlrl.exe 30 PID 2448 wrote to memory of 1664 2448 rrfrlrl.exe 30 PID 2448 wrote to memory of 1664 2448 rrfrlrl.exe 30 PID 2448 wrote to memory of 1664 2448 rrfrlrl.exe 30 PID 1664 wrote to memory of 2108 1664 vjdjd.exe 31 PID 1664 wrote to memory of 2108 1664 vjdjd.exe 31 PID 1664 wrote to memory of 2108 1664 vjdjd.exe 31 PID 1664 wrote to memory of 2108 1664 vjdjd.exe 31 PID 2108 wrote to memory of 284 2108 lllrfrf.exe 32 PID 2108 wrote to memory of 284 2108 lllrfrf.exe 32 PID 2108 wrote to memory of 284 2108 lllrfrf.exe 32 PID 2108 wrote to memory of 284 2108 lllrfrf.exe 32 PID 284 wrote to memory of 1536 284 hbtttb.exe 33 PID 284 wrote to memory of 1536 284 hbtttb.exe 33 PID 284 wrote to memory of 1536 284 hbtttb.exe 33 PID 284 wrote to memory of 1536 284 hbtttb.exe 33 PID 1536 wrote to memory of 1656 1536 pppjj.exe 34 PID 1536 wrote to memory of 1656 1536 pppjj.exe 34 PID 1536 wrote to memory of 1656 1536 pppjj.exe 34 PID 1536 wrote to memory of 1656 1536 pppjj.exe 34 PID 1656 wrote to memory of 2984 1656 1bntnt.exe 35 PID 1656 wrote to memory of 2984 1656 1bntnt.exe 35 PID 1656 wrote to memory of 2984 1656 1bntnt.exe 35 PID 1656 wrote to memory of 2984 1656 1bntnt.exe 35 PID 2984 wrote to memory of 2816 2984 rxrlxlf.exe 36 PID 2984 wrote to memory of 2816 2984 rxrlxlf.exe 36 PID 2984 wrote to memory of 2816 2984 rxrlxlf.exe 36 PID 2984 wrote to memory of 2816 2984 rxrlxlf.exe 36 PID 2816 wrote to memory of 2700 2816 tbtthh.exe 37 PID 2816 wrote to memory of 2700 2816 tbtthh.exe 37 PID 2816 wrote to memory of 2700 2816 tbtthh.exe 37 PID 2816 wrote to memory of 2700 2816 tbtthh.exe 37 PID 2700 wrote to memory of 2572 2700 dvjpd.exe 38 PID 2700 wrote to memory of 2572 2700 dvjpd.exe 38 PID 2700 wrote to memory of 2572 2700 dvjpd.exe 38 PID 2700 wrote to memory of 2572 2700 dvjpd.exe 38 PID 2572 wrote to memory of 2652 2572 rxxxrfr.exe 39 PID 2572 wrote to memory of 2652 2572 rxxxrfr.exe 39 PID 2572 wrote to memory of 2652 2572 rxxxrfr.exe 39 PID 2572 wrote to memory of 2652 2572 rxxxrfr.exe 39 PID 2652 wrote to memory of 2504 2652 bbbnhn.exe 40 PID 2652 wrote to memory of 2504 2652 bbbnhn.exe 40 PID 2652 wrote to memory of 2504 2652 bbbnhn.exe 40 PID 2652 wrote to memory of 2504 2652 bbbnhn.exe 40 PID 2504 wrote to memory of 2532 2504 rxflfrf.exe 41 PID 2504 wrote to memory of 2532 2504 rxflfrf.exe 41 PID 2504 wrote to memory of 2532 2504 rxflfrf.exe 41 PID 2504 wrote to memory of 2532 2504 rxflfrf.exe 41 PID 2532 wrote to memory of 1876 2532 9hhtnb.exe 42 PID 2532 wrote to memory of 1876 2532 9hhtnb.exe 42 PID 2532 wrote to memory of 1876 2532 9hhtnb.exe 42 PID 2532 wrote to memory of 1876 2532 9hhtnb.exe 42 PID 1876 wrote to memory of 2020 1876 jdvvv.exe 43 PID 1876 wrote to memory of 2020 1876 jdvvv.exe 43 PID 1876 wrote to memory of 2020 1876 jdvvv.exe 43 PID 1876 wrote to memory of 2020 1876 jdvvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe"C:\Users\Admin\AppData\Local\Temp\fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9rrfxll.exec:\9rrfxll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rrfrlrl.exec:\rrfrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vjdjd.exec:\vjdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\lllrfrf.exec:\lllrfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\hbtttb.exec:\hbtttb.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\pppjj.exec:\pppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\1bntnt.exec:\1bntnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rxrlxlf.exec:\rxrlxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tbtthh.exec:\tbtthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\dvjpd.exec:\dvjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rxxxrfr.exec:\rxxxrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bbbnhn.exec:\bbbnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rxflfrf.exec:\rxflfrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9hhtnb.exec:\9hhtnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jdvvv.exec:\jdvvv.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rxxfrfr.exec:\rxxfrfr.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pvpvj.exec:\pvpvj.exe18⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hthhtt.exec:\hthhtt.exe19⤵
- Executes dropped EXE
PID:1292 -
\??\c:\dvjpd.exec:\dvjpd.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7tthtn.exec:\7tthtn.exe21⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjjpj.exec:\jjjpj.exe22⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lffflrf.exec:\lffflrf.exe23⤵
- Executes dropped EXE
PID:2320 -
\??\c:\7hbbtb.exec:\7hbbtb.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fllfxfx.exec:\fllfxfx.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\bnttbb.exec:\bnttbb.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rrflxfx.exec:\rrflxfx.exe27⤵
- Executes dropped EXE
PID:944 -
\??\c:\nhbbnb.exec:\nhbbnb.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\bhttbh.exec:\bhttbh.exe29⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7rfrflf.exec:\7rfrflf.exe30⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jjdvj.exec:\jjdvj.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\3xrfxfr.exec:\3xrfxfr.exe32⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rllrxfx.exec:\rllrxfx.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pppvd.exec:\pppvd.exe34⤵
- Executes dropped EXE
PID:624 -
\??\c:\bttnht.exec:\bttnht.exe35⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jjvjv.exec:\jjvjv.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvvpd.exec:\vvvpd.exe37⤵
- Executes dropped EXE
PID:884 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5hhtht.exec:\5hhtht.exe39⤵
- Executes dropped EXE
PID:296 -
\??\c:\bbbhtb.exec:\bbbhtb.exe40⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ddpvj.exec:\ddpvj.exe41⤵
- Executes dropped EXE
PID:2076 -
\??\c:\flxlllx.exec:\flxlllx.exe42⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5fxlxlf.exec:\5fxlxlf.exe43⤵
- Executes dropped EXE
PID:2296 -
\??\c:\htbttn.exec:\htbttn.exe44⤵
- Executes dropped EXE
PID:284 -
\??\c:\vddvj.exec:\vddvj.exe45⤵
- Executes dropped EXE
PID:2340 -
\??\c:\djpjj.exec:\djpjj.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lxrxfrx.exec:\lxrxfrx.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tbttth.exec:\tbttth.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1vjvv.exec:\1vjvv.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3flflxl.exec:\3flflxl.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rlfrxfx.exec:\rlfrxfx.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\bbtthn.exec:\bbtthn.exe52⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jjjpj.exec:\jjjpj.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjddv.exec:\pjddv.exe54⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5llrlrx.exec:\5llrlrx.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892 -
\??\c:\bbttbb.exec:\bbttbb.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dvvdv.exec:\dvvdv.exe57⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vdvdd.exec:\vdvdd.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xrrxrxr.exec:\xrrxrxr.exe59⤵
- Executes dropped EXE
PID:752 -
\??\c:\ntnnnt.exec:\ntnnnt.exe60⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ntnbth.exec:\ntnbth.exe61⤵
- Executes dropped EXE
PID:316 -
\??\c:\pppjv.exec:\pppjv.exe62⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ffxfxff.exec:\ffxfxff.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nnhhbh.exec:\nnhhbh.exe64⤵
- Executes dropped EXE
PID:1640 -
\??\c:\3dvvd.exec:\3dvvd.exe65⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jpjjd.exec:\jpjjd.exe66⤵PID:1304
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe67⤵PID:796
-
\??\c:\hhbhth.exec:\hhbhth.exe68⤵PID:264
-
\??\c:\hhhtht.exec:\hhhtht.exe69⤵PID:1960
-
\??\c:\vdvdp.exec:\vdvdp.exe70⤵PID:1956
-
\??\c:\lllrxfr.exec:\lllrxfr.exe71⤵PID:1376
-
\??\c:\lxllxfr.exec:\lxllxfr.exe72⤵PID:1524
-
\??\c:\nnhtnt.exec:\nnhtnt.exe73⤵PID:1896
-
\??\c:\vppdp.exec:\vppdp.exe74⤵PID:672
-
\??\c:\vvvjv.exec:\vvvjv.exe75⤵PID:1468
-
\??\c:\lrxxlfl.exec:\lrxxlfl.exe76⤵PID:3000
-
\??\c:\5htbnt.exec:\5htbnt.exe77⤵PID:464
-
\??\c:\dvpjv.exec:\dvpjv.exe78⤵PID:1628
-
\??\c:\7jpdj.exec:\7jpdj.exe79⤵PID:1540
-
\??\c:\3llrflx.exec:\3llrflx.exe80⤵PID:2912
-
\??\c:\1hntbb.exec:\1hntbb.exe81⤵PID:2260
-
\??\c:\bbtbht.exec:\bbtbht.exe82⤵PID:1552
-
\??\c:\pjvvv.exec:\pjvvv.exe83⤵PID:2916
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe84⤵PID:2376
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe85⤵PID:2072
-
\??\c:\bbhnnb.exec:\bbhnnb.exe86⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\jdpvp.exec:\jdpvp.exe87⤵PID:2104
-
\??\c:\1dppv.exec:\1dppv.exe88⤵PID:2044
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe89⤵PID:2268
-
\??\c:\3bntbh.exec:\3bntbh.exe90⤵PID:284
-
\??\c:\pvpjv.exec:\pvpjv.exe91⤵PID:2340
-
\??\c:\xfxxrfx.exec:\xfxxrfx.exe92⤵PID:2740
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe93⤵PID:2608
-
\??\c:\ttntnt.exec:\ttntnt.exe94⤵PID:2816
-
\??\c:\9ppjd.exec:\9ppjd.exe95⤵PID:2616
-
\??\c:\ddppd.exec:\ddppd.exe96⤵PID:2512
-
\??\c:\3xrxrfr.exec:\3xrxrfr.exe97⤵PID:2720
-
\??\c:\7bthtt.exec:\7bthtt.exe98⤵PID:2652
-
\??\c:\djjvd.exec:\djjvd.exe99⤵PID:2480
-
\??\c:\7vvvj.exec:\7vvvj.exe100⤵PID:2360
-
\??\c:\xrrxrxx.exec:\xrrxrxx.exe101⤵PID:2880
-
\??\c:\nhbnht.exec:\nhbnht.exe102⤵PID:2408
-
\??\c:\vvvdv.exec:\vvvdv.exe103⤵PID:2244
-
\??\c:\5ddvj.exec:\5ddvj.exe104⤵PID:1920
-
\??\c:\rlrxlxx.exec:\rlrxlxx.exe105⤵PID:2392
-
\??\c:\7tntbt.exec:\7tntbt.exe106⤵PID:1036
-
\??\c:\tbthtb.exec:\tbthtb.exe107⤵PID:1852
-
\??\c:\9pjpd.exec:\9pjpd.exe108⤵PID:2308
-
\??\c:\lfrxrfr.exec:\lfrxrfr.exe109⤵PID:2780
-
\??\c:\7xxfxlx.exec:\7xxfxlx.exe110⤵PID:2128
-
\??\c:\tbtbnb.exec:\tbtbnb.exe111⤵PID:1052
-
\??\c:\dvpdd.exec:\dvpdd.exe112⤵PID:1324
-
\??\c:\vjvjp.exec:\vjvjp.exe113⤵PID:1304
-
\??\c:\ffxlffr.exec:\ffxlffr.exe114⤵PID:1560
-
\??\c:\hhbhtb.exec:\hhbhtb.exe115⤵PID:264
-
\??\c:\tnntnt.exec:\tnntnt.exe116⤵PID:1848
-
\??\c:\5dddv.exec:\5dddv.exe117⤵PID:600
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe118⤵PID:376
-
\??\c:\nnhhtb.exec:\nnhhtb.exe119⤵PID:744
-
\??\c:\ntttnt.exec:\ntttnt.exe120⤵PID:1624
-
\??\c:\5jddp.exec:\5jddp.exe121⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-