Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe
-
Size
453KB
-
MD5
c5b5de336ea7eef236a9288b6b151c58
-
SHA1
cddfbc4f2a763e854eab6c59a006e5cfa9112f2b
-
SHA256
fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0
-
SHA512
5b5f8fc1d03318b05da3d5d3aefdc320d98a3c880f50c0706c66b404acb0bff96f13e590ea2ee19fd6af50f96dc5a81eec3f75add2e13913eb1667f1cbf8e81e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2380-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-432-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2456-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-577-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3064-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-586-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2744-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-676-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1252-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-773-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2484-772-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1284-787-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-820-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 3hntbb.exe 1036 7frlxrf.exe 1972 jvdjj.exe 2756 1fxrrrl.exe 2816 thtnnh.exe 2616 jvvpj.exe 2636 xlrfffl.exe 2656 3vjdv.exe 2640 frxxfxx.exe 3048 9nnbth.exe 1704 1pvvv.exe 2184 hbnbnt.exe 1064 vddvj.exe 1256 vjppv.exe 1776 tbnntt.exe 1012 pvdjp.exe 2112 xlrrlfx.exe 1692 9vddv.exe 2188 rxfflff.exe 2056 thtthh.exe 1308 rflllff.exe 908 bnbtnh.exe 832 pdpdd.exe 1664 5rfrlll.exe 1324 pppdd.exe 2528 pjdvv.exe 2280 9nhbtn.exe 2032 pdjdd.exe 1740 lrxrxrr.exe 1856 5thnnh.exe 2076 rlrxlrf.exe 1600 htnhnh.exe 2380 djppp.exe 108 lxffxxx.exe 1844 btbhnb.exe 2888 jvddd.exe 2444 rxlffxx.exe 2972 7lxrllx.exe 2960 bnbhbt.exe 2808 pddpj.exe 2312 xlrrxxr.exe 2780 1lrxfxx.exe 2608 bthnhn.exe 2620 vpddj.exe 2652 5rfxffl.exe 2080 frxrrrx.exe 1360 hnbtbt.exe 1268 pppvp.exe 2184 rlrrxrl.exe 1984 bbbhtb.exe 896 7jdpj.exe 444 dpjvp.exe 1872 rfxrffl.exe 1868 tbbttn.exe 1628 vjppv.exe 2220 vdjdv.exe 2456 lxlxflx.exe 692 nhtbbb.exe 544 jdjjv.exe 708 flfxffr.exe 1552 3xllxxx.exe 948 1htnnn.exe 2116 jvjpj.exe 1336 xrfxllr.exe -
resource yara_rule behavioral1/memory/2212-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-460-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1856-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-772-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2212 2380 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 30 PID 2380 wrote to memory of 2212 2380 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 30 PID 2380 wrote to memory of 2212 2380 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 30 PID 2380 wrote to memory of 2212 2380 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 30 PID 2212 wrote to memory of 1036 2212 3hntbb.exe 31 PID 2212 wrote to memory of 1036 2212 3hntbb.exe 31 PID 2212 wrote to memory of 1036 2212 3hntbb.exe 31 PID 2212 wrote to memory of 1036 2212 3hntbb.exe 31 PID 1036 wrote to memory of 1972 1036 7frlxrf.exe 32 PID 1036 wrote to memory of 1972 1036 7frlxrf.exe 32 PID 1036 wrote to memory of 1972 1036 7frlxrf.exe 32 PID 1036 wrote to memory of 1972 1036 7frlxrf.exe 32 PID 1972 wrote to memory of 2756 1972 jvdjj.exe 33 PID 1972 wrote to memory of 2756 1972 jvdjj.exe 33 PID 1972 wrote to memory of 2756 1972 jvdjj.exe 33 PID 1972 wrote to memory of 2756 1972 jvdjj.exe 33 PID 2756 wrote to memory of 2816 2756 1fxrrrl.exe 34 PID 2756 wrote to memory of 2816 2756 1fxrrrl.exe 34 PID 2756 wrote to memory of 2816 2756 1fxrrrl.exe 34 PID 2756 wrote to memory of 2816 2756 1fxrrrl.exe 34 PID 2816 wrote to memory of 2616 2816 thtnnh.exe 35 PID 2816 wrote to memory of 2616 2816 thtnnh.exe 35 PID 2816 wrote to memory of 2616 2816 thtnnh.exe 35 PID 2816 wrote to memory of 2616 2816 thtnnh.exe 35 PID 2616 wrote to memory of 2636 2616 jvvpj.exe 36 PID 2616 wrote to memory of 2636 2616 jvvpj.exe 36 PID 2616 wrote to memory of 2636 2616 jvvpj.exe 36 PID 2616 wrote to memory of 2636 2616 jvvpj.exe 36 PID 2636 wrote to memory of 2656 2636 xlrfffl.exe 37 PID 2636 wrote to memory of 2656 2636 xlrfffl.exe 37 PID 2636 wrote to memory of 2656 2636 xlrfffl.exe 37 PID 2636 wrote to memory of 2656 2636 xlrfffl.exe 37 PID 2656 wrote to memory of 2640 2656 3vjdv.exe 38 PID 2656 wrote to memory of 2640 2656 3vjdv.exe 38 PID 2656 wrote to memory of 2640 2656 3vjdv.exe 38 PID 2656 wrote to memory of 2640 2656 3vjdv.exe 38 PID 2640 wrote to memory of 3048 2640 frxxfxx.exe 39 PID 2640 wrote to memory of 3048 2640 frxxfxx.exe 39 PID 2640 wrote to memory of 3048 2640 frxxfxx.exe 39 PID 2640 wrote to memory of 3048 2640 frxxfxx.exe 39 PID 3048 wrote to memory of 1704 3048 9nnbth.exe 40 PID 3048 wrote to memory of 1704 3048 9nnbth.exe 40 PID 3048 wrote to memory of 1704 3048 9nnbth.exe 40 PID 3048 wrote to memory of 1704 3048 9nnbth.exe 40 PID 1704 wrote to memory of 2184 1704 1pvvv.exe 41 PID 1704 wrote to memory of 2184 1704 1pvvv.exe 41 PID 1704 wrote to memory of 2184 1704 1pvvv.exe 41 PID 1704 wrote to memory of 2184 1704 1pvvv.exe 41 PID 2184 wrote to memory of 1064 2184 hbnbnt.exe 42 PID 2184 wrote to memory of 1064 2184 hbnbnt.exe 42 PID 2184 wrote to memory of 1064 2184 hbnbnt.exe 42 PID 2184 wrote to memory of 1064 2184 hbnbnt.exe 42 PID 1064 wrote to memory of 1256 1064 vddvj.exe 43 PID 1064 wrote to memory of 1256 1064 vddvj.exe 43 PID 1064 wrote to memory of 1256 1064 vddvj.exe 43 PID 1064 wrote to memory of 1256 1064 vddvj.exe 43 PID 1256 wrote to memory of 1776 1256 vjppv.exe 44 PID 1256 wrote to memory of 1776 1256 vjppv.exe 44 PID 1256 wrote to memory of 1776 1256 vjppv.exe 44 PID 1256 wrote to memory of 1776 1256 vjppv.exe 44 PID 1776 wrote to memory of 1012 1776 tbnntt.exe 45 PID 1776 wrote to memory of 1012 1776 tbnntt.exe 45 PID 1776 wrote to memory of 1012 1776 tbnntt.exe 45 PID 1776 wrote to memory of 1012 1776 tbnntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe"C:\Users\Admin\AppData\Local\Temp\fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\3hntbb.exec:\3hntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\7frlxrf.exec:\7frlxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\jvdjj.exec:\jvdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\1fxrrrl.exec:\1fxrrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\thtnnh.exec:\thtnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jvvpj.exec:\jvvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xlrfffl.exec:\xlrfffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3vjdv.exec:\3vjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\frxxfxx.exec:\frxxfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9nnbth.exec:\9nnbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\1pvvv.exec:\1pvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hbnbnt.exec:\hbnbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vddvj.exec:\vddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\vjppv.exec:\vjppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\tbnntt.exec:\tbnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\pvdjp.exec:\pvdjp.exe17⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xlrrlfx.exec:\xlrrlfx.exe18⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9vddv.exec:\9vddv.exe19⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rxfflff.exec:\rxfflff.exe20⤵
- Executes dropped EXE
PID:2188 -
\??\c:\thtthh.exec:\thtthh.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rflllff.exec:\rflllff.exe22⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bnbtnh.exec:\bnbtnh.exe23⤵
- Executes dropped EXE
PID:908 -
\??\c:\pdpdd.exec:\pdpdd.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\5rfrlll.exec:\5rfrlll.exe25⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pppdd.exec:\pppdd.exe26⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pjdvv.exec:\pjdvv.exe27⤵
- Executes dropped EXE
PID:2528 -
\??\c:\9nhbtn.exec:\9nhbtn.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pdjdd.exec:\pdjdd.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lrxrxrr.exec:\lrxrxrr.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\5thnnh.exec:\5thnnh.exe31⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe32⤵
- Executes dropped EXE
PID:2076 -
\??\c:\htnhnh.exec:\htnhnh.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\djppp.exec:\djppp.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxffxxx.exec:\lxffxxx.exe35⤵
- Executes dropped EXE
PID:108 -
\??\c:\btbhnb.exec:\btbhnb.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jvddd.exec:\jvddd.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rxlffxx.exec:\rxlffxx.exe38⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7lxrllx.exec:\7lxrllx.exe39⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bnbhbt.exec:\bnbhbt.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pddpj.exec:\pddpj.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe42⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1lrxfxx.exec:\1lrxfxx.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bthnhn.exec:\bthnhn.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpddj.exec:\vpddj.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\5rfxffl.exec:\5rfxffl.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\frxrrrx.exec:\frxrrrx.exe47⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hnbtbt.exec:\hnbtbt.exe48⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pppvp.exec:\pppvp.exe49⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rlrrxrl.exec:\rlrrxrl.exe50⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bbbhtb.exec:\bbbhtb.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\7jdpj.exec:\7jdpj.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\dpjvp.exec:\dpjvp.exe53⤵
- Executes dropped EXE
PID:444 -
\??\c:\rfxrffl.exec:\rfxrffl.exe54⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tbbttn.exec:\tbbttn.exe55⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vjppv.exec:\vjppv.exe56⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vdjdv.exec:\vdjdv.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lxlxflx.exec:\lxlxflx.exe58⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nhtbbb.exec:\nhtbbb.exe59⤵
- Executes dropped EXE
PID:692 -
\??\c:\jdjjv.exec:\jdjjv.exe60⤵
- Executes dropped EXE
PID:544 -
\??\c:\flfxffr.exec:\flfxffr.exe61⤵
- Executes dropped EXE
PID:708 -
\??\c:\3xllxxx.exec:\3xllxxx.exe62⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1htnnn.exec:\1htnnn.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\jvjpj.exec:\jvjpj.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xrfxllr.exec:\xrfxllr.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\5xffffl.exec:\5xffffl.exe66⤵PID:1664
-
\??\c:\hhtbhh.exec:\hhtbhh.exe67⤵PID:2336
-
\??\c:\ddjjv.exec:\ddjjv.exe68⤵PID:1652
-
\??\c:\ppdjj.exec:\ppdjj.exe69⤵PID:1452
-
\??\c:\rflfffl.exec:\rflfffl.exe70⤵PID:572
-
\??\c:\tnhntn.exec:\tnhntn.exe71⤵PID:2032
-
\??\c:\jjddp.exec:\jjddp.exe72⤵PID:1648
-
\??\c:\fxrrlrx.exec:\fxrrlrx.exe73⤵PID:888
-
\??\c:\bthttb.exec:\bthttb.exe74⤵PID:1856
-
\??\c:\1httbb.exec:\1httbb.exe75⤵PID:2572
-
\??\c:\dvjjp.exec:\dvjjp.exe76⤵PID:3064
-
\??\c:\lxlllll.exec:\lxlllll.exe77⤵PID:876
-
\??\c:\bnhntt.exec:\bnhntt.exe78⤵PID:108
-
\??\c:\htnntn.exec:\htnntn.exe79⤵PID:1916
-
\??\c:\5vvpp.exec:\5vvpp.exe80⤵PID:2888
-
\??\c:\lfrlfff.exec:\lfrlfff.exe81⤵PID:2764
-
\??\c:\bbtbnn.exec:\bbtbnn.exe82⤵PID:2768
-
\??\c:\1ppvj.exec:\1ppvj.exe83⤵
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\jvjdd.exec:\jvjdd.exe84⤵PID:2744
-
\??\c:\1lxxrrr.exec:\1lxxrrr.exe85⤵PID:2796
-
\??\c:\hbnthh.exec:\hbnthh.exe86⤵PID:2660
-
\??\c:\ddjpv.exec:\ddjpv.exe87⤵PID:2228
-
\??\c:\vjddd.exec:\vjddd.exe88⤵PID:2544
-
\??\c:\frfxxrx.exec:\frfxxrx.exe89⤵PID:2436
-
\??\c:\7tnntt.exec:\7tnntt.exe90⤵PID:1252
-
\??\c:\thnhnh.exec:\thnhnh.exe91⤵PID:1796
-
\??\c:\djdjd.exec:\djdjd.exe92⤵PID:2184
-
\??\c:\frxxxrl.exec:\frxxxrl.exe93⤵PID:1636
-
\??\c:\7thnbb.exec:\7thnbb.exe94⤵PID:1084
-
\??\c:\hbnbtt.exec:\hbnbtt.exe95⤵PID:1776
-
\??\c:\pdppp.exec:\pdppp.exe96⤵PID:2180
-
\??\c:\9xflllr.exec:\9xflllr.exe97⤵PID:1032
-
\??\c:\nhtbnn.exec:\nhtbnn.exe98⤵PID:300
-
\??\c:\7hbttt.exec:\7hbttt.exe99⤵PID:1900
-
\??\c:\jvjjv.exec:\jvjjv.exe100⤵PID:1748
-
\??\c:\rffffxf.exec:\rffffxf.exe101⤵PID:2508
-
\??\c:\1fxrfll.exec:\1fxrfll.exe102⤵PID:1840
-
\??\c:\5htnhh.exec:\5htnhh.exe103⤵PID:960
-
\??\c:\vjppd.exec:\vjppd.exe104⤵PID:1348
-
\??\c:\pvjvv.exec:\pvjvv.exe105⤵PID:2484
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe106⤵PID:1584
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe107⤵PID:1284
-
\??\c:\tnttnn.exec:\tnttnn.exe108⤵PID:2920
-
\??\c:\7pdjd.exec:\7pdjd.exe109⤵PID:2528
-
\??\c:\9rlfllr.exec:\9rlfllr.exe110⤵PID:696
-
\??\c:\frflrrr.exec:\frflrrr.exe111⤵PID:1452
-
\??\c:\thttbt.exec:\thttbt.exe112⤵PID:572
-
\??\c:\pjdjv.exec:\pjdjv.exe113⤵PID:2120
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe114⤵PID:1512
-
\??\c:\frrllfl.exec:\frrllfl.exe115⤵PID:2560
-
\??\c:\3nnbhh.exec:\3nnbhh.exe116⤵PID:1576
-
\??\c:\pjvpp.exec:\pjvpp.exe117⤵PID:1600
-
\??\c:\pjddj.exec:\pjddj.exe118⤵PID:916
-
\??\c:\9lrffff.exec:\9lrffff.exe119⤵PID:2208
-
\??\c:\9nbtbb.exec:\9nbtbb.exe120⤵PID:2824
-
\??\c:\1nbbhn.exec:\1nbbhn.exe121⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-