Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe
-
Size
454KB
-
MD5
316f3f69f06f9a81a12bd79317a438c8
-
SHA1
4aa92d00c10aa7492b64c80cebcdcac22a3b80d6
-
SHA256
1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40
-
SHA512
a4a0172dfdb4fd86a37b8ea50bf94971c539667ba323d2250eeddb17513372be7bcca6aaaee2238da8492c8c8e086d7fd4820812f97711b9b8364e5abc02c192
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2192-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-74-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-160-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1628-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/476-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-423-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1872-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-462-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1884-477-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-940-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2988 bthhtn.exe 2756 7pddj.exe 2584 ffffrrx.exe 2772 btbhhb.exe 2800 xflxlxx.exe 2632 thnhhn.exe 2580 pvppv.exe 1748 lflrffl.exe 768 vdvpd.exe 1080 llxxlrf.exe 2672 pdjjp.exe 2824 lfxxllx.exe 2052 jdpjj.exe 1216 jdpdj.exe 1916 nnbbbt.exe 1628 pjvdp.exe 2684 frrrxxx.exe 1460 bbtthh.exe 1880 jdpjp.exe 2324 xrxxlfl.exe 2292 5btnnt.exe 2860 lxlfrxf.exe 2424 1jjjj.exe 1572 rlffxxf.exe 1680 1tbthn.exe 2136 pjppv.exe 1272 5flrxff.exe 2040 vvjdd.exe 2012 3bbtnn.exe 340 jvjpv.exe 1328 1lrrffl.exe 2836 nhhbhh.exe 3004 7pddj.exe 1652 7lxlxxx.exe 2776 nhnhnn.exe 2752 vpjjp.exe 2848 1jpdj.exe 2484 xrlrxfl.exe 2612 nbnbbb.exe 2800 jjvdp.exe 2512 lxrxllx.exe 2916 rfrxrrx.exe 1960 nbtthn.exe 476 dvjjd.exe 536 7lxlrrx.exe 1196 rlllflr.exe 2664 hhbhnt.exe 2696 pjdjp.exe 2672 5rfrxrx.exe 2932 7thbnt.exe 2188 bntntt.exe 2364 pdvdv.exe 1216 7rfllrr.exe 1624 rrllxxl.exe 1992 tntntt.exe 2636 ddvdj.exe 1872 xrlflff.exe 1884 rlxxlxx.exe 1696 5btbhn.exe 2296 vjvjp.exe 2324 pjppd.exe 2292 fxlrxfx.exe 2644 3btbnn.exe 3064 nnhhtt.exe -
resource yara_rule behavioral1/memory/2192-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-160-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/1628-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-490-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2292-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-940-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/676-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2988 2192 1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe 28 PID 2192 wrote to memory of 2988 2192 1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe 28 PID 2192 wrote to memory of 2988 2192 1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe 28 PID 2192 wrote to memory of 2988 2192 1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe 28 PID 2988 wrote to memory of 2756 2988 bthhtn.exe 29 PID 2988 wrote to memory of 2756 2988 bthhtn.exe 29 PID 2988 wrote to memory of 2756 2988 bthhtn.exe 29 PID 2988 wrote to memory of 2756 2988 bthhtn.exe 29 PID 2756 wrote to memory of 2584 2756 7pddj.exe 30 PID 2756 wrote to memory of 2584 2756 7pddj.exe 30 PID 2756 wrote to memory of 2584 2756 7pddj.exe 30 PID 2756 wrote to memory of 2584 2756 7pddj.exe 30 PID 2584 wrote to memory of 2772 2584 ffffrrx.exe 31 PID 2584 wrote to memory of 2772 2584 ffffrrx.exe 31 PID 2584 wrote to memory of 2772 2584 ffffrrx.exe 31 PID 2584 wrote to memory of 2772 2584 ffffrrx.exe 31 PID 2772 wrote to memory of 2800 2772 btbhhb.exe 32 PID 2772 wrote to memory of 2800 2772 btbhhb.exe 32 PID 2772 wrote to memory of 2800 2772 btbhhb.exe 32 PID 2772 wrote to memory of 2800 2772 btbhhb.exe 32 PID 2800 wrote to memory of 2632 2800 xflxlxx.exe 33 PID 2800 wrote to memory of 2632 2800 xflxlxx.exe 33 PID 2800 wrote to memory of 2632 2800 xflxlxx.exe 33 PID 2800 wrote to memory of 2632 2800 xflxlxx.exe 33 PID 2632 wrote to memory of 2580 2632 thnhhn.exe 34 PID 2632 wrote to memory of 2580 2632 thnhhn.exe 34 PID 2632 wrote to memory of 2580 2632 thnhhn.exe 34 PID 2632 wrote to memory of 2580 2632 thnhhn.exe 34 PID 2580 wrote to memory of 1748 2580 pvppv.exe 35 PID 2580 wrote to memory of 1748 2580 pvppv.exe 35 PID 2580 wrote to memory of 1748 2580 pvppv.exe 35 PID 2580 wrote to memory of 1748 2580 pvppv.exe 35 PID 1748 wrote to memory of 768 1748 lflrffl.exe 36 PID 1748 wrote to memory of 768 1748 lflrffl.exe 36 PID 1748 wrote to memory of 768 1748 lflrffl.exe 36 PID 1748 wrote to memory of 768 1748 lflrffl.exe 36 PID 768 wrote to memory of 1080 768 vdvpd.exe 37 PID 768 wrote to memory of 1080 768 vdvpd.exe 37 PID 768 wrote to memory of 1080 768 vdvpd.exe 37 PID 768 wrote to memory of 1080 768 vdvpd.exe 37 PID 1080 wrote to memory of 2672 1080 llxxlrf.exe 38 PID 1080 wrote to memory of 2672 1080 llxxlrf.exe 38 PID 1080 wrote to memory of 2672 1080 llxxlrf.exe 38 PID 1080 wrote to memory of 2672 1080 llxxlrf.exe 38 PID 2672 wrote to memory of 2824 2672 pdjjp.exe 39 PID 2672 wrote to memory of 2824 2672 pdjjp.exe 39 PID 2672 wrote to memory of 2824 2672 pdjjp.exe 39 PID 2672 wrote to memory of 2824 2672 pdjjp.exe 39 PID 2824 wrote to memory of 2052 2824 lfxxllx.exe 40 PID 2824 wrote to memory of 2052 2824 lfxxllx.exe 40 PID 2824 wrote to memory of 2052 2824 lfxxllx.exe 40 PID 2824 wrote to memory of 2052 2824 lfxxllx.exe 40 PID 2052 wrote to memory of 1216 2052 jdpjj.exe 41 PID 2052 wrote to memory of 1216 2052 jdpjj.exe 41 PID 2052 wrote to memory of 1216 2052 jdpjj.exe 41 PID 2052 wrote to memory of 1216 2052 jdpjj.exe 41 PID 1216 wrote to memory of 1916 1216 jdpdj.exe 42 PID 1216 wrote to memory of 1916 1216 jdpdj.exe 42 PID 1216 wrote to memory of 1916 1216 jdpdj.exe 42 PID 1216 wrote to memory of 1916 1216 jdpdj.exe 42 PID 1916 wrote to memory of 1628 1916 nnbbbt.exe 43 PID 1916 wrote to memory of 1628 1916 nnbbbt.exe 43 PID 1916 wrote to memory of 1628 1916 nnbbbt.exe 43 PID 1916 wrote to memory of 1628 1916 nnbbbt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe"C:\Users\Admin\AppData\Local\Temp\1b8f36ff1350ff793463e0fa37e4a3db092d4bb52be47a8390cb67cc55433c40.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bthhtn.exec:\bthhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7pddj.exec:\7pddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ffffrrx.exec:\ffffrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\btbhhb.exec:\btbhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xflxlxx.exec:\xflxlxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\thnhhn.exec:\thnhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pvppv.exec:\pvppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\lflrffl.exec:\lflrffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vdvpd.exec:\vdvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\llxxlrf.exec:\llxxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\pdjjp.exec:\pdjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lfxxllx.exec:\lfxxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jdpjj.exec:\jdpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\jdpdj.exec:\jdpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\nnbbbt.exec:\nnbbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\pjvdp.exec:\pjvdp.exe17⤵
- Executes dropped EXE
PID:1628 -
\??\c:\frrrxxx.exec:\frrrxxx.exe18⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bbtthh.exec:\bbtthh.exe19⤵
- Executes dropped EXE
PID:1460 -
\??\c:\jdpjp.exec:\jdpjp.exe20⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xrxxlfl.exec:\xrxxlfl.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5btnnt.exec:\5btnnt.exe22⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lxlfrxf.exec:\lxlfrxf.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1jjjj.exec:\1jjjj.exe24⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rlffxxf.exec:\rlffxxf.exe25⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1tbthn.exec:\1tbthn.exe26⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pjppv.exec:\pjppv.exe27⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5flrxff.exec:\5flrxff.exe28⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vvjdd.exec:\vvjdd.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3bbtnn.exec:\3bbtnn.exe30⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jvjpv.exec:\jvjpv.exe31⤵
- Executes dropped EXE
PID:340 -
\??\c:\1lrrffl.exec:\1lrrffl.exe32⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nhhbhh.exec:\nhhbhh.exe33⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7pddj.exec:\7pddj.exe34⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7lxlxxx.exec:\7lxlxxx.exe35⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nhnhnn.exec:\nhnhnn.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vpjjp.exec:\vpjjp.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1jpdj.exec:\1jpdj.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe39⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nbnbbb.exec:\nbnbbb.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jjvdp.exec:\jjvdp.exe41⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lxrxllx.exec:\lxrxllx.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe43⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nbtthn.exec:\nbtthn.exe44⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dvjjd.exec:\dvjjd.exe45⤵
- Executes dropped EXE
PID:476 -
\??\c:\7lxlrrx.exec:\7lxlrrx.exe46⤵
- Executes dropped EXE
PID:536 -
\??\c:\rlllflr.exec:\rlllflr.exe47⤵
- Executes dropped EXE
PID:1196 -
\??\c:\hhbhnt.exec:\hhbhnt.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjdjp.exec:\pjdjp.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5rfrxrx.exec:\5rfrxrx.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7thbnt.exec:\7thbnt.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bntntt.exec:\bntntt.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\pdvdv.exec:\pdvdv.exe53⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7rfllrr.exec:\7rfllrr.exe54⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rrllxxl.exec:\rrllxxl.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tntntt.exec:\tntntt.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ddvdj.exec:\ddvdj.exe57⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrlflff.exec:\xrlflff.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rlxxlxx.exec:\rlxxlxx.exe59⤵
- Executes dropped EXE
PID:1884 -
\??\c:\5btbhn.exec:\5btbhn.exe60⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vjvjp.exec:\vjvjp.exe61⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pjppd.exec:\pjppd.exe62⤵
- Executes dropped EXE
PID:2324 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3btbnn.exec:\3btbnn.exe64⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nnhhtt.exec:\nnhhtt.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jdvdp.exec:\jdvdp.exe66⤵PID:1620
-
\??\c:\3rxflff.exec:\3rxflff.exe67⤵PID:2084
-
\??\c:\5hbhnn.exec:\5hbhnn.exe68⤵PID:1116
-
\??\c:\nbnttb.exec:\nbnttb.exe69⤵PID:600
-
\??\c:\vppdj.exec:\vppdj.exe70⤵PID:2840
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe71⤵PID:2184
-
\??\c:\1xrrxfl.exec:\1xrrxfl.exe72⤵PID:3044
-
\??\c:\bbnthh.exec:\bbnthh.exe73⤵PID:2852
-
\??\c:\dvddd.exec:\dvddd.exe74⤵PID:1468
-
\??\c:\3pdjd.exec:\3pdjd.exe75⤵PID:2384
-
\??\c:\1rllrfl.exec:\1rllrfl.exe76⤵PID:1976
-
\??\c:\bnhhhh.exec:\bnhhhh.exe77⤵
- System Location Discovery: System Language Discovery
PID:2080 -
\??\c:\pjdjj.exec:\pjdjj.exe78⤵PID:3004
-
\??\c:\jvjdj.exec:\jvjdj.exe79⤵PID:2568
-
\??\c:\fxlfffl.exec:\fxlfffl.exe80⤵
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\1htnhh.exec:\1htnhh.exe81⤵PID:2752
-
\??\c:\btntbh.exec:\btntbh.exe82⤵PID:2596
-
\??\c:\9jpvv.exec:\9jpvv.exe83⤵PID:2844
-
\??\c:\7xrrxfl.exec:\7xrrxfl.exe84⤵PID:2456
-
\??\c:\9hntht.exec:\9hntht.exe85⤵PID:2632
-
\??\c:\hbtbtt.exec:\hbtbtt.exe86⤵PID:2492
-
\??\c:\7vdvv.exec:\7vdvv.exe87⤵PID:2916
-
\??\c:\xlfflrx.exec:\xlfflrx.exe88⤵PID:1960
-
\??\c:\fxxfffl.exec:\fxxfffl.exe89⤵PID:2504
-
\??\c:\3bnnnt.exec:\3bnnnt.exe90⤵PID:864
-
\??\c:\vjvvd.exec:\vjvvd.exe91⤵PID:580
-
\??\c:\9jvpj.exec:\9jvpj.exe92⤵PID:2796
-
\??\c:\9rllxrx.exec:\9rllxrx.exe93⤵PID:2700
-
\??\c:\btttbt.exec:\btttbt.exe94⤵PID:2904
-
\??\c:\vjddj.exec:\vjddj.exe95⤵PID:2212
-
\??\c:\vpdvv.exec:\vpdvv.exe96⤵PID:2188
-
\??\c:\lfxxrfl.exec:\lfxxrfl.exe97⤵PID:1720
-
\??\c:\rlffllx.exec:\rlffllx.exe98⤵PID:1900
-
\??\c:\tnhhnt.exec:\tnhhnt.exe99⤵PID:1624
-
\??\c:\dppjj.exec:\dppjj.exe100⤵PID:1992
-
\??\c:\vpdvd.exec:\vpdvd.exe101⤵PID:2684
-
\??\c:\5rflxxf.exec:\5rflxxf.exe102⤵PID:1872
-
\??\c:\9nthhb.exec:\9nthhb.exe103⤵PID:1856
-
\??\c:\7vjdd.exec:\7vjdd.exe104⤵PID:1880
-
\??\c:\9vpjp.exec:\9vpjp.exe105⤵PID:2064
-
\??\c:\fxlrrrr.exec:\fxlrrrr.exe106⤵PID:2120
-
\??\c:\bthhnh.exec:\bthhnh.exe107⤵PID:752
-
\??\c:\9bnntn.exec:\9bnntn.exe108⤵PID:1728
-
\??\c:\jpvvd.exec:\jpvvd.exe109⤵PID:2644
-
\??\c:\9xrxrrx.exec:\9xrxrrx.exe110⤵PID:2108
-
\??\c:\nhtbhh.exec:\nhtbhh.exe111⤵PID:2076
-
\??\c:\nhhhhh.exec:\nhhhhh.exe112⤵PID:2888
-
\??\c:\pjpvp.exec:\pjpvp.exe113⤵PID:940
-
\??\c:\lfxfllr.exec:\lfxfllr.exe114⤵PID:1704
-
\??\c:\bntbbh.exec:\bntbbh.exe115⤵PID:924
-
\??\c:\thhbtb.exec:\thhbtb.exe116⤵PID:2040
-
\??\c:\jpvpp.exec:\jpvpp.exe117⤵PID:672
-
\??\c:\vjvvj.exec:\vjvvj.exe118⤵PID:2708
-
\??\c:\9lffxxx.exec:\9lffxxx.exe119⤵PID:872
-
\??\c:\3nhntb.exec:\3nhntb.exe120⤵PID:868
-
\??\c:\jdvdp.exec:\jdvdp.exe121⤵PID:2192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-