Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe
-
Size
453KB
-
MD5
d98d859789f1662d4b8cd89add0dbf10
-
SHA1
4ea41397451ba57ce3b5e6a378ba0d118beba343
-
SHA256
ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621
-
SHA512
0a22f8b40fec8c7cbb8a906c9cb837a4c7f9516adf661e648741a3c8f7770f846038791786668b3c0a0a5561c5731fd4b554f5246da09b7d7fbc1cc7ad9214e3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2120-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-71-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-171-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-243-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-311-0x00000000776D0000-0x00000000777EF000-memory.dmp family_blackmoon behavioral1/memory/2108-312-0x00000000775D0000-0x00000000776CA000-memory.dmp family_blackmoon behavioral1/memory/2896-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-409-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1104-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-532-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2808-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-767-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1524-769-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 lxfxrrr.exe 2792 7bnthh.exe 2716 7xlrxrx.exe 2708 xxfflll.exe 2604 3rflrrr.exe 2056 bttntn.exe 2704 5frxffl.exe 2348 3hnnbt.exe 3024 fffrffr.exe 1580 ppdvd.exe 1680 xxlrxxf.exe 2052 jjpvv.exe 2640 rrfllll.exe 1496 btbbbh.exe 1140 1pdjd.exe 2932 9lxllfl.exe 2456 dvddj.exe 1636 fflfrll.exe 324 pjvvp.exe 2328 9fxxxff.exe 1920 pjppd.exe 1164 nnntnt.exe 1500 pjvdp.exe 832 1bhhbb.exe 1088 3jpvv.exe 1856 xrflxlx.exe 2244 jdjdd.exe 2180 7rxffxl.exe 2492 nhnhtn.exe 2212 jpvdd.exe 880 9vvvj.exe 1336 5hbttn.exe 2108 pjpvv.exe 2384 nnnhtt.exe 2796 llllfxf.exe 2896 9hntbb.exe 2444 vvddj.exe 2608 1xffllr.exe 2636 bhtbhn.exe 2720 3pddp.exe 1980 vvdjp.exe 2656 xxxlrll.exe 1228 3hbntb.exe 900 1djdd.exe 1740 fxlrrrf.exe 3056 frrfxrl.exe 1564 tntnbh.exe 1868 ddvdj.exe 1728 llxxflx.exe 296 9bbtbb.exe 2640 tnnhnn.exe 2620 5dvpv.exe 1104 xfrrxxf.exe 2948 hnbtth.exe 2140 pvjvv.exe 628 3rxxffl.exe 2084 3bbhnn.exe 2452 hbntbb.exe 1984 5vddd.exe 2332 flrrxxf.exe 1752 7ttntt.exe 1908 7dpjp.exe 2468 pdjjj.exe 1016 fflflrr.exe -
resource yara_rule behavioral1/memory/2120-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-54-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2704-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-134-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2932-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-151-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1636-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-171-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1920-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-728-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/576-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-767-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/764-828-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2384 2120 ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe 30 PID 2120 wrote to memory of 2384 2120 ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe 30 PID 2120 wrote to memory of 2384 2120 ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe 30 PID 2120 wrote to memory of 2384 2120 ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe 30 PID 2384 wrote to memory of 2792 2384 lxfxrrr.exe 31 PID 2384 wrote to memory of 2792 2384 lxfxrrr.exe 31 PID 2384 wrote to memory of 2792 2384 lxfxrrr.exe 31 PID 2384 wrote to memory of 2792 2384 lxfxrrr.exe 31 PID 2792 wrote to memory of 2716 2792 7bnthh.exe 32 PID 2792 wrote to memory of 2716 2792 7bnthh.exe 32 PID 2792 wrote to memory of 2716 2792 7bnthh.exe 32 PID 2792 wrote to memory of 2716 2792 7bnthh.exe 32 PID 2716 wrote to memory of 2708 2716 7xlrxrx.exe 33 PID 2716 wrote to memory of 2708 2716 7xlrxrx.exe 33 PID 2716 wrote to memory of 2708 2716 7xlrxrx.exe 33 PID 2716 wrote to memory of 2708 2716 7xlrxrx.exe 33 PID 2708 wrote to memory of 2604 2708 xxfflll.exe 34 PID 2708 wrote to memory of 2604 2708 xxfflll.exe 34 PID 2708 wrote to memory of 2604 2708 xxfflll.exe 34 PID 2708 wrote to memory of 2604 2708 xxfflll.exe 34 PID 2604 wrote to memory of 2056 2604 3rflrrr.exe 35 PID 2604 wrote to memory of 2056 2604 3rflrrr.exe 35 PID 2604 wrote to memory of 2056 2604 3rflrrr.exe 35 PID 2604 wrote to memory of 2056 2604 3rflrrr.exe 35 PID 2056 wrote to memory of 2704 2056 bttntn.exe 36 PID 2056 wrote to memory of 2704 2056 bttntn.exe 36 PID 2056 wrote to memory of 2704 2056 bttntn.exe 36 PID 2056 wrote to memory of 2704 2056 bttntn.exe 36 PID 2704 wrote to memory of 2348 2704 5frxffl.exe 37 PID 2704 wrote to memory of 2348 2704 5frxffl.exe 37 PID 2704 wrote to memory of 2348 2704 5frxffl.exe 37 PID 2704 wrote to memory of 2348 2704 5frxffl.exe 37 PID 2348 wrote to memory of 3024 2348 3hnnbt.exe 38 PID 2348 wrote to memory of 3024 2348 3hnnbt.exe 38 PID 2348 wrote to memory of 3024 2348 3hnnbt.exe 38 PID 2348 wrote to memory of 3024 2348 3hnnbt.exe 38 PID 3024 wrote to memory of 1580 3024 fffrffr.exe 39 PID 3024 wrote to memory of 1580 3024 fffrffr.exe 39 PID 3024 wrote to memory of 1580 3024 fffrffr.exe 39 PID 3024 wrote to memory of 1580 3024 fffrffr.exe 39 PID 1580 wrote to memory of 1680 1580 ppdvd.exe 40 PID 1580 wrote to memory of 1680 1580 ppdvd.exe 40 PID 1580 wrote to memory of 1680 1580 ppdvd.exe 40 PID 1580 wrote to memory of 1680 1580 ppdvd.exe 40 PID 1680 wrote to memory of 2052 1680 xxlrxxf.exe 41 PID 1680 wrote to memory of 2052 1680 xxlrxxf.exe 41 PID 1680 wrote to memory of 2052 1680 xxlrxxf.exe 41 PID 1680 wrote to memory of 2052 1680 xxlrxxf.exe 41 PID 2052 wrote to memory of 2640 2052 jjpvv.exe 42 PID 2052 wrote to memory of 2640 2052 jjpvv.exe 42 PID 2052 wrote to memory of 2640 2052 jjpvv.exe 42 PID 2052 wrote to memory of 2640 2052 jjpvv.exe 42 PID 2640 wrote to memory of 1496 2640 rrfllll.exe 43 PID 2640 wrote to memory of 1496 2640 rrfllll.exe 43 PID 2640 wrote to memory of 1496 2640 rrfllll.exe 43 PID 2640 wrote to memory of 1496 2640 rrfllll.exe 43 PID 1496 wrote to memory of 1140 1496 btbbbh.exe 44 PID 1496 wrote to memory of 1140 1496 btbbbh.exe 44 PID 1496 wrote to memory of 1140 1496 btbbbh.exe 44 PID 1496 wrote to memory of 1140 1496 btbbbh.exe 44 PID 1140 wrote to memory of 2932 1140 1pdjd.exe 45 PID 1140 wrote to memory of 2932 1140 1pdjd.exe 45 PID 1140 wrote to memory of 2932 1140 1pdjd.exe 45 PID 1140 wrote to memory of 2932 1140 1pdjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe"C:\Users\Admin\AppData\Local\Temp\ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\7bnthh.exec:\7bnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7xlrxrx.exec:\7xlrxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xxfflll.exec:\xxfflll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3rflrrr.exec:\3rflrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\bttntn.exec:\bttntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5frxffl.exec:\5frxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3hnnbt.exec:\3hnnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\fffrffr.exec:\fffrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\ppdvd.exec:\ppdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\jjpvv.exec:\jjpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rrfllll.exec:\rrfllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\btbbbh.exec:\btbbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\1pdjd.exec:\1pdjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\9lxllfl.exec:\9lxllfl.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dvddj.exec:\dvddj.exe18⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fflfrll.exec:\fflfrll.exe19⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pjvvp.exec:\pjvvp.exe20⤵
- Executes dropped EXE
PID:324 -
\??\c:\9fxxxff.exec:\9fxxxff.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pjppd.exec:\pjppd.exe22⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nnntnt.exec:\nnntnt.exe23⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pjvdp.exec:\pjvdp.exe24⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1bhhbb.exec:\1bhhbb.exe25⤵
- Executes dropped EXE
PID:832 -
\??\c:\3jpvv.exec:\3jpvv.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xrflxlx.exec:\xrflxlx.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jdjdd.exec:\jdjdd.exe28⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7rxffxl.exec:\7rxffxl.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nhnhtn.exec:\nhnhtn.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jpvdd.exec:\jpvdd.exe31⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9vvvj.exec:\9vvvj.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\5hbttn.exec:\5hbttn.exe33⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pjpvv.exec:\pjpvv.exe34⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xfxrxxf.exec:\xfxrxxf.exe35⤵PID:1492
-
\??\c:\nnnhtt.exec:\nnnhtt.exe36⤵
- Executes dropped EXE
PID:2384 -
\??\c:\llllfxf.exec:\llllfxf.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9hntbb.exec:\9hntbb.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vvddj.exec:\vvddj.exe39⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1xffllr.exec:\1xffllr.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\bhtbhn.exec:\bhtbhn.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3pddp.exec:\3pddp.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vvdjp.exec:\vvdjp.exe43⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xxxlrll.exec:\xxxlrll.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3hbntb.exec:\3hbntb.exe45⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1djdd.exec:\1djdd.exe46⤵
- Executes dropped EXE
PID:900 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\frrfxrl.exec:\frrfxrl.exe48⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tntnbh.exec:\tntnbh.exe49⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ddvdj.exec:\ddvdj.exe50⤵
- Executes dropped EXE
PID:1868 -
\??\c:\llxxflx.exec:\llxxflx.exe51⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9bbtbb.exec:\9bbtbb.exe52⤵
- Executes dropped EXE
PID:296 -
\??\c:\tnnhnn.exec:\tnnhnn.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5dvpv.exec:\5dvpv.exe54⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xfrrxxf.exec:\xfrrxxf.exe55⤵
- Executes dropped EXE
PID:1104 -
\??\c:\hnbtth.exec:\hnbtth.exe56⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pvjvv.exec:\pvjvv.exe57⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3rxxffl.exec:\3rxxffl.exe58⤵
- Executes dropped EXE
PID:628 -
\??\c:\3bbhnn.exec:\3bbhnn.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbntbb.exec:\hbntbb.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5vddd.exec:\5vddd.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\flrrxxf.exec:\flrrxxf.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7ttntt.exec:\7ttntt.exe63⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7dpjp.exec:\7dpjp.exe64⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pdjjj.exec:\pdjjj.exe65⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fflflrr.exec:\fflflrr.exe66⤵
- Executes dropped EXE
PID:1016 -
\??\c:\thttbh.exec:\thttbh.exe67⤵PID:1396
-
\??\c:\3vdvv.exec:\3vdvv.exe68⤵PID:3016
-
\??\c:\lrflllx.exec:\lrflllx.exe69⤵PID:1608
-
\??\c:\9nntbb.exec:\9nntbb.exe70⤵
- System Location Discovery: System Language Discovery
PID:1204 -
\??\c:\dpdvp.exec:\dpdvp.exe71⤵PID:1924
-
\??\c:\llrllll.exec:\llrllll.exe72⤵PID:2496
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe73⤵PID:976
-
\??\c:\ntttht.exec:\ntttht.exe74⤵PID:2428
-
\??\c:\ppddj.exec:\ppddj.exe75⤵PID:1464
-
\??\c:\3xrxlrf.exec:\3xrxlrf.exe76⤵PID:748
-
\??\c:\1hnbnt.exec:\1hnbnt.exe77⤵PID:2148
-
\??\c:\vpvpd.exec:\vpvpd.exe78⤵PID:2772
-
\??\c:\rxfllrx.exec:\rxfllrx.exe79⤵PID:1484
-
\??\c:\rrflxfl.exec:\rrflxfl.exe80⤵PID:3060
-
\??\c:\bbnttb.exec:\bbnttb.exe81⤵PID:1880
-
\??\c:\jpdjv.exec:\jpdjv.exe82⤵PID:2740
-
\??\c:\flxrflx.exec:\flxrflx.exe83⤵PID:2808
-
\??\c:\9tnntb.exec:\9tnntb.exe84⤵PID:2868
-
\??\c:\jjvvj.exec:\jjvvj.exe85⤵PID:2988
-
\??\c:\1vpvp.exec:\1vpvp.exe86⤵PID:2600
-
\??\c:\rrflflx.exec:\rrflflx.exe87⤵PID:2652
-
\??\c:\nbhhnh.exec:\nbhhnh.exe88⤵PID:1004
-
\??\c:\7vppd.exec:\7vppd.exe89⤵PID:2280
-
\??\c:\jpjpd.exec:\jpjpd.exe90⤵PID:1572
-
\??\c:\9rlrxll.exec:\9rlrxll.exe91⤵PID:2080
-
\??\c:\5hhnbh.exec:\5hhnbh.exe92⤵PID:584
-
\??\c:\jpppp.exec:\jpppp.exe93⤵PID:1240
-
\??\c:\7xxxrrf.exec:\7xxxrrf.exe94⤵PID:1932
-
\??\c:\btbbhn.exec:\btbbhn.exe95⤵PID:1652
-
\??\c:\nbhhnt.exec:\nbhhnt.exe96⤵PID:996
-
\??\c:\jjvvj.exec:\jjvvj.exe97⤵PID:1000
-
\??\c:\xrffrlx.exec:\xrffrlx.exe98⤵PID:2124
-
\??\c:\7bnhtt.exec:\7bnhtt.exe99⤵PID:2676
-
\??\c:\vvdjv.exec:\vvdjv.exe100⤵PID:1300
-
\??\c:\3vpvd.exec:\3vpvd.exe101⤵PID:576
-
\??\c:\rrlrflr.exec:\rrlrflr.exe102⤵PID:536
-
\??\c:\7bhhtn.exec:\7bhhtn.exe103⤵PID:1524
-
\??\c:\jdppv.exec:\jdppv.exe104⤵PID:1632
-
\??\c:\xxflrrf.exec:\xxflrrf.exe105⤵PID:2328
-
\??\c:\nnbbnt.exec:\nnbbnt.exe106⤵PID:344
-
\??\c:\jvddj.exec:\jvddj.exe107⤵PID:2008
-
\??\c:\3xlllrr.exec:\3xlllrr.exe108⤵PID:1276
-
\??\c:\rlffrrf.exec:\rlffrrf.exe109⤵PID:1164
-
\??\c:\tthnbh.exec:\tthnbh.exe110⤵PID:1732
-
\??\c:\pjjjj.exec:\pjjjj.exe111⤵PID:1704
-
\??\c:\flxxrxx.exec:\flxxrxx.exe112⤵PID:1432
-
\??\c:\hbbbtt.exec:\hbbbtt.exe113⤵PID:764
-
\??\c:\nnbhbh.exec:\nnbhbh.exe114⤵PID:2104
-
\??\c:\jdjjv.exec:\jdjjv.exe115⤵PID:264
-
\??\c:\xrffflx.exec:\xrffflx.exe116⤵PID:1924
-
\??\c:\5nbtbh.exec:\5nbtbh.exe117⤵PID:1992
-
\??\c:\nntbbb.exec:\nntbbb.exe118⤵PID:976
-
\??\c:\ppvpd.exec:\ppvpd.exe119⤵PID:2428
-
\??\c:\rlllllr.exec:\rlllllr.exe120⤵PID:1464
-
\??\c:\nnnhnh.exec:\nnnhnh.exe121⤵PID:2380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-