Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe
-
Size
453KB
-
MD5
21f7f1bb95bfc7466f96b95b89014e35
-
SHA1
ef7c775bd3be2c8c01fcb19408178bf59b0d2d16
-
SHA256
fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9
-
SHA512
b240ad4d4537e68cc99da80459875933fee94002e72675966704693e5cb23697aba1fffd20e776ed287e77e3bb9cbe1ffdd6a4545f5a870784e58913e675e742
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1072-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-53-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2604-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-109-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2220-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-219-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1668-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-301-0x0000000076DF0000-0x0000000076F0F000-memory.dmp family_blackmoon behavioral1/memory/2788-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-373-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-455-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1772-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-806-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2700 flrrxrf.exe 2744 lfllfxx.exe 2144 bbtthh.exe 3044 5fxxfrr.exe 2720 1thbbb.exe 2572 dvdjj.exe 2604 jjpjj.exe 1204 jpvvv.exe 1104 bhbbnh.exe 2764 pjvvv.exe 1696 hbbbbb.exe 2220 djvpj.exe 2612 bhbhhb.exe 764 rfrxflr.exe 1200 thtthh.exe 2380 rrxrxfl.exe 696 hhtttn.exe 592 xrxxxxx.exe 1888 hhnbth.exe 2336 9xllrlr.exe 1208 5ntttt.exe 3036 vvjpv.exe 692 7fxxflr.exe 616 jpdvd.exe 1668 ddjjp.exe 2120 ttntnh.exe 2480 djvdp.exe 1160 hhtbnb.exe 1392 5dpjd.exe 1084 ppdpj.exe 1896 xxfflfl.exe 2752 9htnnn.exe 2472 dvddv.exe 1708 tbbhtt.exe 2732 xxrrfff.exe 2768 5httbt.exe 2608 7dpvp.exe 2568 ppdvv.exe 2624 flxxxfl.exe 2176 7nnhhb.exe 1408 vddjp.exe 2352 jpvvv.exe 2532 xxfxxxf.exe 2344 thnhht.exe 1692 jpvvv.exe 3032 flrlllf.exe 584 3nnhnn.exe 1488 tbhbhh.exe 1352 9pjjp.exe 344 7frrxrf.exe 1324 ffflrxx.exe 2356 bbntbb.exe 588 pvdjj.exe 596 ffrxxfr.exe 2140 xxxrxxf.exe 2084 bbhbhn.exe 2196 ddpvd.exe 1900 xfrrrrx.exe 1256 hhhhhn.exe 1560 dpddp.exe 1772 xllfllx.exe 348 bntbbh.exe 2020 nnbhtb.exe 2892 jpvvp.exe -
resource yara_rule behavioral1/memory/1072-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-90-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2220-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-301-0x0000000076DF0000-0x0000000076F0F000-memory.dmp upx behavioral1/memory/2788-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-455-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2084-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-769-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2700 1072 fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe 30 PID 1072 wrote to memory of 2700 1072 fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe 30 PID 1072 wrote to memory of 2700 1072 fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe 30 PID 1072 wrote to memory of 2700 1072 fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe 30 PID 2700 wrote to memory of 2744 2700 flrrxrf.exe 31 PID 2700 wrote to memory of 2744 2700 flrrxrf.exe 31 PID 2700 wrote to memory of 2744 2700 flrrxrf.exe 31 PID 2700 wrote to memory of 2744 2700 flrrxrf.exe 31 PID 2744 wrote to memory of 2144 2744 lfllfxx.exe 32 PID 2744 wrote to memory of 2144 2744 lfllfxx.exe 32 PID 2744 wrote to memory of 2144 2744 lfllfxx.exe 32 PID 2744 wrote to memory of 2144 2744 lfllfxx.exe 32 PID 2144 wrote to memory of 3044 2144 bbtthh.exe 33 PID 2144 wrote to memory of 3044 2144 bbtthh.exe 33 PID 2144 wrote to memory of 3044 2144 bbtthh.exe 33 PID 2144 wrote to memory of 3044 2144 bbtthh.exe 33 PID 3044 wrote to memory of 2720 3044 5fxxfrr.exe 34 PID 3044 wrote to memory of 2720 3044 5fxxfrr.exe 34 PID 3044 wrote to memory of 2720 3044 5fxxfrr.exe 34 PID 3044 wrote to memory of 2720 3044 5fxxfrr.exe 34 PID 2720 wrote to memory of 2572 2720 1thbbb.exe 35 PID 2720 wrote to memory of 2572 2720 1thbbb.exe 35 PID 2720 wrote to memory of 2572 2720 1thbbb.exe 35 PID 2720 wrote to memory of 2572 2720 1thbbb.exe 35 PID 2572 wrote to memory of 2604 2572 dvdjj.exe 36 PID 2572 wrote to memory of 2604 2572 dvdjj.exe 36 PID 2572 wrote to memory of 2604 2572 dvdjj.exe 36 PID 2572 wrote to memory of 2604 2572 dvdjj.exe 36 PID 2604 wrote to memory of 1204 2604 jjpjj.exe 37 PID 2604 wrote to memory of 1204 2604 jjpjj.exe 37 PID 2604 wrote to memory of 1204 2604 jjpjj.exe 37 PID 2604 wrote to memory of 1204 2604 jjpjj.exe 37 PID 1204 wrote to memory of 1104 1204 jpvvv.exe 38 PID 1204 wrote to memory of 1104 1204 jpvvv.exe 38 PID 1204 wrote to memory of 1104 1204 jpvvv.exe 38 PID 1204 wrote to memory of 1104 1204 jpvvv.exe 38 PID 1104 wrote to memory of 2764 1104 bhbbnh.exe 39 PID 1104 wrote to memory of 2764 1104 bhbbnh.exe 39 PID 1104 wrote to memory of 2764 1104 bhbbnh.exe 39 PID 1104 wrote to memory of 2764 1104 bhbbnh.exe 39 PID 2764 wrote to memory of 1696 2764 pjvvv.exe 40 PID 2764 wrote to memory of 1696 2764 pjvvv.exe 40 PID 2764 wrote to memory of 1696 2764 pjvvv.exe 40 PID 2764 wrote to memory of 1696 2764 pjvvv.exe 40 PID 1696 wrote to memory of 2220 1696 hbbbbb.exe 41 PID 1696 wrote to memory of 2220 1696 hbbbbb.exe 41 PID 1696 wrote to memory of 2220 1696 hbbbbb.exe 41 PID 1696 wrote to memory of 2220 1696 hbbbbb.exe 41 PID 2220 wrote to memory of 2612 2220 djvpj.exe 42 PID 2220 wrote to memory of 2612 2220 djvpj.exe 42 PID 2220 wrote to memory of 2612 2220 djvpj.exe 42 PID 2220 wrote to memory of 2612 2220 djvpj.exe 42 PID 2612 wrote to memory of 764 2612 bhbhhb.exe 43 PID 2612 wrote to memory of 764 2612 bhbhhb.exe 43 PID 2612 wrote to memory of 764 2612 bhbhhb.exe 43 PID 2612 wrote to memory of 764 2612 bhbhhb.exe 43 PID 764 wrote to memory of 1200 764 rfrxflr.exe 44 PID 764 wrote to memory of 1200 764 rfrxflr.exe 44 PID 764 wrote to memory of 1200 764 rfrxflr.exe 44 PID 764 wrote to memory of 1200 764 rfrxflr.exe 44 PID 1200 wrote to memory of 2380 1200 thtthh.exe 45 PID 1200 wrote to memory of 2380 1200 thtthh.exe 45 PID 1200 wrote to memory of 2380 1200 thtthh.exe 45 PID 1200 wrote to memory of 2380 1200 thtthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe"C:\Users\Admin\AppData\Local\Temp\fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\flrrxrf.exec:\flrrxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lfllfxx.exec:\lfllfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bbtthh.exec:\bbtthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\5fxxfrr.exec:\5fxxfrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\1thbbb.exec:\1thbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\dvdjj.exec:\dvdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jjpjj.exec:\jjpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jpvvv.exec:\jpvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\bhbbnh.exec:\bhbbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\pjvvv.exec:\pjvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hbbbbb.exec:\hbbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\djvpj.exec:\djvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\bhbhhb.exec:\bhbhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rfrxflr.exec:\rfrxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\thtthh.exec:\thtthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\rrxrxfl.exec:\rrxrxfl.exe17⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hhtttn.exec:\hhtttn.exe18⤵
- Executes dropped EXE
PID:696 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe19⤵
- Executes dropped EXE
PID:592 -
\??\c:\hhnbth.exec:\hhnbth.exe20⤵
- Executes dropped EXE
PID:1888 -
\??\c:\9xllrlr.exec:\9xllrlr.exe21⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5ntttt.exec:\5ntttt.exe22⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vvjpv.exec:\vvjpv.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7fxxflr.exec:\7fxxflr.exe24⤵
- Executes dropped EXE
PID:692 -
\??\c:\jpdvd.exec:\jpdvd.exe25⤵
- Executes dropped EXE
PID:616 -
\??\c:\ddjjp.exec:\ddjjp.exe26⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ttntnh.exec:\ttntnh.exe27⤵
- Executes dropped EXE
PID:2120 -
\??\c:\djvdp.exec:\djvdp.exe28⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hhtbnb.exec:\hhtbnb.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5dpjd.exec:\5dpjd.exe30⤵
- Executes dropped EXE
PID:1392 -
\??\c:\ppdpj.exec:\ppdpj.exe31⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xxfflfl.exec:\xxfflfl.exe32⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9htnnn.exec:\9htnnn.exe33⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dvddv.exec:\dvddv.exe34⤵
- Executes dropped EXE
PID:2472 -
\??\c:\1lrrlrl.exec:\1lrrlrl.exe35⤵PID:2788
-
\??\c:\tbbhtt.exec:\tbbhtt.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xxrrfff.exec:\xxrrfff.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5httbt.exec:\5httbt.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7dpvp.exec:\7dpvp.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ppdvv.exec:\ppdvv.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\flxxxfl.exec:\flxxxfl.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7nnhhb.exec:\7nnhhb.exe42⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vddjp.exec:\vddjp.exe43⤵
- Executes dropped EXE
PID:1408 -
\??\c:\jpvvv.exec:\jpvvv.exe44⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xxfxxxf.exec:\xxfxxxf.exe45⤵
- Executes dropped EXE
PID:2532 -
\??\c:\thnhht.exec:\thnhht.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jpvvv.exec:\jpvvv.exe47⤵
- Executes dropped EXE
PID:1692 -
\??\c:\flrlllf.exec:\flrlllf.exe48⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3nnhnn.exec:\3nnhnn.exe49⤵
- Executes dropped EXE
PID:584 -
\??\c:\tbhbhh.exec:\tbhbhh.exe50⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9pjjp.exec:\9pjjp.exe51⤵
- Executes dropped EXE
PID:1352 -
\??\c:\7frrxrf.exec:\7frrxrf.exe52⤵
- Executes dropped EXE
PID:344 -
\??\c:\ffflrxx.exec:\ffflrxx.exe53⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bbntbb.exec:\bbntbb.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pvdjj.exec:\pvdjj.exe55⤵
- Executes dropped EXE
PID:588 -
\??\c:\ffrxxfr.exec:\ffrxxfr.exe56⤵
- Executes dropped EXE
PID:596 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe57⤵
- Executes dropped EXE
PID:2140 -
\??\c:\bbhbhn.exec:\bbhbhn.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ddpvd.exec:\ddpvd.exe59⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xfrrrrx.exec:\xfrrrrx.exe60⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hhhhhn.exec:\hhhhhn.exe61⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dpddp.exec:\dpddp.exe62⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xllfllx.exec:\xllfllx.exe63⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bntbbh.exec:\bntbbh.exe64⤵
- Executes dropped EXE
PID:348 -
\??\c:\nnbhtb.exec:\nnbhtb.exe65⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jpvvp.exec:\jpvvp.exe66⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xrxflrf.exec:\xrxflrf.exe67⤵PID:2008
-
\??\c:\bbbbtn.exec:\bbbbtn.exe68⤵PID:3052
-
\??\c:\ddvjv.exec:\ddvjv.exe69⤵PID:2492
-
\??\c:\1pvdj.exec:\1pvdj.exe70⤵PID:1160
-
\??\c:\xfffffl.exec:\xfffffl.exe71⤵PID:2484
-
\??\c:\5htnnh.exec:\5htnnh.exe72⤵PID:1788
-
\??\c:\pvpvd.exec:\pvpvd.exe73⤵PID:2656
-
\??\c:\1lflllr.exec:\1lflllr.exe74⤵PID:2700
-
\??\c:\7bnnnt.exec:\7bnnnt.exe75⤵PID:2800
-
\??\c:\nntttt.exec:\nntttt.exe76⤵PID:1588
-
\??\c:\dvvpv.exec:\dvvpv.exe77⤵PID:2812
-
\??\c:\rxlfrrx.exec:\rxlfrrx.exe78⤵PID:2064
-
\??\c:\5rlrxff.exec:\5rlrxff.exe79⤵PID:2716
-
\??\c:\9httht.exec:\9httht.exe80⤵PID:2724
-
\??\c:\7vdvj.exec:\7vdvj.exe81⤵PID:2596
-
\??\c:\rrfxfff.exec:\rrfxfff.exe82⤵PID:2572
-
\??\c:\hhhhbh.exec:\hhhhbh.exe83⤵PID:3064
-
\??\c:\tnttnh.exec:\tnttnh.exe84⤵PID:2604
-
\??\c:\dvvvv.exec:\dvvvv.exe85⤵PID:1408
-
\??\c:\rlxxflr.exec:\rlxxflr.exe86⤵PID:2984
-
\??\c:\7bhntt.exec:\7bhntt.exe87⤵PID:1520
-
\??\c:\bbnthh.exec:\bbnthh.exe88⤵PID:2444
-
\??\c:\1dvvd.exec:\1dvvd.exe89⤵PID:1692
-
\??\c:\lrrflxx.exec:\lrrflxx.exe90⤵PID:2648
-
\??\c:\tbnhnn.exec:\tbnhnn.exe91⤵PID:584
-
\??\c:\tttnhh.exec:\tttnhh.exe92⤵PID:2824
-
\??\c:\7pppv.exec:\7pppv.exe93⤵PID:1352
-
\??\c:\fxfrrrr.exec:\fxfrrrr.exe94⤵PID:1740
-
\??\c:\ttbbhh.exec:\ttbbhh.exe95⤵PID:2128
-
\??\c:\3tnthh.exec:\3tnthh.exe96⤵PID:480
-
\??\c:\pdppv.exec:\pdppv.exe97⤵PID:264
-
\??\c:\5fxxlrr.exec:\5fxxlrr.exe98⤵PID:2072
-
\??\c:\lxlrffl.exec:\lxlrffl.exe99⤵PID:636
-
\??\c:\btbbbh.exec:\btbbbh.exe100⤵PID:1888
-
\??\c:\ppvdj.exec:\ppvdj.exe101⤵PID:2336
-
\??\c:\djpvd.exec:\djpvd.exe102⤵PID:3028
-
\??\c:\xrfxffl.exec:\xrfxffl.exe103⤵PID:1208
-
\??\c:\7htnnn.exec:\7htnnn.exe104⤵PID:860
-
\??\c:\jpvpv.exec:\jpvpv.exe105⤵PID:900
-
\??\c:\lflfxrr.exec:\lflfxrr.exe106⤵PID:2912
-
\??\c:\7flxxrr.exec:\7flxxrr.exe107⤵PID:1668
-
\??\c:\5htbbt.exec:\5htbbt.exe108⤵PID:2124
-
\??\c:\ppddv.exec:\ppddv.exe109⤵PID:1404
-
\??\c:\fxxrlrr.exec:\fxxrlrr.exe110⤵PID:2460
-
\??\c:\ffrrffr.exec:\ffrrffr.exe111⤵PID:2836
-
\??\c:\hhbhth.exec:\hhbhth.exe112⤵PID:2400
-
\??\c:\vdjdd.exec:\vdjdd.exe113⤵PID:1088
-
\??\c:\ffrxxll.exec:\ffrxxll.exe114⤵PID:1084
-
\??\c:\3nhbnh.exec:\3nhbnh.exe115⤵PID:2012
-
\??\c:\pvjdd.exec:\pvjdd.exe116⤵PID:2976
-
\??\c:\flfllxl.exec:\flfllxl.exe117⤵PID:2700
-
\??\c:\9xxxlrx.exec:\9xxxlrx.exe118⤵PID:1612
-
\??\c:\9nhbnn.exec:\9nhbnn.exe119⤵PID:1588
-
\??\c:\dvjdv.exec:\dvjdv.exe120⤵PID:1708
-
\??\c:\7pvvd.exec:\7pvvd.exe121⤵PID:2664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-