Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe
-
Size
455KB
-
MD5
ffbd551f4f4908b273d99f7fba1530a0
-
SHA1
5676726e87e07e574d9f7818ef12ef1de3997f53
-
SHA256
8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070fae
-
SHA512
9adaf6f6f31f2f04d2cb8e452a9d51f018c458eaac8326c49a8139fa2f9620f14208087c78c0f6d066225608500a9c99b4a79d4f43f6e7c2fa72224d5b559929
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/328-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-35-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2248-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-63-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2720-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1984-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1512-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-148-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2752-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-54-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2524-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-827-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2928-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-1079-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2268-1291-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1076-1323-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 1xxfxxr.exe 2056 3tnntb.exe 1668 1hbhhn.exe 2248 fxrfrxr.exe 2672 7bnttb.exe 2720 dvppd.exe 2952 fxrrffr.exe 2588 hbbbnn.exe 2824 3jddd.exe 2752 pdvpp.exe 2596 3bnttb.exe 2872 jpddp.exe 1708 hhbnhh.exe 1984 tnbbnn.exe 884 pjddj.exe 1208 9nhhhh.exe 1880 dpjpd.exe 1936 9rxfxrx.exe 2840 hhthtb.exe 2784 ttttbt.exe 2184 pjvjp.exe 2468 3fxxrxf.exe 916 vpdvv.exe 2960 9xflflf.exe 1504 fxxlxfl.exe 2276 jdddj.exe 2100 1rflxlf.exe 2204 thnttb.exe 2324 rfrrxfl.exe 2028 3nbnth.exe 2064 pvpdd.exe 1512 1jjpv.exe 1228 1xllrff.exe 2548 nnhntb.exe 2080 pdppd.exe 2520 lllfxfr.exe 2088 ddpvd.exe 2732 9xrxxxl.exe 2776 xfrrxfl.exe 2688 hthnbb.exe 2888 1dpvv.exe 2940 rlrflrl.exe 2740 hhbhtb.exe 2700 5vpvv.exe 3016 lxrfxlx.exe 2580 hnhtth.exe 648 thnbbb.exe 1544 ppppv.exe 2624 3llrxrx.exe 1464 nbtnbt.exe 1712 nbntbb.exe 1428 pjjjd.exe 2140 frlrffl.exe 1268 nnbntn.exe 2904 vvjjv.exe 2756 1pjdj.exe 532 ffxxffx.exe 2060 ttntbb.exe 2432 nhbbbb.exe 1100 dvvvj.exe 2828 xrflrfr.exe 892 1bttbb.exe 776 pjdpj.exe 904 dpjdd.exe -
resource yara_rule behavioral1/memory/2524-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-777-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1412-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-841-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2088-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-1012-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-1079-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1864-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-1131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-1253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-1284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-1292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-1323-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 328 wrote to memory of 2524 328 8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe 30 PID 328 wrote to memory of 2524 328 8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe 30 PID 328 wrote to memory of 2524 328 8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe 30 PID 328 wrote to memory of 2524 328 8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe 30 PID 2524 wrote to memory of 2056 2524 1xxfxxr.exe 31 PID 2524 wrote to memory of 2056 2524 1xxfxxr.exe 31 PID 2524 wrote to memory of 2056 2524 1xxfxxr.exe 31 PID 2524 wrote to memory of 2056 2524 1xxfxxr.exe 31 PID 2056 wrote to memory of 1668 2056 3tnntb.exe 32 PID 2056 wrote to memory of 1668 2056 3tnntb.exe 32 PID 2056 wrote to memory of 1668 2056 3tnntb.exe 32 PID 2056 wrote to memory of 1668 2056 3tnntb.exe 32 PID 1668 wrote to memory of 2248 1668 1hbhhn.exe 33 PID 1668 wrote to memory of 2248 1668 1hbhhn.exe 33 PID 1668 wrote to memory of 2248 1668 1hbhhn.exe 33 PID 1668 wrote to memory of 2248 1668 1hbhhn.exe 33 PID 2248 wrote to memory of 2672 2248 fxrfrxr.exe 34 PID 2248 wrote to memory of 2672 2248 fxrfrxr.exe 34 PID 2248 wrote to memory of 2672 2248 fxrfrxr.exe 34 PID 2248 wrote to memory of 2672 2248 fxrfrxr.exe 34 PID 2672 wrote to memory of 2720 2672 7bnttb.exe 35 PID 2672 wrote to memory of 2720 2672 7bnttb.exe 35 PID 2672 wrote to memory of 2720 2672 7bnttb.exe 35 PID 2672 wrote to memory of 2720 2672 7bnttb.exe 35 PID 2720 wrote to memory of 2952 2720 dvppd.exe 36 PID 2720 wrote to memory of 2952 2720 dvppd.exe 36 PID 2720 wrote to memory of 2952 2720 dvppd.exe 36 PID 2720 wrote to memory of 2952 2720 dvppd.exe 36 PID 2952 wrote to memory of 2588 2952 fxrrffr.exe 37 PID 2952 wrote to memory of 2588 2952 fxrrffr.exe 37 PID 2952 wrote to memory of 2588 2952 fxrrffr.exe 37 PID 2952 wrote to memory of 2588 2952 fxrrffr.exe 37 PID 2588 wrote to memory of 2824 2588 hbbbnn.exe 38 PID 2588 wrote to memory of 2824 2588 hbbbnn.exe 38 PID 2588 wrote to memory of 2824 2588 hbbbnn.exe 38 PID 2588 wrote to memory of 2824 2588 hbbbnn.exe 38 PID 2824 wrote to memory of 2752 2824 3jddd.exe 39 PID 2824 wrote to memory of 2752 2824 3jddd.exe 39 PID 2824 wrote to memory of 2752 2824 3jddd.exe 39 PID 2824 wrote to memory of 2752 2824 3jddd.exe 39 PID 2752 wrote to memory of 2596 2752 pdvpp.exe 40 PID 2752 wrote to memory of 2596 2752 pdvpp.exe 40 PID 2752 wrote to memory of 2596 2752 pdvpp.exe 40 PID 2752 wrote to memory of 2596 2752 pdvpp.exe 40 PID 2596 wrote to memory of 2872 2596 3bnttb.exe 41 PID 2596 wrote to memory of 2872 2596 3bnttb.exe 41 PID 2596 wrote to memory of 2872 2596 3bnttb.exe 41 PID 2596 wrote to memory of 2872 2596 3bnttb.exe 41 PID 2872 wrote to memory of 1708 2872 jpddp.exe 42 PID 2872 wrote to memory of 1708 2872 jpddp.exe 42 PID 2872 wrote to memory of 1708 2872 jpddp.exe 42 PID 2872 wrote to memory of 1708 2872 jpddp.exe 42 PID 1708 wrote to memory of 1984 1708 hhbnhh.exe 43 PID 1708 wrote to memory of 1984 1708 hhbnhh.exe 43 PID 1708 wrote to memory of 1984 1708 hhbnhh.exe 43 PID 1708 wrote to memory of 1984 1708 hhbnhh.exe 43 PID 1984 wrote to memory of 884 1984 tnbbnn.exe 44 PID 1984 wrote to memory of 884 1984 tnbbnn.exe 44 PID 1984 wrote to memory of 884 1984 tnbbnn.exe 44 PID 1984 wrote to memory of 884 1984 tnbbnn.exe 44 PID 884 wrote to memory of 1208 884 pjddj.exe 45 PID 884 wrote to memory of 1208 884 pjddj.exe 45 PID 884 wrote to memory of 1208 884 pjddj.exe 45 PID 884 wrote to memory of 1208 884 pjddj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe"C:\Users\Admin\AppData\Local\Temp\8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\1xxfxxr.exec:\1xxfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3tnntb.exec:\3tnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\1hbhhn.exec:\1hbhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\7bnttb.exec:\7bnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\dvppd.exec:\dvppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\fxrrffr.exec:\fxrrffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hbbbnn.exec:\hbbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\3jddd.exec:\3jddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pdvpp.exec:\pdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3bnttb.exec:\3bnttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jpddp.exec:\jpddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hhbnhh.exec:\hhbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\tnbbnn.exec:\tnbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\pjddj.exec:\pjddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\9nhhhh.exec:\9nhhhh.exe17⤵
- Executes dropped EXE
PID:1208 -
\??\c:\dpjpd.exec:\dpjpd.exe18⤵
- Executes dropped EXE
PID:1880 -
\??\c:\9rxfxrx.exec:\9rxfxrx.exe19⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hhthtb.exec:\hhthtb.exe20⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ttttbt.exec:\ttttbt.exe21⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjvjp.exec:\pjvjp.exe22⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3fxxrxf.exec:\3fxxrxf.exe23⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vpdvv.exec:\vpdvv.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\9xflflf.exec:\9xflflf.exe25⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fxxlxfl.exec:\fxxlxfl.exe26⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jdddj.exec:\jdddj.exe27⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1rflxlf.exec:\1rflxlf.exe28⤵
- Executes dropped EXE
PID:2100 -
\??\c:\thnttb.exec:\thnttb.exe29⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3nbnth.exec:\3nbnth.exe31⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pvpdd.exec:\pvpdd.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1jjpv.exec:\1jjpv.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\1xllrff.exec:\1xllrff.exe34⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nnhntb.exec:\nnhntb.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pdppd.exec:\pdppd.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lllfxfr.exec:\lllfxfr.exe37⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ddpvd.exec:\ddpvd.exe38⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9xrxxxl.exec:\9xrxxxl.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hthnbb.exec:\hthnbb.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1dpvv.exec:\1dpvv.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlrflrl.exec:\rlrflrl.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hhbhtb.exec:\hhbhtb.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5vpvv.exec:\5vpvv.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lxrfxlx.exec:\lxrfxlx.exe46⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hnhtth.exec:\hnhtth.exe47⤵
- Executes dropped EXE
PID:2580 -
\??\c:\thnbbb.exec:\thnbbb.exe48⤵
- Executes dropped EXE
PID:648 -
\??\c:\ppppv.exec:\ppppv.exe49⤵
- Executes dropped EXE
PID:1544 -
\??\c:\3llrxrx.exec:\3llrxrx.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbtnbt.exec:\nbtnbt.exe51⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nbntbb.exec:\nbntbb.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pjjjd.exec:\pjjjd.exe53⤵
- Executes dropped EXE
PID:1428 -
\??\c:\frlrffl.exec:\frlrffl.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nnbntn.exec:\nnbntn.exe55⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vvjjv.exec:\vvjjv.exe56⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1pjdj.exec:\1pjdj.exe57⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ffxxffx.exec:\ffxxffx.exe58⤵
- Executes dropped EXE
PID:532 -
\??\c:\ttntbb.exec:\ttntbb.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nhbbbb.exec:\nhbbbb.exe60⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvvvj.exec:\dvvvj.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrflrfr.exec:\xrflrfr.exe62⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1bttbb.exec:\1bttbb.exe63⤵
- Executes dropped EXE
PID:892 -
\??\c:\pjdpj.exec:\pjdpj.exe64⤵
- Executes dropped EXE
PID:776 -
\??\c:\dpjdd.exec:\dpjdd.exe65⤵
- Executes dropped EXE
PID:904 -
\??\c:\rffrlfr.exec:\rffrlfr.exe66⤵PID:1976
-
\??\c:\bnnhhh.exec:\bnnhhh.exe67⤵PID:2272
-
\??\c:\djvdd.exec:\djvdd.exe68⤵PID:2944
-
\??\c:\vdpjd.exec:\vdpjd.exe69⤵PID:2280
-
\??\c:\9rrfllr.exec:\9rrfllr.exe70⤵PID:1896
-
\??\c:\frrxxxx.exec:\frrxxxx.exe71⤵PID:2324
-
\??\c:\nbntbb.exec:\nbntbb.exe72⤵PID:2028
-
\??\c:\7pjjd.exec:\7pjjd.exe73⤵PID:2064
-
\??\c:\xrlflfl.exec:\xrlflfl.exe74⤵PID:2492
-
\??\c:\lxlllrl.exec:\lxlllrl.exe75⤵PID:2552
-
\??\c:\thtttt.exec:\thtttt.exe76⤵PID:2116
-
\??\c:\jppdd.exec:\jppdd.exe77⤵PID:2248
-
\??\c:\5xrrrlr.exec:\5xrrrlr.exe78⤵PID:2016
-
\??\c:\5hbnnt.exec:\5hbnnt.exe79⤵PID:1728
-
\??\c:\jvjdv.exec:\jvjdv.exe80⤵PID:2344
-
\??\c:\fxlxxrf.exec:\fxlxxrf.exe81⤵PID:2704
-
\??\c:\llffrxl.exec:\llffrxl.exe82⤵PID:2712
-
\??\c:\tttbnn.exec:\tttbnn.exe83⤵PID:2588
-
\??\c:\1jvdj.exec:\1jvdj.exe84⤵
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\dpvpp.exec:\dpvpp.exe85⤵PID:2868
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe86⤵PID:2940
-
\??\c:\nbnhnn.exec:\nbnhnn.exe87⤵PID:2740
-
\??\c:\5htbhn.exec:\5htbhn.exe88⤵PID:2700
-
\??\c:\jpdvv.exec:\jpdvv.exe89⤵PID:1160
-
\??\c:\rxlxrlr.exec:\rxlxrlr.exe90⤵PID:2384
-
\??\c:\rfrrrlr.exec:\rfrrrlr.exe91⤵PID:1300
-
\??\c:\9btbbh.exec:\9btbbh.exe92⤵PID:1844
-
\??\c:\btbhtb.exec:\btbhtb.exe93⤵PID:3012
-
\??\c:\dpppv.exec:\dpppv.exe94⤵PID:1636
-
\??\c:\rfrlffl.exec:\rfrlffl.exe95⤵PID:1808
-
\??\c:\bbbbnn.exec:\bbbbnn.exe96⤵PID:1948
-
\??\c:\nnnhbn.exec:\nnnhbn.exe97⤵PID:1196
-
\??\c:\pjvdv.exec:\pjvdv.exe98⤵PID:2040
-
\??\c:\frflllx.exec:\frflllx.exe99⤵PID:1672
-
\??\c:\rlffrrx.exec:\rlffrrx.exe100⤵PID:2472
-
\??\c:\3tnthh.exec:\3tnthh.exe101⤵PID:1072
-
\??\c:\jvjjj.exec:\jvjjj.exe102⤵PID:1732
-
\??\c:\7frxxll.exec:\7frxxll.exe103⤵PID:444
-
\??\c:\7thbhn.exec:\7thbhn.exe104⤵PID:1100
-
\??\c:\hhbtth.exec:\hhbtth.exe105⤵PID:1648
-
\??\c:\vppjj.exec:\vppjj.exe106⤵PID:632
-
\??\c:\lflfrxf.exec:\lflfrxf.exe107⤵PID:2404
-
\??\c:\5tnhnn.exec:\5tnhnn.exe108⤵PID:2412
-
\??\c:\dpddd.exec:\dpddd.exe109⤵PID:2240
-
\??\c:\dpdvj.exec:\dpdvj.exe110⤵PID:2156
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe111⤵PID:1412
-
\??\c:\llxflrr.exec:\llxflrr.exe112⤵PID:2364
-
\??\c:\nbtthh.exec:\nbtthh.exe113⤵PID:2996
-
\??\c:\vpddj.exec:\vpddj.exe114⤵PID:2068
-
\??\c:\dvpvj.exec:\dvpvj.exe115⤵PID:1512
-
\??\c:\lxffrrx.exec:\lxffrrx.exe116⤵PID:2928
-
\??\c:\nntnnt.exec:\nntnnt.exe117⤵PID:880
-
\??\c:\7ttbbb.exec:\7ttbbb.exe118⤵PID:956
-
\??\c:\5rrrrrx.exec:\5rrrrrx.exe119⤵PID:1980
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe120⤵PID:2816
-
\??\c:\nbnhnn.exec:\nbnhnn.exe121⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-