Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe
-
Size
454KB
-
MD5
1194c8f7783166fc7c9637e2169b4e65
-
SHA1
e66e589a3e64ee01a71a517a34a96d0853b24fbb
-
SHA256
d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1
-
SHA512
2ca85b93e68ccd966e632e2b18b97acbd32409025ded5e77a4389b9a40a4179b7bbe5f7f8263cab8ba530ed45dc6353ae7d74cd92c1964b1d4d7493936f332aa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/1728-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-85-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2300-103-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/3028-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-125-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1648-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-370-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/768-411-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/768-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-487-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-805-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-812-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-976-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-980-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1648-991-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1704-1006-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-1031-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-1038-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/752-1121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2068 hhntbh.exe 1544 5rlrrrl.exe 2160 vdvvd.exe 2124 5dvvj.exe 2744 fllrxfr.exe 2824 jdvjv.exe 2932 9ffrxxl.exe 2688 nhbtnb.exe 2552 lffrfrl.exe 2300 xxxlflx.exe 3028 pvdjd.exe 680 bbbtht.exe 1040 dpvpv.exe 1648 9fxlflx.exe 2364 7vjpv.exe 2036 lrlllxr.exe 1564 htnntb.exe 2536 vvpdv.exe 3008 nhnhtb.exe 2228 ttntnt.exe 912 fxlrxfr.exe 2912 hhhbth.exe 1428 ddjpp.exe 864 lrrfrxr.exe 2016 vvpvj.exe 1764 ffrxlrf.exe 884 jpjdp.exe 3044 7rxfffl.exe 2972 pvpvj.exe 1808 jjdjv.exe 2340 3bnttt.exe 1756 7jpjj.exe 2488 fxlflfr.exe 1732 tnbhth.exe 1048 vpddj.exe 2832 5djjp.exe 2076 xrfflrr.exe 2656 ttbnbn.exe 2768 hbtthh.exe 2676 jvpvd.exe 2556 rlxrxfr.exe 2828 xlfrlxr.exe 2596 hnnbtb.exe 2548 5nnbnt.exe 2600 djdvj.exe 2620 rlrlrrr.exe 2300 1fxxxxl.exe 2280 hhhbhn.exe 768 1jjvd.exe 1192 xrfrxlf.exe 2440 lllxlxr.exe 1540 hbtbhh.exe 1256 7pdpp.exe 1568 7xxxfrf.exe 892 fxrrxfr.exe 1200 bhbntn.exe 2776 vpjjj.exe 2864 xxxrrxl.exe 2148 5lfllrx.exe 1720 hhbhtb.exe 1660 pjvvd.exe 1976 3vvjd.exe 1860 3rlrfrx.exe 1528 7tbhth.exe -
resource yara_rule behavioral1/memory/1728-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-304-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2488-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-1006-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2128-1031-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-1045-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2068 1728 d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe 32 PID 1728 wrote to memory of 2068 1728 d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe 32 PID 1728 wrote to memory of 2068 1728 d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe 32 PID 1728 wrote to memory of 2068 1728 d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe 32 PID 2068 wrote to memory of 1544 2068 hhntbh.exe 33 PID 2068 wrote to memory of 1544 2068 hhntbh.exe 33 PID 2068 wrote to memory of 1544 2068 hhntbh.exe 33 PID 2068 wrote to memory of 1544 2068 hhntbh.exe 33 PID 1544 wrote to memory of 2160 1544 5rlrrrl.exe 34 PID 1544 wrote to memory of 2160 1544 5rlrrrl.exe 34 PID 1544 wrote to memory of 2160 1544 5rlrrrl.exe 34 PID 1544 wrote to memory of 2160 1544 5rlrrrl.exe 34 PID 2160 wrote to memory of 2124 2160 vdvvd.exe 35 PID 2160 wrote to memory of 2124 2160 vdvvd.exe 35 PID 2160 wrote to memory of 2124 2160 vdvvd.exe 35 PID 2160 wrote to memory of 2124 2160 vdvvd.exe 35 PID 2124 wrote to memory of 2744 2124 5dvvj.exe 36 PID 2124 wrote to memory of 2744 2124 5dvvj.exe 36 PID 2124 wrote to memory of 2744 2124 5dvvj.exe 36 PID 2124 wrote to memory of 2744 2124 5dvvj.exe 36 PID 2744 wrote to memory of 2824 2744 fllrxfr.exe 37 PID 2744 wrote to memory of 2824 2744 fllrxfr.exe 37 PID 2744 wrote to memory of 2824 2744 fllrxfr.exe 37 PID 2744 wrote to memory of 2824 2744 fllrxfr.exe 37 PID 2824 wrote to memory of 2932 2824 jdvjv.exe 38 PID 2824 wrote to memory of 2932 2824 jdvjv.exe 38 PID 2824 wrote to memory of 2932 2824 jdvjv.exe 38 PID 2824 wrote to memory of 2932 2824 jdvjv.exe 38 PID 2932 wrote to memory of 2688 2932 9ffrxxl.exe 39 PID 2932 wrote to memory of 2688 2932 9ffrxxl.exe 39 PID 2932 wrote to memory of 2688 2932 9ffrxxl.exe 39 PID 2932 wrote to memory of 2688 2932 9ffrxxl.exe 39 PID 2688 wrote to memory of 2552 2688 nhbtnb.exe 40 PID 2688 wrote to memory of 2552 2688 nhbtnb.exe 40 PID 2688 wrote to memory of 2552 2688 nhbtnb.exe 40 PID 2688 wrote to memory of 2552 2688 nhbtnb.exe 40 PID 2552 wrote to memory of 2300 2552 lffrfrl.exe 41 PID 2552 wrote to memory of 2300 2552 lffrfrl.exe 41 PID 2552 wrote to memory of 2300 2552 lffrfrl.exe 41 PID 2552 wrote to memory of 2300 2552 lffrfrl.exe 41 PID 2300 wrote to memory of 3028 2300 xxxlflx.exe 42 PID 2300 wrote to memory of 3028 2300 xxxlflx.exe 42 PID 2300 wrote to memory of 3028 2300 xxxlflx.exe 42 PID 2300 wrote to memory of 3028 2300 xxxlflx.exe 42 PID 3028 wrote to memory of 680 3028 pvdjd.exe 43 PID 3028 wrote to memory of 680 3028 pvdjd.exe 43 PID 3028 wrote to memory of 680 3028 pvdjd.exe 43 PID 3028 wrote to memory of 680 3028 pvdjd.exe 43 PID 680 wrote to memory of 1040 680 bbbtht.exe 44 PID 680 wrote to memory of 1040 680 bbbtht.exe 44 PID 680 wrote to memory of 1040 680 bbbtht.exe 44 PID 680 wrote to memory of 1040 680 bbbtht.exe 44 PID 1040 wrote to memory of 1648 1040 dpvpv.exe 45 PID 1040 wrote to memory of 1648 1040 dpvpv.exe 45 PID 1040 wrote to memory of 1648 1040 dpvpv.exe 45 PID 1040 wrote to memory of 1648 1040 dpvpv.exe 45 PID 1648 wrote to memory of 2364 1648 9fxlflx.exe 46 PID 1648 wrote to memory of 2364 1648 9fxlflx.exe 46 PID 1648 wrote to memory of 2364 1648 9fxlflx.exe 46 PID 1648 wrote to memory of 2364 1648 9fxlflx.exe 46 PID 2364 wrote to memory of 2036 2364 7vjpv.exe 47 PID 2364 wrote to memory of 2036 2364 7vjpv.exe 47 PID 2364 wrote to memory of 2036 2364 7vjpv.exe 47 PID 2364 wrote to memory of 2036 2364 7vjpv.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe"C:\Users\Admin\AppData\Local\Temp\d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\hhntbh.exec:\hhntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\5rlrrrl.exec:\5rlrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\vdvvd.exec:\vdvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\5dvvj.exec:\5dvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\fllrxfr.exec:\fllrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jdvjv.exec:\jdvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9ffrxxl.exec:\9ffrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nhbtnb.exec:\nhbtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lffrfrl.exec:\lffrfrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xxxlflx.exec:\xxxlflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\pvdjd.exec:\pvdjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\bbbtht.exec:\bbbtht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\dpvpv.exec:\dpvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\9fxlflx.exec:\9fxlflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\7vjpv.exec:\7vjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\lrlllxr.exec:\lrlllxr.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\htnntb.exec:\htnntb.exe18⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vvpdv.exec:\vvpdv.exe19⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhnhtb.exec:\nhnhtb.exe20⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ttntnt.exec:\ttntnt.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe22⤵
- Executes dropped EXE
PID:912 -
\??\c:\hhhbth.exec:\hhhbth.exe23⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ddjpp.exec:\ddjpp.exe24⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lrrfrxr.exec:\lrrfrxr.exe25⤵
- Executes dropped EXE
PID:864 -
\??\c:\vvpvj.exec:\vvpvj.exe26⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe27⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jpjdp.exec:\jpjdp.exe28⤵
- Executes dropped EXE
PID:884 -
\??\c:\7rxfffl.exec:\7rxfffl.exe29⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pvpvj.exec:\pvpvj.exe30⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jjdjv.exec:\jjdjv.exe31⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3bnttt.exec:\3bnttt.exe32⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7jpjj.exec:\7jpjj.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\fxlflfr.exec:\fxlflfr.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tnbhth.exec:\tnbhth.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vpddj.exec:\vpddj.exe36⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5djjp.exec:\5djjp.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrfflrr.exec:\xrfflrr.exe38⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ttbnbn.exec:\ttbnbn.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbtthh.exec:\hbtthh.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvpvd.exec:\jvpvd.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hnnbtb.exec:\hnnbtb.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5nnbnt.exec:\5nnbnt.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\djdvj.exec:\djdvj.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe47⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1fxxxxl.exec:\1fxxxxl.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hhhbhn.exec:\hhhbhn.exe49⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1jjvd.exec:\1jjvd.exe50⤵
- Executes dropped EXE
PID:768 -
\??\c:\xrfrxlf.exec:\xrfrxlf.exe51⤵
- Executes dropped EXE
PID:1192 -
\??\c:\lllxlxr.exec:\lllxlxr.exe52⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hbtbhh.exec:\hbtbhh.exe53⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7pdpp.exec:\7pdpp.exe54⤵
- Executes dropped EXE
PID:1256 -
\??\c:\7xxxfrf.exec:\7xxxfrf.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe56⤵
- Executes dropped EXE
PID:892 -
\??\c:\bhbntn.exec:\bhbntn.exe57⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vpjjj.exec:\vpjjj.exe58⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xxxrrxl.exec:\xxxrrxl.exe59⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5lfllrx.exec:\5lfllrx.exe60⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hhbhtb.exec:\hhbhtb.exe61⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pjvvd.exec:\pjvvd.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3vvjd.exec:\3vvjd.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3rlrfrx.exec:\3rlrfrx.exe64⤵
- Executes dropped EXE
PID:1860 -
\??\c:\7tbhth.exec:\7tbhth.exe65⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dddjv.exec:\dddjv.exe66⤵PID:328
-
\??\c:\llflxfl.exec:\llflxfl.exe67⤵PID:576
-
\??\c:\lrrfrff.exec:\lrrfrff.exe68⤵PID:1208
-
\??\c:\9ttbnh.exec:\9ttbnh.exe69⤵PID:3056
-
\??\c:\pjjpp.exec:\pjjpp.exe70⤵PID:300
-
\??\c:\pdpjd.exec:\pdpjd.exe71⤵PID:2140
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe72⤵PID:2376
-
\??\c:\5hnnbb.exec:\5hnnbb.exe73⤵PID:2508
-
\??\c:\htbttb.exec:\htbttb.exe74⤵PID:2516
-
\??\c:\djjdp.exec:\djjdp.exe75⤵PID:584
-
\??\c:\lrrfrrf.exec:\lrrfrrf.exe76⤵PID:2012
-
\??\c:\rrxxrfx.exec:\rrxxrfx.exe77⤵PID:2628
-
\??\c:\nnhhtt.exec:\nnhhtt.exe78⤵PID:2052
-
\??\c:\djpdd.exec:\djpdd.exe79⤵PID:2176
-
\??\c:\9jjvp.exec:\9jjvp.exe80⤵PID:1500
-
\??\c:\5xfxrlr.exec:\5xfxrlr.exe81⤵PID:2220
-
\??\c:\hhhhhn.exec:\hhhhhn.exe82⤵PID:2680
-
\??\c:\jjjjd.exec:\jjjjd.exe83⤵PID:2124
-
\??\c:\pdjdd.exec:\pdjdd.exe84⤵PID:2696
-
\??\c:\3lflxxl.exec:\3lflxxl.exe85⤵PID:2844
-
\??\c:\thtbbh.exec:\thtbbh.exe86⤵PID:2712
-
\??\c:\hnnhth.exec:\hnnhth.exe87⤵PID:2604
-
\??\c:\1dppp.exec:\1dppp.exe88⤵PID:2664
-
\??\c:\flflfxl.exec:\flflfxl.exe89⤵PID:2724
-
\??\c:\bbbttn.exec:\bbbttn.exe90⤵PID:1740
-
\??\c:\tnthhh.exec:\tnthhh.exe91⤵PID:1556
-
\??\c:\9pjvj.exec:\9pjvj.exe92⤵PID:1748
-
\??\c:\9xxrrlr.exec:\9xxrrlr.exe93⤵PID:1184
-
\??\c:\bhnhbb.exec:\bhnhbb.exe94⤵PID:680
-
\??\c:\bbbttt.exec:\bbbttt.exe95⤵PID:1872
-
\??\c:\1dddp.exec:\1dddp.exe96⤵PID:324
-
\??\c:\5fflxlr.exec:\5fflxlr.exe97⤵PID:812
-
\??\c:\llxfrfr.exec:\llxfrfr.exe98⤵PID:388
-
\??\c:\hhhbbb.exec:\hhhbbb.exe99⤵PID:1144
-
\??\c:\ddvjd.exec:\ddvjd.exe100⤵PID:2848
-
\??\c:\jppjv.exec:\jppjv.exe101⤵PID:2028
-
\??\c:\lrrxffx.exec:\lrrxffx.exe102⤵PID:2616
-
\??\c:\1hhnbn.exec:\1hhnbn.exe103⤵PID:2080
-
\??\c:\ddjpd.exec:\ddjpd.exe104⤵PID:3008
-
\??\c:\5vjdv.exec:\5vjdv.exe105⤵PID:1004
-
\??\c:\rfxlxlx.exec:\rfxlxlx.exe106⤵PID:912
-
\??\c:\tnntbn.exec:\tnntbn.exe107⤵PID:2652
-
\??\c:\jdppp.exec:\jdppp.exe108⤵PID:1096
-
\??\c:\9djpd.exec:\9djpd.exe109⤵PID:1860
-
\??\c:\fxxllxr.exec:\fxxllxr.exe110⤵PID:2116
-
\??\c:\bthbhh.exec:\bthbhh.exe111⤵PID:1584
-
\??\c:\1jdjv.exec:\1jdjv.exe112⤵PID:1212
-
\??\c:\dvvpv.exec:\dvvpv.exe113⤵PID:2260
-
\??\c:\xffflff.exec:\xffflff.exe114⤵PID:3048
-
\??\c:\1ttttb.exec:\1ttttb.exe115⤵PID:3052
-
\??\c:\3jvvj.exec:\3jvvj.exe116⤵PID:2188
-
\??\c:\pjddp.exec:\pjddp.exe117⤵PID:2376
-
\??\c:\xxffllr.exec:\xxffllr.exe118⤵PID:1672
-
\??\c:\bthnbh.exec:\bthnbh.exe119⤵PID:1696
-
\??\c:\5tbnhn.exec:\5tbnhn.exe120⤵PID:1880
-
\??\c:\1vdpj.exec:\1vdpj.exe121⤵PID:1756
-
\??\c:\llrxrfx.exec:\llrxrfx.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-