Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe
-
Size
454KB
-
MD5
2b4faf2f3c904584a30d9b1b1069068d
-
SHA1
54dd12feffc7d07b934cf2c0fd75814d6ec24cd1
-
SHA256
1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7
-
SHA512
6e97618c78254dd78b65a4294959db31b622c8b6655b56fbe10535f62da7b27a6a7a7a2b3457810977ceccef2e445fc5844a4e26e4990bdcb9d4c0ab78221d78
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7I:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2004-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2668-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-63-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2824-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-374-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3020-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-532-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3056-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-652-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2460-672-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2640-671-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-718-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-966-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1276-979-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/276-1067-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-1110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-1261-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1484-1272-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1312-1281-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 7hthnh.exe 2668 lfxxfff.exe 2312 3tbntn.exe 2912 lfrrlll.exe 2144 1bthhh.exe 2824 jvjjv.exe 2460 lfrllxr.exe 2768 jdpvd.exe 2752 ffllllr.exe 2604 3thbbb.exe 3020 9lxxfxf.exe 644 1tnntb.exe 1808 5ppjj.exe 2892 rrrfrxr.exe 1716 nhhhnn.exe 2496 3lxfffx.exe 2884 bthntt.exe 2136 jjdpj.exe 2192 bbnnbb.exe 1292 vjvvd.exe 1272 9lxrrxf.exe 276 thbhhn.exe 2956 7jpjj.exe 2988 1xllxxl.exe 1072 dppvj.exe 1548 lxxlrrx.exe 1760 vpddv.exe 564 pdjjd.exe 1428 bbnnbh.exe 988 hbhntt.exe 1828 flflrlf.exe 888 9hbhhb.exe 2168 jjddj.exe 1612 xrxlxrf.exe 2672 hhbbhh.exe 1040 hbbbbt.exe 2216 jdpdd.exe 2312 fffllrx.exe 2284 nbttbh.exe 2736 nhnhhb.exe 2820 pjdjv.exe 2596 1fffrlr.exe 2880 nbnbbt.exe 2616 5tbbtt.exe 2844 vvvjd.exe 2600 3lxxfff.exe 2588 9btbnb.exe 2292 bhnhhn.exe 3020 ddjpv.exe 1068 lrfflxl.exe 1664 hbntbb.exe 2688 ddvdj.exe 2892 jdpvj.exe 2416 1xllrxx.exe 1676 3bhhht.exe 2896 jjddp.exe 2256 7xrxrxx.exe 2132 lrlfrrf.exe 536 tnhhnn.exe 2084 9vjjp.exe 2196 xrfxxxl.exe 844 lfxlxlr.exe 2480 tnnhtt.exe 2572 vvppv.exe -
resource yara_rule behavioral1/memory/2004-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-120-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2496-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-191-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1272-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-210-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2988-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-639-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1860-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-1113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-1154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-1261-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1484-1272-0x0000000000430000-0x000000000045A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2004 2380 1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe 30 PID 2380 wrote to memory of 2004 2380 1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe 30 PID 2380 wrote to memory of 2004 2380 1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe 30 PID 2380 wrote to memory of 2004 2380 1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe 30 PID 2004 wrote to memory of 2668 2004 7hthnh.exe 31 PID 2004 wrote to memory of 2668 2004 7hthnh.exe 31 PID 2004 wrote to memory of 2668 2004 7hthnh.exe 31 PID 2004 wrote to memory of 2668 2004 7hthnh.exe 31 PID 2668 wrote to memory of 2312 2668 lfxxfff.exe 32 PID 2668 wrote to memory of 2312 2668 lfxxfff.exe 32 PID 2668 wrote to memory of 2312 2668 lfxxfff.exe 32 PID 2668 wrote to memory of 2312 2668 lfxxfff.exe 32 PID 2312 wrote to memory of 2912 2312 3tbntn.exe 33 PID 2312 wrote to memory of 2912 2312 3tbntn.exe 33 PID 2312 wrote to memory of 2912 2312 3tbntn.exe 33 PID 2312 wrote to memory of 2912 2312 3tbntn.exe 33 PID 2912 wrote to memory of 2144 2912 lfrrlll.exe 34 PID 2912 wrote to memory of 2144 2912 lfrrlll.exe 34 PID 2912 wrote to memory of 2144 2912 lfrrlll.exe 34 PID 2912 wrote to memory of 2144 2912 lfrrlll.exe 34 PID 2144 wrote to memory of 2824 2144 1bthhh.exe 35 PID 2144 wrote to memory of 2824 2144 1bthhh.exe 35 PID 2144 wrote to memory of 2824 2144 1bthhh.exe 35 PID 2144 wrote to memory of 2824 2144 1bthhh.exe 35 PID 2824 wrote to memory of 2460 2824 jvjjv.exe 36 PID 2824 wrote to memory of 2460 2824 jvjjv.exe 36 PID 2824 wrote to memory of 2460 2824 jvjjv.exe 36 PID 2824 wrote to memory of 2460 2824 jvjjv.exe 36 PID 2460 wrote to memory of 2768 2460 lfrllxr.exe 37 PID 2460 wrote to memory of 2768 2460 lfrllxr.exe 37 PID 2460 wrote to memory of 2768 2460 lfrllxr.exe 37 PID 2460 wrote to memory of 2768 2460 lfrllxr.exe 37 PID 2768 wrote to memory of 2752 2768 jdpvd.exe 38 PID 2768 wrote to memory of 2752 2768 jdpvd.exe 38 PID 2768 wrote to memory of 2752 2768 jdpvd.exe 38 PID 2768 wrote to memory of 2752 2768 jdpvd.exe 38 PID 2752 wrote to memory of 2604 2752 ffllllr.exe 39 PID 2752 wrote to memory of 2604 2752 ffllllr.exe 39 PID 2752 wrote to memory of 2604 2752 ffllllr.exe 39 PID 2752 wrote to memory of 2604 2752 ffllllr.exe 39 PID 2604 wrote to memory of 3020 2604 3thbbb.exe 40 PID 2604 wrote to memory of 3020 2604 3thbbb.exe 40 PID 2604 wrote to memory of 3020 2604 3thbbb.exe 40 PID 2604 wrote to memory of 3020 2604 3thbbb.exe 40 PID 3020 wrote to memory of 644 3020 9lxxfxf.exe 41 PID 3020 wrote to memory of 644 3020 9lxxfxf.exe 41 PID 3020 wrote to memory of 644 3020 9lxxfxf.exe 41 PID 3020 wrote to memory of 644 3020 9lxxfxf.exe 41 PID 644 wrote to memory of 1808 644 1tnntb.exe 42 PID 644 wrote to memory of 1808 644 1tnntb.exe 42 PID 644 wrote to memory of 1808 644 1tnntb.exe 42 PID 644 wrote to memory of 1808 644 1tnntb.exe 42 PID 1808 wrote to memory of 2892 1808 5ppjj.exe 43 PID 1808 wrote to memory of 2892 1808 5ppjj.exe 43 PID 1808 wrote to memory of 2892 1808 5ppjj.exe 43 PID 1808 wrote to memory of 2892 1808 5ppjj.exe 43 PID 2892 wrote to memory of 1716 2892 rrrfrxr.exe 44 PID 2892 wrote to memory of 1716 2892 rrrfrxr.exe 44 PID 2892 wrote to memory of 1716 2892 rrrfrxr.exe 44 PID 2892 wrote to memory of 1716 2892 rrrfrxr.exe 44 PID 1716 wrote to memory of 2496 1716 nhhhnn.exe 45 PID 1716 wrote to memory of 2496 1716 nhhhnn.exe 45 PID 1716 wrote to memory of 2496 1716 nhhhnn.exe 45 PID 1716 wrote to memory of 2496 1716 nhhhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe"C:\Users\Admin\AppData\Local\Temp\1f6f8881fac661eca6bc2fb68f7cf598683201aa25a986390a59fe83eddf74b7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\7hthnh.exec:\7hthnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\lfxxfff.exec:\lfxxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3tbntn.exec:\3tbntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\lfrrlll.exec:\lfrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\1bthhh.exec:\1bthhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jvjjv.exec:\jvjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lfrllxr.exec:\lfrllxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\jdpvd.exec:\jdpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ffllllr.exec:\ffllllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3thbbb.exec:\3thbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\9lxxfxf.exec:\9lxxfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\1tnntb.exec:\1tnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\5ppjj.exec:\5ppjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\rrrfrxr.exec:\rrrfrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nhhhnn.exec:\nhhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\3lxfffx.exec:\3lxfffx.exe17⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bthntt.exec:\bthntt.exe18⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jjdpj.exec:\jjdpj.exe19⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bbnnbb.exec:\bbnnbb.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vjvvd.exec:\vjvvd.exe21⤵
- Executes dropped EXE
PID:1292 -
\??\c:\9lxrrxf.exec:\9lxrrxf.exe22⤵
- Executes dropped EXE
PID:1272 -
\??\c:\thbhhn.exec:\thbhhn.exe23⤵
- Executes dropped EXE
PID:276 -
\??\c:\7jpjj.exec:\7jpjj.exe24⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1xllxxl.exec:\1xllxxl.exe25⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dppvj.exec:\dppvj.exe26⤵
- Executes dropped EXE
PID:1072 -
\??\c:\lxxlrrx.exec:\lxxlrrx.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vpddv.exec:\vpddv.exe28⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pdjjd.exec:\pdjjd.exe29⤵
- Executes dropped EXE
PID:564 -
\??\c:\bbnnbh.exec:\bbnnbh.exe30⤵
- Executes dropped EXE
PID:1428 -
\??\c:\hbhntt.exec:\hbhntt.exe31⤵
- Executes dropped EXE
PID:988 -
\??\c:\flflrlf.exec:\flflrlf.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\9hbhhb.exec:\9hbhhb.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\jjddj.exec:\jjddj.exe34⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrxlxrf.exec:\xrxlxrf.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hhbbhh.exec:\hhbbhh.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbbbbt.exec:\hbbbbt.exe37⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdpdd.exec:\jdpdd.exe38⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fffllrx.exec:\fffllrx.exe39⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nbttbh.exec:\nbttbh.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nhnhhb.exec:\nhnhhb.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pjdjv.exec:\pjdjv.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1fffrlr.exec:\1fffrlr.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nbnbbt.exec:\nbnbbt.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5tbbtt.exec:\5tbbtt.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vvvjd.exec:\vvvjd.exe46⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3lxxfff.exec:\3lxxfff.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9btbnb.exec:\9btbnb.exe48⤵
- Executes dropped EXE
PID:2588 -
\??\c:\bhnhhn.exec:\bhnhhn.exe49⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ddjpv.exec:\ddjpv.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lrfflxl.exec:\lrfflxl.exe51⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hbntbb.exec:\hbntbb.exe52⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ddvdj.exec:\ddvdj.exe53⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdpvj.exec:\jdpvj.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1xllrxx.exec:\1xllrxx.exe55⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3bhhht.exec:\3bhhht.exe56⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jjddp.exec:\jjddp.exe57⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7xrxrxx.exec:\7xrxrxx.exe58⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lrlfrrf.exec:\lrlfrrf.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tnhhnn.exec:\tnhhnn.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\9vjjp.exec:\9vjjp.exe61⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe62⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lfxlxlr.exec:\lfxlxlr.exe63⤵
- Executes dropped EXE
PID:844 -
\??\c:\tnnhtt.exec:\tnnhtt.exe64⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vvppv.exec:\vvppv.exe65⤵
- Executes dropped EXE
PID:2572 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe66⤵PID:2044
-
\??\c:\7bnnnn.exec:\7bnnnn.exe67⤵PID:2972
-
\??\c:\bhbnbh.exec:\bhbnbh.exe68⤵PID:1600
-
\??\c:\vjjvj.exec:\vjjvj.exe69⤵PID:2180
-
\??\c:\rrflrrf.exec:\rrflrrf.exe70⤵PID:1708
-
\??\c:\7bhhtb.exec:\7bhhtb.exe71⤵PID:3068
-
\??\c:\djpjj.exec:\djpjj.exe72⤵PID:3056
-
\??\c:\llflxfx.exec:\llflxfx.exe73⤵PID:1428
-
\??\c:\xrflrrx.exec:\xrflrrx.exe74⤵PID:2184
-
\??\c:\nbtnnh.exec:\nbtnnh.exe75⤵PID:1004
-
\??\c:\dpjdp.exec:\dpjdp.exe76⤵PID:2392
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe77⤵PID:2116
-
\??\c:\5frxllf.exec:\5frxllf.exe78⤵PID:1620
-
\??\c:\nnbbtt.exec:\nnbbtt.exe79⤵PID:1848
-
\??\c:\pjddj.exec:\pjddj.exe80⤵PID:2100
-
\??\c:\xfflfrf.exec:\xfflfrf.exe81⤵PID:1864
-
\??\c:\fxlrxff.exec:\fxlrxff.exe82⤵PID:2424
-
\??\c:\nhthnh.exec:\nhthnh.exe83⤵PID:2680
-
\??\c:\dvpdp.exec:\dvpdp.exe84⤵PID:2164
-
\??\c:\5xrflfl.exec:\5xrflfl.exe85⤵PID:2740
-
\??\c:\3lllfxx.exec:\3lllfxx.exe86⤵PID:2796
-
\??\c:\9nnnnn.exec:\9nnnnn.exe87⤵PID:2928
-
\??\c:\ppjvj.exec:\ppjvj.exe88⤵PID:2460
-
\??\c:\1fflrxf.exec:\1fflrxf.exe89⤵PID:2836
-
\??\c:\btbbbb.exec:\btbbbb.exe90⤵PID:2760
-
\??\c:\tbnhbt.exec:\tbnhbt.exe91⤵PID:2640
-
\??\c:\djpdp.exec:\djpdp.exe92⤵PID:2708
-
\??\c:\xrlflrx.exec:\xrlflrx.exe93⤵PID:1860
-
\??\c:\xfxlrfr.exec:\xfxlrfr.exe94⤵PID:3024
-
\??\c:\tbthnt.exec:\tbthnt.exe95⤵PID:1700
-
\??\c:\jvvvv.exec:\jvvvv.exe96⤵PID:1484
-
\??\c:\9jddp.exec:\9jddp.exe97⤵PID:1924
-
\??\c:\xrrrffl.exec:\xrrrffl.exe98⤵PID:2000
-
\??\c:\1btbhh.exec:\1btbhh.exe99⤵PID:1668
-
\??\c:\vjvdj.exec:\vjvdj.exe100⤵PID:2648
-
\??\c:\pjvdj.exec:\pjvdj.exe101⤵PID:2072
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe102⤵PID:2888
-
\??\c:\nhbtnb.exec:\nhbtnb.exe103⤵PID:2212
-
\??\c:\bbnbnn.exec:\bbnbnn.exe104⤵PID:332
-
\??\c:\dvjpj.exec:\dvjpj.exe105⤵PID:2556
-
\??\c:\3frrffx.exec:\3frrffx.exe106⤵PID:1492
-
\??\c:\7frllrl.exec:\7frllrl.exe107⤵PID:2196
-
\??\c:\btnntb.exec:\btnntb.exe108⤵PID:844
-
\??\c:\9btttb.exec:\9btttb.exe109⤵PID:1632
-
\??\c:\vvpvj.exec:\vvpvj.exe110⤵PID:1816
-
\??\c:\lfflxxl.exec:\lfflxxl.exe111⤵PID:1036
-
\??\c:\fxrfflx.exec:\fxrfflx.exe112⤵PID:600
-
\??\c:\ntnhtb.exec:\ntnhtb.exe113⤵PID:1780
-
\??\c:\pjjvd.exec:\pjjvd.exe114⤵PID:1760
-
\??\c:\jpjpj.exec:\jpjpj.exe115⤵PID:944
-
\??\c:\xfrlxlx.exec:\xfrlxlx.exe116⤵PID:2552
-
\??\c:\3thhnh.exec:\3thhnh.exe117⤵PID:2152
-
\??\c:\nnbbhh.exec:\nnbbhh.exe118⤵PID:2320
-
\??\c:\vppvv.exec:\vppvv.exe119⤵PID:1788
-
\??\c:\rlxfflf.exec:\rlxfflf.exe120⤵PID:1004
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe121⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-