Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe
-
Size
453KB
-
MD5
49ffc5ddc1d5920cba2294df033f510a
-
SHA1
73504d05d9a44c5936a7d764ac09f43f33e05916
-
SHA256
0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a
-
SHA512
95ac284fc611f87a1a27ec564d729bef24e6e8f05d3e11342f22526f850f03f4e5d481f303575018d1cfee6642340c0ef14555fde3ad6ff1d91c6f8b52f4f96e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1944-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-84-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2764-93-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1924-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-133-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2848-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-187-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1996-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-643-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2712-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-778-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2184-874-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-975-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 jdjpv.exe 2352 lxlrrrr.exe 864 vpvvd.exe 2268 bnttnt.exe 2700 dpjpv.exe 3012 3lrrlll.exe 2712 1tbttt.exe 2624 lflllrx.exe 2764 1xlfxxr.exe 2616 5vdpp.exe 2160 pjdvd.exe 1924 5tbbhn.exe 596 5thbnn.exe 2952 lrfxfxf.exe 2848 ttntnb.exe 1484 llxrxff.exe 1904 tbtbhn.exe 1028 jpdvj.exe 1996 3lxffxf.exe 576 pjdjv.exe 1864 3rxxrrf.exe 652 bnnhnh.exe 2944 nnbttt.exe 1740 1lrrffr.exe 288 btnntt.exe 1236 thbhhh.exe 1648 fxlfxrx.exe 2420 9bnhnn.exe 1668 vjdvd.exe 1392 lflrxxl.exe 2104 bhbntn.exe 1612 dpppp.exe 2088 3pvvd.exe 1964 7xllllr.exe 1752 ttbnhh.exe 2468 1nbbhh.exe 2740 pdpjj.exe 2704 lxlffxf.exe 2804 bbnnnn.exe 2124 3ntnnn.exe 2712 vjvpd.exe 2796 ppdvj.exe 2660 xlllxxx.exe 2788 5bhtth.exe 1328 3hbnnn.exe 536 dpjpp.exe 1924 xlxxxxr.exe 480 lxlflfl.exe 2932 5nhhbn.exe 2952 7vjjj.exe 2036 ppvpp.exe 2848 lflrfxf.exe 808 xrxxflr.exe 1640 thnntt.exe 1904 ppddj.exe 2452 jvvvd.exe 2156 frffrrx.exe 268 rfffxrf.exe 1488 nttnbh.exe 444 hthbhh.exe 3016 1ddvv.exe 2096 3xlllll.exe 1824 1lrxlrl.exe 352 bthttt.exe -
resource yara_rule behavioral1/memory/1944-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-968-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2212 1944 0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe 30 PID 1944 wrote to memory of 2212 1944 0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe 30 PID 1944 wrote to memory of 2212 1944 0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe 30 PID 1944 wrote to memory of 2212 1944 0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe 30 PID 2212 wrote to memory of 2352 2212 jdjpv.exe 31 PID 2212 wrote to memory of 2352 2212 jdjpv.exe 31 PID 2212 wrote to memory of 2352 2212 jdjpv.exe 31 PID 2212 wrote to memory of 2352 2212 jdjpv.exe 31 PID 2352 wrote to memory of 864 2352 lxlrrrr.exe 32 PID 2352 wrote to memory of 864 2352 lxlrrrr.exe 32 PID 2352 wrote to memory of 864 2352 lxlrrrr.exe 32 PID 2352 wrote to memory of 864 2352 lxlrrrr.exe 32 PID 864 wrote to memory of 2268 864 vpvvd.exe 33 PID 864 wrote to memory of 2268 864 vpvvd.exe 33 PID 864 wrote to memory of 2268 864 vpvvd.exe 33 PID 864 wrote to memory of 2268 864 vpvvd.exe 33 PID 2268 wrote to memory of 2700 2268 bnttnt.exe 34 PID 2268 wrote to memory of 2700 2268 bnttnt.exe 34 PID 2268 wrote to memory of 2700 2268 bnttnt.exe 34 PID 2268 wrote to memory of 2700 2268 bnttnt.exe 34 PID 2700 wrote to memory of 3012 2700 dpjpv.exe 35 PID 2700 wrote to memory of 3012 2700 dpjpv.exe 35 PID 2700 wrote to memory of 3012 2700 dpjpv.exe 35 PID 2700 wrote to memory of 3012 2700 dpjpv.exe 35 PID 3012 wrote to memory of 2712 3012 3lrrlll.exe 36 PID 3012 wrote to memory of 2712 3012 3lrrlll.exe 36 PID 3012 wrote to memory of 2712 3012 3lrrlll.exe 36 PID 3012 wrote to memory of 2712 3012 3lrrlll.exe 36 PID 2712 wrote to memory of 2624 2712 1tbttt.exe 37 PID 2712 wrote to memory of 2624 2712 1tbttt.exe 37 PID 2712 wrote to memory of 2624 2712 1tbttt.exe 37 PID 2712 wrote to memory of 2624 2712 1tbttt.exe 37 PID 2624 wrote to memory of 2764 2624 lflllrx.exe 38 PID 2624 wrote to memory of 2764 2624 lflllrx.exe 38 PID 2624 wrote to memory of 2764 2624 lflllrx.exe 38 PID 2624 wrote to memory of 2764 2624 lflllrx.exe 38 PID 2764 wrote to memory of 2616 2764 1xlfxxr.exe 39 PID 2764 wrote to memory of 2616 2764 1xlfxxr.exe 39 PID 2764 wrote to memory of 2616 2764 1xlfxxr.exe 39 PID 2764 wrote to memory of 2616 2764 1xlfxxr.exe 39 PID 2616 wrote to memory of 2160 2616 5vdpp.exe 40 PID 2616 wrote to memory of 2160 2616 5vdpp.exe 40 PID 2616 wrote to memory of 2160 2616 5vdpp.exe 40 PID 2616 wrote to memory of 2160 2616 5vdpp.exe 40 PID 2160 wrote to memory of 1924 2160 pjdvd.exe 41 PID 2160 wrote to memory of 1924 2160 pjdvd.exe 41 PID 2160 wrote to memory of 1924 2160 pjdvd.exe 41 PID 2160 wrote to memory of 1924 2160 pjdvd.exe 41 PID 1924 wrote to memory of 596 1924 5tbbhn.exe 42 PID 1924 wrote to memory of 596 1924 5tbbhn.exe 42 PID 1924 wrote to memory of 596 1924 5tbbhn.exe 42 PID 1924 wrote to memory of 596 1924 5tbbhn.exe 42 PID 596 wrote to memory of 2952 596 5thbnn.exe 43 PID 596 wrote to memory of 2952 596 5thbnn.exe 43 PID 596 wrote to memory of 2952 596 5thbnn.exe 43 PID 596 wrote to memory of 2952 596 5thbnn.exe 43 PID 2952 wrote to memory of 2848 2952 lrfxfxf.exe 44 PID 2952 wrote to memory of 2848 2952 lrfxfxf.exe 44 PID 2952 wrote to memory of 2848 2952 lrfxfxf.exe 44 PID 2952 wrote to memory of 2848 2952 lrfxfxf.exe 44 PID 2848 wrote to memory of 1484 2848 ttntnb.exe 45 PID 2848 wrote to memory of 1484 2848 ttntnb.exe 45 PID 2848 wrote to memory of 1484 2848 ttntnb.exe 45 PID 2848 wrote to memory of 1484 2848 ttntnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe"C:\Users\Admin\AppData\Local\Temp\0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\jdjpv.exec:\jdjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vpvvd.exec:\vpvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\bnttnt.exec:\bnttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\dpjpv.exec:\dpjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\3lrrlll.exec:\3lrrlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1tbttt.exec:\1tbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\lflllrx.exec:\lflllrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\1xlfxxr.exec:\1xlfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5vdpp.exec:\5vdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pjdvd.exec:\pjdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\5tbbhn.exec:\5tbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\5thbnn.exec:\5thbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\lrfxfxf.exec:\lrfxfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ttntnb.exec:\ttntnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\llxrxff.exec:\llxrxff.exe17⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tbtbhn.exec:\tbtbhn.exe18⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jpdvj.exec:\jpdvj.exe19⤵
- Executes dropped EXE
PID:1028 -
\??\c:\3lxffxf.exec:\3lxffxf.exe20⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pjdjv.exec:\pjdjv.exe21⤵
- Executes dropped EXE
PID:576 -
\??\c:\3rxxrrf.exec:\3rxxrrf.exe22⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bnnhnh.exec:\bnnhnh.exe23⤵
- Executes dropped EXE
PID:652 -
\??\c:\nnbttt.exec:\nnbttt.exe24⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1lrrffr.exec:\1lrrffr.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btnntt.exec:\btnntt.exe26⤵
- Executes dropped EXE
PID:288 -
\??\c:\thbhhh.exec:\thbhhh.exe27⤵
- Executes dropped EXE
PID:1236 -
\??\c:\fxlfxrx.exec:\fxlfxrx.exe28⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9bnhnn.exec:\9bnhnn.exe29⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vjdvd.exec:\vjdvd.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lflrxxl.exec:\lflrxxl.exe31⤵
- Executes dropped EXE
PID:1392 -
\??\c:\bhbntn.exec:\bhbntn.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dpppp.exec:\dpppp.exe33⤵
- Executes dropped EXE
PID:1612 -
\??\c:\3pvvd.exec:\3pvvd.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7xllllr.exec:\7xllllr.exe35⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ttbnhh.exec:\ttbnhh.exe36⤵
- Executes dropped EXE
PID:1752 -
\??\c:\1nbbhh.exec:\1nbbhh.exe37⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pdpjj.exec:\pdpjj.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\lxlffxf.exec:\lxlffxf.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbnnnn.exec:\bbnnnn.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3ntnnn.exec:\3ntnnn.exe41⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vjvpd.exec:\vjvpd.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ppdvj.exec:\ppdvj.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xlllxxx.exec:\xlllxxx.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5bhtth.exec:\5bhtth.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3hbnnn.exec:\3hbnnn.exe46⤵
- Executes dropped EXE
PID:1328 -
\??\c:\dpjpp.exec:\dpjpp.exe47⤵
- Executes dropped EXE
PID:536 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe48⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lxlflfl.exec:\lxlflfl.exe49⤵
- Executes dropped EXE
PID:480 -
\??\c:\5nhhbn.exec:\5nhhbn.exe50⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7vjjj.exec:\7vjjj.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ppvpp.exec:\ppvpp.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lflrfxf.exec:\lflrfxf.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrxxflr.exec:\xrxxflr.exe54⤵
- Executes dropped EXE
PID:808 -
\??\c:\thnntt.exec:\thnntt.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ppddj.exec:\ppddj.exe56⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jvvvd.exec:\jvvvd.exe57⤵
- Executes dropped EXE
PID:2452 -
\??\c:\frffrrx.exec:\frffrrx.exe58⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rfffxrf.exec:\rfffxrf.exe59⤵
- Executes dropped EXE
PID:268 -
\??\c:\nttnbh.exec:\nttnbh.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hthbhh.exec:\hthbhh.exe61⤵
- Executes dropped EXE
PID:444 -
\??\c:\1ddvv.exec:\1ddvv.exe62⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3xlllll.exec:\3xlllll.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1lrxlrl.exec:\1lrxlrl.exe64⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bthttt.exec:\bthttt.exe65⤵
- Executes dropped EXE
PID:352 -
\??\c:\5jdvv.exec:\5jdvv.exe66⤵PID:2992
-
\??\c:\9djdj.exec:\9djdj.exe67⤵PID:1560
-
\??\c:\7xrrrxx.exec:\7xrrrxx.exe68⤵PID:2040
-
\??\c:\lxfflrr.exec:\lxfflrr.exe69⤵PID:2132
-
\??\c:\nhbbnh.exec:\nhbbnh.exe70⤵PID:572
-
\??\c:\pdjvv.exec:\pdjvv.exe71⤵PID:880
-
\??\c:\pvjpp.exec:\pvjpp.exe72⤵PID:1280
-
\??\c:\fxlflll.exec:\fxlflll.exe73⤵PID:1608
-
\??\c:\lffxffx.exec:\lffxffx.exe74⤵PID:2212
-
\??\c:\9nhnhn.exec:\9nhnhn.exe75⤵PID:1628
-
\??\c:\ddpjp.exec:\ddpjp.exe76⤵PID:2188
-
\??\c:\vvvdd.exec:\vvvdd.exe77⤵PID:1980
-
\??\c:\dpddp.exec:\dpddp.exe78⤵PID:2172
-
\??\c:\xrxxflx.exec:\xrxxflx.exe79⤵PID:2724
-
\??\c:\nbhnnt.exec:\nbhnnt.exe80⤵PID:1604
-
\??\c:\1nhnhh.exec:\1nhnhh.exe81⤵PID:2744
-
\??\c:\5jvvv.exec:\5jvvv.exe82⤵PID:2996
-
\??\c:\dpjdj.exec:\dpjdj.exe83⤵PID:2252
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe84⤵PID:2604
-
\??\c:\1rxrxxr.exec:\1rxrxxr.exe85⤵PID:2712
-
\??\c:\1bbtnn.exec:\1bbtnn.exe86⤵PID:2600
-
\??\c:\ttnttt.exec:\ttnttt.exe87⤵PID:2668
-
\??\c:\pvjpj.exec:\pvjpj.exe88⤵PID:1340
-
\??\c:\dpjdp.exec:\dpjdp.exe89⤵PID:680
-
\??\c:\xflfxxl.exec:\xflfxxl.exe90⤵PID:2860
-
\??\c:\lffllll.exec:\lffllll.exe91⤵PID:3068
-
\??\c:\1tnnnh.exec:\1tnnnh.exe92⤵PID:2892
-
\??\c:\9lrrxxx.exec:\9lrrxxx.exe93⤵PID:2780
-
\??\c:\1nbtbt.exec:\1nbtbt.exe94⤵PID:2644
-
\??\c:\7vjpp.exec:\7vjpp.exe95⤵PID:564
-
\??\c:\9rfxxrx.exec:\9rfxxrx.exe96⤵PID:1920
-
\??\c:\tnbhnn.exec:\tnbhnn.exe97⤵PID:1680
-
\??\c:\htbbbt.exec:\htbbbt.exe98⤵PID:1948
-
\??\c:\vjpjj.exec:\vjpjj.exe99⤵PID:2636
-
\??\c:\1xlrrrr.exec:\1xlrrrr.exe100⤵PID:1992
-
\??\c:\lfllrrr.exec:\lfllrrr.exe101⤵PID:1500
-
\??\c:\7tnnnn.exec:\7tnnnn.exe102⤵PID:1768
-
\??\c:\5djpp.exec:\5djpp.exe103⤵PID:2444
-
\??\c:\vjvvd.exec:\vjvvd.exe104⤵PID:1644
-
\??\c:\vjdjp.exec:\vjdjp.exe105⤵PID:652
-
\??\c:\vdppp.exec:\vdppp.exe106⤵PID:3024
-
\??\c:\xrxxffl.exec:\xrxxffl.exe107⤵PID:620
-
\??\c:\1thhnb.exec:\1thhnb.exe108⤵PID:1072
-
\??\c:\ddvdp.exec:\ddvdp.exe109⤵PID:2508
-
\??\c:\llfrfrx.exec:\llfrfrx.exe110⤵PID:1236
-
\??\c:\3ntnnh.exec:\3ntnnh.exe111⤵PID:1656
-
\??\c:\jvjdj.exec:\jvjdj.exe112⤵PID:2564
-
\??\c:\nhnnnn.exec:\nhnnnn.exe113⤵PID:1972
-
\??\c:\jjvvd.exec:\jjvvd.exe114⤵PID:1664
-
\??\c:\pvddj.exec:\pvddj.exe115⤵PID:2204
-
\??\c:\3rlffff.exec:\3rlffff.exe116⤵PID:2044
-
\??\c:\7xlffxf.exec:\7xlffxf.exe117⤵PID:1600
-
\??\c:\hbnhnh.exec:\hbnhnh.exe118⤵PID:1856
-
\??\c:\vvddj.exec:\vvddj.exe119⤵PID:2916
-
\??\c:\pjpvj.exec:\pjpvj.exe120⤵PID:2736
-
\??\c:\5flllll.exec:\5flllll.exe121⤵PID:2184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-