Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe
-
Size
452KB
-
MD5
9fb45cb4881e004f47e19f5dc623b948
-
SHA1
a1b0a3d67c0556f92f61a541fe879030ab06a590
-
SHA256
0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c
-
SHA512
6a672cc56f109a25bb1772aece23ca370bd83fb8c9590f5d427b77235337b166d97cf97dd5b6760de709b3d5166cf76dd254c5486ffcd92714901c27bc3738d8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-94-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2360-104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2668-56-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1556-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-123-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1920-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-133-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1788-151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-274-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-391-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/288-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-458-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1092-457-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1520-472-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1220-489-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1288-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-539-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1940-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-628-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2396-729-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2396-728-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/340-769-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-825-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-860-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2228-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-922-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1996-1218-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 fxrrffr.exe 2264 1tnntb.exe 2356 jjvdp.exe 2768 nbnhhh.exe 2668 nhbhtt.exe 2764 rfrrxrf.exe 2680 nhbbnb.exe 2540 1hbhhh.exe 2664 1dppp.exe 2360 thttht.exe 1816 ppdvj.exe 1556 thnnbb.exe 2368 vjppd.exe 1920 5xrxxxl.exe 1788 xfllrlr.exe 2456 7pdjj.exe 2004 ffffllx.exe 2416 btnnnn.exe 2348 jvvvj.exe 2408 hthhnn.exe 2092 nbnnbb.exe 1692 hhhbtb.exe 760 5hnnnt.exe 1288 jvpvj.exe 1384 3frrflr.exe 1304 7dpjp.exe 1512 ppdpd.exe 652 5vppd.exe 1884 llfrxxf.exe 2472 pppvj.exe 2444 jdpvp.exe 2284 bbnnhh.exe 1572 dvjjp.exe 2264 bnhnbh.exe 2636 hbnntn.exe 2800 vjddp.exe 2228 xrxxffl.exe 2812 lxrrxrf.exe 2856 thbbtt.exe 2712 jpjpv.exe 2808 fxrrxfr.exe 2564 3rxrffl.exe 2972 thhbhh.exe 1356 dpjpd.exe 2740 xlffrrf.exe 288 1xlrrxf.exe 1816 5nbhhn.exe 1996 dvjpv.exe 2060 jjvdp.exe 640 lfxxffr.exe 1088 bnnbhh.exe 332 5jjvv.exe 2600 pjjjp.exe 376 xlffffl.exe 3064 3tbtbb.exe 1092 nhtttt.exe 2580 vjddp.exe 1520 xlffflr.exe 2156 xlrrxxx.exe 2092 jjvjp.exe 1220 pdvpd.exe 1812 frrrrxf.exe 1288 7bhhhn.exe 800 pdvvd.exe -
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-400-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/376-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-489-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1288-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-728-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/1688-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-1125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-1199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-1335-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1732 1916 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 31 PID 1916 wrote to memory of 1732 1916 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 31 PID 1916 wrote to memory of 1732 1916 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 31 PID 1916 wrote to memory of 1732 1916 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 31 PID 1732 wrote to memory of 2264 1732 fxrrffr.exe 32 PID 1732 wrote to memory of 2264 1732 fxrrffr.exe 32 PID 1732 wrote to memory of 2264 1732 fxrrffr.exe 32 PID 1732 wrote to memory of 2264 1732 fxrrffr.exe 32 PID 2264 wrote to memory of 2356 2264 1tnntb.exe 33 PID 2264 wrote to memory of 2356 2264 1tnntb.exe 33 PID 2264 wrote to memory of 2356 2264 1tnntb.exe 33 PID 2264 wrote to memory of 2356 2264 1tnntb.exe 33 PID 2356 wrote to memory of 2768 2356 jjvdp.exe 34 PID 2356 wrote to memory of 2768 2356 jjvdp.exe 34 PID 2356 wrote to memory of 2768 2356 jjvdp.exe 34 PID 2356 wrote to memory of 2768 2356 jjvdp.exe 34 PID 2768 wrote to memory of 2668 2768 nbnhhh.exe 35 PID 2768 wrote to memory of 2668 2768 nbnhhh.exe 35 PID 2768 wrote to memory of 2668 2768 nbnhhh.exe 35 PID 2768 wrote to memory of 2668 2768 nbnhhh.exe 35 PID 2668 wrote to memory of 2764 2668 nhbhtt.exe 36 PID 2668 wrote to memory of 2764 2668 nhbhtt.exe 36 PID 2668 wrote to memory of 2764 2668 nhbhtt.exe 36 PID 2668 wrote to memory of 2764 2668 nhbhtt.exe 36 PID 2764 wrote to memory of 2680 2764 rfrrxrf.exe 37 PID 2764 wrote to memory of 2680 2764 rfrrxrf.exe 37 PID 2764 wrote to memory of 2680 2764 rfrrxrf.exe 37 PID 2764 wrote to memory of 2680 2764 rfrrxrf.exe 37 PID 2680 wrote to memory of 2540 2680 nhbbnb.exe 38 PID 2680 wrote to memory of 2540 2680 nhbbnb.exe 38 PID 2680 wrote to memory of 2540 2680 nhbbnb.exe 38 PID 2680 wrote to memory of 2540 2680 nhbbnb.exe 38 PID 2540 wrote to memory of 2664 2540 1hbhhh.exe 39 PID 2540 wrote to memory of 2664 2540 1hbhhh.exe 39 PID 2540 wrote to memory of 2664 2540 1hbhhh.exe 39 PID 2540 wrote to memory of 2664 2540 1hbhhh.exe 39 PID 2664 wrote to memory of 2360 2664 1dppp.exe 40 PID 2664 wrote to memory of 2360 2664 1dppp.exe 40 PID 2664 wrote to memory of 2360 2664 1dppp.exe 40 PID 2664 wrote to memory of 2360 2664 1dppp.exe 40 PID 2360 wrote to memory of 1816 2360 thttht.exe 41 PID 2360 wrote to memory of 1816 2360 thttht.exe 41 PID 2360 wrote to memory of 1816 2360 thttht.exe 41 PID 2360 wrote to memory of 1816 2360 thttht.exe 41 PID 1816 wrote to memory of 1556 1816 ppdvj.exe 42 PID 1816 wrote to memory of 1556 1816 ppdvj.exe 42 PID 1816 wrote to memory of 1556 1816 ppdvj.exe 42 PID 1816 wrote to memory of 1556 1816 ppdvj.exe 42 PID 1556 wrote to memory of 2368 1556 thnnbb.exe 43 PID 1556 wrote to memory of 2368 1556 thnnbb.exe 43 PID 1556 wrote to memory of 2368 1556 thnnbb.exe 43 PID 1556 wrote to memory of 2368 1556 thnnbb.exe 43 PID 2368 wrote to memory of 1920 2368 vjppd.exe 44 PID 2368 wrote to memory of 1920 2368 vjppd.exe 44 PID 2368 wrote to memory of 1920 2368 vjppd.exe 44 PID 2368 wrote to memory of 1920 2368 vjppd.exe 44 PID 1920 wrote to memory of 1788 1920 5xrxxxl.exe 45 PID 1920 wrote to memory of 1788 1920 5xrxxxl.exe 45 PID 1920 wrote to memory of 1788 1920 5xrxxxl.exe 45 PID 1920 wrote to memory of 1788 1920 5xrxxxl.exe 45 PID 1788 wrote to memory of 2456 1788 xfllrlr.exe 46 PID 1788 wrote to memory of 2456 1788 xfllrlr.exe 46 PID 1788 wrote to memory of 2456 1788 xfllrlr.exe 46 PID 1788 wrote to memory of 2456 1788 xfllrlr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe"C:\Users\Admin\AppData\Local\Temp\0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\fxrrffr.exec:\fxrrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\1tnntb.exec:\1tnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\jjvdp.exec:\jjvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\nbnhhh.exec:\nbnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\nhbhtt.exec:\nhbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nhbbnb.exec:\nhbbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1hbhhh.exec:\1hbhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\1dppp.exec:\1dppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\thttht.exec:\thttht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\ppdvj.exec:\ppdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\thnnbb.exec:\thnnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\vjppd.exec:\vjppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\5xrxxxl.exec:\5xrxxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\xfllrlr.exec:\xfllrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\7pdjj.exec:\7pdjj.exe17⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ffffllx.exec:\ffffllx.exe18⤵
- Executes dropped EXE
PID:2004 -
\??\c:\btnnnn.exec:\btnnnn.exe19⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jvvvj.exec:\jvvvj.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hthhnn.exec:\hthhnn.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nbnnbb.exec:\nbnnbb.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hhhbtb.exec:\hhhbtb.exe23⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5hnnnt.exec:\5hnnnt.exe24⤵
- Executes dropped EXE
PID:760 -
\??\c:\jvpvj.exec:\jvpvj.exe25⤵
- Executes dropped EXE
PID:1288 -
\??\c:\3frrflr.exec:\3frrflr.exe26⤵
- Executes dropped EXE
PID:1384 -
\??\c:\7dpjp.exec:\7dpjp.exe27⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ppdpd.exec:\ppdpd.exe28⤵
- Executes dropped EXE
PID:1512 -
\??\c:\5vppd.exec:\5vppd.exe29⤵
- Executes dropped EXE
PID:652 -
\??\c:\llfrxxf.exec:\llfrxxf.exe30⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pppvj.exec:\pppvj.exe31⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jdpvp.exec:\jdpvp.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bbnnhh.exec:\bbnnhh.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dvjjp.exec:\dvjjp.exe34⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bnhnbh.exec:\bnhnbh.exe35⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hbnntn.exec:\hbnntn.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vjddp.exec:\vjddp.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xrxxffl.exec:\xrxxffl.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lxrrxrf.exec:\lxrrxrf.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\thbbtt.exec:\thbbtt.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jpjpv.exec:\jpjpv.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3rxrffl.exec:\3rxrffl.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\thhbhh.exec:\thhbhh.exe44⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dpjpd.exec:\dpjpd.exe45⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xlffrrf.exec:\xlffrrf.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1xlrrxf.exec:\1xlrrxf.exe47⤵
- Executes dropped EXE
PID:288 -
\??\c:\5nbhhn.exec:\5nbhhn.exe48⤵
- Executes dropped EXE
PID:1816 -
\??\c:\dvjpv.exec:\dvjpv.exe49⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jjvdp.exec:\jjvdp.exe50⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lfxxffr.exec:\lfxxffr.exe51⤵
- Executes dropped EXE
PID:640 -
\??\c:\bnnbhh.exec:\bnnbhh.exe52⤵
- Executes dropped EXE
PID:1088 -
\??\c:\5jjvv.exec:\5jjvv.exe53⤵
- Executes dropped EXE
PID:332 -
\??\c:\pjjjp.exec:\pjjjp.exe54⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xlffffl.exec:\xlffffl.exe55⤵
- Executes dropped EXE
PID:376 -
\??\c:\3tbtbb.exec:\3tbtbb.exe56⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nhtttt.exec:\nhtttt.exe57⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vjddp.exec:\vjddp.exe58⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xlffflr.exec:\xlffflr.exe59⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjvjp.exec:\jjvjp.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\pdvpd.exec:\pdvpd.exe62⤵
- Executes dropped EXE
PID:1220 -
\??\c:\frrrrxf.exec:\frrrrxf.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\7bhhhn.exec:\7bhhhn.exe64⤵
- Executes dropped EXE
PID:1288 -
\??\c:\pdvvd.exec:\pdvvd.exe65⤵
- Executes dropped EXE
PID:800 -
\??\c:\5vdvj.exec:\5vdvj.exe66⤵PID:1712
-
\??\c:\rlflxxl.exec:\rlflxxl.exe67⤵PID:1028
-
\??\c:\tnhhbt.exec:\tnhhbt.exe68⤵PID:2504
-
\??\c:\vpjdj.exec:\vpjdj.exe69⤵PID:652
-
\??\c:\pddvj.exec:\pddvj.exe70⤵PID:2960
-
\??\c:\xlllrlr.exec:\xlllrlr.exe71⤵PID:316
-
\??\c:\bnhhtb.exec:\bnhhtb.exe72⤵PID:300
-
\??\c:\ddpvj.exec:\ddpvj.exe73⤵PID:1940
-
\??\c:\jjdjp.exec:\jjdjp.exe74⤵PID:2996
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe75⤵PID:1600
-
\??\c:\5ttthh.exec:\5ttthh.exe76⤵PID:2648
-
\??\c:\pjpdj.exec:\pjpdj.exe77⤵PID:3036
-
\??\c:\frffxfr.exec:\frffxfr.exe78⤵PID:2628
-
\??\c:\7lffffl.exec:\7lffffl.exe79⤵PID:2768
-
\??\c:\htntbh.exec:\htntbh.exe80⤵PID:2644
-
\??\c:\jvdjd.exec:\jvdjd.exe81⤵PID:2708
-
\??\c:\frlrxxx.exec:\frlrxxx.exe82⤵PID:2856
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe83⤵PID:2572
-
\??\c:\nnhnth.exec:\nnhnth.exe84⤵PID:2808
-
\??\c:\9vdjv.exec:\9vdjv.exe85⤵PID:1824
-
\??\c:\vjdjd.exec:\vjdjd.exe86⤵PID:2592
-
\??\c:\9ffffll.exec:\9ffffll.exe87⤵PID:2604
-
\??\c:\1nhntt.exec:\1nhntt.exe88⤵PID:2616
-
\??\c:\jpjpd.exec:\jpjpd.exe89⤵PID:2272
-
\??\c:\9djjj.exec:\9djjj.exe90⤵PID:344
-
\??\c:\9xrxxlr.exec:\9xrxxlr.exe91⤵PID:1696
-
\??\c:\nhhhtt.exec:\nhhhtt.exe92⤵PID:1476
-
\??\c:\bnbbbt.exec:\bnbbbt.exe93⤵PID:1164
-
\??\c:\7jdvj.exec:\7jdvj.exe94⤵PID:2000
-
\??\c:\xlfxffl.exec:\xlfxffl.exe95⤵PID:2912
-
\??\c:\llxfxrf.exec:\llxfxrf.exe96⤵PID:324
-
\??\c:\jdpvd.exec:\jdpvd.exe97⤵PID:2412
-
\??\c:\rllfrfr.exec:\rllfrfr.exe98⤵PID:1768
-
\??\c:\xrxxllr.exec:\xrxxllr.exe99⤵PID:2396
-
\??\c:\btnnnn.exec:\btnnnn.exe100⤵PID:952
-
\??\c:\dpjjd.exec:\dpjjd.exe101⤵PID:2236
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe102⤵PID:448
-
\??\c:\rffrrfr.exec:\rffrrfr.exe103⤵PID:2884
-
\??\c:\nhttbt.exec:\nhttbt.exe104⤵PID:1688
-
\??\c:\dvpjd.exec:\dvpjd.exe105⤵PID:340
-
\??\c:\pvdjp.exec:\pvdjp.exe106⤵PID:2404
-
\??\c:\lxxxffr.exec:\lxxxffr.exe107⤵PID:1232
-
\??\c:\thbbhb.exec:\thbbhb.exe108⤵PID:800
-
\??\c:\ppdjj.exec:\ppdjj.exe109⤵PID:1712
-
\??\c:\ddppv.exec:\ddppv.exe110⤵PID:1512
-
\??\c:\rfrrrxf.exec:\rfrrrxf.exe111⤵PID:2504
-
\??\c:\hbnnbh.exec:\hbnnbh.exe112⤵PID:2168
-
\??\c:\bhhhnn.exec:\bhhhnn.exe113⤵PID:2960
-
\??\c:\dvppv.exec:\dvppv.exe114⤵PID:2124
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe115⤵PID:2388
-
\??\c:\rlffllr.exec:\rlffllr.exe116⤵PID:1940
-
\??\c:\tnnntt.exec:\tnnntt.exe117⤵PID:2996
-
\??\c:\9hbhnn.exec:\9hbhnn.exe118⤵PID:2116
-
\??\c:\pjjjp.exec:\pjjjp.exe119⤵PID:2688
-
\??\c:\ffxllxf.exec:\ffxllxf.exe120⤵PID:1760
-
\??\c:\tnbhtb.exec:\tnbhtb.exe121⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-