Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe
-
Size
453KB
-
MD5
1f2a727f70d9dd22ed42f519a1b13b45
-
SHA1
22994df526fb5d83064e1489608ffba7746050e8
-
SHA256
e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f
-
SHA512
111c36b813438fcf1189559bab1bd880821bd2ea73637adc96bcd513f1a1ae8dcd191639a0340fa139ec4d5b1ee262cdbdb9907f2e64bd03218d7f7271a43430
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/3004-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-27-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-39-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2820-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-54-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2828-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-87-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1348-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1556-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-189-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2372-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-203-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2020-240-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/768-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-441-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-506-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-536-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-569-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1728-576-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-652-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-742-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2220-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-830-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/872-844-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3028-1041-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1532-1048-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/896-1087-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2292-1101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-1159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-1258-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/1724-1275-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3068 ddvdp.exe 2092 3xlrxxx.exe 2464 ffxlrrf.exe 2132 tnbtnt.exe 2820 tthhnb.exe 2828 bbbtnn.exe 2708 tnhntb.exe 2728 tnbhnt.exe 2588 xxflflx.exe 3036 tnbbhb.exe 2120 3htntt.exe 2660 7vdjp.exe 1992 bbbnbn.exe 1620 pjdjp.exe 976 hhtthb.exe 1348 ppjvj.exe 1556 fxllrxl.exe 2904 pjpvj.exe 1464 fxlrxxf.exe 2372 jjjvd.exe 2144 1hbbht.exe 1392 jdvdj.exe 1784 llxfrlf.exe 2224 3vvdv.exe 2020 7tbthb.exe 1460 djpjj.exe 2472 hnnhtb.exe 2512 ntbtht.exe 768 xxxrxfr.exe 1544 nttbtn.exe 1424 vvvdp.exe 3016 lrrxrfl.exe 1508 hhhnht.exe 2524 vvdpp.exe 3068 llffrlx.exe 2092 5ttbtb.exe 2424 ddvpp.exe 1900 5djvv.exe 2808 fflxlrf.exe 2956 hnnnbh.exe 2600 3nhtbn.exe 2860 3jjvp.exe 1652 frrflrf.exe 2704 1xxrfxl.exe 2612 bbhtnb.exe 3040 vdjpj.exe 2168 fllrxfx.exe 2000 lxxllfx.exe 2120 tbthth.exe 2116 dvppd.exe 2652 ffflflf.exe 2340 bttthn.exe 1620 5hhthn.exe 1584 3ppvd.exe 1572 5xrxllf.exe 2932 3rrrflf.exe 1556 btnbnt.exe 492 9pjpv.exe 2212 rxrrflf.exe 2352 3lflxfl.exe 2372 tttnhb.exe 2144 ddpvd.exe 952 3djpj.exe 2008 3llxlxl.exe -
resource yara_rule behavioral1/memory/3004-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-87-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2728-85-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3036-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-161-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1556-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-441-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2212-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-506-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1712-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-536-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3008-569-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1932-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-643-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2604-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-830-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1188-836-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2684-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-1055-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2292-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-1159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-1214-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 3068 3004 e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe 30 PID 3004 wrote to memory of 3068 3004 e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe 30 PID 3004 wrote to memory of 3068 3004 e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe 30 PID 3004 wrote to memory of 3068 3004 e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe 30 PID 3068 wrote to memory of 2092 3068 ddvdp.exe 31 PID 3068 wrote to memory of 2092 3068 ddvdp.exe 31 PID 3068 wrote to memory of 2092 3068 ddvdp.exe 31 PID 3068 wrote to memory of 2092 3068 ddvdp.exe 31 PID 2092 wrote to memory of 2464 2092 3xlrxxx.exe 32 PID 2092 wrote to memory of 2464 2092 3xlrxxx.exe 32 PID 2092 wrote to memory of 2464 2092 3xlrxxx.exe 32 PID 2092 wrote to memory of 2464 2092 3xlrxxx.exe 32 PID 2464 wrote to memory of 2132 2464 ffxlrrf.exe 33 PID 2464 wrote to memory of 2132 2464 ffxlrrf.exe 33 PID 2464 wrote to memory of 2132 2464 ffxlrrf.exe 33 PID 2464 wrote to memory of 2132 2464 ffxlrrf.exe 33 PID 2132 wrote to memory of 2820 2132 tnbtnt.exe 34 PID 2132 wrote to memory of 2820 2132 tnbtnt.exe 34 PID 2132 wrote to memory of 2820 2132 tnbtnt.exe 34 PID 2132 wrote to memory of 2820 2132 tnbtnt.exe 34 PID 2820 wrote to memory of 2828 2820 tthhnb.exe 35 PID 2820 wrote to memory of 2828 2820 tthhnb.exe 35 PID 2820 wrote to memory of 2828 2820 tthhnb.exe 35 PID 2820 wrote to memory of 2828 2820 tthhnb.exe 35 PID 2828 wrote to memory of 2708 2828 bbbtnn.exe 36 PID 2828 wrote to memory of 2708 2828 bbbtnn.exe 36 PID 2828 wrote to memory of 2708 2828 bbbtnn.exe 36 PID 2828 wrote to memory of 2708 2828 bbbtnn.exe 36 PID 2708 wrote to memory of 2728 2708 tnhntb.exe 37 PID 2708 wrote to memory of 2728 2708 tnhntb.exe 37 PID 2708 wrote to memory of 2728 2708 tnhntb.exe 37 PID 2708 wrote to memory of 2728 2708 tnhntb.exe 37 PID 2728 wrote to memory of 2588 2728 tnbhnt.exe 38 PID 2728 wrote to memory of 2588 2728 tnbhnt.exe 38 PID 2728 wrote to memory of 2588 2728 tnbhnt.exe 38 PID 2728 wrote to memory of 2588 2728 tnbhnt.exe 38 PID 2588 wrote to memory of 3036 2588 xxflflx.exe 39 PID 2588 wrote to memory of 3036 2588 xxflflx.exe 39 PID 2588 wrote to memory of 3036 2588 xxflflx.exe 39 PID 2588 wrote to memory of 3036 2588 xxflflx.exe 39 PID 3036 wrote to memory of 2120 3036 tnbbhb.exe 40 PID 3036 wrote to memory of 2120 3036 tnbbhb.exe 40 PID 3036 wrote to memory of 2120 3036 tnbbhb.exe 40 PID 3036 wrote to memory of 2120 3036 tnbbhb.exe 40 PID 2120 wrote to memory of 2660 2120 3htntt.exe 41 PID 2120 wrote to memory of 2660 2120 3htntt.exe 41 PID 2120 wrote to memory of 2660 2120 3htntt.exe 41 PID 2120 wrote to memory of 2660 2120 3htntt.exe 41 PID 2660 wrote to memory of 1992 2660 7vdjp.exe 42 PID 2660 wrote to memory of 1992 2660 7vdjp.exe 42 PID 2660 wrote to memory of 1992 2660 7vdjp.exe 42 PID 2660 wrote to memory of 1992 2660 7vdjp.exe 42 PID 1992 wrote to memory of 1620 1992 bbbnbn.exe 43 PID 1992 wrote to memory of 1620 1992 bbbnbn.exe 43 PID 1992 wrote to memory of 1620 1992 bbbnbn.exe 43 PID 1992 wrote to memory of 1620 1992 bbbnbn.exe 43 PID 1620 wrote to memory of 976 1620 pjdjp.exe 44 PID 1620 wrote to memory of 976 1620 pjdjp.exe 44 PID 1620 wrote to memory of 976 1620 pjdjp.exe 44 PID 1620 wrote to memory of 976 1620 pjdjp.exe 44 PID 976 wrote to memory of 1348 976 hhtthb.exe 45 PID 976 wrote to memory of 1348 976 hhtthb.exe 45 PID 976 wrote to memory of 1348 976 hhtthb.exe 45 PID 976 wrote to memory of 1348 976 hhtthb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe"C:\Users\Admin\AppData\Local\Temp\e72a51c9f629ad22df9d871b1f2b2475f7e9dfb2edb88fa80a6239f3bfd8840f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\ddvdp.exec:\ddvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\3xlrxxx.exec:\3xlrxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\ffxlrrf.exec:\ffxlrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\tnbtnt.exec:\tnbtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\tthhnb.exec:\tthhnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bbbtnn.exec:\bbbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\tnhntb.exec:\tnhntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\tnbhnt.exec:\tnbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xxflflx.exec:\xxflflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tnbbhb.exec:\tnbbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\3htntt.exec:\3htntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\7vdjp.exec:\7vdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bbbnbn.exec:\bbbnbn.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pjdjp.exec:\pjdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hhtthb.exec:\hhtthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\ppjvj.exec:\ppjvj.exe17⤵
- Executes dropped EXE
PID:1348 -
\??\c:\fxllrxl.exec:\fxllrxl.exe18⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pjpvj.exec:\pjpvj.exe19⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe20⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jjjvd.exec:\jjjvd.exe21⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1hbbht.exec:\1hbbht.exe22⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jdvdj.exec:\jdvdj.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\llxfrlf.exec:\llxfrlf.exe24⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3vvdv.exec:\3vvdv.exe25⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7tbthb.exec:\7tbthb.exe26⤵
- Executes dropped EXE
PID:2020 -
\??\c:\djpjj.exec:\djpjj.exe27⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hnnhtb.exec:\hnnhtb.exe28⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ntbtht.exec:\ntbtht.exe29⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xxxrxfr.exec:\xxxrxfr.exe30⤵
- Executes dropped EXE
PID:768 -
\??\c:\nttbtn.exec:\nttbtn.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vvvdp.exec:\vvvdp.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lrrxrfl.exec:\lrrxrfl.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhhnht.exec:\hhhnht.exe34⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vvdpp.exec:\vvdpp.exe35⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llffrlx.exec:\llffrlx.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5ttbtb.exec:\5ttbtb.exe37⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ddvpp.exec:\ddvpp.exe38⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5djvv.exec:\5djvv.exe39⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fflxlrf.exec:\fflxlrf.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hnnnbh.exec:\hnnnbh.exe41⤵
- Executes dropped EXE
PID:2956 -
\??\c:\3nhtbn.exec:\3nhtbn.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3jjvp.exec:\3jjvp.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\frrflrf.exec:\frrflrf.exe44⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1xxrfxl.exec:\1xxrfxl.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbhtnb.exec:\bbhtnb.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vdjpj.exec:\vdjpj.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fllrxfx.exec:\fllrxfx.exe48⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lxxllfx.exec:\lxxllfx.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tbthth.exec:\tbthth.exe50⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dvppd.exec:\dvppd.exe51⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ffflflf.exec:\ffflflf.exe52⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bttthn.exec:\bttthn.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5hhthn.exec:\5hhthn.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3ppvd.exec:\3ppvd.exe55⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5xrxllf.exec:\5xrxllf.exe56⤵
- Executes dropped EXE
PID:1572 -
\??\c:\3rrrflf.exec:\3rrrflf.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\btnbnt.exec:\btnbnt.exe58⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9pjpv.exec:\9pjpv.exe59⤵
- Executes dropped EXE
PID:492 -
\??\c:\rxrrflf.exec:\rxrrflf.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3lflxfl.exec:\3lflxfl.exe61⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tttnhb.exec:\tttnhb.exe62⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ddpvd.exec:\ddpvd.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\3djpj.exec:\3djpj.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\3llxlxl.exec:\3llxlxl.exe65⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ttthtb.exec:\ttthtb.exe66⤵PID:1712
-
\??\c:\pjvvj.exec:\pjvvj.exe67⤵PID:1940
-
\??\c:\7rrxxxx.exec:\7rrxxxx.exe68⤵PID:896
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe69⤵PID:864
-
\??\c:\nbbbnb.exec:\nbbbnb.exe70⤵PID:2052
-
\??\c:\1vpvd.exec:\1vpvd.exe71⤵PID:980
-
\??\c:\ppjpd.exec:\ppjpd.exe72⤵PID:1912
-
\??\c:\rxxlrxr.exec:\rxxlrxr.exe73⤵PID:768
-
\??\c:\ttnthh.exec:\ttnthh.exe74⤵PID:1528
-
\??\c:\hhhhnn.exec:\hhhhnn.exe75⤵PID:1524
-
\??\c:\pvdpp.exec:\pvdpp.exe76⤵PID:3008
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe77⤵PID:1728
-
\??\c:\tnbhhn.exec:\tnbhhn.exe78⤵PID:1932
-
\??\c:\pjppv.exec:\pjppv.exe79⤵PID:2112
-
\??\c:\1pjvj.exec:\1pjvj.exe80⤵PID:2380
-
\??\c:\ffrxlxf.exec:\ffrxlxf.exe81⤵PID:1852
-
\??\c:\bhbbth.exec:\bhbbth.exe82⤵PID:2940
-
\??\c:\vdvjv.exec:\vdvjv.exe83⤵PID:2464
-
\??\c:\djjvp.exec:\djjvp.exe84⤵PID:2836
-
\??\c:\3flrffx.exec:\3flrffx.exe85⤵PID:2832
-
\??\c:\bbthhn.exec:\bbthhn.exe86⤵PID:2816
-
\??\c:\nbttbb.exec:\nbttbb.exe87⤵PID:1960
-
\??\c:\vppvd.exec:\vppvd.exe88⤵PID:2812
-
\??\c:\1lflxfr.exec:\1lflxfr.exe89⤵PID:2656
-
\??\c:\5lxffff.exec:\5lxffff.exe90⤵PID:2604
-
\??\c:\ttnthn.exec:\ttnthn.exe91⤵PID:1896
-
\??\c:\vpjjp.exec:\vpjjp.exe92⤵PID:1668
-
\??\c:\ddjjv.exec:\ddjjv.exe93⤵PID:2580
-
\??\c:\fllxlxr.exec:\fllxlxr.exe94⤵
- System Location Discovery: System Language Discovery
PID:1352 -
\??\c:\5bthhn.exec:\5bthhn.exe95⤵PID:2116
-
\??\c:\hhbnnt.exec:\hhbnnt.exe96⤵PID:620
-
\??\c:\jjdvj.exec:\jjdvj.exe97⤵PID:1020
-
\??\c:\3llxffr.exec:\3llxffr.exe98⤵PID:1428
-
\??\c:\tthnbh.exec:\tthnbh.exe99⤵PID:760
-
\??\c:\nhnntb.exec:\nhnntb.exe100⤵PID:1740
-
\??\c:\jjjvj.exec:\jjjvj.exe101⤵PID:2908
-
\??\c:\xrfrffr.exec:\xrfrffr.exe102⤵PID:2916
-
\??\c:\flxrrll.exec:\flxrrll.exe103⤵PID:2328
-
\??\c:\nnnnhn.exec:\nnnnhn.exe104⤵PID:2220
-
\??\c:\ddvdp.exec:\ddvdp.exe105⤵PID:2260
-
\??\c:\fxxfffl.exec:\fxxfffl.exe106⤵PID:2372
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe107⤵PID:628
-
\??\c:\hbttnn.exec:\hbttnn.exe108⤵PID:952
-
\??\c:\3jpdv.exec:\3jpdv.exe109⤵PID:2080
-
\??\c:\rlfxffl.exec:\rlfxffl.exe110⤵PID:1672
-
\??\c:\xlllfxl.exec:\xlllfxl.exe111⤵PID:1748
-
\??\c:\9hhnbb.exec:\9hhnbb.exe112⤵PID:896
-
\??\c:\vdvdj.exec:\vdvdj.exe113⤵PID:772
-
\??\c:\lrrxflx.exec:\lrrxflx.exe114⤵PID:2052
-
\??\c:\3frrrlr.exec:\3frrrlr.exe115⤵PID:676
-
\??\c:\bbhnht.exec:\bbhnht.exe116⤵PID:2512
-
\??\c:\ppjpv.exec:\ppjpv.exe117⤵PID:1188
-
\??\c:\rrllflx.exec:\rrllflx.exe118⤵PID:872
-
\??\c:\hhbbnt.exec:\hhbbnt.exe119⤵PID:1524
-
\??\c:\tnnnhn.exec:\tnnnhn.exe120⤵PID:3064
-
\??\c:\dddpd.exec:\dddpd.exe121⤵
- System Location Discovery: System Language Discovery
PID:2504 -
\??\c:\lffflrf.exec:\lffflrf.exe122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-