Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 02:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe
-
Size
454KB
-
MD5
73eef3b57f280f6b61d189312e466169
-
SHA1
4f987f4a6cdf32c3bca3b21a495c693cffe7440f
-
SHA256
c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491
-
SHA512
32ab99fb682ec4e8d8af6021f83699702b1d312163fe5ff828e9176eaaaa61ac6bfed5e2dbb04081b2549a3ba9a38b55b140c2f4c77482c8a021275ad7f24ee9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-33-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-71-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1532-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-314-0x0000000077930000-0x0000000077A4F000-memory.dmp family_blackmoon behavioral1/memory/2800-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-362-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-378-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-700-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/768-783-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2364-822-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 vpdjp.exe 2780 rfflrxf.exe 2116 9pvdd.exe 2596 9rlrfrx.exe 2524 jvjdj.exe 2616 bthntb.exe 2188 jdvdj.exe 1532 3flllrf.exe 2548 jddjv.exe 2372 tnbnbh.exe 2540 1ddjj.exe 2388 9bhhhh.exe 1708 7bbbbt.exe 2448 nnhthh.exe 572 thnntb.exe 2236 9fxxfll.exe 2304 7nbbtt.exe 2340 fxlrxrf.exe 2428 nhnhnn.exe 764 5fxfrxf.exe 600 7thhnt.exe 968 ffflrxf.exe 1904 nhhhtt.exe 1588 ffrlrxl.exe 2668 tthnbh.exe 1360 vpjdv.exe 860 1lxxlxl.exe 2488 dvjpd.exe 1764 lfrlrxf.exe 812 vpddp.exe 2172 3lffrxx.exe 888 tnbbbb.exe 2788 jdpvj.exe 2828 nhbhnt.exe 2972 9jvdp.exe 1724 rrlrxfx.exe 2592 pvppd.exe 2800 fffflrr.exe 2568 hthnhh.exe 2524 jddvv.exe 3024 rfrrxxf.exe 2452 lxrlrlr.exe 1148 nbnnbb.exe 2956 7jjdj.exe 2508 lflrxfr.exe 2372 3hnhbn.exe 532 jvdvv.exe 2256 3xrrfff.exe 1956 nhhtbn.exe 1708 nbtthb.exe 332 3dvvd.exe 2224 xrfrxxf.exe 2044 bnttbh.exe 2528 vppdj.exe 2400 jpjpv.exe 1988 llrrrrr.exe 316 hbbhhn.exe 2296 vjvjj.exe 1540 lxrrxxf.exe 1908 llllrxx.exe 1484 nhthtt.exe 2844 pddvp.exe 1680 xrffllr.exe 2536 3nbbht.exe -
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-314-0x0000000077930000-0x0000000077A4F000-memory.dmp upx behavioral1/memory/2800-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-362-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2452-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-904-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbbbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2696 2336 c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe 30 PID 2336 wrote to memory of 2696 2336 c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe 30 PID 2336 wrote to memory of 2696 2336 c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe 30 PID 2336 wrote to memory of 2696 2336 c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe 30 PID 2696 wrote to memory of 2780 2696 vpdjp.exe 31 PID 2696 wrote to memory of 2780 2696 vpdjp.exe 31 PID 2696 wrote to memory of 2780 2696 vpdjp.exe 31 PID 2696 wrote to memory of 2780 2696 vpdjp.exe 31 PID 2780 wrote to memory of 2116 2780 rfflrxf.exe 32 PID 2780 wrote to memory of 2116 2780 rfflrxf.exe 32 PID 2780 wrote to memory of 2116 2780 rfflrxf.exe 32 PID 2780 wrote to memory of 2116 2780 rfflrxf.exe 32 PID 2116 wrote to memory of 2596 2116 9pvdd.exe 33 PID 2116 wrote to memory of 2596 2116 9pvdd.exe 33 PID 2116 wrote to memory of 2596 2116 9pvdd.exe 33 PID 2116 wrote to memory of 2596 2116 9pvdd.exe 33 PID 2596 wrote to memory of 2524 2596 9rlrfrx.exe 34 PID 2596 wrote to memory of 2524 2596 9rlrfrx.exe 34 PID 2596 wrote to memory of 2524 2596 9rlrfrx.exe 34 PID 2596 wrote to memory of 2524 2596 9rlrfrx.exe 34 PID 2524 wrote to memory of 2616 2524 jvjdj.exe 35 PID 2524 wrote to memory of 2616 2524 jvjdj.exe 35 PID 2524 wrote to memory of 2616 2524 jvjdj.exe 35 PID 2524 wrote to memory of 2616 2524 jvjdj.exe 35 PID 2616 wrote to memory of 2188 2616 bthntb.exe 36 PID 2616 wrote to memory of 2188 2616 bthntb.exe 36 PID 2616 wrote to memory of 2188 2616 bthntb.exe 36 PID 2616 wrote to memory of 2188 2616 bthntb.exe 36 PID 2188 wrote to memory of 1532 2188 jdvdj.exe 37 PID 2188 wrote to memory of 1532 2188 jdvdj.exe 37 PID 2188 wrote to memory of 1532 2188 jdvdj.exe 37 PID 2188 wrote to memory of 1532 2188 jdvdj.exe 37 PID 1532 wrote to memory of 2548 1532 3flllrf.exe 38 PID 1532 wrote to memory of 2548 1532 3flllrf.exe 38 PID 1532 wrote to memory of 2548 1532 3flllrf.exe 38 PID 1532 wrote to memory of 2548 1532 3flllrf.exe 38 PID 2548 wrote to memory of 2372 2548 jddjv.exe 39 PID 2548 wrote to memory of 2372 2548 jddjv.exe 39 PID 2548 wrote to memory of 2372 2548 jddjv.exe 39 PID 2548 wrote to memory of 2372 2548 jddjv.exe 39 PID 2372 wrote to memory of 2540 2372 tnbnbh.exe 40 PID 2372 wrote to memory of 2540 2372 tnbnbh.exe 40 PID 2372 wrote to memory of 2540 2372 tnbnbh.exe 40 PID 2372 wrote to memory of 2540 2372 tnbnbh.exe 40 PID 2540 wrote to memory of 2388 2540 1ddjj.exe 41 PID 2540 wrote to memory of 2388 2540 1ddjj.exe 41 PID 2540 wrote to memory of 2388 2540 1ddjj.exe 41 PID 2540 wrote to memory of 2388 2540 1ddjj.exe 41 PID 2388 wrote to memory of 1708 2388 9bhhhh.exe 42 PID 2388 wrote to memory of 1708 2388 9bhhhh.exe 42 PID 2388 wrote to memory of 1708 2388 9bhhhh.exe 42 PID 2388 wrote to memory of 1708 2388 9bhhhh.exe 42 PID 1708 wrote to memory of 2448 1708 7bbbbt.exe 43 PID 1708 wrote to memory of 2448 1708 7bbbbt.exe 43 PID 1708 wrote to memory of 2448 1708 7bbbbt.exe 43 PID 1708 wrote to memory of 2448 1708 7bbbbt.exe 43 PID 2448 wrote to memory of 572 2448 nnhthh.exe 44 PID 2448 wrote to memory of 572 2448 nnhthh.exe 44 PID 2448 wrote to memory of 572 2448 nnhthh.exe 44 PID 2448 wrote to memory of 572 2448 nnhthh.exe 44 PID 572 wrote to memory of 2236 572 thnntb.exe 45 PID 572 wrote to memory of 2236 572 thnntb.exe 45 PID 572 wrote to memory of 2236 572 thnntb.exe 45 PID 572 wrote to memory of 2236 572 thnntb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe"C:\Users\Admin\AppData\Local\Temp\c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\vpdjp.exec:\vpdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rfflrxf.exec:\rfflrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9pvdd.exec:\9pvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\9rlrfrx.exec:\9rlrfrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jvjdj.exec:\jvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bthntb.exec:\bthntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jdvdj.exec:\jdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\3flllrf.exec:\3flllrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jddjv.exec:\jddjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\tnbnbh.exec:\tnbnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1ddjj.exec:\1ddjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\9bhhhh.exec:\9bhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\7bbbbt.exec:\7bbbbt.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\nnhthh.exec:\nnhthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\thnntb.exec:\thnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\9fxxfll.exec:\9fxxfll.exe17⤵
- Executes dropped EXE
PID:2236 -
\??\c:\7nbbtt.exec:\7nbbtt.exe18⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fxlrxrf.exec:\fxlrxrf.exe19⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhnhnn.exec:\nhnhnn.exe20⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5fxfrxf.exec:\5fxfrxf.exe21⤵
- Executes dropped EXE
PID:764 -
\??\c:\7thhnt.exec:\7thhnt.exe22⤵
- Executes dropped EXE
PID:600 -
\??\c:\ffflrxf.exec:\ffflrxf.exe23⤵
- Executes dropped EXE
PID:968 -
\??\c:\nhhhtt.exec:\nhhhtt.exe24⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ffrlrxl.exec:\ffrlrxl.exe25⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tthnbh.exec:\tthnbh.exe26⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vpjdv.exec:\vpjdv.exe27⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1lxxlxl.exec:\1lxxlxl.exe28⤵
- Executes dropped EXE
PID:860 -
\??\c:\dvjpd.exec:\dvjpd.exe29⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lfrlrxf.exec:\lfrlrxf.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vpddp.exec:\vpddp.exe31⤵
- Executes dropped EXE
PID:812 -
\??\c:\3lffrxx.exec:\3lffrxx.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnbbbb.exec:\tnbbbb.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\jdpvj.exec:\jdpvj.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nhbhnt.exec:\nhbhnt.exe35⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9jvdp.exec:\9jvdp.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ffrrxrf.exec:\ffrrxrf.exe37⤵PID:2728
-
\??\c:\rrlrxfx.exec:\rrlrxfx.exe38⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pvppd.exec:\pvppd.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fffflrr.exec:\fffflrr.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hthnhh.exec:\hthnhh.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jddvv.exec:\jddvv.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lxrlrlr.exec:\lxrlrlr.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nbnnbb.exec:\nbnnbb.exe45⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7jjdj.exec:\7jjdj.exe46⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lflrxfr.exec:\lflrxfr.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3hnhbn.exec:\3hnhbn.exe48⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jvdvv.exec:\jvdvv.exe49⤵
- Executes dropped EXE
PID:532 -
\??\c:\3xrrfff.exec:\3xrrfff.exe50⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhhtbn.exec:\nhhtbn.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nbtthb.exec:\nbtthb.exe52⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3dvvd.exec:\3dvvd.exe53⤵
- Executes dropped EXE
PID:332 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe54⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bnttbh.exec:\bnttbh.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vppdj.exec:\vppdj.exe56⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jpjpv.exec:\jpjpv.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\llrrrrr.exec:\llrrrrr.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hbbhhn.exec:\hbbhhn.exe59⤵
- Executes dropped EXE
PID:316 -
\??\c:\vjvjj.exec:\vjvjj.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe61⤵
- Executes dropped EXE
PID:1540 -
\??\c:\llllrxx.exec:\llllrxx.exe62⤵
- Executes dropped EXE
PID:1908 -
\??\c:\nhthtt.exec:\nhthtt.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pddvp.exec:\pddvp.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrffllr.exec:\xrffllr.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\3nbbht.exec:\3nbbht.exe66⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tnbntt.exec:\tnbntt.exe67⤵PID:1820
-
\??\c:\jdvpv.exec:\jdvpv.exe68⤵PID:1360
-
\??\c:\llflrxl.exec:\llflrxl.exe69⤵PID:2156
-
\??\c:\bthhbt.exec:\bthhbt.exe70⤵PID:2912
-
\??\c:\hnhhnn.exec:\hnhhnn.exe71⤵PID:2864
-
\??\c:\dpjjv.exec:\dpjjv.exe72⤵PID:1040
-
\??\c:\3lxrxxl.exec:\3lxrxxl.exe73⤵PID:900
-
\??\c:\1bbtbb.exec:\1bbtbb.exe74⤵PID:1928
-
\??\c:\1jjpv.exec:\1jjpv.exe75⤵PID:2336
-
\??\c:\jvdpj.exec:\jvdpj.exe76⤵PID:2716
-
\??\c:\rrrflrr.exec:\rrrflrr.exe77⤵PID:2940
-
\??\c:\ttnbhn.exec:\ttnbhn.exe78⤵PID:2840
-
\??\c:\vvpdj.exec:\vvpdj.exe79⤵PID:1608
-
\??\c:\vpdpd.exec:\vpdpd.exe80⤵PID:2116
-
\??\c:\rlffllx.exec:\rlffllx.exe81⤵PID:2484
-
\??\c:\thtbhh.exec:\thtbhh.exe82⤵PID:2624
-
\??\c:\dddvp.exec:\dddvp.exe83⤵PID:2584
-
\??\c:\jvvvp.exec:\jvvvp.exe84⤵PID:2644
-
\??\c:\1rlrxrx.exec:\1rlrxrx.exe85⤵PID:2772
-
\??\c:\thttbb.exec:\thttbb.exe86⤵
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\vdvdj.exec:\vdvdj.exe87⤵PID:2056
-
\??\c:\pjdjp.exec:\pjdjp.exe88⤵PID:1532
-
\??\c:\lfxxflx.exec:\lfxxflx.exe89⤵PID:2504
-
\??\c:\nnnthh.exec:\nnnthh.exe90⤵PID:2444
-
\??\c:\hbtbnn.exec:\hbtbnn.exe91⤵PID:2608
-
\??\c:\1jvpp.exec:\1jvpp.exe92⤵PID:2372
-
\??\c:\xlxxffl.exec:\xlxxffl.exe93⤵PID:1052
-
\??\c:\7tnbnn.exec:\7tnbnn.exe94⤵PID:2256
-
\??\c:\dvjvp.exec:\dvjvp.exe95⤵PID:592
-
\??\c:\ppdjp.exec:\ppdjp.exe96⤵PID:1708
-
\??\c:\lxlxxxf.exec:\lxlxxxf.exe97⤵PID:332
-
\??\c:\hbnhhb.exec:\hbnhhb.exe98⤵PID:1768
-
\??\c:\tnbhnh.exec:\tnbhnh.exe99⤵PID:2712
-
\??\c:\5jjdd.exec:\5jjdd.exe100⤵PID:2352
-
\??\c:\xxlrffx.exec:\xxlrffx.exe101⤵PID:2340
-
\??\c:\hbtbnn.exec:\hbtbnn.exe102⤵PID:692
-
\??\c:\bnhnbt.exec:\bnhnbt.exe103⤵PID:960
-
\??\c:\vpddd.exec:\vpddd.exe104⤵PID:1520
-
\??\c:\llllxxl.exec:\llllxxl.exe105⤵PID:476
-
\??\c:\1flllrr.exec:\1flllrr.exe106⤵PID:928
-
\??\c:\bbtbhn.exec:\bbtbhn.exe107⤵PID:768
-
\??\c:\vjjpp.exec:\vjjpp.exe108⤵PID:340
-
\??\c:\fffxflr.exec:\fffxflr.exe109⤵PID:856
-
\??\c:\1lrxxxx.exec:\1lrxxxx.exe110⤵PID:1132
-
\??\c:\bntttt.exec:\bntttt.exe111⤵PID:2536
-
\??\c:\1vdvd.exec:\1vdvd.exe112⤵PID:2744
-
\??\c:\fllrffl.exec:\fllrffl.exe113⤵PID:2364
-
\??\c:\ttnntb.exec:\ttnntb.exe114⤵PID:2140
-
\??\c:\dpdvj.exec:\dpdvj.exe115⤵PID:1872
-
\??\c:\9rffrxl.exec:\9rffrxl.exe116⤵PID:2920
-
\??\c:\tthntt.exec:\tthntt.exe117⤵PID:2192
-
\??\c:\vjpjj.exec:\vjpjj.exe118⤵PID:2708
-
\??\c:\ddvpv.exec:\ddvpv.exe119⤵PID:2724
-
\??\c:\xlffxff.exec:\xlffxff.exe120⤵PID:2832
-
\??\c:\hhbbhh.exec:\hhbbhh.exe121⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-