Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe
-
Size
454KB
-
MD5
274a1fcae472dba4b609fb93f6bff0f2
-
SHA1
e9d7de4676f38184195d19ae4d26c034b79c956d
-
SHA256
ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae
-
SHA512
f0ad51de354726370bf6e8696c38e9b9316d056af559809c2de2346c8a99d14f8ceee3fce2f15cfea48abf0b98cda99889037ac792d347fa55cafb26b0a6e2c2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2136-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-77-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2688-82-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2612-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-321-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-341-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-367-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-399-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-520-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2096-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-581-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-822-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1152-841-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1660-890-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1780-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-945-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-1090-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 tthtnh.exe 1652 ddvdv.exe 2576 xrxfxxf.exe 1968 1pppd.exe 3032 ddvdv.exe 1528 dpdpj.exe 2408 1nttnn.exe 2120 dpvdj.exe 2688 1thhnh.exe 2648 ppddj.exe 2612 hbnthb.exe 2524 nnbbhb.exe 2552 rfrxllx.exe 2560 btntbb.exe 2980 rrfxllx.exe 1580 nbhhtt.exe 848 fxllfxl.exe 1956 ttnntb.exe 1436 lfrxlrl.exe 2236 1tnhnn.exe 308 xrxlrll.exe 2756 nnhhhb.exe 2764 fxllrlx.exe 2740 rfrlfrf.exe 2840 vvppj.exe 2776 xrllrrf.exe 1552 lfrfrxl.exe 1212 nhnnhh.exe 2748 9pvjj.exe 2920 5hbbhh.exe 1632 vjvdp.exe 2168 9lrrxff.exe 2068 vvpvd.exe 2304 5ppjv.exe 2264 bthnbb.exe 1572 5nbthn.exe 1652 pdvpp.exe 1828 rrlxxxl.exe 3016 tnhhnn.exe 2248 9vjjj.exe 2308 xlrrlfr.exe 3052 1rffflr.exe 2640 hhhhtn.exe 2708 pvpvd.exe 2624 jvjjj.exe 2652 llxlrrf.exe 2732 bntntn.exe 2796 nhttnn.exe 2524 7pdjj.exe 2548 rfxxfll.exe 2508 hhtbnh.exe 1648 bttbtn.exe 2980 jpddj.exe 1224 3xllflr.exe 1056 3xrrxxl.exe 1144 3bnttb.exe 1996 jdvvj.exe 2240 9djjp.exe 2040 7lxlrrx.exe 2236 9nbbnn.exe 2028 9hhbtt.exe 2772 7djpp.exe 2868 rlxfllr.exe 2764 nbnnbt.exe -
resource yara_rule behavioral1/memory/2136-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-296-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2068-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-357-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2308-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-399-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1996-467-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2028-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-841-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1780-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-1090-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-1272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-1285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-1298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-1366-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1980 2136 ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe 28 PID 2136 wrote to memory of 1980 2136 ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe 28 PID 2136 wrote to memory of 1980 2136 ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe 28 PID 2136 wrote to memory of 1980 2136 ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe 28 PID 1980 wrote to memory of 1652 1980 tthtnh.exe 29 PID 1980 wrote to memory of 1652 1980 tthtnh.exe 29 PID 1980 wrote to memory of 1652 1980 tthtnh.exe 29 PID 1980 wrote to memory of 1652 1980 tthtnh.exe 29 PID 1652 wrote to memory of 2576 1652 ddvdv.exe 30 PID 1652 wrote to memory of 2576 1652 ddvdv.exe 30 PID 1652 wrote to memory of 2576 1652 ddvdv.exe 30 PID 1652 wrote to memory of 2576 1652 ddvdv.exe 30 PID 2576 wrote to memory of 1968 2576 xrxfxxf.exe 31 PID 2576 wrote to memory of 1968 2576 xrxfxxf.exe 31 PID 2576 wrote to memory of 1968 2576 xrxfxxf.exe 31 PID 2576 wrote to memory of 1968 2576 xrxfxxf.exe 31 PID 1968 wrote to memory of 3032 1968 1pppd.exe 32 PID 1968 wrote to memory of 3032 1968 1pppd.exe 32 PID 1968 wrote to memory of 3032 1968 1pppd.exe 32 PID 1968 wrote to memory of 3032 1968 1pppd.exe 32 PID 3032 wrote to memory of 1528 3032 ddvdv.exe 33 PID 3032 wrote to memory of 1528 3032 ddvdv.exe 33 PID 3032 wrote to memory of 1528 3032 ddvdv.exe 33 PID 3032 wrote to memory of 1528 3032 ddvdv.exe 33 PID 1528 wrote to memory of 2408 1528 dpdpj.exe 34 PID 1528 wrote to memory of 2408 1528 dpdpj.exe 34 PID 1528 wrote to memory of 2408 1528 dpdpj.exe 34 PID 1528 wrote to memory of 2408 1528 dpdpj.exe 34 PID 2408 wrote to memory of 2120 2408 1nttnn.exe 35 PID 2408 wrote to memory of 2120 2408 1nttnn.exe 35 PID 2408 wrote to memory of 2120 2408 1nttnn.exe 35 PID 2408 wrote to memory of 2120 2408 1nttnn.exe 35 PID 2120 wrote to memory of 2688 2120 dpvdj.exe 36 PID 2120 wrote to memory of 2688 2120 dpvdj.exe 36 PID 2120 wrote to memory of 2688 2120 dpvdj.exe 36 PID 2120 wrote to memory of 2688 2120 dpvdj.exe 36 PID 2688 wrote to memory of 2648 2688 1thhnh.exe 37 PID 2688 wrote to memory of 2648 2688 1thhnh.exe 37 PID 2688 wrote to memory of 2648 2688 1thhnh.exe 37 PID 2688 wrote to memory of 2648 2688 1thhnh.exe 37 PID 2648 wrote to memory of 2612 2648 ppddj.exe 38 PID 2648 wrote to memory of 2612 2648 ppddj.exe 38 PID 2648 wrote to memory of 2612 2648 ppddj.exe 38 PID 2648 wrote to memory of 2612 2648 ppddj.exe 38 PID 2612 wrote to memory of 2524 2612 hbnthb.exe 39 PID 2612 wrote to memory of 2524 2612 hbnthb.exe 39 PID 2612 wrote to memory of 2524 2612 hbnthb.exe 39 PID 2612 wrote to memory of 2524 2612 hbnthb.exe 39 PID 2524 wrote to memory of 2552 2524 nnbbhb.exe 40 PID 2524 wrote to memory of 2552 2524 nnbbhb.exe 40 PID 2524 wrote to memory of 2552 2524 nnbbhb.exe 40 PID 2524 wrote to memory of 2552 2524 nnbbhb.exe 40 PID 2552 wrote to memory of 2560 2552 rfrxllx.exe 41 PID 2552 wrote to memory of 2560 2552 rfrxllx.exe 41 PID 2552 wrote to memory of 2560 2552 rfrxllx.exe 41 PID 2552 wrote to memory of 2560 2552 rfrxllx.exe 41 PID 2560 wrote to memory of 2980 2560 btntbb.exe 42 PID 2560 wrote to memory of 2980 2560 btntbb.exe 42 PID 2560 wrote to memory of 2980 2560 btntbb.exe 42 PID 2560 wrote to memory of 2980 2560 btntbb.exe 42 PID 2980 wrote to memory of 1580 2980 rrfxllx.exe 43 PID 2980 wrote to memory of 1580 2980 rrfxllx.exe 43 PID 2980 wrote to memory of 1580 2980 rrfxllx.exe 43 PID 2980 wrote to memory of 1580 2980 rrfxllx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe"C:\Users\Admin\AppData\Local\Temp\ff1329ef875231339790a5801c27e70e6ad6fcfeb8bb93b8df483ee3dca83bae.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\tthtnh.exec:\tthtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\ddvdv.exec:\ddvdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\xrxfxxf.exec:\xrxfxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1pppd.exec:\1pppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\ddvdv.exec:\ddvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\dpdpj.exec:\dpdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\1nttnn.exec:\1nttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\dpvdj.exec:\dpvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\1thhnh.exec:\1thhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ppddj.exec:\ppddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hbnthb.exec:\hbnthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nnbbhb.exec:\nnbbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rfrxllx.exec:\rfrxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\btntbb.exec:\btntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rrfxllx.exec:\rrfxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nbhhtt.exec:\nbhhtt.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1580 -
\??\c:\fxllfxl.exec:\fxllfxl.exe18⤵
- Executes dropped EXE
PID:848 -
\??\c:\ttnntb.exec:\ttnntb.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lfrxlrl.exec:\lfrxlrl.exe20⤵
- Executes dropped EXE
PID:1436 -
\??\c:\1tnhnn.exec:\1tnhnn.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xrxlrll.exec:\xrxlrll.exe22⤵
- Executes dropped EXE
PID:308 -
\??\c:\nnhhhb.exec:\nnhhhb.exe23⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fxllrlx.exec:\fxllrlx.exe24⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rfrlfrf.exec:\rfrlfrf.exe25⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vvppj.exec:\vvppj.exe26⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xrllrrf.exec:\xrllrrf.exe27⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe28⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nhnnhh.exec:\nhnnhh.exe29⤵
- Executes dropped EXE
PID:1212 -
\??\c:\9pvjj.exec:\9pvjj.exe30⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5hbbhh.exec:\5hbbhh.exe31⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vjvdp.exec:\vjvdp.exe32⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9lrrxff.exec:\9lrrxff.exe33⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vvpvd.exec:\vvpvd.exe34⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5ppjv.exec:\5ppjv.exe35⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bthnbb.exec:\bthnbb.exe36⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5nbthn.exec:\5nbthn.exe37⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pdvpp.exec:\pdvpp.exe38⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrlxxxl.exec:\rrlxxxl.exe39⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tnhhnn.exec:\tnhhnn.exe40⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9vjjj.exec:\9vjjj.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xlrrlfr.exec:\xlrrlfr.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1rffflr.exec:\1rffflr.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hhhhtn.exec:\hhhhtn.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pvpvd.exec:\pvpvd.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jvjjj.exec:\jvjjj.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\llxlrrf.exec:\llxlrrf.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bntntn.exec:\bntntn.exe48⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhttnn.exec:\nhttnn.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7pdjj.exec:\7pdjj.exe50⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rfxxfll.exec:\rfxxfll.exe51⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hhtbnh.exec:\hhtbnh.exe52⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bttbtn.exec:\bttbtn.exe53⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jpddj.exec:\jpddj.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3xllflr.exec:\3xllflr.exe55⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3xrrxxl.exec:\3xrrxxl.exe56⤵
- Executes dropped EXE
PID:1056 -
\??\c:\3bnttb.exec:\3bnttb.exe57⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jdvvj.exec:\jdvvj.exe58⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9djjp.exec:\9djjp.exe59⤵
- Executes dropped EXE
PID:2240 -
\??\c:\7lxlrrx.exec:\7lxlrrx.exe60⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9nbbnn.exec:\9nbbnn.exe61⤵
- Executes dropped EXE
PID:2236 -
\??\c:\9hhbtt.exec:\9hhbtt.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7djpp.exec:\7djpp.exe63⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlxfllr.exec:\rlxfllr.exe64⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nbnnbt.exec:\nbnnbt.exe65⤵
- Executes dropped EXE
PID:2764 -
\??\c:\btbbnh.exec:\btbbnh.exe66⤵PID:2740
-
\??\c:\pjvvv.exec:\pjvvv.exe67⤵PID:2096
-
\??\c:\3xxrrrr.exec:\3xxrrrr.exe68⤵PID:2088
-
\??\c:\xrxrllr.exec:\xrxrllr.exe69⤵PID:788
-
\??\c:\7tbbhb.exec:\7tbbhb.exe70⤵PID:1396
-
\??\c:\pjdjv.exec:\pjdjv.exe71⤵PID:1540
-
\??\c:\frlfrlx.exec:\frlfrlx.exe72⤵PID:2148
-
\??\c:\nbnnnn.exec:\nbnnnn.exe73⤵PID:1768
-
\??\c:\7thhnn.exec:\7thhnn.exe74⤵PID:608
-
\??\c:\vdpjp.exec:\vdpjp.exe75⤵PID:900
-
\??\c:\jpppv.exec:\jpppv.exe76⤵PID:2480
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe77⤵PID:2204
-
\??\c:\hthhnh.exec:\hthhnh.exe78⤵PID:2008
-
\??\c:\bbnnhh.exec:\bbnnhh.exe79⤵PID:2312
-
\??\c:\9vddj.exec:\9vddj.exe80⤵PID:3048
-
\??\c:\frrxllx.exec:\frrxllx.exe81⤵PID:1572
-
\??\c:\rllllff.exec:\rllllff.exe82⤵PID:1652
-
\??\c:\1bhbnt.exec:\1bhbnt.exe83⤵PID:2936
-
\??\c:\ppddj.exec:\ppddj.exe84⤵PID:1812
-
\??\c:\jvppd.exec:\jvppd.exe85⤵PID:2464
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe86⤵PID:2996
-
\??\c:\tnbbnt.exec:\tnbbnt.exe87⤵PID:2072
-
\??\c:\1dpjj.exec:\1dpjj.exe88⤵PID:3052
-
\??\c:\pjvvd.exec:\pjvvd.exe89⤵PID:2640
-
\??\c:\1lrxxxf.exec:\1lrxxxf.exe90⤵PID:2708
-
\??\c:\lxllrrf.exec:\lxllrrf.exe91⤵PID:2784
-
\??\c:\htbbbb.exec:\htbbbb.exe92⤵PID:2652
-
\??\c:\jdpvj.exec:\jdpvj.exe93⤵PID:2544
-
\??\c:\dvjpp.exec:\dvjpp.exe94⤵PID:2496
-
\??\c:\xxlrlrx.exec:\xxlrlrx.exe95⤵PID:2572
-
\??\c:\3ntbbh.exec:\3ntbbh.exe96⤵PID:3012
-
\??\c:\1ddvd.exec:\1ddvd.exe97⤵PID:2508
-
\??\c:\dvppv.exec:\dvppv.exe98⤵PID:2444
-
\??\c:\xllfrrx.exec:\xllfrrx.exe99⤵PID:2980
-
\??\c:\htbhtt.exec:\htbhtt.exe100⤵PID:380
-
\??\c:\7httbh.exec:\7httbh.exe101⤵PID:1056
-
\??\c:\1jvdj.exec:\1jvdj.exe102⤵PID:848
-
\??\c:\rrrxlfr.exec:\rrrxlfr.exe103⤵PID:1996
-
\??\c:\9fllxrr.exec:\9fllxrr.exe104⤵PID:1388
-
\??\c:\1nbthh.exec:\1nbthh.exe105⤵PID:1948
-
\??\c:\pdpjj.exec:\pdpjj.exe106⤵PID:2752
-
\??\c:\dvjvj.exec:\dvjvj.exe107⤵PID:308
-
\??\c:\xrrfflf.exec:\xrrfflf.exe108⤵PID:2872
-
\??\c:\btnthh.exec:\btnthh.exe109⤵PID:2884
-
\??\c:\nbntnt.exec:\nbntnt.exe110⤵PID:2988
-
\??\c:\jjddp.exec:\jjddp.exe111⤵PID:1008
-
\??\c:\xlxxffl.exec:\xlxxffl.exe112⤵PID:2436
-
\??\c:\lfrxffl.exec:\lfrxffl.exe113⤵PID:2060
-
\??\c:\5nbtbt.exec:\5nbtbt.exe114⤵PID:1152
-
\??\c:\thtbbh.exec:\thtbbh.exe115⤵PID:884
-
\??\c:\pjpvp.exec:\pjpvp.exe116⤵PID:1396
-
\??\c:\3lrrxxl.exec:\3lrrxxl.exe117⤵PID:568
-
\??\c:\ffrxllx.exec:\ffrxllx.exe118⤵PID:2128
-
\??\c:\nnhhtn.exec:\nnhhtn.exe119⤵PID:1708
-
\??\c:\ddvjp.exec:\ddvjp.exe120⤵PID:844
-
\??\c:\jjppv.exec:\jjppv.exe121⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-