Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe
-
Size
455KB
-
MD5
fdcb0d1c35362790c47d3496a73ae170
-
SHA1
b12e29a4bff892a257ac112af499888eadfeb77d
-
SHA256
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7
-
SHA512
b84ee16844220c5b6969465ffa5fd53ee775c262ff1449ecee628b85bd1f5bddcea86b2e5aaddc9ca1cbabd29d8802e0888de6663194c05ce31127cbaaa3223a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRIJ:q7Tc2NYHUrAwfMp3CDRQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2508-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-47-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2724-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-91-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1892-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-109-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/840-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-296-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-295-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-303-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-320-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-342-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/528-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-925-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-932-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-958-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-970-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1904-989-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/700-1271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1320 pjddj.exe 2540 1rlllrx.exe 2124 nhbbbb.exe 2092 fxrrfxf.exe 2872 htnntb.exe 2724 vpjpv.exe 2716 1thbbb.exe 2620 frlxffr.exe 2496 3nbbhb.exe 2672 hhhhtn.exe 1892 3nbhhh.exe 840 9vdpp.exe 1744 5nnhtn.exe 2824 vjvdj.exe 2936 7lrrrxx.exe 1308 xrflxxx.exe 1544 vpjvd.exe 624 5bhtnt.exe 1196 lfrrffl.exe 808 nhbtbb.exe 1632 5vvjp.exe 1476 frfflll.exe 2488 nhbhtn.exe 2424 1frffxl.exe 1768 7nnntn.exe 896 xxxxxxx.exe 2188 tttbnn.exe 2436 1pjvd.exe 348 rfxfllr.exe 1644 7bbhth.exe 880 dvvdp.exe 2216 hbnhnn.exe 1860 pjpvj.exe 2400 btttbb.exe 1872 hhhhnn.exe 2692 jpdvj.exe 2728 llxlxfr.exe 2868 lrflfrx.exe 3020 nnhhtt.exe 1900 vpjjp.exe 2848 dddjv.exe 2716 xrxrrrx.exe 2768 hhbtbb.exe 2652 thbbnn.exe 2644 jddvp.exe 2440 vpdjj.exe 1700 5lxxxfl.exe 668 hbtbtt.exe 2952 tnbhtb.exe 2840 pjvdv.exe 2824 1lxrrxx.exe 2844 1xlfffl.exe 2944 bbtbtb.exe 2984 jdppv.exe 1096 vpdvd.exe 1564 7fxxxfr.exe 624 bbbhhn.exe 2396 nnnbhn.exe 1704 vvjjv.exe 2312 xlxrrrx.exe 1632 rfrrllr.exe 528 5hnnbb.exe 2068 3ddvj.exe 2468 1vpjd.exe -
resource yara_rule behavioral1/memory/2508-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-72-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/2716-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-305-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1860-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/528-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-543-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1644-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-970-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1076-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-1271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-1347-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1320 2508 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 2508 wrote to memory of 1320 2508 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 2508 wrote to memory of 1320 2508 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 2508 wrote to memory of 1320 2508 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 1320 wrote to memory of 2540 1320 pjddj.exe 31 PID 1320 wrote to memory of 2540 1320 pjddj.exe 31 PID 1320 wrote to memory of 2540 1320 pjddj.exe 31 PID 1320 wrote to memory of 2540 1320 pjddj.exe 31 PID 2540 wrote to memory of 2124 2540 1rlllrx.exe 32 PID 2540 wrote to memory of 2124 2540 1rlllrx.exe 32 PID 2540 wrote to memory of 2124 2540 1rlllrx.exe 32 PID 2540 wrote to memory of 2124 2540 1rlllrx.exe 32 PID 2124 wrote to memory of 2092 2124 nhbbbb.exe 33 PID 2124 wrote to memory of 2092 2124 nhbbbb.exe 33 PID 2124 wrote to memory of 2092 2124 nhbbbb.exe 33 PID 2124 wrote to memory of 2092 2124 nhbbbb.exe 33 PID 2092 wrote to memory of 2872 2092 fxrrfxf.exe 34 PID 2092 wrote to memory of 2872 2092 fxrrfxf.exe 34 PID 2092 wrote to memory of 2872 2092 fxrrfxf.exe 34 PID 2092 wrote to memory of 2872 2092 fxrrfxf.exe 34 PID 2872 wrote to memory of 2724 2872 htnntb.exe 35 PID 2872 wrote to memory of 2724 2872 htnntb.exe 35 PID 2872 wrote to memory of 2724 2872 htnntb.exe 35 PID 2872 wrote to memory of 2724 2872 htnntb.exe 35 PID 2724 wrote to memory of 2716 2724 vpjpv.exe 36 PID 2724 wrote to memory of 2716 2724 vpjpv.exe 36 PID 2724 wrote to memory of 2716 2724 vpjpv.exe 36 PID 2724 wrote to memory of 2716 2724 vpjpv.exe 36 PID 2716 wrote to memory of 2620 2716 1thbbb.exe 37 PID 2716 wrote to memory of 2620 2716 1thbbb.exe 37 PID 2716 wrote to memory of 2620 2716 1thbbb.exe 37 PID 2716 wrote to memory of 2620 2716 1thbbb.exe 37 PID 2620 wrote to memory of 2496 2620 frlxffr.exe 38 PID 2620 wrote to memory of 2496 2620 frlxffr.exe 38 PID 2620 wrote to memory of 2496 2620 frlxffr.exe 38 PID 2620 wrote to memory of 2496 2620 frlxffr.exe 38 PID 2496 wrote to memory of 2672 2496 3nbbhb.exe 39 PID 2496 wrote to memory of 2672 2496 3nbbhb.exe 39 PID 2496 wrote to memory of 2672 2496 3nbbhb.exe 39 PID 2496 wrote to memory of 2672 2496 3nbbhb.exe 39 PID 2672 wrote to memory of 1892 2672 hhhhtn.exe 40 PID 2672 wrote to memory of 1892 2672 hhhhtn.exe 40 PID 2672 wrote to memory of 1892 2672 hhhhtn.exe 40 PID 2672 wrote to memory of 1892 2672 hhhhtn.exe 40 PID 1892 wrote to memory of 840 1892 3nbhhh.exe 41 PID 1892 wrote to memory of 840 1892 3nbhhh.exe 41 PID 1892 wrote to memory of 840 1892 3nbhhh.exe 41 PID 1892 wrote to memory of 840 1892 3nbhhh.exe 41 PID 840 wrote to memory of 1744 840 9vdpp.exe 42 PID 840 wrote to memory of 1744 840 9vdpp.exe 42 PID 840 wrote to memory of 1744 840 9vdpp.exe 42 PID 840 wrote to memory of 1744 840 9vdpp.exe 42 PID 1744 wrote to memory of 2824 1744 5nnhtn.exe 43 PID 1744 wrote to memory of 2824 1744 5nnhtn.exe 43 PID 1744 wrote to memory of 2824 1744 5nnhtn.exe 43 PID 1744 wrote to memory of 2824 1744 5nnhtn.exe 43 PID 2824 wrote to memory of 2936 2824 vjvdj.exe 44 PID 2824 wrote to memory of 2936 2824 vjvdj.exe 44 PID 2824 wrote to memory of 2936 2824 vjvdj.exe 44 PID 2824 wrote to memory of 2936 2824 vjvdj.exe 44 PID 2936 wrote to memory of 1308 2936 7lrrrxx.exe 45 PID 2936 wrote to memory of 1308 2936 7lrrrxx.exe 45 PID 2936 wrote to memory of 1308 2936 7lrrrxx.exe 45 PID 2936 wrote to memory of 1308 2936 7lrrrxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe"C:\Users\Admin\AppData\Local\Temp\faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pjddj.exec:\pjddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\1rlllrx.exec:\1rlllrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhbbbb.exec:\nhbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\fxrrfxf.exec:\fxrrfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\htnntb.exec:\htnntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vpjpv.exec:\vpjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1thbbb.exec:\1thbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\frlxffr.exec:\frlxffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3nbbhb.exec:\3nbbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\hhhhtn.exec:\hhhhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\3nbhhh.exec:\3nbhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\9vdpp.exec:\9vdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\5nnhtn.exec:\5nnhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\vjvdj.exec:\vjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7lrrrxx.exec:\7lrrrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xrflxxx.exec:\xrflxxx.exe17⤵
- Executes dropped EXE
PID:1308 -
\??\c:\vpjvd.exec:\vpjvd.exe18⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5bhtnt.exec:\5bhtnt.exe19⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfrrffl.exec:\lfrrffl.exe20⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nhbtbb.exec:\nhbtbb.exe21⤵
- Executes dropped EXE
PID:808 -
\??\c:\5vvjp.exec:\5vvjp.exe22⤵
- Executes dropped EXE
PID:1632 -
\??\c:\frfflll.exec:\frfflll.exe23⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nhbhtn.exec:\nhbhtn.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1frffxl.exec:\1frffxl.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7nnntn.exec:\7nnntn.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\tttbnn.exec:\tttbnn.exe28⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1pjvd.exec:\1pjvd.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rfxfllr.exec:\rfxfllr.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\7bbhth.exec:\7bbhth.exe31⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dvvdp.exec:\dvvdp.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\hbnhnn.exec:\hbnhnn.exe33⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pjpvj.exec:\pjpvj.exe34⤵
- Executes dropped EXE
PID:1860 -
\??\c:\btttbb.exec:\btttbb.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhhhnn.exec:\hhhhnn.exe36⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jpdvj.exec:\jpdvj.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\llxlxfr.exec:\llxlxfr.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lrflfrx.exec:\lrflfrx.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nnhhtt.exec:\nnhhtt.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vpjjp.exec:\vpjjp.exe41⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dddjv.exec:\dddjv.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hhbtbb.exec:\hhbtbb.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\thbbnn.exec:\thbbnn.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jddvp.exec:\jddvp.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpdjj.exec:\vpdjj.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5lxxxfl.exec:\5lxxxfl.exe48⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hbtbtt.exec:\hbtbtt.exe49⤵
- Executes dropped EXE
PID:668 -
\??\c:\tnbhtb.exec:\tnbhtb.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pjvdv.exec:\pjvdv.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1lxrrxx.exec:\1lxrrxx.exe52⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1xlfffl.exec:\1xlfffl.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bbtbtb.exec:\bbtbtb.exe54⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jdppv.exec:\jdppv.exe55⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpdvd.exec:\vpdvd.exe56⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7fxxxfr.exec:\7fxxxfr.exe57⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bbbhhn.exec:\bbbhhn.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\nnnbhn.exec:\nnnbhn.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvjjv.exec:\vvjjv.exe60⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rfrrllr.exec:\rfrrllr.exe62⤵
- Executes dropped EXE
PID:1632 -
\??\c:\5hnnbb.exec:\5hnnbb.exe63⤵
- Executes dropped EXE
PID:528 -
\??\c:\3ddvj.exec:\3ddvj.exe64⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1vpjd.exec:\1vpjd.exe65⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fxlxffr.exec:\fxlxffr.exe66⤵PID:2224
-
\??\c:\bbtbnt.exec:\bbtbnt.exe67⤵PID:2460
-
\??\c:\bbthhh.exec:\bbthhh.exe68⤵PID:2136
-
\??\c:\dpjjp.exec:\dpjjp.exe69⤵PID:2276
-
\??\c:\3lxfxxf.exec:\3lxfxxf.exe70⤵PID:2932
-
\??\c:\btnttb.exec:\btnttb.exe71⤵PID:2076
-
\??\c:\tnnnbh.exec:\tnnnbh.exe72⤵PID:1644
-
\??\c:\ppjjp.exec:\ppjjp.exe73⤵PID:2636
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe74⤵PID:3024
-
\??\c:\9lxfxlx.exec:\9lxfxlx.exe75⤵PID:2420
-
\??\c:\hhbbhn.exec:\hhbbhn.exe76⤵PID:2556
-
\??\c:\jvdvd.exec:\jvdvd.exe77⤵PID:2384
-
\??\c:\3pdjd.exec:\3pdjd.exe78⤵PID:1724
-
\??\c:\5xllrlf.exec:\5xllrlf.exe79⤵PID:3000
-
\??\c:\nhttht.exec:\nhttht.exe80⤵PID:2116
-
\??\c:\nhtnnn.exec:\nhtnnn.exe81⤵PID:2008
-
\??\c:\5vjpv.exec:\5vjpv.exe82⤵PID:2324
-
\??\c:\xrllrrf.exec:\xrllrrf.exe83⤵PID:2880
-
\??\c:\9frlrrr.exec:\9frlrrr.exe84⤵PID:2896
-
\??\c:\nhbhnn.exec:\nhbhnn.exe85⤵PID:1900
-
\??\c:\vvpvd.exec:\vvpvd.exe86⤵PID:2016
-
\??\c:\vpvpj.exec:\vpvpj.exe87⤵PID:2716
-
\??\c:\rlfflfl.exec:\rlfflfl.exe88⤵PID:2720
-
\??\c:\hhtnbn.exec:\hhtnbn.exe89⤵PID:2652
-
\??\c:\7bntnn.exec:\7bntnn.exe90⤵PID:1444
-
\??\c:\jpdpp.exec:\jpdpp.exe91⤵PID:2820
-
\??\c:\fxxxffr.exec:\fxxxffr.exe92⤵PID:1700
-
\??\c:\fxlxxxx.exec:\fxlxxxx.exe93⤵PID:2700
-
\??\c:\ttbhtt.exec:\ttbhtt.exe94⤵
- System Location Discovery: System Language Discovery
PID:2804 -
\??\c:\3jpjd.exec:\3jpjd.exe95⤵PID:2796
-
\??\c:\9jdvj.exec:\9jdvj.exe96⤵PID:2800
-
\??\c:\5fxrlfl.exec:\5fxrlfl.exe97⤵PID:2844
-
\??\c:\fxllxxf.exec:\fxllxxf.exe98⤵PID:2936
-
\??\c:\tnbbhb.exec:\tnbbhb.exe99⤵PID:2984
-
\??\c:\dvddj.exec:\dvddj.exe100⤵PID:1996
-
\??\c:\rflxrlr.exec:\rflxrlr.exe101⤵PID:1500
-
\??\c:\xlffffl.exec:\xlffffl.exe102⤵PID:2012
-
\??\c:\nhbbhn.exec:\nhbbhn.exe103⤵PID:1208
-
\??\c:\3vjdd.exec:\3vjdd.exe104⤵PID:2528
-
\??\c:\vvpvd.exec:\vvpvd.exe105⤵PID:1484
-
\??\c:\rxxlxxr.exec:\rxxlxxr.exe106⤵PID:2980
-
\??\c:\btnnbb.exec:\btnnbb.exe107⤵PID:2148
-
\??\c:\ppjpv.exec:\ppjpv.exe108⤵PID:2488
-
\??\c:\vvdvv.exec:\vvdvv.exe109⤵PID:1764
-
\??\c:\5lrllff.exec:\5lrllff.exe110⤵PID:1780
-
\??\c:\nhtttb.exec:\nhtttb.exe111⤵PID:2196
-
\??\c:\5dpvj.exec:\5dpvj.exe112⤵PID:2412
-
\??\c:\5jvdj.exec:\5jvdj.exe113⤵PID:1680
-
\??\c:\rxlxffl.exec:\rxlxffl.exe114⤵PID:2276
-
\??\c:\9tbtbh.exec:\9tbtbh.exe115⤵PID:3048
-
\??\c:\tnhhtb.exec:\tnhhtb.exe116⤵PID:1652
-
\??\c:\dpjpp.exec:\dpjpp.exe117⤵PID:2304
-
\??\c:\jvdjp.exec:\jvdjp.exe118⤵PID:2364
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe119⤵PID:3024
-
\??\c:\1thhhh.exec:\1thhhh.exe120⤵PID:2420
-
\??\c:\ppdjp.exec:\ppdjp.exe121⤵PID:1320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-