Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe
-
Size
454KB
-
MD5
3ae412290ed5e15b39a272fc1989956f
-
SHA1
c9f6d25cf2b501090cf07aed88a250f824aa2b30
-
SHA256
414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5
-
SHA512
7c63868cad38872f2ee148ce049a4108139f72d521187911bf98ab517e851bc149db0754623cdd01f01ca4dcfcc72d470c0d1ef30db7eea2e8b6d602259e8507
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2520-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1896-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-309-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2864-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-501-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1300-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-716-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2372-755-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2108-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-915-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-993-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-992-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-1011-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-1025-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/784-1089-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 vpdpp.exe 1436 ffxlxxl.exe 2252 ththnh.exe 1932 vpdpd.exe 2720 ffxrffl.exe 3020 hnntnt.exe 2932 xrlxllx.exe 2188 9xxxrfx.exe 1952 nthbbn.exe 2624 9jpvd.exe 2168 9jdvd.exe 676 fxxfrxr.exe 692 hnhthn.exe 336 pjvdj.exe 1896 3xrrrrx.exe 1876 dpjpj.exe 1636 lfxxxxl.exe 2808 nnbnbn.exe 2960 xxxfllx.exe 2976 3pvdj.exe 2184 jpppj.exe 2956 ddpdd.exe 1396 djvdj.exe 2492 lxxrxxx.exe 964 pjjdd.exe 1200 xxxfffx.exe 112 1bnntb.exe 2092 tbttht.exe 1976 jdvvd.exe 2052 5dppv.exe 2548 bhbnbh.exe 3060 bbbhhn.exe 2384 3jpdp.exe 1664 1rflrxf.exe 596 1tntbh.exe 2508 tthhnt.exe 2864 dvpdj.exe 2848 xfffflx.exe 2908 tthnbh.exe 2532 5tnbht.exe 1916 jdvjv.exe 2692 llfrfll.exe 2640 frlxrfr.exe 2636 bthbnn.exe 2704 pvppj.exe 588 jdvvp.exe 2604 rflxlrl.exe 768 1bbnbn.exe 1504 7nhntb.exe 1220 vppjv.exe 1740 xffxflr.exe 1880 nnnhnb.exe 1184 5btthh.exe 2012 3ppvj.exe 1012 lfxfrrl.exe 1780 lfffllx.exe 2808 nnhhtb.exe 2820 vjvjj.exe 2996 dvppd.exe 2208 lllfrfx.exe 2948 tnbhnh.exe 2632 ddpdp.exe 348 vppdv.exe 1396 1lllrxl.exe -
resource yara_rule behavioral1/memory/2520-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-52-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2188-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-184-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2184-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-642-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/992-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-915-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/784-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-1121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-1198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-1225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-1314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-1327-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2212 2520 414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe 30 PID 2520 wrote to memory of 2212 2520 414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe 30 PID 2520 wrote to memory of 2212 2520 414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe 30 PID 2520 wrote to memory of 2212 2520 414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe 30 PID 2212 wrote to memory of 1436 2212 vpdpp.exe 31 PID 2212 wrote to memory of 1436 2212 vpdpp.exe 31 PID 2212 wrote to memory of 1436 2212 vpdpp.exe 31 PID 2212 wrote to memory of 1436 2212 vpdpp.exe 31 PID 1436 wrote to memory of 2252 1436 ffxlxxl.exe 32 PID 1436 wrote to memory of 2252 1436 ffxlxxl.exe 32 PID 1436 wrote to memory of 2252 1436 ffxlxxl.exe 32 PID 1436 wrote to memory of 2252 1436 ffxlxxl.exe 32 PID 2252 wrote to memory of 1932 2252 ththnh.exe 33 PID 2252 wrote to memory of 1932 2252 ththnh.exe 33 PID 2252 wrote to memory of 1932 2252 ththnh.exe 33 PID 2252 wrote to memory of 1932 2252 ththnh.exe 33 PID 1932 wrote to memory of 2720 1932 vpdpd.exe 34 PID 1932 wrote to memory of 2720 1932 vpdpd.exe 34 PID 1932 wrote to memory of 2720 1932 vpdpd.exe 34 PID 1932 wrote to memory of 2720 1932 vpdpd.exe 34 PID 2720 wrote to memory of 3020 2720 ffxrffl.exe 35 PID 2720 wrote to memory of 3020 2720 ffxrffl.exe 35 PID 2720 wrote to memory of 3020 2720 ffxrffl.exe 35 PID 2720 wrote to memory of 3020 2720 ffxrffl.exe 35 PID 3020 wrote to memory of 2932 3020 hnntnt.exe 36 PID 3020 wrote to memory of 2932 3020 hnntnt.exe 36 PID 3020 wrote to memory of 2932 3020 hnntnt.exe 36 PID 3020 wrote to memory of 2932 3020 hnntnt.exe 36 PID 2932 wrote to memory of 2188 2932 xrlxllx.exe 37 PID 2932 wrote to memory of 2188 2932 xrlxllx.exe 37 PID 2932 wrote to memory of 2188 2932 xrlxllx.exe 37 PID 2932 wrote to memory of 2188 2932 xrlxllx.exe 37 PID 2188 wrote to memory of 1952 2188 9xxxrfx.exe 38 PID 2188 wrote to memory of 1952 2188 9xxxrfx.exe 38 PID 2188 wrote to memory of 1952 2188 9xxxrfx.exe 38 PID 2188 wrote to memory of 1952 2188 9xxxrfx.exe 38 PID 1952 wrote to memory of 2624 1952 nthbbn.exe 39 PID 1952 wrote to memory of 2624 1952 nthbbn.exe 39 PID 1952 wrote to memory of 2624 1952 nthbbn.exe 39 PID 1952 wrote to memory of 2624 1952 nthbbn.exe 39 PID 2624 wrote to memory of 2168 2624 9jpvd.exe 40 PID 2624 wrote to memory of 2168 2624 9jpvd.exe 40 PID 2624 wrote to memory of 2168 2624 9jpvd.exe 40 PID 2624 wrote to memory of 2168 2624 9jpvd.exe 40 PID 2168 wrote to memory of 676 2168 9jdvd.exe 41 PID 2168 wrote to memory of 676 2168 9jdvd.exe 41 PID 2168 wrote to memory of 676 2168 9jdvd.exe 41 PID 2168 wrote to memory of 676 2168 9jdvd.exe 41 PID 676 wrote to memory of 692 676 fxxfrxr.exe 42 PID 676 wrote to memory of 692 676 fxxfrxr.exe 42 PID 676 wrote to memory of 692 676 fxxfrxr.exe 42 PID 676 wrote to memory of 692 676 fxxfrxr.exe 42 PID 692 wrote to memory of 336 692 hnhthn.exe 43 PID 692 wrote to memory of 336 692 hnhthn.exe 43 PID 692 wrote to memory of 336 692 hnhthn.exe 43 PID 692 wrote to memory of 336 692 hnhthn.exe 43 PID 336 wrote to memory of 1896 336 pjvdj.exe 44 PID 336 wrote to memory of 1896 336 pjvdj.exe 44 PID 336 wrote to memory of 1896 336 pjvdj.exe 44 PID 336 wrote to memory of 1896 336 pjvdj.exe 44 PID 1896 wrote to memory of 1876 1896 3xrrrrx.exe 45 PID 1896 wrote to memory of 1876 1896 3xrrrrx.exe 45 PID 1896 wrote to memory of 1876 1896 3xrrrrx.exe 45 PID 1896 wrote to memory of 1876 1896 3xrrrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe"C:\Users\Admin\AppData\Local\Temp\414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vpdpp.exec:\vpdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\ththnh.exec:\ththnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vpdpd.exec:\vpdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\ffxrffl.exec:\ffxrffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\hnntnt.exec:\hnntnt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xrlxllx.exec:\xrlxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\9xxxrfx.exec:\9xxxrfx.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\nthbbn.exec:\nthbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\9jpvd.exec:\9jpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\9jdvd.exec:\9jdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\fxxfrxr.exec:\fxxfrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\hnhthn.exec:\hnhthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\pjvdj.exec:\pjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\3xrrrrx.exec:\3xrrrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\dpjpj.exec:\dpjpj.exe17⤵
- Executes dropped EXE
PID:1876 -
\??\c:\lfxxxxl.exec:\lfxxxxl.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nnbnbn.exec:\nnbnbn.exe19⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xxxfllx.exec:\xxxfllx.exe20⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3pvdj.exec:\3pvdj.exe21⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jpppj.exec:\jpppj.exe22⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ddpdd.exec:\ddpdd.exe23⤵
- Executes dropped EXE
PID:2956 -
\??\c:\djvdj.exec:\djvdj.exe24⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lxxrxxx.exec:\lxxrxxx.exe25⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjjdd.exec:\pjjdd.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\xxxfffx.exec:\xxxfffx.exe27⤵
- Executes dropped EXE
PID:1200 -
\??\c:\1bnntb.exec:\1bnntb.exe28⤵
- Executes dropped EXE
PID:112 -
\??\c:\tbttht.exec:\tbttht.exe29⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jdvvd.exec:\jdvvd.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5dppv.exec:\5dppv.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bhbnbh.exec:\bhbnbh.exe32⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bbbhhn.exec:\bbbhhn.exe33⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3jpdp.exec:\3jpdp.exe34⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1rflrxf.exec:\1rflrxf.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1tntbh.exec:\1tntbh.exe36⤵
- Executes dropped EXE
PID:596 -
\??\c:\tthhnt.exec:\tthhnt.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dvpdj.exec:\dvpdj.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xfffflx.exec:\xfffflx.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tthnbh.exec:\tthnbh.exe40⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5tnbht.exec:\5tnbht.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdvjv.exec:\jdvjv.exe42⤵
- Executes dropped EXE
PID:1916 -
\??\c:\llfrfll.exec:\llfrfll.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\frlxrfr.exec:\frlxrfr.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bthbnn.exec:\bthbnn.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pvppj.exec:\pvppj.exe46⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdvvp.exec:\jdvvp.exe47⤵
- Executes dropped EXE
PID:588 -
\??\c:\rflxlrl.exec:\rflxlrl.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1bbnbn.exec:\1bbnbn.exe49⤵
- Executes dropped EXE
PID:768 -
\??\c:\7nhntb.exec:\7nhntb.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vppjv.exec:\vppjv.exe51⤵
- Executes dropped EXE
PID:1220 -
\??\c:\xffxflr.exec:\xffxflr.exe52⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nnnhnb.exec:\nnnhnb.exe53⤵
- Executes dropped EXE
PID:1880 -
\??\c:\5btthh.exec:\5btthh.exe54⤵
- Executes dropped EXE
PID:1184 -
\??\c:\3ppvj.exec:\3ppvj.exe55⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe56⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lfffllx.exec:\lfffllx.exe57⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnhhtb.exec:\nnhhtb.exe58⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vjvjj.exec:\vjvjj.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\dvppd.exec:\dvppd.exe60⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lllfrfx.exec:\lllfrfx.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\tnbhnh.exec:\tnbhnh.exe62⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ddpdp.exec:\ddpdp.exe63⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vppdv.exec:\vppdv.exe64⤵
- Executes dropped EXE
PID:348 -
\??\c:\1lllrxl.exec:\1lllrxl.exe65⤵
- Executes dropped EXE
PID:1396 -
\??\c:\ttnhnb.exec:\ttnhnb.exe66⤵PID:1984
-
\??\c:\vvjvp.exec:\vvjvp.exe67⤵PID:1300
-
\??\c:\djjvj.exec:\djjvj.exe68⤵PID:696
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe69⤵PID:2220
-
\??\c:\ththnn.exec:\ththnn.exe70⤵PID:1460
-
\??\c:\7ttttb.exec:\7ttttb.exe71⤵PID:892
-
\??\c:\vvpvj.exec:\vvpvj.exe72⤵PID:984
-
\??\c:\frxlxff.exec:\frxlxff.exe73⤵PID:1812
-
\??\c:\1hbbhh.exec:\1hbbhh.exe74⤵PID:2108
-
\??\c:\thttbt.exec:\thttbt.exe75⤵PID:2520
-
\??\c:\jpjdp.exec:\jpjdp.exe76⤵PID:2672
-
\??\c:\lllxrfr.exec:\lllxrfr.exe77⤵PID:2544
-
\??\c:\hbtnbh.exec:\hbtnbh.exe78⤵PID:2320
-
\??\c:\btbtth.exec:\btbtth.exe79⤵PID:3004
-
\??\c:\dvpdp.exec:\dvpdp.exe80⤵PID:1912
-
\??\c:\dvppd.exec:\dvppd.exe81⤵PID:2940
-
\??\c:\xfxlxxl.exec:\xfxlxxl.exe82⤵PID:2328
-
\??\c:\htntbb.exec:\htntbb.exe83⤵PID:2720
-
\??\c:\ddppj.exec:\ddppj.exe84⤵PID:2860
-
\??\c:\dvvjd.exec:\dvvjd.exe85⤵PID:3012
-
\??\c:\xxxlxxr.exec:\xxxlxxr.exe86⤵PID:1916
-
\??\c:\hnhntb.exec:\hnhntb.exe87⤵PID:1728
-
\??\c:\jdjjj.exec:\jdjjj.exe88⤵PID:2664
-
\??\c:\lfxxffl.exec:\lfxxffl.exe89⤵PID:2596
-
\??\c:\9xxfrxf.exec:\9xxfrxf.exe90⤵PID:2608
-
\??\c:\bhbhbt.exec:\bhbhbt.exe91⤵PID:992
-
\??\c:\dppdp.exec:\dppdp.exe92⤵PID:1032
-
\??\c:\pdpvj.exec:\pdpvj.exe93⤵PID:1668
-
\??\c:\rrrlflx.exec:\rrrlflx.exe94⤵PID:524
-
\??\c:\tnnthn.exec:\tnnthn.exe95⤵PID:1616
-
\??\c:\vpvdd.exec:\vpvdd.exe96⤵PID:2128
-
\??\c:\lllrxxl.exec:\lllrxxl.exe97⤵PID:284
-
\??\c:\9fxflrl.exec:\9fxflrl.exe98⤵PID:592
-
\??\c:\hbttbt.exec:\hbttbt.exe99⤵PID:1908
-
\??\c:\bhhntt.exec:\bhhntt.exe100⤵PID:1768
-
\??\c:\lfxfxff.exec:\lfxfxff.exe101⤵PID:2832
-
\??\c:\llffrxr.exec:\llffrxr.exe102⤵PID:2960
-
\??\c:\bbtbtt.exec:\bbtbtt.exe103⤵PID:2268
-
\??\c:\jdjdd.exec:\jdjdd.exe104⤵PID:2792
-
\??\c:\lxrlrlx.exec:\lxrlrlx.exe105⤵PID:2372
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe106⤵PID:948
-
\??\c:\1httbh.exec:\1httbh.exe107⤵PID:2968
-
\??\c:\jjjpd.exec:\jjjpd.exe108⤵PID:1824
-
\??\c:\7xxlrxl.exec:\7xxlrxl.exe109⤵PID:108
-
\??\c:\9frrxrr.exec:\9frrxrr.exe110⤵PID:2488
-
\??\c:\tthbhh.exec:\tthbhh.exe111⤵PID:1200
-
\??\c:\7vdpv.exec:\7vdpv.exe112⤵
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\jjvvd.exec:\jjvvd.exe113⤵PID:2092
-
\??\c:\9frlxrl.exec:\9frlxrl.exe114⤵PID:2768
-
\??\c:\3htnbn.exec:\3htnbn.exe115⤵PID:1600
-
\??\c:\hbbnnb.exec:\hbbnnb.exe116⤵PID:2068
-
\??\c:\ppddp.exec:\ppddp.exe117⤵PID:1424
-
\??\c:\rllxlxl.exec:\rllxlxl.exe118⤵PID:2108
-
\??\c:\xrfrflx.exec:\xrfrflx.exe119⤵PID:2004
-
\??\c:\9bhnth.exec:\9bhnth.exe120⤵PID:1628
-
\??\c:\ppjjv.exec:\ppjjv.exe121⤵PID:1664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-