Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 23:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe
-
Size
455KB
-
MD5
b8b732ea10e540fc99ce1c29806f5fab
-
SHA1
f62256f4446623914bcfc54f6bb20377dfb33366
-
SHA256
6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4
-
SHA512
dfa003aa580f09c4d571e97e39c2604a6cc62c95fe4a786873dc97b4a544cf9b2772f58b6603479af8ab266c4b452db96e514e4b8c09abfeff557ad37474d4d2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRK:q7Tc2NYHUrAwfMp3CDRK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-53-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1968-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-190-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1060-186-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1912-197-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-299-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1648-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-353-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-376-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2512-410-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2304-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-425-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2652-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-516-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1988-559-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3056-578-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3056-580-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-583-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2120-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-640-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3012-639-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2356-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-806-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 7rlrrll.exe 308 tnbbhn.exe 1624 llfrlxr.exe 1080 ffflxlf.exe 2412 tnhhht.exe 1384 bbtbtt.exe 3004 5vvdp.exe 2744 7vdpp.exe 2588 vpdjp.exe 2252 nbtbhh.exe 2692 vjppp.exe 2480 xrxfxfr.exe 2560 lflrflr.exe 2280 7hnbtt.exe 1968 jdpvj.exe 2380 hhbhnn.exe 1720 1vdpj.exe 2284 7jjvj.exe 1060 jjddv.exe 1960 xrlrxfr.exe 1912 jjddv.exe 2572 7bhbtt.exe 2676 pjdjd.exe 2372 rrxlxxl.exe 2816 5tnbnn.exe 784 1dvjd.exe 1148 lfxflrf.exe 1664 5fxlfrl.exe 2352 fxrfxxx.exe 2872 3lfxflx.exe 2208 9ttthb.exe 2184 7dvdp.exe 808 rrrrxxr.exe 1584 ddpjv.exe 1648 pvpdd.exe 1624 lfxrxxf.exe 1240 7tnnhn.exe 1676 ppjpj.exe 2236 3pddp.exe 2248 ffxxlrf.exe 2628 nnntbh.exe 2592 pjvpd.exe 2728 5djpd.exe 2856 llffrfr.exe 2588 ntnhtt.exe 2712 1jdpd.exe 2596 flflxfx.exe 2512 1llfflr.exe 2304 9bhnnn.exe 2652 vdddp.exe 1780 xxrrlrf.exe 1412 5rrfrxf.exe 1916 hnhtbh.exe 1692 pddvj.exe 832 jdddp.exe 2452 xrffrrx.exe 2384 thtthb.exe 1932 nhbhhh.exe 1856 pvpdp.exe 2468 1xfxxxf.exe 2928 nnhtbn.exe 2360 ppdpj.exe 2828 pjvpp.exe 928 5fxxflr.exe -
resource yara_rule behavioral1/memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-129-0x0000000001C80000-0x0000000001CAA000-memory.dmp upx behavioral1/memory/1968-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-190-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1060-184-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1912-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-444-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2452-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-516-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1988-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-806-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2192 2868 6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe 28 PID 2868 wrote to memory of 2192 2868 6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe 28 PID 2868 wrote to memory of 2192 2868 6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe 28 PID 2868 wrote to memory of 2192 2868 6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe 28 PID 2192 wrote to memory of 308 2192 7rlrrll.exe 29 PID 2192 wrote to memory of 308 2192 7rlrrll.exe 29 PID 2192 wrote to memory of 308 2192 7rlrrll.exe 29 PID 2192 wrote to memory of 308 2192 7rlrrll.exe 29 PID 308 wrote to memory of 1624 308 tnbbhn.exe 30 PID 308 wrote to memory of 1624 308 tnbbhn.exe 30 PID 308 wrote to memory of 1624 308 tnbbhn.exe 30 PID 308 wrote to memory of 1624 308 tnbbhn.exe 30 PID 1624 wrote to memory of 1080 1624 llfrlxr.exe 31 PID 1624 wrote to memory of 1080 1624 llfrlxr.exe 31 PID 1624 wrote to memory of 1080 1624 llfrlxr.exe 31 PID 1624 wrote to memory of 1080 1624 llfrlxr.exe 31 PID 1080 wrote to memory of 2412 1080 ffflxlf.exe 32 PID 1080 wrote to memory of 2412 1080 ffflxlf.exe 32 PID 1080 wrote to memory of 2412 1080 ffflxlf.exe 32 PID 1080 wrote to memory of 2412 1080 ffflxlf.exe 32 PID 2412 wrote to memory of 1384 2412 tnhhht.exe 33 PID 2412 wrote to memory of 1384 2412 tnhhht.exe 33 PID 2412 wrote to memory of 1384 2412 tnhhht.exe 33 PID 2412 wrote to memory of 1384 2412 tnhhht.exe 33 PID 1384 wrote to memory of 3004 1384 bbtbtt.exe 34 PID 1384 wrote to memory of 3004 1384 bbtbtt.exe 34 PID 1384 wrote to memory of 3004 1384 bbtbtt.exe 34 PID 1384 wrote to memory of 3004 1384 bbtbtt.exe 34 PID 3004 wrote to memory of 2744 3004 5vvdp.exe 35 PID 3004 wrote to memory of 2744 3004 5vvdp.exe 35 PID 3004 wrote to memory of 2744 3004 5vvdp.exe 35 PID 3004 wrote to memory of 2744 3004 5vvdp.exe 35 PID 2744 wrote to memory of 2588 2744 7vdpp.exe 36 PID 2744 wrote to memory of 2588 2744 7vdpp.exe 36 PID 2744 wrote to memory of 2588 2744 7vdpp.exe 36 PID 2744 wrote to memory of 2588 2744 7vdpp.exe 36 PID 2588 wrote to memory of 2252 2588 vpdjp.exe 37 PID 2588 wrote to memory of 2252 2588 vpdjp.exe 37 PID 2588 wrote to memory of 2252 2588 vpdjp.exe 37 PID 2588 wrote to memory of 2252 2588 vpdjp.exe 37 PID 2252 wrote to memory of 2692 2252 nbtbhh.exe 38 PID 2252 wrote to memory of 2692 2252 nbtbhh.exe 38 PID 2252 wrote to memory of 2692 2252 nbtbhh.exe 38 PID 2252 wrote to memory of 2692 2252 nbtbhh.exe 38 PID 2692 wrote to memory of 2480 2692 vjppp.exe 39 PID 2692 wrote to memory of 2480 2692 vjppp.exe 39 PID 2692 wrote to memory of 2480 2692 vjppp.exe 39 PID 2692 wrote to memory of 2480 2692 vjppp.exe 39 PID 2480 wrote to memory of 2560 2480 xrxfxfr.exe 40 PID 2480 wrote to memory of 2560 2480 xrxfxfr.exe 40 PID 2480 wrote to memory of 2560 2480 xrxfxfr.exe 40 PID 2480 wrote to memory of 2560 2480 xrxfxfr.exe 40 PID 2560 wrote to memory of 2280 2560 lflrflr.exe 41 PID 2560 wrote to memory of 2280 2560 lflrflr.exe 41 PID 2560 wrote to memory of 2280 2560 lflrflr.exe 41 PID 2560 wrote to memory of 2280 2560 lflrflr.exe 41 PID 2280 wrote to memory of 1968 2280 7hnbtt.exe 42 PID 2280 wrote to memory of 1968 2280 7hnbtt.exe 42 PID 2280 wrote to memory of 1968 2280 7hnbtt.exe 42 PID 2280 wrote to memory of 1968 2280 7hnbtt.exe 42 PID 1968 wrote to memory of 2380 1968 jdpvj.exe 43 PID 1968 wrote to memory of 2380 1968 jdpvj.exe 43 PID 1968 wrote to memory of 2380 1968 jdpvj.exe 43 PID 1968 wrote to memory of 2380 1968 jdpvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe"C:\Users\Admin\AppData\Local\Temp\6a25a0da1a19632b59f23b6303ff81d01f7c39d8bf8ba14e9c5c49536c910ca4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7rlrrll.exec:\7rlrrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\tnbbhn.exec:\tnbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\llfrlxr.exec:\llfrlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ffflxlf.exec:\ffflxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\tnhhht.exec:\tnhhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\bbtbtt.exec:\bbtbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\5vvdp.exec:\5vvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\7vdpp.exec:\7vdpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vpdjp.exec:\vpdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nbtbhh.exec:\nbtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vjppp.exec:\vjppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xrxfxfr.exec:\xrxfxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\lflrflr.exec:\lflrflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\7hnbtt.exec:\7hnbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\jdpvj.exec:\jdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\hhbhnn.exec:\hhbhnn.exe17⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1vdpj.exec:\1vdpj.exe18⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7jjvj.exec:\7jjvj.exe19⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jjddv.exec:\jjddv.exe20⤵
- Executes dropped EXE
PID:1060 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe21⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jjddv.exec:\jjddv.exe22⤵
- Executes dropped EXE
PID:1912 -
\??\c:\7bhbtt.exec:\7bhbtt.exe23⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pjdjd.exec:\pjdjd.exe24⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rrxlxxl.exec:\rrxlxxl.exe25⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5tnbnn.exec:\5tnbnn.exe26⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1dvjd.exec:\1dvjd.exe27⤵
- Executes dropped EXE
PID:784 -
\??\c:\lfxflrf.exec:\lfxflrf.exe28⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5fxlfrl.exec:\5fxlfrl.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxrfxxx.exec:\fxrfxxx.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\3lfxflx.exec:\3lfxflx.exe31⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9ttthb.exec:\9ttthb.exe32⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7dvdp.exec:\7dvdp.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rrrrxxr.exec:\rrrrxxr.exe34⤵
- Executes dropped EXE
PID:808 -
\??\c:\ddpjv.exec:\ddpjv.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pvpdd.exec:\pvpdd.exe36⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7tnnhn.exec:\7tnnhn.exe38⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ppjpj.exec:\ppjpj.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\3pddp.exec:\3pddp.exe40⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nnntbh.exec:\nnntbh.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pjvpd.exec:\pjvpd.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5djpd.exec:\5djpd.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\llffrfr.exec:\llffrfr.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ntnhtt.exec:\ntnhtt.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1jdpd.exec:\1jdpd.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\flflxfx.exec:\flflxfx.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1llfflr.exec:\1llfflr.exe49⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9bhnnn.exec:\9bhnnn.exe50⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vdddp.exec:\vdddp.exe51⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xxrrlrf.exec:\xxrrlrf.exe52⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5rrfrxf.exec:\5rrfrxf.exe53⤵
- Executes dropped EXE
PID:1412 -
\??\c:\hnhtbh.exec:\hnhtbh.exe54⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pddvj.exec:\pddvj.exe55⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jdddp.exec:\jdddp.exe56⤵
- Executes dropped EXE
PID:832 -
\??\c:\xrffrrx.exec:\xrffrrx.exe57⤵
- Executes dropped EXE
PID:2452 -
\??\c:\thtthb.exec:\thtthb.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nhbhhh.exec:\nhbhhh.exe59⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pvpdp.exec:\pvpdp.exe60⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1xfxxxf.exec:\1xfxxxf.exe61⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nnhtbn.exec:\nnhtbn.exe62⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ppdpj.exec:\ppdpj.exe63⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pjvpp.exec:\pjvpp.exe64⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5fxxflr.exec:\5fxxflr.exe65⤵
- Executes dropped EXE
PID:928 -
\??\c:\nhhnht.exec:\nhhnht.exe66⤵PID:400
-
\??\c:\pjvdj.exec:\pjvdj.exe67⤵PID:896
-
\??\c:\9dvpp.exec:\9dvpp.exe68⤵PID:880
-
\??\c:\ffrxfxl.exec:\ffrxfxl.exe69⤵PID:1628
-
\??\c:\tntthh.exec:\tntthh.exe70⤵PID:780
-
\??\c:\tntnbh.exec:\tntnbh.exe71⤵PID:1988
-
\??\c:\pjjvj.exec:\pjjvj.exe72⤵PID:2188
-
\??\c:\1xxxxxl.exec:\1xxxxxl.exe73⤵PID:888
-
\??\c:\3tttbh.exec:\3tttbh.exe74⤵PID:3056
-
\??\c:\5hbnnn.exec:\5hbnnn.exe75⤵PID:2120
-
\??\c:\ppdvp.exec:\ppdvp.exe76⤵PID:2108
-
\??\c:\lrllflr.exec:\lrllflr.exe77⤵PID:2924
-
\??\c:\nhbhhh.exec:\nhbhhh.exe78⤵PID:316
-
\??\c:\htbnth.exec:\htbnth.exe79⤵PID:1804
-
\??\c:\jvjjp.exec:\jvjjp.exe80⤵PID:2200
-
\??\c:\3lxxxfl.exec:\3lxxxfl.exe81⤵PID:548
-
\??\c:\lfrxffx.exec:\lfrxffx.exe82⤵PID:1696
-
\??\c:\btnbhh.exec:\btnbhh.exe83⤵PID:3012
-
\??\c:\vvjvp.exec:\vvjvp.exe84⤵PID:2772
-
\??\c:\frlflrx.exec:\frlflrx.exe85⤵PID:2724
-
\??\c:\lfrxffl.exec:\lfrxffl.exe86⤵PID:3020
-
\??\c:\tntttt.exec:\tntttt.exe87⤵PID:2600
-
\??\c:\pdvdj.exec:\pdvdj.exe88⤵PID:2252
-
\??\c:\jdddv.exec:\jdddv.exe89⤵PID:2716
-
\??\c:\1xlrrrf.exec:\1xlrrrf.exe90⤵PID:2492
-
\??\c:\nhtbtb.exec:\nhtbtb.exe91⤵PID:2300
-
\??\c:\hbnnbb.exec:\hbnnbb.exe92⤵PID:2532
-
\??\c:\7pjvj.exec:\7pjvj.exe93⤵PID:2524
-
\??\c:\fxfflrx.exec:\fxfflrx.exe94⤵
- System Location Discovery: System Language Discovery
PID:2652 -
\??\c:\tnhnth.exec:\tnhnth.exe95⤵PID:2020
-
\??\c:\ttbthb.exec:\ttbthb.exe96⤵PID:1668
-
\??\c:\ppjvd.exec:\ppjvd.exe97⤵PID:2240
-
\??\c:\llxfxxr.exec:\llxfxxr.exe98⤵PID:2000
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe99⤵PID:1792
-
\??\c:\ttnbnt.exec:\ttnbnt.exe100⤵PID:1632
-
\??\c:\jdvpj.exec:\jdvpj.exe101⤵PID:1928
-
\??\c:\jdppj.exec:\jdppj.exe102⤵PID:1964
-
\??\c:\3xrxlrx.exec:\3xrxlrx.exe103⤵PID:2704
-
\??\c:\hbnnbn.exec:\hbnnbn.exe104⤵PID:2552
-
\??\c:\1bhhnh.exec:\1bhhnh.exe105⤵PID:1616
-
\??\c:\vvjpd.exec:\vvjpd.exe106⤵PID:2520
-
\??\c:\xrlrfrx.exec:\xrlrfrx.exe107⤵PID:2356
-
\??\c:\3rxrfff.exec:\3rxrfff.exe108⤵PID:1312
-
\??\c:\hhntth.exec:\hhntth.exe109⤵PID:3016
-
\??\c:\jdppv.exec:\jdppv.exe110⤵PID:1500
-
\??\c:\fxrllll.exec:\fxrllll.exe111⤵PID:1148
-
\??\c:\lflrlxf.exec:\lflrlxf.exe112⤵PID:880
-
\??\c:\5tntbt.exec:\5tntbt.exe113⤵PID:1304
-
\??\c:\dvjjd.exec:\dvjjd.exe114⤵PID:2164
-
\??\c:\frxfllx.exec:\frxfllx.exe115⤵PID:1988
-
\??\c:\7xrxlrf.exec:\7xrxlrf.exe116⤵PID:2208
-
\??\c:\5btbnt.exec:\5btbnt.exe117⤵PID:2396
-
\??\c:\pjpvj.exec:\pjpvj.exe118⤵PID:2184
-
\??\c:\3pvpv.exec:\3pvpv.exe119⤵PID:808
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe120⤵PID:2108
-
\??\c:\tthnbh.exec:\tthnbh.exe121⤵PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-