Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 00:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe
-
Size
453KB
-
MD5
e397452dc86f606cdd1b549c9585d421
-
SHA1
46d32cfd288736519e766c6aecde1e1cc449ca79
-
SHA256
7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd
-
SHA512
2c2006e58da996254e20e335b306e70d70723308bd9798f86cb9f662f72f64436cc956ff4b133abaecb0138923824f8d9bf9106a8f67156868b653173739eb1c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2500-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/476-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/348-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-216-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1244-228-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-237-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1400-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-278-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2420-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-324-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-463-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/288-476-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1048-489-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-669-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1576-708-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2372-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-783-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-817-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2536-834-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1584-859-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2196-868-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-965-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1952 1tnnhn.exe 2560 rrfrxfr.exe 2412 3djpv.exe 1984 9rfrlrl.exe 476 jjddj.exe 2780 xfrxxxl.exe 2784 9jdvd.exe 3008 dpdpd.exe 2980 xlrxfrx.exe 2800 1pdjp.exe 2648 btbhnn.exe 2684 lfllrxx.exe 1088 thhnbh.exe 1412 9vjdj.exe 2372 flflffx.exe 1176 5nhhnb.exe 1628 btbhnt.exe 1640 vjvpv.exe 2264 bhntth.exe 1736 nbtthb.exe 348 tntbbb.exe 1044 hhnntt.exe 1264 nbhnnn.exe 1244 hbhhhh.exe 1916 btbhnt.exe 1400 ttbhnt.exe 920 tnttbb.exe 544 ppdjp.exe 2232 xxllrll.exe 1788 1htbnn.exe 2320 xfrlxxf.exe 828 nhtbhn.exe 1684 dpjpd.exe 2420 1rfxrll.exe 2560 btthhn.exe 2820 ddvpj.exe 2176 vvddj.exe 2740 lfllllr.exe 2864 1htnnn.exe 2872 9nbhnn.exe 2748 pjdvv.exe 2484 rxllrrr.exe 2668 ttbbhb.exe 2680 thhhhb.exe 2628 ppvvv.exe 2696 3lrrxfl.exe 2488 3rlrxfr.exe 2148 hbhtbh.exe 2948 ddjjp.exe 2956 1pvdj.exe 1872 lllrlrr.exe 2372 1nnbbb.exe 2160 vpvvv.exe 1596 ddddd.exe 2080 ffffrlr.exe 1892 ttbbhn.exe 1048 vvddd.exe 288 1vppv.exe 348 xfrrxrf.exe 628 3nhntt.exe 1044 ntbbht.exe 2940 5dpvd.exe 3040 xlrfrfx.exe 1680 lxllffr.exe -
resource yara_rule behavioral1/memory/2500-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-265-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2320-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-324-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2560-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-331-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2748-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-950-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1952 2500 7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe 30 PID 2500 wrote to memory of 1952 2500 7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe 30 PID 2500 wrote to memory of 1952 2500 7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe 30 PID 2500 wrote to memory of 1952 2500 7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe 30 PID 1952 wrote to memory of 2560 1952 1tnnhn.exe 31 PID 1952 wrote to memory of 2560 1952 1tnnhn.exe 31 PID 1952 wrote to memory of 2560 1952 1tnnhn.exe 31 PID 1952 wrote to memory of 2560 1952 1tnnhn.exe 31 PID 2560 wrote to memory of 2412 2560 rrfrxfr.exe 32 PID 2560 wrote to memory of 2412 2560 rrfrxfr.exe 32 PID 2560 wrote to memory of 2412 2560 rrfrxfr.exe 32 PID 2560 wrote to memory of 2412 2560 rrfrxfr.exe 32 PID 2412 wrote to memory of 1984 2412 3djpv.exe 33 PID 2412 wrote to memory of 1984 2412 3djpv.exe 33 PID 2412 wrote to memory of 1984 2412 3djpv.exe 33 PID 2412 wrote to memory of 1984 2412 3djpv.exe 33 PID 1984 wrote to memory of 476 1984 9rfrlrl.exe 34 PID 1984 wrote to memory of 476 1984 9rfrlrl.exe 34 PID 1984 wrote to memory of 476 1984 9rfrlrl.exe 34 PID 1984 wrote to memory of 476 1984 9rfrlrl.exe 34 PID 476 wrote to memory of 2780 476 jjddj.exe 35 PID 476 wrote to memory of 2780 476 jjddj.exe 35 PID 476 wrote to memory of 2780 476 jjddj.exe 35 PID 476 wrote to memory of 2780 476 jjddj.exe 35 PID 2780 wrote to memory of 2784 2780 xfrxxxl.exe 36 PID 2780 wrote to memory of 2784 2780 xfrxxxl.exe 36 PID 2780 wrote to memory of 2784 2780 xfrxxxl.exe 36 PID 2780 wrote to memory of 2784 2780 xfrxxxl.exe 36 PID 2784 wrote to memory of 3008 2784 9jdvd.exe 37 PID 2784 wrote to memory of 3008 2784 9jdvd.exe 37 PID 2784 wrote to memory of 3008 2784 9jdvd.exe 37 PID 2784 wrote to memory of 3008 2784 9jdvd.exe 37 PID 3008 wrote to memory of 2980 3008 dpdpd.exe 38 PID 3008 wrote to memory of 2980 3008 dpdpd.exe 38 PID 3008 wrote to memory of 2980 3008 dpdpd.exe 38 PID 3008 wrote to memory of 2980 3008 dpdpd.exe 38 PID 2980 wrote to memory of 2800 2980 xlrxfrx.exe 39 PID 2980 wrote to memory of 2800 2980 xlrxfrx.exe 39 PID 2980 wrote to memory of 2800 2980 xlrxfrx.exe 39 PID 2980 wrote to memory of 2800 2980 xlrxfrx.exe 39 PID 2800 wrote to memory of 2648 2800 1pdjp.exe 40 PID 2800 wrote to memory of 2648 2800 1pdjp.exe 40 PID 2800 wrote to memory of 2648 2800 1pdjp.exe 40 PID 2800 wrote to memory of 2648 2800 1pdjp.exe 40 PID 2648 wrote to memory of 2684 2648 btbhnn.exe 41 PID 2648 wrote to memory of 2684 2648 btbhnn.exe 41 PID 2648 wrote to memory of 2684 2648 btbhnn.exe 41 PID 2648 wrote to memory of 2684 2648 btbhnn.exe 41 PID 2684 wrote to memory of 1088 2684 lfllrxx.exe 42 PID 2684 wrote to memory of 1088 2684 lfllrxx.exe 42 PID 2684 wrote to memory of 1088 2684 lfllrxx.exe 42 PID 2684 wrote to memory of 1088 2684 lfllrxx.exe 42 PID 1088 wrote to memory of 1412 1088 thhnbh.exe 43 PID 1088 wrote to memory of 1412 1088 thhnbh.exe 43 PID 1088 wrote to memory of 1412 1088 thhnbh.exe 43 PID 1088 wrote to memory of 1412 1088 thhnbh.exe 43 PID 1412 wrote to memory of 2372 1412 9vjdj.exe 44 PID 1412 wrote to memory of 2372 1412 9vjdj.exe 44 PID 1412 wrote to memory of 2372 1412 9vjdj.exe 44 PID 1412 wrote to memory of 2372 1412 9vjdj.exe 44 PID 2372 wrote to memory of 1176 2372 flflffx.exe 45 PID 2372 wrote to memory of 1176 2372 flflffx.exe 45 PID 2372 wrote to memory of 1176 2372 flflffx.exe 45 PID 2372 wrote to memory of 1176 2372 flflffx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe"C:\Users\Admin\AppData\Local\Temp\7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\1tnnhn.exec:\1tnnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rrfrxfr.exec:\rrfrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\3djpv.exec:\3djpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\9rfrlrl.exec:\9rfrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jjddj.exec:\jjddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\xfrxxxl.exec:\xfrxxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9jdvd.exec:\9jdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\dpdpd.exec:\dpdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\xlrxfrx.exec:\xlrxfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\1pdjp.exec:\1pdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\btbhnn.exec:\btbhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lfllrxx.exec:\lfllrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\thhnbh.exec:\thhnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\9vjdj.exec:\9vjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\flflffx.exec:\flflffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\5nhhnb.exec:\5nhhnb.exe17⤵
- Executes dropped EXE
PID:1176 -
\??\c:\btbhnt.exec:\btbhnt.exe18⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjvpv.exec:\vjvpv.exe19⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bhntth.exec:\bhntth.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nbtthb.exec:\nbtthb.exe21⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tntbbb.exec:\tntbbb.exe22⤵
- Executes dropped EXE
PID:348 -
\??\c:\hhnntt.exec:\hhnntt.exe23⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nbhnnn.exec:\nbhnnn.exe24⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hbhhhh.exec:\hbhhhh.exe25⤵
- Executes dropped EXE
PID:1244 -
\??\c:\btbhnt.exec:\btbhnt.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\ttbhnt.exec:\ttbhnt.exe27⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tnttbb.exec:\tnttbb.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\ppdjp.exec:\ppdjp.exe29⤵
- Executes dropped EXE
PID:544 -
\??\c:\xxllrll.exec:\xxllrll.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1htbnn.exec:\1htbnn.exe31⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xfrlxxf.exec:\xfrlxxf.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhtbhn.exec:\nhtbhn.exe33⤵
- Executes dropped EXE
PID:828 -
\??\c:\dpjpd.exec:\dpjpd.exe34⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1rfxrll.exec:\1rfxrll.exe35⤵
- Executes dropped EXE
PID:2420 -
\??\c:\btthhn.exec:\btthhn.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ddvpj.exec:\ddvpj.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vvddj.exec:\vvddj.exe38⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lfllllr.exec:\lfllllr.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1htnnn.exec:\1htnnn.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9nbhnn.exec:\9nbhnn.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjdvv.exec:\pjdvv.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rxllrrr.exec:\rxllrrr.exe43⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ttbbhb.exec:\ttbbhb.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\thhhhb.exec:\thhhhb.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ppvvv.exec:\ppvvv.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3lrrxfl.exec:\3lrrxfl.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\3rlrxfr.exec:\3rlrxfr.exe48⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbhtbh.exec:\hbhtbh.exe49⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ddjjp.exec:\ddjjp.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1pvdj.exec:\1pvdj.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lllrlrr.exec:\lllrlrr.exe52⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1nnbbb.exec:\1nnbbb.exe53⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpvvv.exec:\vpvvv.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ddddd.exec:\ddddd.exe55⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ffffrlr.exec:\ffffrlr.exe56⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ttbbhn.exec:\ttbbhn.exe57⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vvddd.exec:\vvddd.exe58⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1vppv.exec:\1vppv.exe59⤵
- Executes dropped EXE
PID:288 -
\??\c:\xfrrxrf.exec:\xfrrxrf.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\3nhntt.exec:\3nhntt.exe61⤵
- Executes dropped EXE
PID:628 -
\??\c:\ntbbht.exec:\ntbbht.exe62⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5dpvd.exec:\5dpvd.exe63⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xlrfrfx.exec:\xlrfrfx.exe64⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lxllffr.exec:\lxllffr.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hbhntb.exec:\hbhntb.exe66⤵PID:1016
-
\??\c:\vvdjp.exec:\vvdjp.exe67⤵PID:2476
-
\??\c:\flxlxlx.exec:\flxlxlx.exe68⤵PID:2100
-
\??\c:\rrflxxf.exec:\rrflxxf.exe69⤵PID:1492
-
\??\c:\tbhhnn.exec:\tbhhnn.exe70⤵PID:1968
-
\??\c:\nhnnnn.exec:\nhnnnn.exe71⤵PID:556
-
\??\c:\vvddj.exec:\vvddj.exe72⤵PID:1420
-
\??\c:\9rlrflr.exec:\9rlrflr.exe73⤵PID:1700
-
\??\c:\htbhhh.exec:\htbhhh.exe74⤵PID:1560
-
\??\c:\hhnhhn.exec:\hhnhhn.exe75⤵PID:2596
-
\??\c:\jjdvd.exec:\jjdvd.exe76⤵PID:2544
-
\??\c:\1dvjp.exec:\1dvjp.exe77⤵PID:2120
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe78⤵PID:2712
-
\??\c:\tnthhh.exec:\tnthhh.exe79⤵PID:2716
-
\??\c:\9nbbhh.exec:\9nbbhh.exe80⤵PID:264
-
\??\c:\pvjjj.exec:\pvjjj.exe81⤵PID:2176
-
\??\c:\xxlrrxx.exec:\xxlrrxx.exe82⤵PID:2844
-
\??\c:\hbttbh.exec:\hbttbh.exe83⤵PID:2788
-
\??\c:\nnttbb.exec:\nnttbb.exe84⤵PID:2764
-
\??\c:\vdppj.exec:\vdppj.exe85⤵PID:2660
-
\??\c:\1rfllrr.exec:\1rfllrr.exe86⤵PID:2332
-
\??\c:\rrflrxx.exec:\rrflrxx.exe87⤵PID:2828
-
\??\c:\ttbttt.exec:\ttbttt.exe88⤵PID:2800
-
\??\c:\pdjpd.exec:\pdjpd.exe89⤵PID:2652
-
\??\c:\vvpjp.exec:\vvpjp.exe90⤵PID:2304
-
\??\c:\xllrxfl.exec:\xllrxfl.exe91⤵PID:1268
-
\??\c:\lrfxxfl.exec:\lrfxxfl.exe92⤵PID:2964
-
\??\c:\hntbhb.exec:\hntbhb.exe93⤵PID:1412
-
\??\c:\jpdpp.exec:\jpdpp.exe94⤵PID:2956
-
\??\c:\vdvdp.exec:\vdvdp.exe95⤵PID:1576
-
\??\c:\llrrrxf.exec:\llrrrxf.exe96⤵PID:2372
-
\??\c:\xfrlllr.exec:\xfrlllr.exe97⤵PID:1752
-
\??\c:\hbntbh.exec:\hbntbh.exe98⤵PID:2192
-
\??\c:\vvjjj.exec:\vvjjj.exe99⤵PID:2080
-
\??\c:\ppppv.exec:\ppppv.exe100⤵PID:2552
-
\??\c:\rflrxxx.exec:\rflrxxx.exe101⤵PID:2312
-
\??\c:\5hbbhh.exec:\5hbbhh.exe102⤵
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\ththhb.exec:\ththhb.exe103⤵PID:1528
-
\??\c:\jpdjp.exec:\jpdjp.exe104⤵PID:1144
-
\??\c:\5frxffl.exec:\5frxffl.exe105⤵PID:2600
-
\??\c:\lrlllll.exec:\lrlllll.exe106⤵PID:1668
-
\??\c:\tnbthn.exec:\tnbthn.exe107⤵PID:1732
-
\??\c:\vdvdj.exec:\vdvdj.exe108⤵PID:1652
-
\??\c:\dvjjp.exec:\dvjjp.exe109⤵PID:892
-
\??\c:\xxllrxf.exec:\xxllrxf.exe110⤵PID:572
-
\??\c:\1hthtb.exec:\1hthtb.exe111⤵PID:1540
-
\??\c:\3vpjj.exec:\3vpjj.exe112⤵
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\1jddj.exec:\1jddj.exe113⤵PID:2268
-
\??\c:\9lffffl.exec:\9lffffl.exe114⤵PID:876
-
\??\c:\nnnntb.exec:\nnnntb.exe115⤵PID:2224
-
\??\c:\hbnnnh.exec:\hbnnnh.exe116⤵PID:1584
-
\??\c:\1vpjd.exec:\1vpjd.exe117⤵PID:1588
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe118⤵PID:1952
-
\??\c:\flllffl.exec:\flllffl.exe119⤵PID:1932
-
\??\c:\3nttnn.exec:\3nttnn.exe120⤵PID:2196
-
\??\c:\3pdpd.exec:\3pdpd.exe121⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-