Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe
-
Size
454KB
-
MD5
d2082844fdb1d2289f641e1cebf22ffa
-
SHA1
87b3841f8dbb98119140f2a385126e5f39663045
-
SHA256
caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432
-
SHA512
42bb7f46c5ed45cc994cc971cf0b9480b053b0a73817330576c290bfbbef452c8b6961a43f785a5c15b38e5db54c5f5c50bb8f407f2a8f9ba057362b21a6707e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1956-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-55-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2844-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-132-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/804-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-522-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1724-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-919-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2312-933-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1172-1014-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/904-1151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-1171-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/904-1172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 1jdvv.exe 2368 vvjvj.exe 1528 ddjvj.exe 2916 5nbntb.exe 2752 dvppv.exe 2844 vvpvj.exe 2848 dvppj.exe 2780 hhbnth.exe 1744 ppjpd.exe 2624 1hhntb.exe 2176 pjvvd.exe 2352 hbthnt.exe 2040 1bthnn.exe 2020 dvdjj.exe 804 btntht.exe 2936 5pddp.exe 536 9ththt.exe 2980 fxlrrrx.exe 2128 thbbtb.exe 1520 llllrrf.exe 2136 rlxlxxr.exe 1796 9jvvv.exe 1344 rlrxrrl.exe 3052 frllrxl.exe 1400 5dddd.exe 944 1hnthh.exe 1084 5dvdj.exe 1756 1rfllll.exe 2480 jdpjp.exe 1160 7nbnbb.exe 880 jvjpd.exe 1956 1lllffl.exe 1576 nnhhnt.exe 2116 vvpjv.exe 2420 7frlrrr.exe 1164 nhnnnt.exe 904 tnhhtb.exe 2916 pjvvd.exe 2816 lfrxflx.exe 2840 rflllfr.exe 2764 tttbnb.exe 2828 dvvvv.exe 2912 vpdvd.exe 2776 rlxxxfx.exe 2616 rlrrfxf.exe 2684 hbtbhh.exe 2900 ppjvj.exe 2176 5vvdj.exe 848 rflffff.exe 1120 1thhtb.exe 588 nhhntb.exe 1496 dvjjj.exe 2680 rrflrrx.exe 1168 xrlrxxf.exe 1664 hbbbbb.exe 1196 5pppj.exe 2096 jdppd.exe 1336 ffxflxl.exe 1200 1nhtbn.exe 1520 jjjvv.exe 888 jdpvd.exe 1620 xrffrxl.exe 284 9fxxllx.exe 2108 hhbbhn.exe -
resource yara_rule behavioral1/memory/1956-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-132-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2040-131-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/804-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-959-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-1064-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-1077-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-1239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-1252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-1295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1352-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2408 1956 caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe 30 PID 1956 wrote to memory of 2408 1956 caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe 30 PID 1956 wrote to memory of 2408 1956 caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe 30 PID 1956 wrote to memory of 2408 1956 caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe 30 PID 2408 wrote to memory of 2368 2408 1jdvv.exe 31 PID 2408 wrote to memory of 2368 2408 1jdvv.exe 31 PID 2408 wrote to memory of 2368 2408 1jdvv.exe 31 PID 2408 wrote to memory of 2368 2408 1jdvv.exe 31 PID 2368 wrote to memory of 1528 2368 vvjvj.exe 32 PID 2368 wrote to memory of 1528 2368 vvjvj.exe 32 PID 2368 wrote to memory of 1528 2368 vvjvj.exe 32 PID 2368 wrote to memory of 1528 2368 vvjvj.exe 32 PID 1528 wrote to memory of 2916 1528 ddjvj.exe 33 PID 1528 wrote to memory of 2916 1528 ddjvj.exe 33 PID 1528 wrote to memory of 2916 1528 ddjvj.exe 33 PID 1528 wrote to memory of 2916 1528 ddjvj.exe 33 PID 2916 wrote to memory of 2752 2916 5nbntb.exe 34 PID 2916 wrote to memory of 2752 2916 5nbntb.exe 34 PID 2916 wrote to memory of 2752 2916 5nbntb.exe 34 PID 2916 wrote to memory of 2752 2916 5nbntb.exe 34 PID 2752 wrote to memory of 2844 2752 dvppv.exe 35 PID 2752 wrote to memory of 2844 2752 dvppv.exe 35 PID 2752 wrote to memory of 2844 2752 dvppv.exe 35 PID 2752 wrote to memory of 2844 2752 dvppv.exe 35 PID 2844 wrote to memory of 2848 2844 vvpvj.exe 36 PID 2844 wrote to memory of 2848 2844 vvpvj.exe 36 PID 2844 wrote to memory of 2848 2844 vvpvj.exe 36 PID 2844 wrote to memory of 2848 2844 vvpvj.exe 36 PID 2848 wrote to memory of 2780 2848 dvppj.exe 37 PID 2848 wrote to memory of 2780 2848 dvppj.exe 37 PID 2848 wrote to memory of 2780 2848 dvppj.exe 37 PID 2848 wrote to memory of 2780 2848 dvppj.exe 37 PID 2780 wrote to memory of 1744 2780 hhbnth.exe 38 PID 2780 wrote to memory of 1744 2780 hhbnth.exe 38 PID 2780 wrote to memory of 1744 2780 hhbnth.exe 38 PID 2780 wrote to memory of 1744 2780 hhbnth.exe 38 PID 1744 wrote to memory of 2624 1744 ppjpd.exe 39 PID 1744 wrote to memory of 2624 1744 ppjpd.exe 39 PID 1744 wrote to memory of 2624 1744 ppjpd.exe 39 PID 1744 wrote to memory of 2624 1744 ppjpd.exe 39 PID 2624 wrote to memory of 2176 2624 1hhntb.exe 40 PID 2624 wrote to memory of 2176 2624 1hhntb.exe 40 PID 2624 wrote to memory of 2176 2624 1hhntb.exe 40 PID 2624 wrote to memory of 2176 2624 1hhntb.exe 40 PID 2176 wrote to memory of 2352 2176 pjvvd.exe 41 PID 2176 wrote to memory of 2352 2176 pjvvd.exe 41 PID 2176 wrote to memory of 2352 2176 pjvvd.exe 41 PID 2176 wrote to memory of 2352 2176 pjvvd.exe 41 PID 2352 wrote to memory of 2040 2352 hbthnt.exe 42 PID 2352 wrote to memory of 2040 2352 hbthnt.exe 42 PID 2352 wrote to memory of 2040 2352 hbthnt.exe 42 PID 2352 wrote to memory of 2040 2352 hbthnt.exe 42 PID 2040 wrote to memory of 2020 2040 1bthnn.exe 43 PID 2040 wrote to memory of 2020 2040 1bthnn.exe 43 PID 2040 wrote to memory of 2020 2040 1bthnn.exe 43 PID 2040 wrote to memory of 2020 2040 1bthnn.exe 43 PID 2020 wrote to memory of 804 2020 dvdjj.exe 44 PID 2020 wrote to memory of 804 2020 dvdjj.exe 44 PID 2020 wrote to memory of 804 2020 dvdjj.exe 44 PID 2020 wrote to memory of 804 2020 dvdjj.exe 44 PID 804 wrote to memory of 2936 804 btntht.exe 45 PID 804 wrote to memory of 2936 804 btntht.exe 45 PID 804 wrote to memory of 2936 804 btntht.exe 45 PID 804 wrote to memory of 2936 804 btntht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe"C:\Users\Admin\AppData\Local\Temp\caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\1jdvv.exec:\1jdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\vvjvj.exec:\vvjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ddjvj.exec:\ddjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\5nbntb.exec:\5nbntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dvppv.exec:\dvppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vvpvj.exec:\vvpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dvppj.exec:\dvppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hhbnth.exec:\hhbnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ppjpd.exec:\ppjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\1hhntb.exec:\1hhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pjvvd.exec:\pjvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\hbthnt.exec:\hbthnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\1bthnn.exec:\1bthnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\dvdjj.exec:\dvdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\btntht.exec:\btntht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\5pddp.exec:\5pddp.exe17⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9ththt.exec:\9ththt.exe18⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe19⤵
- Executes dropped EXE
PID:2980 -
\??\c:\thbbtb.exec:\thbbtb.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\llllrrf.exec:\llllrrf.exe21⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rlxlxxr.exec:\rlxlxxr.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9jvvv.exec:\9jvvv.exe23⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rlrxrrl.exec:\rlrxrrl.exe24⤵
- Executes dropped EXE
PID:1344 -
\??\c:\frllrxl.exec:\frllrxl.exe25⤵
- Executes dropped EXE
PID:3052 -
\??\c:\5dddd.exec:\5dddd.exe26⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1hnthh.exec:\1hnthh.exe27⤵
- Executes dropped EXE
PID:944 -
\??\c:\5dvdj.exec:\5dvdj.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\1rfllll.exec:\1rfllll.exe29⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jdpjp.exec:\jdpjp.exe30⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7nbnbb.exec:\7nbnbb.exe31⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jvjpd.exec:\jvjpd.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\1lllffl.exec:\1lllffl.exe33⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nnhhnt.exec:\nnhhnt.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vvpjv.exec:\vvpjv.exe35⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7frlrrr.exec:\7frlrrr.exe36⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nhnnnt.exec:\nhnnnt.exe37⤵
- Executes dropped EXE
PID:1164 -
\??\c:\tnhhtb.exec:\tnhhtb.exe38⤵
- Executes dropped EXE
PID:904 -
\??\c:\pjvvd.exec:\pjvvd.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lfrxflx.exec:\lfrxflx.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rflllfr.exec:\rflllfr.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tttbnb.exec:\tttbnb.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvvvv.exec:\dvvvv.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\vpdvd.exec:\vpdvd.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rlxxxfx.exec:\rlxxxfx.exe45⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbtbhh.exec:\hbtbhh.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ppjvj.exec:\ppjvj.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5vvdj.exec:\5vvdj.exe49⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rflffff.exec:\rflffff.exe50⤵
- Executes dropped EXE
PID:848 -
\??\c:\1thhtb.exec:\1thhtb.exe51⤵
- Executes dropped EXE
PID:1120 -
\??\c:\nhhntb.exec:\nhhntb.exe52⤵
- Executes dropped EXE
PID:588 -
\??\c:\dvjjj.exec:\dvjjj.exe53⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rrflrrx.exec:\rrflrrx.exe54⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe55⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hbbbbb.exec:\hbbbbb.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5pppj.exec:\5pppj.exe57⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jdppd.exec:\jdppd.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ffxflxl.exec:\ffxflxl.exe59⤵
- Executes dropped EXE
PID:1336 -
\??\c:\1nhtbn.exec:\1nhtbn.exe60⤵
- Executes dropped EXE
PID:1200 -
\??\c:\jjjvv.exec:\jjjvv.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jdpvd.exec:\jdpvd.exe62⤵
- Executes dropped EXE
PID:888 -
\??\c:\xrffrxl.exec:\xrffrxl.exe63⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9fxxllx.exec:\9fxxllx.exe64⤵
- Executes dropped EXE
PID:284 -
\??\c:\hhbbhn.exec:\hhbbhn.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvjjp.exec:\dvjjp.exe66⤵PID:2160
-
\??\c:\9pddv.exec:\9pddv.exe67⤵PID:1860
-
\??\c:\xrlffxl.exec:\xrlffxl.exe68⤵PID:2472
-
\??\c:\5bttbh.exec:\5bttbh.exe69⤵PID:1844
-
\??\c:\pjvdd.exec:\pjvdd.exe70⤵PID:1084
-
\??\c:\jvdvv.exec:\jvdvv.exe71⤵PID:2324
-
\??\c:\fflllll.exec:\fflllll.exe72⤵PID:2504
-
\??\c:\ffrxllr.exec:\ffrxllr.exe73⤵PID:2480
-
\??\c:\7thbhh.exec:\7thbhh.exe74⤵PID:2220
-
\??\c:\ppjjp.exec:\ppjjp.exe75⤵PID:1884
-
\??\c:\pjvdd.exec:\pjvdd.exe76⤵PID:2920
-
\??\c:\flxxffr.exec:\flxxffr.exe77⤵PID:2144
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe78⤵PID:1724
-
\??\c:\tnhhnt.exec:\tnhhnt.exe79⤵PID:2696
-
\??\c:\jvjjj.exec:\jvjjj.exe80⤵PID:2372
-
\??\c:\pvpdd.exec:\pvpdd.exe81⤵PID:2576
-
\??\c:\1lrrxxf.exec:\1lrrxxf.exe82⤵PID:2852
-
\??\c:\5ntbhn.exec:\5ntbhn.exe83⤵PID:2796
-
\??\c:\3thbbh.exec:\3thbbh.exe84⤵PID:3032
-
\??\c:\djjdp.exec:\djjdp.exe85⤵PID:2744
-
\??\c:\9vppv.exec:\9vppv.exe86⤵PID:2760
-
\??\c:\frfflll.exec:\frfflll.exe87⤵PID:2640
-
\??\c:\nhttbb.exec:\nhttbb.exe88⤵PID:2636
-
\??\c:\nnhhnt.exec:\nnhhnt.exe89⤵PID:2632
-
\??\c:\7vjpv.exec:\7vjpv.exe90⤵PID:2616
-
\??\c:\llxfrxl.exec:\llxfrxl.exe91⤵PID:2684
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe92⤵PID:1752
-
\??\c:\hhbbhn.exec:\hhbbhn.exe93⤵PID:884
-
\??\c:\bthnnt.exec:\bthnnt.exe94⤵PID:2996
-
\??\c:\jjdjv.exec:\jjdjv.exe95⤵PID:2960
-
\??\c:\lllffll.exec:\lllffll.exe96⤵PID:2884
-
\??\c:\rlrrllr.exec:\rlrrllr.exe97⤵PID:2892
-
\??\c:\htnthn.exec:\htnthn.exe98⤵PID:1668
-
\??\c:\3pddj.exec:\3pddj.exe99⤵PID:1072
-
\??\c:\vjpjj.exec:\vjpjj.exe100⤵PID:1984
-
\??\c:\llfxfxf.exec:\llfxfxf.exe101⤵PID:2072
-
\??\c:\lfxfffl.exec:\lfxfffl.exe102⤵PID:1928
-
\??\c:\tntttb.exec:\tntttb.exe103⤵PID:1812
-
\??\c:\5vpdd.exec:\5vpdd.exe104⤵PID:560
-
\??\c:\ddvjp.exec:\ddvjp.exe105⤵PID:1060
-
\??\c:\rlxxllx.exec:\rlxxllx.exe106⤵PID:1936
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe107⤵PID:1796
-
\??\c:\nbtbnn.exec:\nbtbnn.exe108⤵PID:1380
-
\??\c:\1dvpv.exec:\1dvpv.exe109⤵PID:2300
-
\??\c:\pjdjp.exec:\pjdjp.exe110⤵PID:1788
-
\??\c:\5rxrrlr.exec:\5rxrrlr.exe111⤵PID:1388
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe112⤵PID:944
-
\??\c:\bthhnn.exec:\bthhnn.exe113⤵PID:2428
-
\??\c:\3vppd.exec:\3vppd.exe114⤵PID:1844
-
\??\c:\dpddd.exec:\dpddd.exe115⤵PID:2140
-
\??\c:\rlrlffl.exec:\rlrlffl.exe116⤵PID:2324
-
\??\c:\btttbh.exec:\btttbh.exe117⤵PID:2504
-
\??\c:\1thttt.exec:\1thttt.exe118⤵PID:2560
-
\??\c:\jdddj.exec:\jdddj.exe119⤵PID:2552
-
\??\c:\7fllffl.exec:\7fllffl.exe120⤵PID:1884
-
\??\c:\5rfxffl.exec:\5rfxffl.exe121⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-