Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe
-
Size
454KB
-
MD5
f331e16f98379eebaa3f6c7a8f9d6076
-
SHA1
f588f6163c0655c6e33cd480948120bce2c705b6
-
SHA256
8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d
-
SHA512
60e6d82034f5d075cf1ff382f3972bd0bc0beeea65f94a9c110e935db3dfa394589337e8c8a17dda3febb740cdd93fa2190b6ed5f4666f3d338f8f844b2d5cce
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-129-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/320-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1332-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-331-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-457-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2080-512-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3032-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-838-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1052-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-888-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1056-945-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1368-1026-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2684-1136-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1696 nbnntt.exe 2316 ppdvv.exe 1164 7xlflll.exe 2240 9vpdp.exe 2748 rlxlflx.exe 2660 pjvvd.exe 2336 1fflrxl.exe 3040 tthhtt.exe 2532 rrlrlrf.exe 2652 ddddv.exe 3016 xxxlfrr.exe 2340 1dvdj.exe 1964 ntntbh.exe 320 jdddv.exe 1700 fxxfrxl.exe 1332 hbnbnb.exe 1032 xlllxxf.exe 2788 vjppv.exe 3004 7xlfxff.exe 2892 7dvvj.exe 1860 frllxfl.exe 2144 llfrrrx.exe 1368 tbntbh.exe 1536 vdppd.exe 1652 rxrrffx.exe 2248 ppjpv.exe 2404 fxlxllx.exe 2472 5pjpv.exe 2960 9jjpv.exe 2008 dvvvd.exe 2272 jppdd.exe 1960 7xrfflr.exe 1704 7bnnnt.exe 1276 3xxxlrf.exe 2460 tttbth.exe 2676 bbbhbn.exe 2828 pjdpv.exe 2688 rllrflf.exe 2692 xrrlxlx.exe 2556 bnhnht.exe 2576 jjvdp.exe 2552 vjvvp.exe 2704 ffxlflx.exe 2996 hhntnb.exe 3012 jppvj.exe 1480 vvvpd.exe 1868 rfxfxxf.exe 1920 bbbhnh.exe 1268 tthnbn.exe 1760 3pddp.exe 1400 7llfffx.exe 2268 tnhnnt.exe 1952 hbtbnn.exe 1692 3dvjv.exe 1032 1lxxfff.exe 2200 9nhhnt.exe 2860 hnnhtb.exe 780 dpvdd.exe 1784 rrrxffr.exe 2780 5lrlllr.exe 580 tnhnbb.exe 912 ddjjj.exe 1804 dpvvv.exe 1524 3lrllrr.exe -
resource yara_rule behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-89-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2652-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-331-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2828-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-450-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3032-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-1170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-1183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-1214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-1295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-1344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-1357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-1370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-1382-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 1696 2432 8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe 31 PID 2432 wrote to memory of 1696 2432 8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe 31 PID 2432 wrote to memory of 1696 2432 8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe 31 PID 2432 wrote to memory of 1696 2432 8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe 31 PID 1696 wrote to memory of 2316 1696 nbnntt.exe 32 PID 1696 wrote to memory of 2316 1696 nbnntt.exe 32 PID 1696 wrote to memory of 2316 1696 nbnntt.exe 32 PID 1696 wrote to memory of 2316 1696 nbnntt.exe 32 PID 2316 wrote to memory of 1164 2316 ppdvv.exe 33 PID 2316 wrote to memory of 1164 2316 ppdvv.exe 33 PID 2316 wrote to memory of 1164 2316 ppdvv.exe 33 PID 2316 wrote to memory of 1164 2316 ppdvv.exe 33 PID 1164 wrote to memory of 2240 1164 7xlflll.exe 34 PID 1164 wrote to memory of 2240 1164 7xlflll.exe 34 PID 1164 wrote to memory of 2240 1164 7xlflll.exe 34 PID 1164 wrote to memory of 2240 1164 7xlflll.exe 34 PID 2240 wrote to memory of 2748 2240 9vpdp.exe 35 PID 2240 wrote to memory of 2748 2240 9vpdp.exe 35 PID 2240 wrote to memory of 2748 2240 9vpdp.exe 35 PID 2240 wrote to memory of 2748 2240 9vpdp.exe 35 PID 2748 wrote to memory of 2660 2748 rlxlflx.exe 36 PID 2748 wrote to memory of 2660 2748 rlxlflx.exe 36 PID 2748 wrote to memory of 2660 2748 rlxlflx.exe 36 PID 2748 wrote to memory of 2660 2748 rlxlflx.exe 36 PID 2660 wrote to memory of 2336 2660 pjvvd.exe 37 PID 2660 wrote to memory of 2336 2660 pjvvd.exe 37 PID 2660 wrote to memory of 2336 2660 pjvvd.exe 37 PID 2660 wrote to memory of 2336 2660 pjvvd.exe 37 PID 2336 wrote to memory of 3040 2336 1fflrxl.exe 38 PID 2336 wrote to memory of 3040 2336 1fflrxl.exe 38 PID 2336 wrote to memory of 3040 2336 1fflrxl.exe 38 PID 2336 wrote to memory of 3040 2336 1fflrxl.exe 38 PID 3040 wrote to memory of 2532 3040 tthhtt.exe 39 PID 3040 wrote to memory of 2532 3040 tthhtt.exe 39 PID 3040 wrote to memory of 2532 3040 tthhtt.exe 39 PID 3040 wrote to memory of 2532 3040 tthhtt.exe 39 PID 2532 wrote to memory of 2652 2532 rrlrlrf.exe 40 PID 2532 wrote to memory of 2652 2532 rrlrlrf.exe 40 PID 2532 wrote to memory of 2652 2532 rrlrlrf.exe 40 PID 2532 wrote to memory of 2652 2532 rrlrlrf.exe 40 PID 2652 wrote to memory of 3016 2652 ddddv.exe 41 PID 2652 wrote to memory of 3016 2652 ddddv.exe 41 PID 2652 wrote to memory of 3016 2652 ddddv.exe 41 PID 2652 wrote to memory of 3016 2652 ddddv.exe 41 PID 3016 wrote to memory of 2340 3016 xxxlfrr.exe 42 PID 3016 wrote to memory of 2340 3016 xxxlfrr.exe 42 PID 3016 wrote to memory of 2340 3016 xxxlfrr.exe 42 PID 3016 wrote to memory of 2340 3016 xxxlfrr.exe 42 PID 2340 wrote to memory of 1964 2340 1dvdj.exe 43 PID 2340 wrote to memory of 1964 2340 1dvdj.exe 43 PID 2340 wrote to memory of 1964 2340 1dvdj.exe 43 PID 2340 wrote to memory of 1964 2340 1dvdj.exe 43 PID 1964 wrote to memory of 320 1964 ntntbh.exe 44 PID 1964 wrote to memory of 320 1964 ntntbh.exe 44 PID 1964 wrote to memory of 320 1964 ntntbh.exe 44 PID 1964 wrote to memory of 320 1964 ntntbh.exe 44 PID 320 wrote to memory of 1700 320 jdddv.exe 45 PID 320 wrote to memory of 1700 320 jdddv.exe 45 PID 320 wrote to memory of 1700 320 jdddv.exe 45 PID 320 wrote to memory of 1700 320 jdddv.exe 45 PID 1700 wrote to memory of 1332 1700 fxxfrxl.exe 46 PID 1700 wrote to memory of 1332 1700 fxxfrxl.exe 46 PID 1700 wrote to memory of 1332 1700 fxxfrxl.exe 46 PID 1700 wrote to memory of 1332 1700 fxxfrxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe"C:\Users\Admin\AppData\Local\Temp\8ffdf404690fa5104a6e0a5f0a271c14f0a636c0bff65d51b3f072218f84f35d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\nbnntt.exec:\nbnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\ppdvv.exec:\ppdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\7xlflll.exec:\7xlflll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\9vpdp.exec:\9vpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\rlxlflx.exec:\rlxlflx.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pjvvd.exec:\pjvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1fflrxl.exec:\1fflrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\tthhtt.exec:\tthhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ddddv.exec:\ddddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xxxlfrr.exec:\xxxlfrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\1dvdj.exec:\1dvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ntntbh.exec:\ntntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\jdddv.exec:\jdddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\hbnbnb.exec:\hbnbnb.exe17⤵
- Executes dropped EXE
PID:1332 -
\??\c:\xlllxxf.exec:\xlllxxf.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vjppv.exec:\vjppv.exe19⤵
- Executes dropped EXE
PID:2788 -
\??\c:\7xlfxff.exec:\7xlfxff.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7dvvj.exec:\7dvvj.exe21⤵
- Executes dropped EXE
PID:2892 -
\??\c:\frllxfl.exec:\frllxfl.exe22⤵
- Executes dropped EXE
PID:1860 -
\??\c:\llfrrrx.exec:\llfrrrx.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tbntbh.exec:\tbntbh.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vdppd.exec:\vdppd.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rxrrffx.exec:\rxrrffx.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ppjpv.exec:\ppjpv.exe27⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxlxllx.exec:\fxlxllx.exe28⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5pjpv.exec:\5pjpv.exe29⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9jjpv.exec:\9jjpv.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dvvvd.exec:\dvvvd.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jppdd.exec:\jppdd.exe32⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7xrfflr.exec:\7xrfflr.exe33⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7bnnnt.exec:\7bnnnt.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3xxxlrf.exec:\3xxxlrf.exe35⤵
- Executes dropped EXE
PID:1276 -
\??\c:\tttbth.exec:\tttbth.exe36⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bbbhbn.exec:\bbbhbn.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjdpv.exec:\pjdpv.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rllrflf.exec:\rllrflf.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xrrlxlx.exec:\xrrlxlx.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bnhnht.exec:\bnhnht.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jjvdp.exec:\jjvdp.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vjvvp.exec:\vjvvp.exe43⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ffxlflx.exec:\ffxlflx.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hhntnb.exec:\hhntnb.exe45⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jppvj.exec:\jppvj.exe46⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vvvpd.exec:\vvvpd.exe47⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rfxfxxf.exec:\rfxfxxf.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\bbbhnh.exec:\bbbhnh.exe49⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tthnbn.exec:\tthnbn.exe50⤵
- Executes dropped EXE
PID:1268 -
\??\c:\3pddp.exec:\3pddp.exe51⤵
- Executes dropped EXE
PID:1760 -
\??\c:\7llfffx.exec:\7llfffx.exe52⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tnhnnt.exec:\tnhnnt.exe53⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hbtbnn.exec:\hbtbnn.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3dvjv.exec:\3dvjv.exe55⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1lxxfff.exec:\1lxxfff.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1032 -
\??\c:\9nhhnt.exec:\9nhhnt.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hnnhtb.exec:\hnnhtb.exe58⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dpvdd.exec:\dpvdd.exe59⤵
- Executes dropped EXE
PID:780 -
\??\c:\rrrxffr.exec:\rrrxffr.exe60⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5lrlllr.exec:\5lrlllr.exe61⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnhnbb.exec:\tnhnbb.exe62⤵
- Executes dropped EXE
PID:580 -
\??\c:\ddjjj.exec:\ddjjj.exe63⤵
- Executes dropped EXE
PID:912 -
\??\c:\dpvvv.exec:\dpvvv.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\3lrllrr.exec:\3lrllrr.exe65⤵
- Executes dropped EXE
PID:1524 -
\??\c:\7hnhhh.exec:\7hnhhh.exe66⤵PID:2080
-
\??\c:\1hhhtt.exec:\1hhhtt.exe67⤵PID:3028
-
\??\c:\7jddj.exec:\7jddj.exe68⤵PID:2116
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe69⤵PID:1644
-
\??\c:\3fxrxfr.exec:\3fxrxfr.exe70⤵PID:3032
-
\??\c:\thbbhh.exec:\thbbhh.exe71⤵PID:2320
-
\??\c:\tnnthb.exec:\tnnthb.exe72⤵PID:800
-
\??\c:\jdvjv.exec:\jdvjv.exe73⤵PID:2196
-
\??\c:\5rffxrx.exec:\5rffxrx.exe74⤵PID:2456
-
\??\c:\bhtbhn.exec:\bhtbhn.exe75⤵PID:2468
-
\??\c:\btnttt.exec:\btnttt.exe76⤵PID:2028
-
\??\c:\jdddj.exec:\jdddj.exe77⤵PID:2624
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe78⤵PID:2012
-
\??\c:\btnhhh.exec:\btnhhh.exe79⤵PID:2924
-
\??\c:\vvddj.exec:\vvddj.exe80⤵PID:2684
-
\??\c:\jjdjp.exec:\jjdjp.exe81⤵PID:2688
-
\??\c:\1lrxflf.exec:\1lrxflf.exe82⤵PID:2768
-
\??\c:\ttnnbb.exec:\ttnnbb.exe83⤵PID:2808
-
\??\c:\tntbnt.exec:\tntbnt.exe84⤵PID:3040
-
\??\c:\dvjpv.exec:\dvjpv.exe85⤵PID:2548
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe86⤵PID:2532
-
\??\c:\xxrflrx.exec:\xxrflrx.exe87⤵PID:3044
-
\??\c:\btthnt.exec:\btthnt.exe88⤵PID:1944
-
\??\c:\nnnnbb.exec:\nnnnbb.exe89⤵PID:1976
-
\??\c:\vpjvp.exec:\vpjvp.exe90⤵PID:2260
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe91⤵PID:1436
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe92⤵PID:1964
-
\??\c:\7btttt.exec:\7btttt.exe93⤵PID:1268
-
\??\c:\pvpvv.exec:\pvpvv.exe94⤵PID:2492
-
\??\c:\3dppv.exec:\3dppv.exe95⤵PID:1400
-
\??\c:\fxxxlrf.exec:\fxxxlrf.exe96⤵PID:2268
-
\??\c:\hbnnbb.exec:\hbnnbb.exe97⤵PID:2772
-
\??\c:\bttbnn.exec:\bttbnn.exe98⤵PID:2896
-
\??\c:\vpdvv.exec:\vpdvv.exe99⤵PID:640
-
\??\c:\7lffrrf.exec:\7lffrrf.exe100⤵PID:2200
-
\??\c:\3rlrlxx.exec:\3rlrlxx.exe101⤵PID:788
-
\??\c:\hhbthn.exec:\hhbthn.exe102⤵PID:992
-
\??\c:\dpdvv.exec:\dpdvv.exe103⤵PID:872
-
\??\c:\3vdjp.exec:\3vdjp.exe104⤵PID:1320
-
\??\c:\rlflxfl.exec:\rlflxfl.exe105⤵PID:2128
-
\??\c:\9nnthn.exec:\9nnthn.exe106⤵PID:1736
-
\??\c:\nnbhtt.exec:\nnbhtt.exe107⤵PID:1536
-
\??\c:\jjddv.exec:\jjddv.exe108⤵PID:1336
-
\??\c:\lllrxxr.exec:\lllrxxr.exe109⤵PID:1652
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe110⤵PID:1740
-
\??\c:\nnnbnt.exec:\nnnbnt.exe111⤵PID:2488
-
\??\c:\pjjpj.exec:\pjjpj.exe112⤵PID:324
-
\??\c:\7dpdd.exec:\7dpdd.exe113⤵PID:1792
-
\??\c:\7lffrxf.exec:\7lffrxf.exe114⤵PID:2956
-
\??\c:\7hhbhh.exec:\7hhbhh.exe115⤵PID:1128
-
\??\c:\bnhhtn.exec:\bnhhtn.exe116⤵PID:2272
-
\??\c:\vvjvd.exec:\vvjvd.exe117⤵PID:1696
-
\??\c:\9rxlfxx.exec:\9rxlfxx.exe118⤵PID:1052
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe119⤵PID:1704
-
\??\c:\ttbbnb.exec:\ttbbnb.exe120⤵PID:2640
-
\??\c:\7ddjp.exec:\7ddjp.exe121⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-