Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe
-
Size
454KB
-
MD5
3860349dc828caa159a980ff515ced7a
-
SHA1
a6c9539a393e8f21e53539243a679d6b9a62fc8f
-
SHA256
83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1
-
SHA512
f97d8bbb88f60f1a138819a7e52711238aea8759746c5834535cf0dd9d8fcb3739009437c08cf48ce0fbb7f25aae5c02e289efa01a8dc4e019a9493ee5494167
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2868-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-307-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/852-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-497-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-747-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2040-746-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1584-880-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-954-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2680-976-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2680-978-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2404-1041-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2812-1085-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/784-1098-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-1270-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1388-1304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-1356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 nhttbb.exe 836 dpddd.exe 2408 rrlfllf.exe 1212 nhtthh.exe 548 tbtnbb.exe 2428 9vjdp.exe 3012 llrffrf.exe 2748 btbhtb.exe 2588 1nbbnn.exe 2252 pdppv.exe 2504 9rffllx.exe 2416 fxlxxrr.exe 2300 7bhntn.exe 2948 nnbntb.exe 1780 xxxlrlr.exe 2444 7btnnt.exe 1708 1nhntb.exe 2028 1dpdp.exe 1184 nthbtt.exe 2384 3hnnnn.exe 1924 fxlrfxf.exe 2572 ddvvd.exe 2676 3djpj.exe 2372 dvpdj.exe 2356 pdjjv.exe 1536 rxfxxlr.exe 1556 9vdvj.exe 1900 nnhntt.exe 2792 ddppd.exe 2276 7fxrfxl.exe 668 btbttn.exe 2996 9vjdj.exe 2924 lxrffxf.exe 2100 7bnbhh.exe 1636 vpvdj.exe 2400 lxffllr.exe 2124 lrrlxxf.exe 2264 5htthh.exe 2292 vpvvj.exe 1292 dvddd.exe 2200 3frrxxx.exe 2428 9ttntn.exe 852 nntbnn.exe 2608 pvjpv.exe 1776 pjvvv.exe 2784 fxlllfr.exe 2672 thtbnh.exe 1384 7bnntb.exe 2508 pjvdp.exe 2692 pjpjd.exe 2604 lfrlrlr.exe 2560 nnhhnn.exe 2524 thtbnh.exe 1784 dpdvv.exe 1716 1ffrxll.exe 2244 llxffxx.exe 2232 htbtbb.exe 1272 ttnnnn.exe 2036 ddpvv.exe 2008 xrrxlfx.exe 1932 thnhtn.exe 1904 tnbhtt.exe 2704 ddppd.exe 2696 9xrrrrx.exe -
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-880-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2844-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-954-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2680-976-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1228-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-1042-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-1295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-1304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-1315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-1323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-1356-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2192 2868 83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe 28 PID 2868 wrote to memory of 2192 2868 83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe 28 PID 2868 wrote to memory of 2192 2868 83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe 28 PID 2868 wrote to memory of 2192 2868 83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe 28 PID 2192 wrote to memory of 836 2192 nhttbb.exe 29 PID 2192 wrote to memory of 836 2192 nhttbb.exe 29 PID 2192 wrote to memory of 836 2192 nhttbb.exe 29 PID 2192 wrote to memory of 836 2192 nhttbb.exe 29 PID 836 wrote to memory of 2408 836 dpddd.exe 30 PID 836 wrote to memory of 2408 836 dpddd.exe 30 PID 836 wrote to memory of 2408 836 dpddd.exe 30 PID 836 wrote to memory of 2408 836 dpddd.exe 30 PID 2408 wrote to memory of 1212 2408 rrlfllf.exe 31 PID 2408 wrote to memory of 1212 2408 rrlfllf.exe 31 PID 2408 wrote to memory of 1212 2408 rrlfllf.exe 31 PID 2408 wrote to memory of 1212 2408 rrlfllf.exe 31 PID 1212 wrote to memory of 548 1212 nhtthh.exe 32 PID 1212 wrote to memory of 548 1212 nhtthh.exe 32 PID 1212 wrote to memory of 548 1212 nhtthh.exe 32 PID 1212 wrote to memory of 548 1212 nhtthh.exe 32 PID 548 wrote to memory of 2428 548 tbtnbb.exe 33 PID 548 wrote to memory of 2428 548 tbtnbb.exe 33 PID 548 wrote to memory of 2428 548 tbtnbb.exe 33 PID 548 wrote to memory of 2428 548 tbtnbb.exe 33 PID 2428 wrote to memory of 3012 2428 9vjdp.exe 34 PID 2428 wrote to memory of 3012 2428 9vjdp.exe 34 PID 2428 wrote to memory of 3012 2428 9vjdp.exe 34 PID 2428 wrote to memory of 3012 2428 9vjdp.exe 34 PID 3012 wrote to memory of 2748 3012 llrffrf.exe 35 PID 3012 wrote to memory of 2748 3012 llrffrf.exe 35 PID 3012 wrote to memory of 2748 3012 llrffrf.exe 35 PID 3012 wrote to memory of 2748 3012 llrffrf.exe 35 PID 2748 wrote to memory of 2588 2748 btbhtb.exe 36 PID 2748 wrote to memory of 2588 2748 btbhtb.exe 36 PID 2748 wrote to memory of 2588 2748 btbhtb.exe 36 PID 2748 wrote to memory of 2588 2748 btbhtb.exe 36 PID 2588 wrote to memory of 2252 2588 1nbbnn.exe 37 PID 2588 wrote to memory of 2252 2588 1nbbnn.exe 37 PID 2588 wrote to memory of 2252 2588 1nbbnn.exe 37 PID 2588 wrote to memory of 2252 2588 1nbbnn.exe 37 PID 2252 wrote to memory of 2504 2252 pdppv.exe 38 PID 2252 wrote to memory of 2504 2252 pdppv.exe 38 PID 2252 wrote to memory of 2504 2252 pdppv.exe 38 PID 2252 wrote to memory of 2504 2252 pdppv.exe 38 PID 2504 wrote to memory of 2416 2504 9rffllx.exe 39 PID 2504 wrote to memory of 2416 2504 9rffllx.exe 39 PID 2504 wrote to memory of 2416 2504 9rffllx.exe 39 PID 2504 wrote to memory of 2416 2504 9rffllx.exe 39 PID 2416 wrote to memory of 2300 2416 fxlxxrr.exe 40 PID 2416 wrote to memory of 2300 2416 fxlxxrr.exe 40 PID 2416 wrote to memory of 2300 2416 fxlxxrr.exe 40 PID 2416 wrote to memory of 2300 2416 fxlxxrr.exe 40 PID 2300 wrote to memory of 2948 2300 7bhntn.exe 41 PID 2300 wrote to memory of 2948 2300 7bhntn.exe 41 PID 2300 wrote to memory of 2948 2300 7bhntn.exe 41 PID 2300 wrote to memory of 2948 2300 7bhntn.exe 41 PID 2948 wrote to memory of 1780 2948 nnbntb.exe 42 PID 2948 wrote to memory of 1780 2948 nnbntb.exe 42 PID 2948 wrote to memory of 1780 2948 nnbntb.exe 42 PID 2948 wrote to memory of 1780 2948 nnbntb.exe 42 PID 1780 wrote to memory of 2444 1780 xxxlrlr.exe 43 PID 1780 wrote to memory of 2444 1780 xxxlrlr.exe 43 PID 1780 wrote to memory of 2444 1780 xxxlrlr.exe 43 PID 1780 wrote to memory of 2444 1780 xxxlrlr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe"C:\Users\Admin\AppData\Local\Temp\83ecdb61aa4be397d1158ba61fc376200931168502162694350696ae07a2abd1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\nhttbb.exec:\nhttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\dpddd.exec:\dpddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\rrlfllf.exec:\rrlfllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\nhtthh.exec:\nhtthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\tbtnbb.exec:\tbtnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\9vjdp.exec:\9vjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\llrffrf.exec:\llrffrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\btbhtb.exec:\btbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\1nbbnn.exec:\1nbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pdppv.exec:\pdppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\9rffllx.exec:\9rffllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\fxlxxrr.exec:\fxlxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\7bhntn.exec:\7bhntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\nnbntb.exec:\nnbntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xxxlrlr.exec:\xxxlrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\7btnnt.exec:\7btnnt.exe17⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1nhntb.exec:\1nhntb.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1dpdp.exec:\1dpdp.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nthbtt.exec:\nthbtt.exe20⤵
- Executes dropped EXE
PID:1184 -
\??\c:\3hnnnn.exec:\3hnnnn.exe21⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe22⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ddvvd.exec:\ddvvd.exe23⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3djpj.exec:\3djpj.exe24⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvpdj.exec:\dvpdj.exe25⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pdjjv.exec:\pdjjv.exe26⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rxfxxlr.exec:\rxfxxlr.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\9vdvj.exec:\9vdvj.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nnhntt.exec:\nnhntt.exe29⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ddppd.exec:\ddppd.exe30⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7fxrfxl.exec:\7fxrfxl.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\btbttn.exec:\btbttn.exe32⤵
- Executes dropped EXE
PID:668 -
\??\c:\9vjdj.exec:\9vjdj.exe33⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lxrffxf.exec:\lxrffxf.exe34⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7bnbhh.exec:\7bnbhh.exe35⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vpvdj.exec:\vpvdj.exe36⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lxffllr.exec:\lxffllr.exe37⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lrrlxxf.exec:\lrrlxxf.exe38⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5htthh.exec:\5htthh.exe39⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vpvvj.exec:\vpvvj.exe40⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvddd.exec:\dvddd.exe41⤵
- Executes dropped EXE
PID:1292 -
\??\c:\3frrxxx.exec:\3frrxxx.exe42⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9ttntn.exec:\9ttntn.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nntbnn.exec:\nntbnn.exe44⤵
- Executes dropped EXE
PID:852 -
\??\c:\pvjpv.exec:\pvjpv.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608 -
\??\c:\pjvvv.exec:\pjvvv.exe46⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fxlllfr.exec:\fxlllfr.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\thtbnh.exec:\thtbnh.exe48⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7bnntb.exec:\7bnntb.exe49⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pjvdp.exec:\pjvdp.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pjpjd.exec:\pjpjd.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe52⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nnhhnn.exec:\nnhhnn.exe53⤵
- Executes dropped EXE
PID:2560 -
\??\c:\thtbnh.exec:\thtbnh.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dpdvv.exec:\dpdvv.exe55⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1ffrxll.exec:\1ffrxll.exe56⤵
- Executes dropped EXE
PID:1716 -
\??\c:\llxffxx.exec:\llxffxx.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\htbtbb.exec:\htbtbb.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232 -
\??\c:\ttnnnn.exec:\ttnnnn.exe59⤵
- Executes dropped EXE
PID:1272 -
\??\c:\ddpvv.exec:\ddpvv.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrrxlfx.exec:\xrrxlfx.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thnhtn.exec:\thnhtn.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tnbhtt.exec:\tnbhtt.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddppd.exec:\ddppd.exe64⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9xrrrrx.exec:\9xrrrrx.exe65⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxlrllx.exec:\fxlrllx.exe66⤵PID:2916
-
\??\c:\tnnttt.exec:\tnnttt.exe67⤵PID:552
-
\??\c:\pdvvv.exec:\pdvvv.exe68⤵PID:2804
-
\??\c:\vvjjv.exec:\vvjjv.exe69⤵PID:2364
-
\??\c:\lxfxxll.exec:\lxfxxll.exe70⤵PID:1884
-
\??\c:\fxllrll.exec:\fxllrll.exe71⤵PID:1316
-
\??\c:\btnntn.exec:\btnntn.exe72⤵PID:1712
-
\??\c:\9pddv.exec:\9pddv.exe73⤵PID:1100
-
\??\c:\1pjpd.exec:\1pjpd.exe74⤵PID:1664
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe75⤵PID:544
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe76⤵PID:2164
-
\??\c:\1bnthb.exec:\1bnthb.exe77⤵PID:1740
-
\??\c:\pvjdp.exec:\pvjdp.exe78⤵PID:2972
-
\??\c:\vjvpp.exec:\vjvpp.exe79⤵PID:2848
-
\??\c:\3xlffll.exec:\3xlffll.exe80⤵PID:1640
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe81⤵PID:1588
-
\??\c:\tntbbb.exec:\tntbbb.exe82⤵PID:1636
-
\??\c:\hthhnn.exec:\hthhnn.exe83⤵PID:2192
-
\??\c:\1jddp.exec:\1jddp.exe84⤵PID:2448
-
\??\c:\rrrrfll.exec:\rrrrfll.exe85⤵PID:2264
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe86⤵PID:1056
-
\??\c:\1bbbnn.exec:\1bbbnn.exe87⤵PID:1292
-
\??\c:\pjvdp.exec:\pjvdp.exe88⤵PID:548
-
\??\c:\9vpvd.exec:\9vpvd.exe89⤵PID:2428
-
\??\c:\9frflfx.exec:\9frflfx.exe90⤵PID:2764
-
\??\c:\bnhhnn.exec:\bnhhnn.exe91⤵PID:3004
-
\??\c:\1btbbb.exec:\1btbbb.exe92⤵PID:2684
-
\??\c:\7dppv.exec:\7dppv.exe93⤵PID:2768
-
\??\c:\9pdvv.exec:\9pdvv.exe94⤵PID:2116
-
\??\c:\rlfflll.exec:\rlfflll.exe95⤵PID:2736
-
\??\c:\9tntnb.exec:\9tntnb.exe96⤵PID:2480
-
\??\c:\5hbbhb.exec:\5hbbhb.exe97⤵PID:2416
-
\??\c:\ppdjp.exec:\ppdjp.exe98⤵PID:2132
-
\??\c:\1vppp.exec:\1vppp.exe99⤵PID:2656
-
\??\c:\flrxlfr.exec:\flrxlfr.exe100⤵PID:2280
-
\??\c:\bttbhb.exec:\bttbhb.exe101⤵PID:2216
-
\??\c:\ttntbt.exec:\ttntbt.exe102⤵PID:1916
-
\??\c:\jdpvj.exec:\jdpvj.exe103⤵PID:1200
-
\??\c:\frxrxxl.exec:\frxrxxl.exe104⤵PID:2240
-
\??\c:\3frrrrx.exec:\3frrrrx.exe105⤵PID:2040
-
\??\c:\tnbtnn.exec:\tnbtnn.exe106⤵PID:1796
-
\??\c:\3jddd.exec:\3jddd.exe107⤵PID:1960
-
\??\c:\5vppv.exec:\5vppv.exe108⤵PID:1856
-
\??\c:\xlfflfr.exec:\xlfflfr.exe109⤵PID:2544
-
\??\c:\rrffllx.exec:\rrffllx.exe110⤵PID:2700
-
\??\c:\nhbhnt.exec:\nhbhnt.exe111⤵PID:2796
-
\??\c:\3pdpp.exec:\3pdpp.exe112⤵PID:2832
-
\??\c:\9djvd.exec:\9djvd.exe113⤵PID:2812
-
\??\c:\lxllllr.exec:\lxllllr.exe114⤵PID:1132
-
\??\c:\lxlfllf.exec:\lxlfllf.exe115⤵PID:2320
-
\??\c:\bnttbh.exec:\bnttbh.exe116⤵PID:1308
-
\??\c:\7jpjp.exec:\7jpjp.exe117⤵PID:1372
-
\??\c:\jjvdd.exec:\jjvdd.exe118⤵PID:1656
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe119⤵PID:1712
-
\??\c:\fxfflrx.exec:\fxfflrx.exe120⤵PID:3028
-
\??\c:\btbhhh.exec:\btbhhh.exe121⤵PID:1664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-