Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe
-
Size
454KB
-
MD5
e1473e5734be6a27bf7f719d14252403
-
SHA1
62da54c9ae9f7e2ff0073fbb5088f63fc1de5cd8
-
SHA256
7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98
-
SHA512
602791707ff71ea3a2463aae4f6fe030ecb0cdfdf0ea155506e0a92388b18a83fda4abae5f0c31f90ea83c3d77a293a7ae39ba4f9eb3d4cbac1e9f19f6dc170d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-116-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/980-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-143-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1424-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-184-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2120-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-273-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2104-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-427-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/700-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-511-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/328-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-518-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2328-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-977-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2700-1069-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-1101-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1720-1194-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 rxlrrrx.exe 776 bnhhbt.exe 2220 pdjdj.exe 2892 pjvvv.exe 2476 frxxllr.exe 2864 9bnhhh.exe 2836 jdjjv.exe 2756 3vjpv.exe 2416 1lxffll.exe 2608 5pddd.exe 2508 xxlrffr.exe 3048 5ntttb.exe 980 jvjjj.exe 1516 nbntht.exe 2132 dpddj.exe 1424 jjdvp.exe 1660 3rlrffl.exe 2028 dvppv.exe 1844 ffrxrrx.exe 2812 nnhbbh.exe 2120 dpjvp.exe 2692 9vjvd.exe 1700 jvjvd.exe 900 htbbhh.exe 1792 3dvvj.exe 696 tttthh.exe 2348 ffrxllf.exe 304 hbthbb.exe 2948 jdvjv.exe 1708 7hthtt.exe 2104 1jjpj.exe 1956 5bntbh.exe 2468 3htbht.exe 2892 rfxxllx.exe 2368 rrlfrrf.exe 2476 bttthn.exe 2964 vdvpp.exe 2852 frfxxxl.exe 684 7tntbn.exe 1148 5thhhh.exe 2808 dvpvj.exe 2624 xxrxxfl.exe 2600 3fxrxxl.exe 2612 tnbbhn.exe 2716 jvjjp.exe 1808 lfxrxfr.exe 1316 lllrxlx.exe 1612 7tnnhh.exe 2004 5vvpv.exe 2164 llfrlrx.exe 2420 9rffrlx.exe 1260 hbbntt.exe 1796 jddjp.exe 1660 jjppj.exe 1784 lfrlrxf.exe 2820 bnthnn.exe 2312 ttnthn.exe 2472 ppjvd.exe 2940 7rllrxl.exe 2692 lxrrfff.exe 840 hbtttb.exe 700 tthhtt.exe 772 pjjpd.exe 2400 xrrrxxl.exe -
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-996-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-1101-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1572-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-1233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-1319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-1344-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xflfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2056 2364 7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe 30 PID 2364 wrote to memory of 2056 2364 7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe 30 PID 2364 wrote to memory of 2056 2364 7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe 30 PID 2364 wrote to memory of 2056 2364 7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe 30 PID 2056 wrote to memory of 776 2056 rxlrrrx.exe 31 PID 2056 wrote to memory of 776 2056 rxlrrrx.exe 31 PID 2056 wrote to memory of 776 2056 rxlrrrx.exe 31 PID 2056 wrote to memory of 776 2056 rxlrrrx.exe 31 PID 776 wrote to memory of 2220 776 bnhhbt.exe 32 PID 776 wrote to memory of 2220 776 bnhhbt.exe 32 PID 776 wrote to memory of 2220 776 bnhhbt.exe 32 PID 776 wrote to memory of 2220 776 bnhhbt.exe 32 PID 2220 wrote to memory of 2892 2220 pdjdj.exe 33 PID 2220 wrote to memory of 2892 2220 pdjdj.exe 33 PID 2220 wrote to memory of 2892 2220 pdjdj.exe 33 PID 2220 wrote to memory of 2892 2220 pdjdj.exe 33 PID 2892 wrote to memory of 2476 2892 pjvvv.exe 34 PID 2892 wrote to memory of 2476 2892 pjvvv.exe 34 PID 2892 wrote to memory of 2476 2892 pjvvv.exe 34 PID 2892 wrote to memory of 2476 2892 pjvvv.exe 34 PID 2476 wrote to memory of 2864 2476 frxxllr.exe 35 PID 2476 wrote to memory of 2864 2476 frxxllr.exe 35 PID 2476 wrote to memory of 2864 2476 frxxllr.exe 35 PID 2476 wrote to memory of 2864 2476 frxxllr.exe 35 PID 2864 wrote to memory of 2836 2864 9bnhhh.exe 36 PID 2864 wrote to memory of 2836 2864 9bnhhh.exe 36 PID 2864 wrote to memory of 2836 2864 9bnhhh.exe 36 PID 2864 wrote to memory of 2836 2864 9bnhhh.exe 36 PID 2836 wrote to memory of 2756 2836 jdjjv.exe 37 PID 2836 wrote to memory of 2756 2836 jdjjv.exe 37 PID 2836 wrote to memory of 2756 2836 jdjjv.exe 37 PID 2836 wrote to memory of 2756 2836 jdjjv.exe 37 PID 2756 wrote to memory of 2416 2756 3vjpv.exe 38 PID 2756 wrote to memory of 2416 2756 3vjpv.exe 38 PID 2756 wrote to memory of 2416 2756 3vjpv.exe 38 PID 2756 wrote to memory of 2416 2756 3vjpv.exe 38 PID 2416 wrote to memory of 2608 2416 1lxffll.exe 39 PID 2416 wrote to memory of 2608 2416 1lxffll.exe 39 PID 2416 wrote to memory of 2608 2416 1lxffll.exe 39 PID 2416 wrote to memory of 2608 2416 1lxffll.exe 39 PID 2608 wrote to memory of 2508 2608 5pddd.exe 40 PID 2608 wrote to memory of 2508 2608 5pddd.exe 40 PID 2608 wrote to memory of 2508 2608 5pddd.exe 40 PID 2608 wrote to memory of 2508 2608 5pddd.exe 40 PID 2508 wrote to memory of 3048 2508 xxlrffr.exe 41 PID 2508 wrote to memory of 3048 2508 xxlrffr.exe 41 PID 2508 wrote to memory of 3048 2508 xxlrffr.exe 41 PID 2508 wrote to memory of 3048 2508 xxlrffr.exe 41 PID 3048 wrote to memory of 980 3048 5ntttb.exe 42 PID 3048 wrote to memory of 980 3048 5ntttb.exe 42 PID 3048 wrote to memory of 980 3048 5ntttb.exe 42 PID 3048 wrote to memory of 980 3048 5ntttb.exe 42 PID 980 wrote to memory of 1516 980 jvjjj.exe 43 PID 980 wrote to memory of 1516 980 jvjjj.exe 43 PID 980 wrote to memory of 1516 980 jvjjj.exe 43 PID 980 wrote to memory of 1516 980 jvjjj.exe 43 PID 1516 wrote to memory of 2132 1516 nbntht.exe 44 PID 1516 wrote to memory of 2132 1516 nbntht.exe 44 PID 1516 wrote to memory of 2132 1516 nbntht.exe 44 PID 1516 wrote to memory of 2132 1516 nbntht.exe 44 PID 2132 wrote to memory of 1424 2132 dpddj.exe 45 PID 2132 wrote to memory of 1424 2132 dpddj.exe 45 PID 2132 wrote to memory of 1424 2132 dpddj.exe 45 PID 2132 wrote to memory of 1424 2132 dpddj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe"C:\Users\Admin\AppData\Local\Temp\7c0dbb445b38c199f4e0b4c1afd77813f2b203c2b1b4db837b1f6d07f01e0a98.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rxlrrrx.exec:\rxlrrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\bnhhbt.exec:\bnhhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\pdjdj.exec:\pdjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\pjvvv.exec:\pjvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\frxxllr.exec:\frxxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\9bnhhh.exec:\9bnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jdjjv.exec:\jdjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\3vjpv.exec:\3vjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1lxffll.exec:\1lxffll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\5pddd.exec:\5pddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xxlrffr.exec:\xxlrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\5ntttb.exec:\5ntttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jvjjj.exec:\jvjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nbntht.exec:\nbntht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\dpddj.exec:\dpddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\jjdvp.exec:\jjdvp.exe17⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3rlrffl.exec:\3rlrffl.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dvppv.exec:\dvppv.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ffrxrrx.exec:\ffrxrrx.exe20⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nnhbbh.exec:\nnhbbh.exe21⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dpjvp.exec:\dpjvp.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9vjvd.exec:\9vjvd.exe23⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jvjvd.exec:\jvjvd.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\htbbhh.exec:\htbbhh.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\3dvvj.exec:\3dvvj.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tttthh.exec:\tttthh.exe27⤵
- Executes dropped EXE
PID:696 -
\??\c:\ffrxllf.exec:\ffrxllf.exe28⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hbthbb.exec:\hbthbb.exe29⤵
- Executes dropped EXE
PID:304 -
\??\c:\jdvjv.exec:\jdvjv.exe30⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7hthtt.exec:\7hthtt.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1jjpj.exec:\1jjpj.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5bntbh.exec:\5bntbh.exe33⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3htbht.exec:\3htbht.exe34⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rfxxllx.exec:\rfxxllx.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bttthn.exec:\bttthn.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vdvpp.exec:\vdvpp.exe38⤵
- Executes dropped EXE
PID:2964 -
\??\c:\frfxxxl.exec:\frfxxxl.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7tntbn.exec:\7tntbn.exe40⤵
- Executes dropped EXE
PID:684 -
\??\c:\5thhhh.exec:\5thhhh.exe41⤵
- Executes dropped EXE
PID:1148 -
\??\c:\dvpvj.exec:\dvpvj.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xxrxxfl.exec:\xxrxxfl.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3fxrxxl.exec:\3fxrxxl.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tnbbhn.exec:\tnbbhn.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jvjjp.exec:\jvjjp.exe46⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfxrxfr.exec:\lfxrxfr.exe47⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lllrxlx.exec:\lllrxlx.exe48⤵
- Executes dropped EXE
PID:1316 -
\??\c:\7tnnhh.exec:\7tnnhh.exe49⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5vvpv.exec:\5vvpv.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\llfrlrx.exec:\llfrlrx.exe51⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9rffrlx.exec:\9rffrlx.exe52⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbbntt.exec:\hbbntt.exe53⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jddjp.exec:\jddjp.exe54⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jjppj.exec:\jjppj.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lfrlrxf.exec:\lfrlrxf.exe56⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bnthnn.exec:\bnthnn.exe57⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ttnthn.exec:\ttnthn.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ppjvd.exec:\ppjvd.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7rllrxl.exec:\7rllrxl.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lxrrfff.exec:\lxrrfff.exe61⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbtttb.exec:\hbtttb.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\tthhtt.exec:\tthhtt.exe63⤵
- Executes dropped EXE
PID:700 -
\??\c:\pjjpd.exec:\pjjpd.exe64⤵
- Executes dropped EXE
PID:772 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7hbhhb.exec:\7hbhhb.exe66⤵PID:1544
-
\??\c:\ntnbnt.exec:\ntnbnt.exe67⤵PID:2228
-
\??\c:\3pdvd.exec:\3pdvd.exe68⤵PID:328
-
\??\c:\lfffrxl.exec:\lfffrxl.exe69⤵PID:1836
-
\??\c:\hhbttb.exec:\hhbttb.exe70⤵PID:1040
-
\??\c:\hthbtt.exec:\hthbtt.exe71⤵PID:2364
-
\??\c:\5dvvj.exec:\5dvvj.exe72⤵PID:2308
-
\??\c:\5xrxxxf.exec:\5xrxxxf.exe73⤵PID:988
-
\??\c:\llffrxl.exec:\llffrxl.exe74⤵PID:1956
-
\??\c:\tnnhtt.exec:\tnnhtt.exe75⤵PID:2484
-
\??\c:\1ddpv.exec:\1ddpv.exe76⤵PID:1628
-
\??\c:\pdpvj.exec:\pdpvj.exe77⤵PID:2284
-
\??\c:\1xrrxxf.exec:\1xrrxxf.exe78⤵PID:2748
-
\??\c:\ttnntt.exec:\ttnntt.exe79⤵PID:2744
-
\??\c:\thbhnn.exec:\thbhnn.exe80⤵PID:2456
-
\??\c:\djvdv.exec:\djvdv.exe81⤵PID:2804
-
\??\c:\xrfrflx.exec:\xrfrflx.exe82⤵PID:2208
-
\??\c:\bthtbh.exec:\bthtbh.exe83⤵PID:2880
-
\??\c:\nhbtbb.exec:\nhbtbb.exe84⤵PID:2768
-
\??\c:\dvvdj.exec:\dvvdj.exe85⤵PID:2648
-
\??\c:\dpdpj.exec:\dpdpj.exe86⤵PID:2188
-
\??\c:\lfxflrf.exec:\lfxflrf.exe87⤵PID:2224
-
\??\c:\1nhntb.exec:\1nhntb.exe88⤵PID:108
-
\??\c:\vvjjp.exec:\vvjjp.exe89⤵PID:1932
-
\??\c:\vpjpv.exec:\vpjpv.exe90⤵PID:1316
-
\??\c:\9rfxflr.exec:\9rfxflr.exe91⤵PID:1392
-
\??\c:\nbnnth.exec:\nbnnth.exe92⤵PID:1584
-
\??\c:\3jvvv.exec:\3jvvv.exe93⤵PID:1764
-
\??\c:\1dvvd.exec:\1dvvd.exe94⤵PID:1324
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe95⤵PID:112
-
\??\c:\btnbhn.exec:\btnbhn.exe96⤵PID:2028
-
\??\c:\tnhtnn.exec:\tnhtnn.exe97⤵PID:760
-
\??\c:\vvpvd.exec:\vvpvd.exe98⤵PID:1044
-
\??\c:\5xrrllr.exec:\5xrrllr.exe99⤵PID:2192
-
\??\c:\xrfrlxf.exec:\xrfrlxf.exe100⤵PID:3060
-
\??\c:\nnbnbh.exec:\nnbnbh.exe101⤵PID:2440
-
\??\c:\3pjjd.exec:\3pjjd.exe102⤵PID:308
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe103⤵PID:1540
-
\??\c:\fxrrlxr.exec:\fxrrlxr.exe104⤵PID:2376
-
\??\c:\nbbbnt.exec:\nbbbnt.exe105⤵PID:2236
-
\??\c:\vppvd.exec:\vppvd.exe106⤵PID:2960
-
\??\c:\ppppd.exec:\ppppd.exe107⤵PID:1884
-
\??\c:\xrffxrf.exec:\xrffxrf.exe108⤵PID:2348
-
\??\c:\nhnttt.exec:\nhnttt.exe109⤵PID:1048
-
\??\c:\thttbb.exec:\thttbb.exe110⤵PID:892
-
\??\c:\vvvjj.exec:\vvvjj.exe111⤵PID:1812
-
\??\c:\xrxxrlr.exec:\xrxxrlr.exe112⤵PID:2304
-
\??\c:\flfrlfr.exec:\flfrlfr.exe113⤵PID:2364
-
\??\c:\ntthnt.exec:\ntthnt.exe114⤵PID:2944
-
\??\c:\9nnhnb.exec:\9nnhnb.exe115⤵PID:2328
-
\??\c:\5dddd.exec:\5dddd.exe116⤵PID:1992
-
\??\c:\3rlxfrf.exec:\3rlxfrf.exe117⤵PID:1596
-
\??\c:\htttbh.exec:\htttbh.exe118⤵PID:2856
-
\??\c:\tnhthn.exec:\tnhthn.exe119⤵PID:2724
-
\??\c:\jvddv.exec:\jvddv.exe120⤵PID:2728
-
\??\c:\rrllrxl.exec:\rrllrxl.exe121⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-