Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe
-
Size
453KB
-
MD5
c62a7499aca2c54cb3f372c42c28861c
-
SHA1
db514b565f7e4bd8055a0edf90c7f075a51d1952
-
SHA256
ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005
-
SHA512
6b1c7856961e5371691605b64b3299663f11e5a7a49d1b2a5d68cff3a9d5bdfb235ad2c795e879d58b74996d44f82f2777c4c04344161076a0b514f3d05b77f3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2744-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-74-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2816-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-94-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2152-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-116-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2908-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-442-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2232-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-525-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2828-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-584-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-614-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-735-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1792-779-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1192-786-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1580-793-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2664-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-974-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2264-1147-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2908-1168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 dpjpj.exe 2364 thnhtn.exe 2580 1pdvv.exe 2108 bhbbth.exe 2548 pvjdj.exe 2712 nbhnnn.exe 2816 btnhhh.exe 1252 3dppp.exe 2152 tbbnht.exe 2096 pdpvj.exe 2908 llfxxxf.exe 672 nbhbhb.exe 2896 1pjjj.exe 2948 rfrrrrf.exe 324 3tnbhh.exe 544 9rffllr.exe 2188 lfflrrx.exe 2232 bntnnn.exe 2216 jvjjj.exe 1320 xfflllx.exe 2044 dpjvv.exe 2328 9fxflrx.exe 1864 xlfxffr.exe 756 hbbhnt.exe 2628 jdpjd.exe 2244 fxlrxxl.exe 1848 pjjpd.exe 1432 xrxxllx.exe 2040 nbbbbb.exe 2744 5ddpp.exe 2464 frxlrrx.exe 2800 bhtntt.exe 2976 htnntt.exe 2708 lfrrxxr.exe 2740 5ntnbb.exe 2576 3tnntt.exe 2156 1djdj.exe 1556 xlxrxxf.exe 2104 lrfrflr.exe 2920 tbtbnh.exe 2252 jpdpd.exe 1720 dpjpp.exe 2228 lxlflll.exe 604 bhttnn.exe 2908 nbhtnb.exe 2880 7jpjj.exe 2860 jvdvj.exe 2836 1fxlrrf.exe 2948 bnhbbt.exe 3048 pvjpp.exe 2988 vjpjj.exe 1840 7lllxxl.exe 2188 htbhtt.exe 2232 nbnnnn.exe 2220 pjvvd.exe 1836 1xffrxl.exe 1320 llflflx.exe 1960 hbnntt.exe 1112 dvjdj.exe 1852 7lxflxl.exe 956 thbhhh.exe 756 ppdjv.exe 684 5jvjv.exe 1212 vjvdp.exe -
resource yara_rule behavioral1/memory/2744-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-94-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2152-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-793-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2664-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-1103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2792 2744 ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe 31 PID 2744 wrote to memory of 2792 2744 ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe 31 PID 2744 wrote to memory of 2792 2744 ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe 31 PID 2744 wrote to memory of 2792 2744 ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe 31 PID 2792 wrote to memory of 2364 2792 dpjpj.exe 32 PID 2792 wrote to memory of 2364 2792 dpjpj.exe 32 PID 2792 wrote to memory of 2364 2792 dpjpj.exe 32 PID 2792 wrote to memory of 2364 2792 dpjpj.exe 32 PID 2364 wrote to memory of 2580 2364 thnhtn.exe 33 PID 2364 wrote to memory of 2580 2364 thnhtn.exe 33 PID 2364 wrote to memory of 2580 2364 thnhtn.exe 33 PID 2364 wrote to memory of 2580 2364 thnhtn.exe 33 PID 2580 wrote to memory of 2108 2580 1pdvv.exe 34 PID 2580 wrote to memory of 2108 2580 1pdvv.exe 34 PID 2580 wrote to memory of 2108 2580 1pdvv.exe 34 PID 2580 wrote to memory of 2108 2580 1pdvv.exe 34 PID 2108 wrote to memory of 2548 2108 bhbbth.exe 35 PID 2108 wrote to memory of 2548 2108 bhbbth.exe 35 PID 2108 wrote to memory of 2548 2108 bhbbth.exe 35 PID 2108 wrote to memory of 2548 2108 bhbbth.exe 35 PID 2548 wrote to memory of 2712 2548 pvjdj.exe 36 PID 2548 wrote to memory of 2712 2548 pvjdj.exe 36 PID 2548 wrote to memory of 2712 2548 pvjdj.exe 36 PID 2548 wrote to memory of 2712 2548 pvjdj.exe 36 PID 2712 wrote to memory of 2816 2712 nbhnnn.exe 37 PID 2712 wrote to memory of 2816 2712 nbhnnn.exe 37 PID 2712 wrote to memory of 2816 2712 nbhnnn.exe 37 PID 2712 wrote to memory of 2816 2712 nbhnnn.exe 37 PID 2816 wrote to memory of 1252 2816 btnhhh.exe 38 PID 2816 wrote to memory of 1252 2816 btnhhh.exe 38 PID 2816 wrote to memory of 1252 2816 btnhhh.exe 38 PID 2816 wrote to memory of 1252 2816 btnhhh.exe 38 PID 1252 wrote to memory of 2152 1252 3dppp.exe 39 PID 1252 wrote to memory of 2152 1252 3dppp.exe 39 PID 1252 wrote to memory of 2152 1252 3dppp.exe 39 PID 1252 wrote to memory of 2152 1252 3dppp.exe 39 PID 2152 wrote to memory of 2096 2152 tbbnht.exe 40 PID 2152 wrote to memory of 2096 2152 tbbnht.exe 40 PID 2152 wrote to memory of 2096 2152 tbbnht.exe 40 PID 2152 wrote to memory of 2096 2152 tbbnht.exe 40 PID 2096 wrote to memory of 2908 2096 pdpvj.exe 75 PID 2096 wrote to memory of 2908 2096 pdpvj.exe 75 PID 2096 wrote to memory of 2908 2096 pdpvj.exe 75 PID 2096 wrote to memory of 2908 2096 pdpvj.exe 75 PID 2908 wrote to memory of 672 2908 llfxxxf.exe 42 PID 2908 wrote to memory of 672 2908 llfxxxf.exe 42 PID 2908 wrote to memory of 672 2908 llfxxxf.exe 42 PID 2908 wrote to memory of 672 2908 llfxxxf.exe 42 PID 672 wrote to memory of 2896 672 nbhbhb.exe 43 PID 672 wrote to memory of 2896 672 nbhbhb.exe 43 PID 672 wrote to memory of 2896 672 nbhbhb.exe 43 PID 672 wrote to memory of 2896 672 nbhbhb.exe 43 PID 2896 wrote to memory of 2948 2896 1pjjj.exe 79 PID 2896 wrote to memory of 2948 2896 1pjjj.exe 79 PID 2896 wrote to memory of 2948 2896 1pjjj.exe 79 PID 2896 wrote to memory of 2948 2896 1pjjj.exe 79 PID 2948 wrote to memory of 324 2948 rfrrrrf.exe 45 PID 2948 wrote to memory of 324 2948 rfrrrrf.exe 45 PID 2948 wrote to memory of 324 2948 rfrrrrf.exe 45 PID 2948 wrote to memory of 324 2948 rfrrrrf.exe 45 PID 324 wrote to memory of 544 324 3tnbhh.exe 46 PID 324 wrote to memory of 544 324 3tnbhh.exe 46 PID 324 wrote to memory of 544 324 3tnbhh.exe 46 PID 324 wrote to memory of 544 324 3tnbhh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe"C:\Users\Admin\AppData\Local\Temp\ac33a02a7230b42b8f4a3c15454f6e40d86b856d39ea17e75e27cdf9b1d3f005.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\dpjpj.exec:\dpjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\thnhtn.exec:\thnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\1pdvv.exec:\1pdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bhbbth.exec:\bhbbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\pvjdj.exec:\pvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\nbhnnn.exec:\nbhnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\btnhhh.exec:\btnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3dppp.exec:\3dppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\tbbnht.exec:\tbbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\pdpvj.exec:\pdpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\llfxxxf.exec:\llfxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nbhbhb.exec:\nbhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\1pjjj.exec:\1pjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\3tnbhh.exec:\3tnbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\9rffllr.exec:\9rffllr.exe17⤵
- Executes dropped EXE
PID:544 -
\??\c:\lfflrrx.exec:\lfflrrx.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bntnnn.exec:\bntnnn.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jvjjj.exec:\jvjjj.exe20⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xfflllx.exec:\xfflllx.exe21⤵
- Executes dropped EXE
PID:1320 -
\??\c:\dpjvv.exec:\dpjvv.exe22⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9fxflrx.exec:\9fxflrx.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xlfxffr.exec:\xlfxffr.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbbhnt.exec:\hbbhnt.exe25⤵
- Executes dropped EXE
PID:756 -
\??\c:\jdpjd.exec:\jdpjd.exe26⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pjjpd.exec:\pjjpd.exe28⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xrxxllx.exec:\xrxxllx.exe29⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nbbbbb.exec:\nbbbbb.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5ddpp.exec:\5ddpp.exe31⤵
- Executes dropped EXE
PID:2744 -
\??\c:\frxlrrx.exec:\frxlrrx.exe32⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bhtntt.exec:\bhtntt.exe33⤵
- Executes dropped EXE
PID:2800 -
\??\c:\htnntt.exec:\htnntt.exe34⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5ntnbb.exec:\5ntnbb.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3tnntt.exec:\3tnntt.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1djdj.exec:\1djdj.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe39⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lrfrflr.exec:\lrfrflr.exe40⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tbtbnh.exec:\tbtbnh.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jpdpd.exec:\jpdpd.exe42⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dpjpp.exec:\dpjpp.exe43⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lxlflll.exec:\lxlflll.exe44⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bhttnn.exec:\bhttnn.exe45⤵
- Executes dropped EXE
PID:604 -
\??\c:\nbhtnb.exec:\nbhtnb.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7jpjj.exec:\7jpjj.exe47⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jvdvj.exec:\jvdvj.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\1fxlrrf.exec:\1fxlrrf.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bnhbbt.exec:\bnhbbt.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pvjpp.exec:\pvjpp.exe51⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vjpjj.exec:\vjpjj.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7lllxxl.exec:\7lllxxl.exe53⤵
- Executes dropped EXE
PID:1840 -
\??\c:\htbhtt.exec:\htbhtt.exe54⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nbnnnn.exec:\nbnnnn.exe55⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pjvvd.exec:\pjvvd.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1xffrxl.exec:\1xffrxl.exe57⤵
- Executes dropped EXE
PID:1836 -
\??\c:\llflflx.exec:\llflflx.exe58⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hbnntt.exec:\hbnntt.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dvjdj.exec:\dvjdj.exe60⤵
- Executes dropped EXE
PID:1112 -
\??\c:\7lxflxl.exec:\7lxflxl.exe61⤵
- Executes dropped EXE
PID:1852 -
\??\c:\thbhhh.exec:\thbhhh.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\ppdjv.exec:\ppdjv.exe63⤵
- Executes dropped EXE
PID:756 -
\??\c:\5jvjv.exec:\5jvjv.exe64⤵
- Executes dropped EXE
PID:684 -
\??\c:\vjvdp.exec:\vjvdp.exe65⤵
- Executes dropped EXE
PID:1212 -
\??\c:\fxlrflf.exec:\fxlrflf.exe66⤵PID:2180
-
\??\c:\ppdjp.exec:\ppdjp.exe67⤵PID:1580
-
\??\c:\dddjv.exec:\dddjv.exe68⤵PID:2828
-
\??\c:\3hbbhh.exec:\3hbbhh.exe69⤵PID:2076
-
\??\c:\btnntt.exec:\btnntt.exe70⤵PID:1524
-
\??\c:\pjjjv.exec:\pjjjv.exe71⤵PID:3024
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe72⤵PID:2780
-
\??\c:\9vvvj.exec:\9vvvj.exe73⤵PID:2840
-
\??\c:\dpjvp.exec:\dpjvp.exe74⤵PID:2960
-
\??\c:\rlxxrlx.exec:\rlxxrlx.exe75⤵PID:1716
-
\??\c:\1nbhhn.exec:\1nbhhn.exe76⤵PID:2108
-
\??\c:\3thbbb.exec:\3thbbb.exe77⤵PID:2740
-
\??\c:\9vvdv.exec:\9vvdv.exe78⤵PID:2680
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe79⤵PID:2156
-
\??\c:\hbbnbh.exec:\hbbnbh.exe80⤵PID:2604
-
\??\c:\btttbh.exec:\btttbh.exe81⤵PID:1700
-
\??\c:\ppjdv.exec:\ppjdv.exe82⤵PID:2204
-
\??\c:\lllrxlx.exec:\lllrxlx.exe83⤵PID:2064
-
\??\c:\lffrxlr.exec:\lffrxlr.exe84⤵PID:2140
-
\??\c:\3nbthn.exec:\3nbthn.exe85⤵PID:2728
-
\??\c:\pdddd.exec:\pdddd.exe86⤵PID:2940
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe87⤵PID:2884
-
\??\c:\lflxlrx.exec:\lflxlrx.exe88⤵PID:2972
-
\??\c:\hbthth.exec:\hbthth.exe89⤵PID:2776
-
\??\c:\ththbt.exec:\ththbt.exe90⤵PID:2748
-
\??\c:\vdpjp.exec:\vdpjp.exe91⤵PID:996
-
\??\c:\xffrxxx.exec:\xffrxxx.exe92⤵PID:2168
-
\??\c:\fxrlrxl.exec:\fxrlrxl.exe93⤵PID:1248
-
\??\c:\nhnbhb.exec:\nhnbhb.exe94⤵PID:1936
-
\??\c:\5jdjd.exec:\5jdjd.exe95⤵PID:2764
-
\??\c:\5jjpd.exec:\5jjpd.exe96⤵PID:2956
-
\??\c:\1xrxflr.exec:\1xrxflr.exe97⤵PID:1140
-
\??\c:\hthhnn.exec:\hthhnn.exe98⤵PID:2392
-
\??\c:\7thhtb.exec:\7thhtb.exe99⤵PID:2044
-
\??\c:\vvvvv.exec:\vvvvv.exe100⤵PID:1188
-
\??\c:\rlflrxl.exec:\rlflrxl.exe101⤵PID:1560
-
\??\c:\3lxfffl.exec:\3lxfffl.exe102⤵PID:1852
-
\??\c:\tnhnth.exec:\tnhnth.exe103⤵PID:912
-
\??\c:\3vjpp.exec:\3vjpp.exe104⤵PID:756
-
\??\c:\dvpdj.exec:\dvpdj.exe105⤵PID:900
-
\??\c:\7frxlrl.exec:\7frxlrl.exe106⤵PID:1792
-
\??\c:\nhttbt.exec:\nhttbt.exe107⤵PID:1192
-
\??\c:\1thhhh.exec:\1thhhh.exe108⤵PID:1580
-
\??\c:\vppvj.exec:\vppvj.exe109⤵PID:1572
-
\??\c:\jvjjj.exec:\jvjjj.exe110⤵PID:2752
-
\??\c:\xfrxlxf.exec:\xfrxlxf.exe111⤵PID:2744
-
\??\c:\nnbhtt.exec:\nnbhtt.exe112⤵PID:552
-
\??\c:\7vvjp.exec:\7vvjp.exe113⤵PID:2704
-
\??\c:\jjdjv.exec:\jjdjv.exe114⤵PID:2788
-
\??\c:\9xrxlrf.exec:\9xrxlrf.exe115⤵PID:2580
-
\??\c:\nbnhnt.exec:\nbnhnt.exe116⤵PID:2556
-
\??\c:\ddvvj.exec:\ddvvj.exe117⤵PID:2544
-
\??\c:\dvpvd.exec:\dvpvd.exe118⤵PID:2664
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe119⤵PID:2608
-
\??\c:\bnnthh.exec:\bnnthh.exe120⤵PID:1844
-
\??\c:\1pppv.exec:\1pppv.exe121⤵PID:2104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-