Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe
-
Size
453KB
-
MD5
faeca8cf1629d601c820f5f9da92491c
-
SHA1
9e988276fbe6c84d75df2a020346d61074ed4239
-
SHA256
59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d
-
SHA512
57e76fc02490f51f7fd24bb6bf94df96f9e1866cbebfac9bf3982fed23a2e93045ac3add5363ed5095f00742592981e08118796f1dec68b247e1aea9f93f3374
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2492-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-75-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2004-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-167-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-185-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2208-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/416-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/416-205-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1608-219-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1972-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-241-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1224-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-713-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-733-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-1052-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1524-1091-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-1130-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1844-1178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-1240-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 3djjp.exe 864 3pdjj.exe 2096 lrflffr.exe 2660 nnhhtt.exe 2748 7frrrlr.exe 2676 nhbhnt.exe 2744 llxxxxl.exe 2572 1nbttb.exe 2664 jddvp.exe 2600 ffxfrxl.exe 2004 7djjp.exe 1244 jdpjp.exe 2732 1btbbh.exe 1852 frxxxxf.exe 1632 tnbbbb.exe 2904 jjddp.exe 1448 9btbhh.exe 1640 7dvdv.exe 2936 1rflrxf.exe 2648 hhthhn.exe 2208 jdvvd.exe 416 5lxxflr.exe 1616 tnbhtb.exe 1608 fxlrxfl.exe 1972 dvvvv.exe 1712 xlrlxrr.exe 1224 vpvvd.exe 2076 fxllllr.exe 2868 btbthn.exe 1864 frxxllr.exe 2360 hthhth.exe 2260 3vpvd.exe 2256 rxrrrxf.exe 2324 pdpjj.exe 2316 7llrrxl.exe 1820 nbhhnt.exe 2320 7bhhnt.exe 2708 pjdjp.exe 2700 7lxxxfl.exe 2668 3rlrflr.exe 2744 tnbbhn.exe 1304 pdpjj.exe 2564 9xxrlff.exe 2580 rrlrflx.exe 2128 9tnhtt.exe 1676 thtntn.exe 2036 dvdjp.exe 856 llxrxxl.exe 2028 tnbhnn.exe 1852 7bhhhh.exe 2860 dpdjp.exe 2024 7lxfrrl.exe 1960 rlflxxf.exe 3040 btttbb.exe 2940 ppjpp.exe 3056 dvddd.exe 892 xrllxxf.exe 2648 hntnhb.exe 2208 3pjvv.exe 1628 vjvdj.exe 3044 rllfrfl.exe 2412 btntbh.exe 1744 nbhhnn.exe 2296 ddpvj.exe -
resource yara_rule behavioral1/memory/2492-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-149-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2904-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/416-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-733-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2676-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-922-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-947-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-976-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-1130-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1844-1178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-1253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-1290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-1322-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2524 2492 59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe 31 PID 2492 wrote to memory of 2524 2492 59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe 31 PID 2492 wrote to memory of 2524 2492 59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe 31 PID 2492 wrote to memory of 2524 2492 59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe 31 PID 2524 wrote to memory of 864 2524 3djjp.exe 32 PID 2524 wrote to memory of 864 2524 3djjp.exe 32 PID 2524 wrote to memory of 864 2524 3djjp.exe 32 PID 2524 wrote to memory of 864 2524 3djjp.exe 32 PID 864 wrote to memory of 2096 864 3pdjj.exe 33 PID 864 wrote to memory of 2096 864 3pdjj.exe 33 PID 864 wrote to memory of 2096 864 3pdjj.exe 33 PID 864 wrote to memory of 2096 864 3pdjj.exe 33 PID 2096 wrote to memory of 2660 2096 lrflffr.exe 34 PID 2096 wrote to memory of 2660 2096 lrflffr.exe 34 PID 2096 wrote to memory of 2660 2096 lrflffr.exe 34 PID 2096 wrote to memory of 2660 2096 lrflffr.exe 34 PID 2660 wrote to memory of 2748 2660 nnhhtt.exe 35 PID 2660 wrote to memory of 2748 2660 nnhhtt.exe 35 PID 2660 wrote to memory of 2748 2660 nnhhtt.exe 35 PID 2660 wrote to memory of 2748 2660 nnhhtt.exe 35 PID 2748 wrote to memory of 2676 2748 7frrrlr.exe 36 PID 2748 wrote to memory of 2676 2748 7frrrlr.exe 36 PID 2748 wrote to memory of 2676 2748 7frrrlr.exe 36 PID 2748 wrote to memory of 2676 2748 7frrrlr.exe 36 PID 2676 wrote to memory of 2744 2676 nhbhnt.exe 37 PID 2676 wrote to memory of 2744 2676 nhbhnt.exe 37 PID 2676 wrote to memory of 2744 2676 nhbhnt.exe 37 PID 2676 wrote to memory of 2744 2676 nhbhnt.exe 37 PID 2744 wrote to memory of 2572 2744 llxxxxl.exe 38 PID 2744 wrote to memory of 2572 2744 llxxxxl.exe 38 PID 2744 wrote to memory of 2572 2744 llxxxxl.exe 38 PID 2744 wrote to memory of 2572 2744 llxxxxl.exe 38 PID 2572 wrote to memory of 2664 2572 1nbttb.exe 39 PID 2572 wrote to memory of 2664 2572 1nbttb.exe 39 PID 2572 wrote to memory of 2664 2572 1nbttb.exe 39 PID 2572 wrote to memory of 2664 2572 1nbttb.exe 39 PID 2664 wrote to memory of 2600 2664 jddvp.exe 40 PID 2664 wrote to memory of 2600 2664 jddvp.exe 40 PID 2664 wrote to memory of 2600 2664 jddvp.exe 40 PID 2664 wrote to memory of 2600 2664 jddvp.exe 40 PID 2600 wrote to memory of 2004 2600 ffxfrxl.exe 41 PID 2600 wrote to memory of 2004 2600 ffxfrxl.exe 41 PID 2600 wrote to memory of 2004 2600 ffxfrxl.exe 41 PID 2600 wrote to memory of 2004 2600 ffxfrxl.exe 41 PID 2004 wrote to memory of 1244 2004 7djjp.exe 42 PID 2004 wrote to memory of 1244 2004 7djjp.exe 42 PID 2004 wrote to memory of 1244 2004 7djjp.exe 42 PID 2004 wrote to memory of 1244 2004 7djjp.exe 42 PID 1244 wrote to memory of 2732 1244 jdpjp.exe 43 PID 1244 wrote to memory of 2732 1244 jdpjp.exe 43 PID 1244 wrote to memory of 2732 1244 jdpjp.exe 43 PID 1244 wrote to memory of 2732 1244 jdpjp.exe 43 PID 2732 wrote to memory of 1852 2732 1btbbh.exe 44 PID 2732 wrote to memory of 1852 2732 1btbbh.exe 44 PID 2732 wrote to memory of 1852 2732 1btbbh.exe 44 PID 2732 wrote to memory of 1852 2732 1btbbh.exe 44 PID 1852 wrote to memory of 1632 1852 frxxxxf.exe 45 PID 1852 wrote to memory of 1632 1852 frxxxxf.exe 45 PID 1852 wrote to memory of 1632 1852 frxxxxf.exe 45 PID 1852 wrote to memory of 1632 1852 frxxxxf.exe 45 PID 1632 wrote to memory of 2904 1632 tnbbbb.exe 46 PID 1632 wrote to memory of 2904 1632 tnbbbb.exe 46 PID 1632 wrote to memory of 2904 1632 tnbbbb.exe 46 PID 1632 wrote to memory of 2904 1632 tnbbbb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe"C:\Users\Admin\AppData\Local\Temp\59f7a068912b45eb056b828a106c31be1521aa29367d04f9bdb1a1e9c8fdf92d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\3djjp.exec:\3djjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3pdjj.exec:\3pdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\lrflffr.exec:\lrflffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\nnhhtt.exec:\nnhhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7frrrlr.exec:\7frrrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nhbhnt.exec:\nhbhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\llxxxxl.exec:\llxxxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\1nbttb.exec:\1nbttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jddvp.exec:\jddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7djjp.exec:\7djjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jdpjp.exec:\jdpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\1btbbh.exec:\1btbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\frxxxxf.exec:\frxxxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\tnbbbb.exec:\tnbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\jjddp.exec:\jjddp.exe17⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9btbhh.exec:\9btbhh.exe18⤵
- Executes dropped EXE
PID:1448 -
\??\c:\7dvdv.exec:\7dvdv.exe19⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1rflrxf.exec:\1rflrxf.exe20⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhthhn.exec:\hhthhn.exe21⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jdvvd.exec:\jdvvd.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5lxxflr.exec:\5lxxflr.exe23⤵
- Executes dropped EXE
PID:416 -
\??\c:\tnbhtb.exec:\tnbhtb.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe25⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dvvvv.exec:\dvvvv.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xlrlxrr.exec:\xlrlxrr.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vpvvd.exec:\vpvvd.exe28⤵
- Executes dropped EXE
PID:1224 -
\??\c:\fxllllr.exec:\fxllllr.exe29⤵
- Executes dropped EXE
PID:2076 -
\??\c:\btbthn.exec:\btbthn.exe30⤵
- Executes dropped EXE
PID:2868 -
\??\c:\frxxllr.exec:\frxxllr.exe31⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hthhth.exec:\hthhth.exe32⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3vpvd.exec:\3vpvd.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\rxrrrxf.exec:\rxrrrxf.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pdpjj.exec:\pdpjj.exe35⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7llrrxl.exec:\7llrrxl.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nbhhnt.exec:\nbhhnt.exe37⤵
- Executes dropped EXE
PID:1820 -
\??\c:\7bhhnt.exec:\7bhhnt.exe38⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pjdjp.exec:\pjdjp.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7lxxxfl.exec:\7lxxxfl.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3rlrflr.exec:\3rlrflr.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\tnbbhn.exec:\tnbbhn.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pdpjj.exec:\pdpjj.exe43⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9xxrlff.exec:\9xxrlff.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\rrlrflx.exec:\rrlrflx.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9tnhtt.exec:\9tnhtt.exe46⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thtntn.exec:\thtntn.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dvdjp.exec:\dvdjp.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\llxrxxl.exec:\llxrxxl.exe49⤵
- Executes dropped EXE
PID:856 -
\??\c:\tnbhnn.exec:\tnbhnn.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7bhhhh.exec:\7bhhhh.exe51⤵
- Executes dropped EXE
PID:1852 -
\??\c:\dpdjp.exec:\dpdjp.exe52⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7lxfrrl.exec:\7lxfrrl.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlflxxf.exec:\rlflxxf.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\btttbb.exec:\btttbb.exe55⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ppjpp.exec:\ppjpp.exe56⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvddd.exec:\dvddd.exe57⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xrllxxf.exec:\xrllxxf.exe58⤵
- Executes dropped EXE
PID:892 -
\??\c:\hntnhb.exec:\hntnhb.exe59⤵
- Executes dropped EXE
PID:2648 -
\??\c:\3pjvv.exec:\3pjvv.exe60⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vjvdj.exec:\vjvdj.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rllfrfl.exec:\rllfrfl.exe62⤵
- Executes dropped EXE
PID:3044 -
\??\c:\btntbh.exec:\btntbh.exe63⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nbhhnn.exec:\nbhhnn.exe64⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ddpvj.exec:\ddpvj.exe65⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lfxxffl.exec:\lfxxffl.exe66⤵PID:2176
-
\??\c:\llfffll.exec:\llfffll.exe67⤵PID:1256
-
\??\c:\bthhht.exec:\bthhht.exe68⤵PID:2444
-
\??\c:\vdjdd.exec:\vdjdd.exe69⤵PID:2216
-
\??\c:\ddvvv.exec:\ddvvv.exe70⤵PID:2076
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe71⤵PID:2180
-
\??\c:\bthhtt.exec:\bthhtt.exe72⤵PID:2160
-
\??\c:\tnhtbb.exec:\tnhtbb.exe73⤵PID:768
-
\??\c:\vjdjv.exec:\vjdjv.exe74⤵PID:2360
-
\??\c:\3rllxfl.exec:\3rllxfl.exe75⤵PID:2456
-
\??\c:\xxlxfxl.exec:\xxlxfxl.exe76⤵PID:1264
-
\??\c:\tnhnnh.exec:\tnhnnh.exe77⤵PID:2040
-
\??\c:\jddjv.exec:\jddjv.exe78⤵PID:2856
-
\??\c:\ddjjp.exec:\ddjjp.exe79⤵PID:2692
-
\??\c:\rlffllr.exec:\rlffllr.exe80⤵PID:2660
-
\??\c:\ttbhbh.exec:\ttbhbh.exe81⤵PID:2824
-
\??\c:\hbhnbb.exec:\hbhnbb.exe82⤵PID:2752
-
\??\c:\ddpvd.exec:\ddpvd.exe83⤵PID:2700
-
\??\c:\lxllxxl.exec:\lxllxxl.exe84⤵PID:2712
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe85⤵PID:2724
-
\??\c:\5tntth.exec:\5tntth.exe86⤵PID:2572
-
\??\c:\jvdpv.exec:\jvdpv.exe87⤵PID:3064
-
\??\c:\dvjpd.exec:\dvjpd.exe88⤵PID:2616
-
\??\c:\frrlllr.exec:\frrlllr.exe89⤵PID:2220
-
\??\c:\1tntbt.exec:\1tntbt.exe90⤵PID:2248
-
\??\c:\ntttnh.exec:\ntttnh.exe91⤵PID:2044
-
\??\c:\3dvvv.exec:\3dvvv.exe92⤵PID:2036
-
\??\c:\rrxxxxl.exec:\rrxxxxl.exe93⤵PID:2364
-
\??\c:\3xrxlfl.exec:\3xrxlfl.exe94⤵PID:1632
-
\??\c:\bnbhhh.exec:\bnbhhh.exe95⤵PID:2804
-
\??\c:\jdppp.exec:\jdppp.exe96⤵PID:1984
-
\??\c:\pdjvd.exec:\pdjvd.exe97⤵PID:564
-
\??\c:\lllxrxf.exec:\lllxrxf.exe98⤵PID:2948
-
\??\c:\hbtbnn.exec:\hbtbnn.exe99⤵PID:2908
-
\??\c:\vppvp.exec:\vppvp.exe100⤵PID:2936
-
\??\c:\rfllllx.exec:\rfllllx.exe101⤵PID:2228
-
\??\c:\5lxxxff.exec:\5lxxxff.exe102⤵PID:2108
-
\??\c:\btbbhh.exec:\btbbhh.exe103⤵PID:548
-
\??\c:\3jjvd.exec:\3jjvd.exe104⤵PID:1616
-
\??\c:\jjdvp.exec:\jjdvp.exe105⤵PID:1020
-
\??\c:\lfflxfl.exec:\lfflxfl.exe106⤵PID:1636
-
\??\c:\nnbhtt.exec:\nnbhtt.exe107⤵PID:1680
-
\??\c:\htnhnn.exec:\htnhnn.exe108⤵PID:1972
-
\??\c:\dpvpp.exec:\dpvpp.exe109⤵PID:1320
-
\??\c:\9rfxxff.exec:\9rfxxff.exe110⤵PID:320
-
\??\c:\7lxrxxf.exec:\7lxrxxf.exe111⤵PID:2068
-
\??\c:\tnbhnn.exec:\tnbhnn.exe112⤵PID:3008
-
\??\c:\3nbbbt.exec:\3nbbbt.exe113⤵PID:1656
-
\??\c:\pjvvv.exec:\pjvvv.exe114⤵PID:1760
-
\??\c:\rfrxlrl.exec:\rfrxlrl.exe115⤵PID:1964
-
\??\c:\nbhbhb.exec:\nbhbhb.exe116⤵PID:1524
-
\??\c:\bthntn.exec:\bthntn.exe117⤵PID:2360
-
\??\c:\9dvvd.exec:\9dvvd.exe118⤵PID:1568
-
\??\c:\frrlrrr.exec:\frrlrrr.exe119⤵PID:1576
-
\??\c:\rlxxrlx.exec:\rlxxrlx.exe120⤵PID:2408
-
\??\c:\bnnnbh.exec:\bnnnbh.exe121⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-