Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe
-
Size
454KB
-
MD5
2022ed2f3b947d31b8b6aa9be828f860
-
SHA1
3a72f89047d93e4d3714323ea020aba4ee21af94
-
SHA256
cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940
-
SHA512
bb2db9a8378bb49bf08f25bdfd6506deaaabdd2e305c18bc63d766d11b5dcd17bfa3ede82674851cfe20e98328f1f1cc3c7c4fdbfdeafeda01fcae25f0f9cb49
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1260-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-81-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2612-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-242-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2256-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-425-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1808-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-557-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2516-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-202-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1776-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-771-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1600-799-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1704-834-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2688-894-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/472-979-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2068-1070-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2524-1358-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1968-1362-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 pdpjp.exe 2352 dpvvd.exe 2788 ppjjv.exe 1712 5nhbth.exe 2856 1vppp.exe 2568 lfxxxff.exe 2964 thnntn.exe 2760 vpdvj.exe 2612 9frlrll.exe 2260 3nbtbb.exe 1936 pddjv.exe 1792 lxllrrr.exe 1244 thttbt.exe 936 lxlrflr.exe 2432 btbttb.exe 1776 9jddd.exe 2904 frflllx.exe 2944 9ttbhb.exe 2896 dvdvv.exe 1508 7flxxll.exe 2984 bnbbht.exe 684 ddpjp.exe 852 xffxxrx.exe 2368 1btntb.exe 1772 jdvjj.exe 2256 5xllxxf.exe 2448 ttnthn.exe 540 fxllllx.exe 1740 nbhntt.exe 2524 vpdjp.exe 1692 rrllrrf.exe 1732 hbttbb.exe 2516 5nnnbb.exe 2532 vpjpv.exe 2440 1rllrrl.exe 2752 lxrxffx.exe 2864 bhhhth.exe 2720 9dddj.exe 2620 pdpvd.exe 2916 rlxfrrr.exe 2872 xlllxxf.exe 2716 3bttbh.exe 2592 vvppv.exe 660 pjdvd.exe 1032 xxllrrr.exe 1936 5frxffl.exe 1096 ttntbb.exe 552 btbbhh.exe 1816 dvppv.exe 936 lrflxxx.exe 2100 frfffll.exe 1912 bhtnnh.exe 1808 nthhtt.exe 2892 jjpvd.exe 2944 3vppj.exe 348 xrfrlfl.exe 1988 btttbb.exe 2928 bnbbbn.exe 2772 vvpvv.exe 1924 lfrlrlr.exe 2996 xrlrxfr.exe 1744 ttntbb.exe 1532 bbnthh.exe 1728 5pjpp.exe -
resource yara_rule behavioral1/memory/1260-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-1199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-1345-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1260 wrote to memory of 1704 1260 cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe 30 PID 1260 wrote to memory of 1704 1260 cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe 30 PID 1260 wrote to memory of 1704 1260 cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe 30 PID 1260 wrote to memory of 1704 1260 cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe 30 PID 1704 wrote to memory of 2352 1704 pdpjp.exe 31 PID 1704 wrote to memory of 2352 1704 pdpjp.exe 31 PID 1704 wrote to memory of 2352 1704 pdpjp.exe 31 PID 1704 wrote to memory of 2352 1704 pdpjp.exe 31 PID 2352 wrote to memory of 2788 2352 dpvvd.exe 32 PID 2352 wrote to memory of 2788 2352 dpvvd.exe 32 PID 2352 wrote to memory of 2788 2352 dpvvd.exe 32 PID 2352 wrote to memory of 2788 2352 dpvvd.exe 32 PID 2788 wrote to memory of 1712 2788 ppjjv.exe 105 PID 2788 wrote to memory of 1712 2788 ppjjv.exe 105 PID 2788 wrote to memory of 1712 2788 ppjjv.exe 105 PID 2788 wrote to memory of 1712 2788 ppjjv.exe 105 PID 1712 wrote to memory of 2856 1712 5nhbth.exe 34 PID 1712 wrote to memory of 2856 1712 5nhbth.exe 34 PID 1712 wrote to memory of 2856 1712 5nhbth.exe 34 PID 1712 wrote to memory of 2856 1712 5nhbth.exe 34 PID 2856 wrote to memory of 2568 2856 1vppp.exe 35 PID 2856 wrote to memory of 2568 2856 1vppp.exe 35 PID 2856 wrote to memory of 2568 2856 1vppp.exe 35 PID 2856 wrote to memory of 2568 2856 1vppp.exe 35 PID 2568 wrote to memory of 2964 2568 lfxxxff.exe 36 PID 2568 wrote to memory of 2964 2568 lfxxxff.exe 36 PID 2568 wrote to memory of 2964 2568 lfxxxff.exe 36 PID 2568 wrote to memory of 2964 2568 lfxxxff.exe 36 PID 2964 wrote to memory of 2760 2964 thnntn.exe 37 PID 2964 wrote to memory of 2760 2964 thnntn.exe 37 PID 2964 wrote to memory of 2760 2964 thnntn.exe 37 PID 2964 wrote to memory of 2760 2964 thnntn.exe 37 PID 2760 wrote to memory of 2612 2760 vpdvj.exe 113 PID 2760 wrote to memory of 2612 2760 vpdvj.exe 113 PID 2760 wrote to memory of 2612 2760 vpdvj.exe 113 PID 2760 wrote to memory of 2612 2760 vpdvj.exe 113 PID 2612 wrote to memory of 2260 2612 9frlrll.exe 39 PID 2612 wrote to memory of 2260 2612 9frlrll.exe 39 PID 2612 wrote to memory of 2260 2612 9frlrll.exe 39 PID 2612 wrote to memory of 2260 2612 9frlrll.exe 39 PID 2260 wrote to memory of 1936 2260 3nbtbb.exe 75 PID 2260 wrote to memory of 1936 2260 3nbtbb.exe 75 PID 2260 wrote to memory of 1936 2260 3nbtbb.exe 75 PID 2260 wrote to memory of 1936 2260 3nbtbb.exe 75 PID 1936 wrote to memory of 1792 1936 pddjv.exe 41 PID 1936 wrote to memory of 1792 1936 pddjv.exe 41 PID 1936 wrote to memory of 1792 1936 pddjv.exe 41 PID 1936 wrote to memory of 1792 1936 pddjv.exe 41 PID 1792 wrote to memory of 1244 1792 lxllrrr.exe 42 PID 1792 wrote to memory of 1244 1792 lxllrrr.exe 42 PID 1792 wrote to memory of 1244 1792 lxllrrr.exe 42 PID 1792 wrote to memory of 1244 1792 lxllrrr.exe 42 PID 1244 wrote to memory of 936 1244 thttbt.exe 79 PID 1244 wrote to memory of 936 1244 thttbt.exe 79 PID 1244 wrote to memory of 936 1244 thttbt.exe 79 PID 1244 wrote to memory of 936 1244 thttbt.exe 79 PID 936 wrote to memory of 2432 936 lxlrflr.exe 44 PID 936 wrote to memory of 2432 936 lxlrflr.exe 44 PID 936 wrote to memory of 2432 936 lxlrflr.exe 44 PID 936 wrote to memory of 2432 936 lxlrflr.exe 44 PID 2432 wrote to memory of 1776 2432 btbttb.exe 45 PID 2432 wrote to memory of 1776 2432 btbttb.exe 45 PID 2432 wrote to memory of 1776 2432 btbttb.exe 45 PID 2432 wrote to memory of 1776 2432 btbttb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe"C:\Users\Admin\AppData\Local\Temp\cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pdpjp.exec:\pdpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\dpvvd.exec:\dpvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ppjjv.exec:\ppjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\5nhbth.exec:\5nhbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\1vppp.exec:\1vppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lfxxxff.exec:\lfxxxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\thnntn.exec:\thnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vpdvj.exec:\vpdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9frlrll.exec:\9frlrll.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\3nbtbb.exec:\3nbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\pddjv.exec:\pddjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\lxllrrr.exec:\lxllrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\thttbt.exec:\thttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\lxlrflr.exec:\lxlrflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\btbttb.exec:\btbttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\9jddd.exec:\9jddd.exe17⤵
- Executes dropped EXE
PID:1776 -
\??\c:\frflllx.exec:\frflllx.exe18⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9ttbhb.exec:\9ttbhb.exe19⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dvdvv.exec:\dvdvv.exe20⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7flxxll.exec:\7flxxll.exe21⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bnbbht.exec:\bnbbht.exe22⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ddpjp.exec:\ddpjp.exe23⤵
- Executes dropped EXE
PID:684 -
\??\c:\xffxxrx.exec:\xffxxrx.exe24⤵
- Executes dropped EXE
PID:852 -
\??\c:\1btntb.exec:\1btntb.exe25⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jdvjj.exec:\jdvjj.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5xllxxf.exec:\5xllxxf.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ttnthn.exec:\ttnthn.exe28⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fxllllx.exec:\fxllllx.exe29⤵
- Executes dropped EXE
PID:540 -
\??\c:\nbhntt.exec:\nbhntt.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vpdjp.exec:\vpdjp.exe31⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rrllrrf.exec:\rrllrrf.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbttbb.exec:\hbttbb.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5nnnbb.exec:\5nnnbb.exe34⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vpjpv.exec:\vpjpv.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1rllrrl.exec:\1rllrrl.exe36⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lxrxffx.exec:\lxrxffx.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bhhhth.exec:\bhhhth.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9dddj.exec:\9dddj.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pdpvd.exec:\pdpvd.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rlxfrrr.exec:\rlxfrrr.exe41⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xlllxxf.exec:\xlllxxf.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3bttbh.exec:\3bttbh.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vvppv.exec:\vvppv.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pjdvd.exec:\pjdvd.exe45⤵
- Executes dropped EXE
PID:660 -
\??\c:\xxllrrr.exec:\xxllrrr.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5frxffl.exec:\5frxffl.exe47⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ttntbb.exec:\ttntbb.exe48⤵
- Executes dropped EXE
PID:1096 -
\??\c:\btbbhh.exec:\btbbhh.exe49⤵
- Executes dropped EXE
PID:552 -
\??\c:\dvppv.exec:\dvppv.exe50⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lrflxxx.exec:\lrflxxx.exe51⤵
- Executes dropped EXE
PID:936 -
\??\c:\frfffll.exec:\frfffll.exe52⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bhtnnh.exec:\bhtnnh.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nthhtt.exec:\nthhtt.exe54⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jjpvd.exec:\jjpvd.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3vppj.exec:\3vppj.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xrfrlfl.exec:\xrfrlfl.exe57⤵
- Executes dropped EXE
PID:348 -
\??\c:\btttbb.exec:\btttbb.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bnbbbn.exec:\bnbbbn.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vvpvv.exec:\vvpvv.exe60⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe62⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ttntbb.exec:\ttntbb.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bbnthh.exec:\bbnthh.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5pjpp.exec:\5pjpp.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdpjp.exec:\jdpjp.exe66⤵PID:3060
-
\??\c:\rfrxxrf.exec:\rfrxxrf.exe67⤵PID:3056
-
\??\c:\9tnhnh.exec:\9tnhnh.exe68⤵PID:820
-
\??\c:\hhbthn.exec:\hhbthn.exe69⤵PID:1708
-
\??\c:\ddpvd.exec:\ddpvd.exe70⤵PID:2408
-
\??\c:\ffxxxxl.exec:\ffxxxxl.exe71⤵PID:1748
-
\??\c:\xrxxlxr.exec:\xrxxlxr.exe72⤵PID:1680
-
\??\c:\tbtttb.exec:\tbtttb.exe73⤵PID:2172
-
\??\c:\pdjjj.exec:\pdjjj.exe74⤵PID:2124
-
\??\c:\jdppv.exec:\jdppv.exe75⤵PID:2140
-
\??\c:\fxrrffl.exec:\fxrrffl.exe76⤵PID:2832
-
\??\c:\nhhhnn.exec:\nhhhnn.exe77⤵PID:1712
-
\??\c:\7thnth.exec:\7thnth.exe78⤵PID:2236
-
\??\c:\5vpvj.exec:\5vpvj.exe79⤵PID:2712
-
\??\c:\dpdjp.exec:\dpdjp.exe80⤵PID:2780
-
\??\c:\lfrlflr.exec:\lfrlflr.exe81⤵PID:2632
-
\??\c:\bnbbhn.exec:\bnbbhn.exe82⤵PID:2636
-
\??\c:\nhbbhb.exec:\nhbbhb.exe83⤵PID:2668
-
\??\c:\jjdjj.exec:\jjdjj.exe84⤵PID:868
-
\??\c:\3dpvv.exec:\3dpvv.exe85⤵PID:2612
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe86⤵PID:2660
-
\??\c:\rrxlrxf.exec:\rrxlrxf.exe87⤵PID:2640
-
\??\c:\tttbnn.exec:\tttbnn.exe88⤵PID:1788
-
\??\c:\jdvdp.exec:\jdvdp.exe89⤵PID:1468
-
\??\c:\7flfrrx.exec:\7flfrrx.exe90⤵PID:808
-
\??\c:\lxxxlfl.exec:\lxxxlfl.exe91⤵PID:376
-
\??\c:\hbbhnt.exec:\hbbhnt.exe92⤵PID:2500
-
\??\c:\fxrrffx.exec:\fxrrffx.exe93⤵PID:756
-
\??\c:\hthnnn.exec:\hthnnn.exe94⤵PID:1996
-
\??\c:\ppjvd.exec:\ppjvd.exe95⤵PID:1148
-
\??\c:\flxfxfl.exec:\flxfxfl.exe96⤵PID:2684
-
\??\c:\nntbbh.exec:\nntbbh.exe97⤵PID:2936
-
\??\c:\ddjjj.exec:\ddjjj.exe98⤵PID:1676
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe99⤵PID:824
-
\??\c:\xrllrrx.exec:\xrllrrx.exe100⤵PID:1804
-
\??\c:\pdppp.exec:\pdppp.exe101⤵PID:440
-
\??\c:\xfxxlrr.exec:\xfxxlrr.exe102⤵PID:2004
-
\??\c:\5pjpd.exec:\5pjpd.exe103⤵PID:932
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe104⤵PID:2168
-
\??\c:\thnthh.exec:\thnthh.exe105⤵PID:1868
-
\??\c:\jvjpd.exec:\jvjpd.exe106⤵PID:2580
-
\??\c:\7jppd.exec:\7jppd.exe107⤵PID:1928
-
\??\c:\7lxfxfr.exec:\7lxfxfr.exe108⤵PID:1624
-
\??\c:\nthntn.exec:\nthntn.exe109⤵PID:2424
-
\??\c:\vpdjj.exec:\vpdjj.exe110⤵PID:1600
-
\??\c:\fxfrxxl.exec:\fxfrxxl.exe111⤵PID:1800
-
\??\c:\hhhnhn.exec:\hhhnhn.exe112⤵PID:2216
-
\??\c:\vdjvp.exec:\vdjvp.exe113⤵PID:1588
-
\??\c:\ppjpv.exec:\ppjpv.exe114⤵PID:2524
-
\??\c:\rlllrxf.exec:\rlllrxf.exe115⤵PID:1232
-
\??\c:\httttt.exec:\httttt.exe116⤵PID:1704
-
\??\c:\vpvpv.exec:\vpvpv.exe117⤵PID:2744
-
\??\c:\pjvvv.exec:\pjvvv.exe118⤵PID:2288
-
\??\c:\1bnhtt.exec:\1bnhtt.exe119⤵PID:2852
-
\??\c:\vpvvp.exec:\vpvvp.exe120⤵PID:2876
-
\??\c:\vpddj.exec:\vpddj.exe121⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-