Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:41
Behavioral task
behavioral1
Sample
7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe
-
Size
97KB
-
MD5
5edadfd1abb63bbec55a6853de1eb46d
-
SHA1
00d79841b80e66268f2638d6649708eef273e9f4
-
SHA256
7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e
-
SHA512
74fbaf462fb08cf2e1b528e2d2e6d195153a2c685d836f2582d50e9de2b6938ee4f458072283be35e2ce6967dc9196111e253d5fd189a61190d3bcf7fefcd47a
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgRy:8cm4FmowdHoSgWrXUgs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2320-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-25-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2292-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-31-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2596-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-60-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2604-69-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2604-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-83-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-92-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2520-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-157-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1672-163-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1672-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-207-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1104-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-224-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1856-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/684-271-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2980-295-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2908-302-0x0000000076EE0000-0x0000000076FDA000-memory.dmp family_blackmoon behavioral1/memory/2908-301-0x0000000076FE0000-0x00000000770FF000-memory.dmp family_blackmoon behavioral1/memory/2416-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-346-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-370-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1608-461-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2888-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/632-544-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3004-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-553-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2184-560-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2984-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-598-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2580-602-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-613-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-623-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2512-658-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2228-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-707-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-765-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2908-861-0x0000000076FE0000-0x00000000770FF000-memory.dmp family_blackmoon behavioral1/memory/2908-11984-0x0000000076FE0000-0x00000000770FF000-memory.dmp family_blackmoon behavioral1/memory/2908-16206-0x0000000076FE0000-0x00000000770FF000-memory.dmp family_blackmoon behavioral1/memory/2908-18142-0x0000000076FE0000-0x00000000770FF000-memory.dmp family_blackmoon behavioral1/memory/2908-18694-0x0000000076FE0000-0x00000000770FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2456 jjvvj.exe 2292 rllrxrf.exe 2668 xfrlfll.exe 2596 tnbbtb.exe 2728 hbntht.exe 2740 pjdjv.exe 2604 vpjpv.exe 2512 tnbhnt.exe 2600 vpjpv.exe 2520 llffrxr.exe 2944 hbnthn.exe 1728 3hbbbb.exe 2732 5jpvd.exe 2816 lfrfxxf.exe 2528 nnbhnt.exe 1424 3fxxffr.exe 756 lxllrrx.exe 2268 1bhhhh.exe 1672 jdjdp.exe 1944 xrrllxr.exe 2264 hbbnbb.exe 1940 hbhhhh.exe 536 dpjdd.exe 1148 rlxxllx.exe 1104 5bhhnn.exe 1664 htntbb.exe 1188 dvvdd.exe 1144 lxrrffx.exe 1520 thtntt.exe 1856 9hbbhh.exe 1964 pdppp.exe 684 rllrllr.exe 2072 lfrxxfr.exe 1044 bthntb.exe 1780 5vppd.exe 2980 3jvvv.exe 2144 3xrllrr.exe 2908 rlrxffl.exe 2436 nbtbbb.exe 1624 fffrffr.exe 1588 5tbbnn.exe 2848 htntnt.exe 2288 dvjvj.exe 3016 7pjjv.exe 760 rfflfff.exe 2620 bthhnn.exe 2860 nhtnnn.exe 2740 pdvvj.exe 2712 3ppjv.exe 2516 lfxxffr.exe 2508 htbbtb.exe 2492 3btbtb.exe 2532 7jvpj.exe 1828 xlxxflr.exe 572 httttt.exe 2796 nhnntn.exe 2832 vpdpp.exe 2964 dvjjj.exe 2016 7lxxfxl.exe 1684 thhttn.exe 1424 5nntnn.exe 316 vpddp.exe 1444 vppjj.exe 2020 lxrrxxf.exe -
resource yara_rule behavioral1/memory/2320-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-5.dat upx behavioral1/memory/2320-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000016cfe-18.dat upx behavioral1/memory/2456-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d0b-28.dat upx behavioral1/memory/2292-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d24-45.dat upx behavioral1/memory/2596-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d13-37.dat upx behavioral1/memory/2668-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d36-54.dat upx behavioral1/memory/2728-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d3f-61.dat upx behavioral1/memory/2740-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2604-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d47-70.dat upx behavioral1/memory/2600-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d50-84.dat upx behavioral1/memory/2600-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2520-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d9f-93.dat upx behavioral1/memory/2944-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001500000001866d-102.dat upx behavioral1/files/0x0009000000018678-110.dat upx behavioral1/memory/1728-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018690-119.dat upx behavioral1/memory/2732-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-126-0x00000000003B0000-0x00000000003D7000-memory.dmp upx behavioral1/files/0x000500000001879b-127.dat upx behavioral1/files/0x00060000000190cd-135.dat upx behavioral1/memory/2528-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190d6-142.dat upx behavioral1/files/0x00050000000191f3-150.dat upx behavioral1/memory/756-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f7-158.dat upx behavioral1/memory/2268-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-157-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019218-168.dat upx behavioral1/memory/1672-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019229-175.dat upx behavioral1/memory/2264-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019234-183.dat upx behavioral1/files/0x000500000001924c-191.dat upx behavioral1/memory/1940-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926b-199.dat upx behavioral1/memory/536-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1148-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019271-208.dat upx behavioral1/memory/1104-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019273-218.dat upx behavioral1/files/0x0005000000019277-227.dat upx behavioral1/memory/1664-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0033000000016ca2-233.dat upx behavioral1/files/0x0005000000019382-240.dat upx behavioral1/files/0x0005000000019389-247.dat upx behavioral1/files/0x00050000000193be-258.dat upx behavioral1/memory/1856-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c4-265.dat upx behavioral1/files/0x00050000000193cc-273.dat upx behavioral1/memory/2908-301-0x0000000076FE0000-0x00000000770FF000-memory.dmp upx behavioral1/memory/2416-309-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2456 2320 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 28 PID 2320 wrote to memory of 2456 2320 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 28 PID 2320 wrote to memory of 2456 2320 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 28 PID 2320 wrote to memory of 2456 2320 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 28 PID 2456 wrote to memory of 2292 2456 jjvvj.exe 29 PID 2456 wrote to memory of 2292 2456 jjvvj.exe 29 PID 2456 wrote to memory of 2292 2456 jjvvj.exe 29 PID 2456 wrote to memory of 2292 2456 jjvvj.exe 29 PID 2292 wrote to memory of 2668 2292 rllrxrf.exe 30 PID 2292 wrote to memory of 2668 2292 rllrxrf.exe 30 PID 2292 wrote to memory of 2668 2292 rllrxrf.exe 30 PID 2292 wrote to memory of 2668 2292 rllrxrf.exe 30 PID 2668 wrote to memory of 2596 2668 xfrlfll.exe 31 PID 2668 wrote to memory of 2596 2668 xfrlfll.exe 31 PID 2668 wrote to memory of 2596 2668 xfrlfll.exe 31 PID 2668 wrote to memory of 2596 2668 xfrlfll.exe 31 PID 2596 wrote to memory of 2728 2596 tnbbtb.exe 32 PID 2596 wrote to memory of 2728 2596 tnbbtb.exe 32 PID 2596 wrote to memory of 2728 2596 tnbbtb.exe 32 PID 2596 wrote to memory of 2728 2596 tnbbtb.exe 32 PID 2728 wrote to memory of 2740 2728 hbntht.exe 33 PID 2728 wrote to memory of 2740 2728 hbntht.exe 33 PID 2728 wrote to memory of 2740 2728 hbntht.exe 33 PID 2728 wrote to memory of 2740 2728 hbntht.exe 33 PID 2740 wrote to memory of 2604 2740 pjdjv.exe 34 PID 2740 wrote to memory of 2604 2740 pjdjv.exe 34 PID 2740 wrote to memory of 2604 2740 pjdjv.exe 34 PID 2740 wrote to memory of 2604 2740 pjdjv.exe 34 PID 2604 wrote to memory of 2512 2604 vpjpv.exe 35 PID 2604 wrote to memory of 2512 2604 vpjpv.exe 35 PID 2604 wrote to memory of 2512 2604 vpjpv.exe 35 PID 2604 wrote to memory of 2512 2604 vpjpv.exe 35 PID 2512 wrote to memory of 2600 2512 tnbhnt.exe 36 PID 2512 wrote to memory of 2600 2512 tnbhnt.exe 36 PID 2512 wrote to memory of 2600 2512 tnbhnt.exe 36 PID 2512 wrote to memory of 2600 2512 tnbhnt.exe 36 PID 2600 wrote to memory of 2520 2600 vpjpv.exe 37 PID 2600 wrote to memory of 2520 2600 vpjpv.exe 37 PID 2600 wrote to memory of 2520 2600 vpjpv.exe 37 PID 2600 wrote to memory of 2520 2600 vpjpv.exe 37 PID 2520 wrote to memory of 2944 2520 llffrxr.exe 38 PID 2520 wrote to memory of 2944 2520 llffrxr.exe 38 PID 2520 wrote to memory of 2944 2520 llffrxr.exe 38 PID 2520 wrote to memory of 2944 2520 llffrxr.exe 38 PID 2944 wrote to memory of 1728 2944 hbnthn.exe 39 PID 2944 wrote to memory of 1728 2944 hbnthn.exe 39 PID 2944 wrote to memory of 1728 2944 hbnthn.exe 39 PID 2944 wrote to memory of 1728 2944 hbnthn.exe 39 PID 1728 wrote to memory of 2732 1728 3hbbbb.exe 40 PID 1728 wrote to memory of 2732 1728 3hbbbb.exe 40 PID 1728 wrote to memory of 2732 1728 3hbbbb.exe 40 PID 1728 wrote to memory of 2732 1728 3hbbbb.exe 40 PID 2732 wrote to memory of 2816 2732 5jpvd.exe 41 PID 2732 wrote to memory of 2816 2732 5jpvd.exe 41 PID 2732 wrote to memory of 2816 2732 5jpvd.exe 41 PID 2732 wrote to memory of 2816 2732 5jpvd.exe 41 PID 2816 wrote to memory of 2528 2816 lfrfxxf.exe 42 PID 2816 wrote to memory of 2528 2816 lfrfxxf.exe 42 PID 2816 wrote to memory of 2528 2816 lfrfxxf.exe 42 PID 2816 wrote to memory of 2528 2816 lfrfxxf.exe 42 PID 2528 wrote to memory of 1424 2528 nnbhnt.exe 43 PID 2528 wrote to memory of 1424 2528 nnbhnt.exe 43 PID 2528 wrote to memory of 1424 2528 nnbhnt.exe 43 PID 2528 wrote to memory of 1424 2528 nnbhnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe"C:\Users\Admin\AppData\Local\Temp\7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jjvvj.exec:\jjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rllrxrf.exec:\rllrxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\xfrlfll.exec:\xfrlfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tnbbtb.exec:\tnbbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hbntht.exec:\hbntht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pjdjv.exec:\pjdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vpjpv.exec:\vpjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tnbhnt.exec:\tnbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vpjpv.exec:\vpjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\llffrxr.exec:\llffrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hbnthn.exec:\hbnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\3hbbbb.exec:\3hbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\5jpvd.exec:\5jpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lfrfxxf.exec:\lfrfxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nnbhnt.exec:\nnbhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\3fxxffr.exec:\3fxxffr.exe17⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lxllrrx.exec:\lxllrrx.exe18⤵
- Executes dropped EXE
PID:756 -
\??\c:\1bhhhh.exec:\1bhhhh.exe19⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdjdp.exec:\jdjdp.exe20⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrrllxr.exec:\xrrllxr.exe21⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hbbnbb.exec:\hbbnbb.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hbhhhh.exec:\hbhhhh.exe23⤵
- Executes dropped EXE
PID:1940 -
\??\c:\dpjdd.exec:\dpjdd.exe24⤵
- Executes dropped EXE
PID:536 -
\??\c:\rlxxllx.exec:\rlxxllx.exe25⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5bhhnn.exec:\5bhhnn.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\htntbb.exec:\htntbb.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dvvdd.exec:\dvvdd.exe28⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lxrrffx.exec:\lxrrffx.exe29⤵
- Executes dropped EXE
PID:1144 -
\??\c:\thtntt.exec:\thtntt.exe30⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9hbbhh.exec:\9hbbhh.exe31⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pdppp.exec:\pdppp.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rllrllr.exec:\rllrllr.exe33⤵
- Executes dropped EXE
PID:684 -
\??\c:\lfrxxfr.exec:\lfrxxfr.exe34⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bthntb.exec:\bthntb.exe35⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5vppd.exec:\5vppd.exe36⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3jvvv.exec:\3jvvv.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3xrllrr.exec:\3xrllrr.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlrxffl.exec:\rlrxffl.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bntnnb.exec:\bntnnb.exe40⤵PID:2416
-
\??\c:\nbtbbb.exec:\nbtbbb.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fffrffr.exec:\fffrffr.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5tbbnn.exec:\5tbbnn.exe43⤵
- Executes dropped EXE
PID:1588 -
\??\c:\htntnt.exec:\htntnt.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dvjvj.exec:\dvjvj.exe45⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7pjjv.exec:\7pjjv.exe46⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rfflfff.exec:\rfflfff.exe47⤵
- Executes dropped EXE
PID:760 -
\??\c:\bthhnn.exec:\bthhnn.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nhtnnn.exec:\nhtnnn.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pdvvj.exec:\pdvvj.exe50⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3ppjv.exec:\3ppjv.exe51⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lfxxffr.exec:\lfxxffr.exe52⤵
- Executes dropped EXE
PID:2516 -
\??\c:\htbbtb.exec:\htbbtb.exe53⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3btbtb.exec:\3btbtb.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7jvpj.exec:\7jvpj.exe55⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xlxxflr.exec:\xlxxflr.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\httttt.exec:\httttt.exe57⤵
- Executes dropped EXE
PID:572 -
\??\c:\nhnntn.exec:\nhnntn.exe58⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpdpp.exec:\vpdpp.exe59⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvjjj.exec:\dvjjj.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7lxxfxl.exec:\7lxxfxl.exe61⤵
- Executes dropped EXE
PID:2016 -
\??\c:\thhttn.exec:\thhttn.exe62⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5nntnn.exec:\5nntnn.exe63⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vpddp.exec:\vpddp.exe64⤵
- Executes dropped EXE
PID:316 -
\??\c:\vppjj.exec:\vppjj.exe65⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe66⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tnhntn.exec:\tnhntn.exe67⤵PID:2344
-
\??\c:\nhtthn.exec:\nhtthn.exe68⤵PID:1608
-
\??\c:\5vjvd.exec:\5vjvd.exe69⤵PID:2464
-
\??\c:\1ddjd.exec:\1ddjd.exe70⤵PID:2264
-
\??\c:\fxxfrrx.exec:\fxxfrrx.exe71⤵PID:1644
-
\??\c:\xrfflrx.exec:\xrfflrx.exe72⤵PID:2360
-
\??\c:\7tttbb.exec:\7tttbb.exe73⤵PID:536
-
\??\c:\ppddj.exec:\ppddj.exe74⤵PID:1060
-
\??\c:\jvjjv.exec:\jvjjv.exe75⤵PID:1104
-
\??\c:\lxxxlll.exec:\lxxxlll.exe76⤵PID:2888
-
\??\c:\rlxxlll.exec:\rlxxlll.exe77⤵PID:980
-
\??\c:\httbhh.exec:\httbhh.exe78⤵PID:1188
-
\??\c:\7jvvp.exec:\7jvvp.exe79⤵PID:920
-
\??\c:\7pjvd.exec:\7pjvd.exe80⤵PID:1704
-
\??\c:\lxfffxf.exec:\lxfffxf.exe81⤵PID:2404
-
\??\c:\9xffllx.exec:\9xffllx.exe82⤵PID:788
-
\??\c:\bnhhhh.exec:\bnhhhh.exe83⤵PID:752
-
\??\c:\tnbhtn.exec:\tnbhtn.exe84⤵PID:632
-
\??\c:\3vpdj.exec:\3vpdj.exe85⤵PID:3004
-
\??\c:\jvjjd.exec:\jvjjd.exe86⤵PID:2184
-
\??\c:\7lrlrrl.exec:\7lrlrrl.exe87⤵PID:2984
-
\??\c:\9nhhnn.exec:\9nhhnn.exe88⤵PID:1720
-
\??\c:\9nnhhn.exec:\9nnhhn.exe89⤵PID:2408
-
\??\c:\dddjj.exec:\dddjj.exe90⤵PID:2900
-
\??\c:\rfrlxfr.exec:\rfrlxfr.exe91⤵PID:2412
-
\??\c:\3nntbh.exec:\3nntbh.exe92⤵PID:2280
-
\??\c:\1tntnh.exec:\1tntnh.exe93⤵PID:2260
-
\??\c:\pjpvj.exec:\pjpvj.exe94⤵PID:2580
-
\??\c:\vpdjp.exec:\vpdjp.exe95⤵PID:1584
-
\??\c:\xrlrffx.exec:\xrlrffx.exe96⤵PID:2872
-
\??\c:\rllfllr.exec:\rllfllr.exe97⤵PID:2688
-
\??\c:\btntnh.exec:\btntnh.exe98⤵PID:3016
-
\??\c:\hthhbt.exec:\hthhbt.exe99⤵PID:2772
-
\??\c:\dpjjp.exec:\dpjjp.exe100⤵PID:3036
-
\??\c:\dpjpv.exec:\dpjpv.exe101⤵PID:2576
-
\??\c:\lffxfxf.exec:\lffxfxf.exe102⤵PID:2652
-
\??\c:\tnbhbb.exec:\tnbhbb.exe103⤵
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\nhttbh.exec:\nhttbh.exe104⤵PID:2484
-
\??\c:\vjjvd.exec:\vjjvd.exe105⤵PID:2940
-
\??\c:\fxfflrx.exec:\fxfflrx.exe106⤵PID:2244
-
\??\c:\bntttn.exec:\bntttn.exe107⤵PID:1852
-
\??\c:\bthhnn.exec:\bthhnn.exe108⤵PID:1356
-
\??\c:\dvddp.exec:\dvddp.exe109⤵PID:1604
-
\??\c:\3dvjj.exec:\3dvjj.exe110⤵PID:2812
-
\??\c:\3fxflll.exec:\3fxflll.exe111⤵PID:2824
-
\??\c:\7frrlrf.exec:\7frrlrf.exe112⤵PID:2228
-
\??\c:\nnhhnt.exec:\nnhhnt.exe113⤵PID:1320
-
\??\c:\btnttb.exec:\btnttb.exe114⤵PID:1400
-
\??\c:\jjdjj.exec:\jjdjj.exe115⤵PID:1792
-
\??\c:\1rrfrxf.exec:\1rrfrxf.exe116⤵PID:756
-
\??\c:\9frlllr.exec:\9frlllr.exe117⤵PID:1800
-
\??\c:\bnbbbh.exec:\bnbbbh.exe118⤵PID:1672
-
\??\c:\hthhnn.exec:\hthhnn.exe119⤵PID:1996
-
\??\c:\jddjd.exec:\jddjd.exe120⤵PID:1928
-
\??\c:\dvjpv.exec:\dvjpv.exe121⤵PID:1948
-
\??\c:\1rfxxrx.exec:\1rfxxrx.exe122⤵PID:1640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-