Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe
-
Size
454KB
-
MD5
06241bd1d858ecd7dfbb1021e97c3a15
-
SHA1
96168875e1b52223de7e2beae79cb419f5ae4c7e
-
SHA256
333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47
-
SHA512
43aa10a2aac5a7fe1a3033a0902b4eb05df01db5d6e058a8ba38acb9e81f911ce65b7d5dd05f775ddce950a8776a042930d485d41661e88f6a58782db65acafc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-98-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-162-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/840-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-201-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-256-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2188-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-282-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2328-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-320-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2436-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-457-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1972-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-595-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-740-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1368-749-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-827-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-962-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1772-1070-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/632-1108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-1226-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 bhnbtb.exe 2316 vdjdj.exe 2980 3jvvd.exe 2200 7rrxlxf.exe 2772 pvvjp.exe 2768 llflrxl.exe 2748 3bnbhb.exe 2428 jdvpj.exe 2332 btnnbb.exe 2616 1jjpp.exe 2736 nthtnb.exe 2664 9vppd.exe 596 7lflxff.exe 380 btbnbt.exe 1200 rflrrfr.exe 2908 pdpjp.exe 2336 xxxlxrl.exe 840 nthhnn.exe 1592 frxrrll.exe 316 hbbtth.exe 1588 xxrfxrf.exe 3008 nnhnth.exe 2564 jdvvj.exe 1640 llfrxfl.exe 2024 vddpj.exe 1680 rlffrxl.exe 2452 jjjpd.exe 2188 xxxfxxl.exe 2280 tnhhtt.exe 2392 3rfrxfl.exe 884 1nthtb.exe 2484 5djjj.exe 1724 nntnnt.exe 2328 9btnhh.exe 3044 jpjjv.exe 2240 lxxxxxf.exe 2436 9nbnht.exe 2824 3vjpj.exe 2720 fxxrrxf.exe 2844 3fxrffr.exe 2084 hbttbb.exe 2108 ppjvp.exe 2952 llxlflx.exe 2812 1fxrxxl.exe 2628 bthnbh.exe 2620 jdvpj.exe 2504 ffxxlrl.exe 676 lfflrxx.exe 2276 hbbnhn.exe 2960 7vpdj.exe 2924 jpppd.exe 2716 rrrxlrf.exe 2964 hnhnbn.exe 1440 pddjv.exe 1956 9xlrflx.exe 2192 3fxfrxf.exe 956 btntnt.exe 1324 pjddp.exe 1796 jjjpd.exe 848 rlffllx.exe 3016 vvpdj.exe 1972 xrxxxxl.exe 612 xrrrxxl.exe 996 7btnbh.exe -
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-90-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2332-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-98-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2736-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-320-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2436-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-962-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2912-997-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/632-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1226-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2796-1257-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bttth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1980 2532 333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe 30 PID 2532 wrote to memory of 1980 2532 333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe 30 PID 2532 wrote to memory of 1980 2532 333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe 30 PID 2532 wrote to memory of 1980 2532 333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe 30 PID 1980 wrote to memory of 2316 1980 bhnbtb.exe 31 PID 1980 wrote to memory of 2316 1980 bhnbtb.exe 31 PID 1980 wrote to memory of 2316 1980 bhnbtb.exe 31 PID 1980 wrote to memory of 2316 1980 bhnbtb.exe 31 PID 2316 wrote to memory of 2980 2316 vdjdj.exe 32 PID 2316 wrote to memory of 2980 2316 vdjdj.exe 32 PID 2316 wrote to memory of 2980 2316 vdjdj.exe 32 PID 2316 wrote to memory of 2980 2316 vdjdj.exe 32 PID 2980 wrote to memory of 2200 2980 3jvvd.exe 33 PID 2980 wrote to memory of 2200 2980 3jvvd.exe 33 PID 2980 wrote to memory of 2200 2980 3jvvd.exe 33 PID 2980 wrote to memory of 2200 2980 3jvvd.exe 33 PID 2200 wrote to memory of 2772 2200 7rrxlxf.exe 34 PID 2200 wrote to memory of 2772 2200 7rrxlxf.exe 34 PID 2200 wrote to memory of 2772 2200 7rrxlxf.exe 34 PID 2200 wrote to memory of 2772 2200 7rrxlxf.exe 34 PID 2772 wrote to memory of 2768 2772 pvvjp.exe 35 PID 2772 wrote to memory of 2768 2772 pvvjp.exe 35 PID 2772 wrote to memory of 2768 2772 pvvjp.exe 35 PID 2772 wrote to memory of 2768 2772 pvvjp.exe 35 PID 2768 wrote to memory of 2748 2768 llflrxl.exe 36 PID 2768 wrote to memory of 2748 2768 llflrxl.exe 36 PID 2768 wrote to memory of 2748 2768 llflrxl.exe 36 PID 2768 wrote to memory of 2748 2768 llflrxl.exe 36 PID 2748 wrote to memory of 2428 2748 3bnbhb.exe 37 PID 2748 wrote to memory of 2428 2748 3bnbhb.exe 37 PID 2748 wrote to memory of 2428 2748 3bnbhb.exe 37 PID 2748 wrote to memory of 2428 2748 3bnbhb.exe 37 PID 2428 wrote to memory of 2332 2428 jdvpj.exe 38 PID 2428 wrote to memory of 2332 2428 jdvpj.exe 38 PID 2428 wrote to memory of 2332 2428 jdvpj.exe 38 PID 2428 wrote to memory of 2332 2428 jdvpj.exe 38 PID 2332 wrote to memory of 2616 2332 btnnbb.exe 39 PID 2332 wrote to memory of 2616 2332 btnnbb.exe 39 PID 2332 wrote to memory of 2616 2332 btnnbb.exe 39 PID 2332 wrote to memory of 2616 2332 btnnbb.exe 39 PID 2616 wrote to memory of 2736 2616 1jjpp.exe 40 PID 2616 wrote to memory of 2736 2616 1jjpp.exe 40 PID 2616 wrote to memory of 2736 2616 1jjpp.exe 40 PID 2616 wrote to memory of 2736 2616 1jjpp.exe 40 PID 2736 wrote to memory of 2664 2736 nthtnb.exe 41 PID 2736 wrote to memory of 2664 2736 nthtnb.exe 41 PID 2736 wrote to memory of 2664 2736 nthtnb.exe 41 PID 2736 wrote to memory of 2664 2736 nthtnb.exe 41 PID 2664 wrote to memory of 596 2664 9vppd.exe 42 PID 2664 wrote to memory of 596 2664 9vppd.exe 42 PID 2664 wrote to memory of 596 2664 9vppd.exe 42 PID 2664 wrote to memory of 596 2664 9vppd.exe 42 PID 596 wrote to memory of 380 596 7lflxff.exe 43 PID 596 wrote to memory of 380 596 7lflxff.exe 43 PID 596 wrote to memory of 380 596 7lflxff.exe 43 PID 596 wrote to memory of 380 596 7lflxff.exe 43 PID 380 wrote to memory of 1200 380 btbnbt.exe 44 PID 380 wrote to memory of 1200 380 btbnbt.exe 44 PID 380 wrote to memory of 1200 380 btbnbt.exe 44 PID 380 wrote to memory of 1200 380 btbnbt.exe 44 PID 1200 wrote to memory of 2908 1200 rflrrfr.exe 45 PID 1200 wrote to memory of 2908 1200 rflrrfr.exe 45 PID 1200 wrote to memory of 2908 1200 rflrrfr.exe 45 PID 1200 wrote to memory of 2908 1200 rflrrfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe"C:\Users\Admin\AppData\Local\Temp\333d61791f040d35464c2cf84930ab00c7b1198bf65eabaa9103c17a5b8d7b47.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bhnbtb.exec:\bhnbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\vdjdj.exec:\vdjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\3jvvd.exec:\3jvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7rrxlxf.exec:\7rrxlxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pvvjp.exec:\pvvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\llflrxl.exec:\llflrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\3bnbhb.exec:\3bnbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jdvpj.exec:\jdvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\btnnbb.exec:\btnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\1jjpp.exec:\1jjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nthtnb.exec:\nthtnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9vppd.exec:\9vppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7lflxff.exec:\7lflxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\btbnbt.exec:\btbnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\rflrrfr.exec:\rflrrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\pdpjp.exec:\pdpjp.exe17⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe18⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nthhnn.exec:\nthhnn.exe19⤵
- Executes dropped EXE
PID:840 -
\??\c:\frxrrll.exec:\frxrrll.exe20⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hbbtth.exec:\hbbtth.exe21⤵
- Executes dropped EXE
PID:316 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe22⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nnhnth.exec:\nnhnth.exe23⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jdvvj.exec:\jdvvj.exe24⤵
- Executes dropped EXE
PID:2564 -
\??\c:\llfrxfl.exec:\llfrxfl.exe25⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vddpj.exec:\vddpj.exe26⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlffrxl.exec:\rlffrxl.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jjjpd.exec:\jjjpd.exe28⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxxfxxl.exec:\xxxfxxl.exe29⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tnhhtt.exec:\tnhhtt.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3rfrxfl.exec:\3rfrxfl.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1nthtb.exec:\1nthtb.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\5djjj.exec:\5djjj.exe33⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nntnnt.exec:\nntnnt.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9btnhh.exec:\9btnhh.exe35⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jpjjv.exec:\jpjjv.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe37⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9nbnht.exec:\9nbnht.exe38⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3vjpj.exec:\3vjpj.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\fxxrrxf.exec:\fxxrrxf.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3fxrffr.exec:\3fxrffr.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hbttbb.exec:\hbttbb.exe42⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ppjvp.exec:\ppjvp.exe43⤵
- Executes dropped EXE
PID:2108 -
\??\c:\llxlflx.exec:\llxlflx.exe44⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1fxrxxl.exec:\1fxrxxl.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bthnbh.exec:\bthnbh.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jdvpj.exec:\jdvpj.exe47⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ffxxlrl.exec:\ffxxlrl.exe48⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfflrxx.exec:\lfflrxx.exe49⤵
- Executes dropped EXE
PID:676 -
\??\c:\hbbnhn.exec:\hbbnhn.exe50⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7vpdj.exec:\7vpdj.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jpppd.exec:\jpppd.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hnhnbn.exec:\hnhnbn.exe54⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pddjv.exec:\pddjv.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9xlrflx.exec:\9xlrflx.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3fxfrxf.exec:\3fxfrxf.exe57⤵
- Executes dropped EXE
PID:2192 -
\??\c:\btntnt.exec:\btntnt.exe58⤵
- Executes dropped EXE
PID:956 -
\??\c:\pjddp.exec:\pjddp.exe59⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jjjpd.exec:\jjjpd.exe60⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rlffllx.exec:\rlffllx.exe61⤵
- Executes dropped EXE
PID:848 -
\??\c:\vvpdj.exec:\vvpdj.exe62⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xrxxxxl.exec:\xrxxxxl.exe63⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe64⤵
- Executes dropped EXE
PID:612 -
\??\c:\7btnbh.exec:\7btnbh.exe65⤵
- Executes dropped EXE
PID:996 -
\??\c:\dpvpp.exec:\dpvpp.exe66⤵PID:1912
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe67⤵PID:908
-
\??\c:\5tnttb.exec:\5tnttb.exe68⤵PID:1752
-
\??\c:\ntnnnn.exec:\ntnnnn.exe69⤵PID:2412
-
\??\c:\ppdjj.exec:\ppdjj.exe70⤵PID:912
-
\??\c:\fllfrrf.exec:\fllfrrf.exe71⤵PID:2408
-
\??\c:\tnbhnn.exec:\tnbhnn.exe72⤵PID:2228
-
\??\c:\3htbnn.exec:\3htbnn.exe73⤵PID:308
-
\??\c:\jpppd.exec:\jpppd.exe74⤵PID:1812
-
\??\c:\lrrxflx.exec:\lrrxflx.exe75⤵PID:1616
-
\??\c:\btthtt.exec:\btthtt.exe76⤵PID:1584
-
\??\c:\hnnnht.exec:\hnnnht.exe77⤵PID:2548
-
\??\c:\pvvpd.exec:\pvvpd.exe78⤵PID:3032
-
\??\c:\jpjvp.exec:\jpjvp.exe79⤵PID:2316
-
\??\c:\xlrxxrr.exec:\xlrxxrr.exe80⤵PID:2240
-
\??\c:\btnnbh.exec:\btnnbh.exe81⤵PID:2752
-
\??\c:\jdjdp.exec:\jdjdp.exe82⤵PID:2740
-
\??\c:\fffxlrf.exec:\fffxlrf.exe83⤵PID:2892
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe84⤵PID:2768
-
\??\c:\tbbhtb.exec:\tbbhtb.exe85⤵PID:2624
-
\??\c:\jpvvd.exec:\jpvvd.exe86⤵PID:2644
-
\??\c:\3lrrxlf.exec:\3lrrxlf.exe87⤵PID:2728
-
\??\c:\nnntht.exec:\nnntht.exe88⤵PID:2612
-
\??\c:\ntnthn.exec:\ntnthn.exe89⤵PID:3068
-
\??\c:\jjpdp.exec:\jjpdp.exe90⤵PID:2312
-
\??\c:\xxllfxf.exec:\xxllfxf.exe91⤵PID:1012
-
\??\c:\bthnbh.exec:\bthnbh.exe92⤵PID:2288
-
\??\c:\nntbnt.exec:\nntbnt.exe93⤵PID:2276
-
\??\c:\1jdpp.exec:\1jdpp.exe94⤵PID:596
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe95⤵PID:2924
-
\??\c:\fxffllf.exec:\fxffllf.exe96⤵PID:1348
-
\??\c:\tttbtb.exec:\tttbtb.exe97⤵PID:1532
-
\??\c:\jdvjd.exec:\jdvjd.exe98⤵PID:1388
-
\??\c:\9xxrrfr.exec:\9xxrrfr.exe99⤵PID:2368
-
\??\c:\9xrlrrx.exec:\9xrlrrx.exe100⤵PID:2444
-
\??\c:\nbhhtt.exec:\nbhhtt.exe101⤵PID:840
-
\??\c:\jjpjv.exec:\jjpjv.exe102⤵PID:1368
-
\??\c:\llxlflf.exec:\llxlflf.exe103⤵PID:416
-
\??\c:\7fxlrxl.exec:\7fxlrxl.exe104⤵PID:2600
-
\??\c:\tnnnbb.exec:\tnnnbb.exe105⤵PID:3020
-
\??\c:\pjdpd.exec:\pjdpd.exe106⤵PID:2940
-
\??\c:\rxxxlxr.exec:\rxxxlxr.exe107⤵PID:612
-
\??\c:\bbhtth.exec:\bbhtth.exe108⤵PID:1412
-
\??\c:\ttbttn.exec:\ttbttn.exe109⤵PID:1912
-
\??\c:\7ppvp.exec:\7ppvp.exe110⤵PID:2024
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe111⤵PID:1032
-
\??\c:\lfxxffr.exec:\lfxxffr.exe112⤵PID:2156
-
\??\c:\tnbhnn.exec:\tnbhnn.exe113⤵PID:2128
-
\??\c:\7ddjp.exec:\7ddjp.exe114⤵PID:1784
-
\??\c:\vvpvd.exec:\vvpvd.exe115⤵PID:1068
-
\??\c:\hhhnhn.exec:\hhhnhn.exe116⤵PID:1744
-
\??\c:\lxlrrll.exec:\lxlrrll.exe117⤵PID:2532
-
\??\c:\bntbhn.exec:\bntbhn.exe118⤵PID:1872
-
\??\c:\vpdpd.exec:\vpdpd.exe119⤵PID:3036
-
\??\c:\dddpv.exec:\dddpv.exe120⤵PID:3040
-
\??\c:\jjvpj.exec:\jjvpj.exe121⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-