Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe
-
Size
495KB
-
MD5
4d29fedebc0c63f2062d9a253486bed6
-
SHA1
351511dcb6fb8e2d55199e371305d45d672bb0e3
-
SHA256
d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da
-
SHA512
1943146a46d472bf020deb281e9055b876ae6152c435fc1ac994cd4586f02de15c84cb6d2b1d10e7e6ee6e9985c63f91c393432f1c13defe3c85e2932c04f1f7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o8K31OU:q7Tc2NYHUrAwfMHNnpls48I1OU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/1784-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-121-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3064-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-146-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2668-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-181-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2664-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-222-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1776-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-465-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2176-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-486-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2952-494-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2952-513-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2440-533-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-562-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/3036-591-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2764-631-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-645-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2756-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-839-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2192-854-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1584-867-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1784 bbthnt.exe 2032 nhtbbt.exe 2376 3vjpj.exe 2288 3lxxlrx.exe 2172 nhttth.exe 2776 pjvdv.exe 2976 dvjpd.exe 2868 pvdvp.exe 2016 vvvjv.exe 2568 pjdpv.exe 2688 btnbhh.exe 3064 ffffxxl.exe 2824 3htbtb.exe 2472 vdvdv.exe 592 1tnnbh.exe 1348 vvppd.exe 1788 7bbthh.exe 2668 3vpvj.exe 2916 1hntbh.exe 2932 5bhtbb.exe 2664 hnhnbh.exe 3044 vvppv.exe 880 7rllxxr.exe 900 7frrxxl.exe 1692 9bnhht.exe 1776 dppvj.exe 560 tnbbnt.exe 2200 pjdjd.exe 3004 nhtbhn.exe 2296 3hbbbh.exe 2396 hhbbnt.exe 1584 lfxfllr.exe 3036 3hnnnh.exe 2504 jdvjv.exe 1752 7vppj.exe 2376 lfxfrrf.exe 2660 hbhhnt.exe 2708 5hbbnt.exe 2024 ddvvd.exe 2720 rlfxxrl.exe 2576 hhntbb.exe 2920 tnhbhh.exe 2756 3pddd.exe 2564 rrllrrx.exe 2584 rrfxrrx.exe 2572 nhbbhh.exe 2276 jjvjd.exe 316 1rrfrxf.exe 2840 rxrxllx.exe 2636 ttnttt.exe 1848 5pddj.exe 980 3xxfllx.exe 272 5xlrxfl.exe 2324 3tnnhn.exe 1408 ddvvv.exe 1456 vvpvv.exe 2904 lfflrrx.exe 2176 rrxflxf.exe 2148 bthhnn.exe 2060 ppjpv.exe 2952 rlxfrrx.exe 1372 5rlfrrl.exe 968 nnhhnh.exe 2548 jdjvd.exe -
resource yara_rule behavioral1/memory/1784-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-253-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/560-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-486-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2440-533-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2196-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-591-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2724-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-631-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2692-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-821-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2104-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-839-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1580-883-0x0000000000430000-0x000000000045A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1784 2356 d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe 30 PID 2356 wrote to memory of 1784 2356 d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe 30 PID 2356 wrote to memory of 1784 2356 d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe 30 PID 2356 wrote to memory of 1784 2356 d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe 30 PID 1784 wrote to memory of 2032 1784 bbthnt.exe 31 PID 1784 wrote to memory of 2032 1784 bbthnt.exe 31 PID 1784 wrote to memory of 2032 1784 bbthnt.exe 31 PID 1784 wrote to memory of 2032 1784 bbthnt.exe 31 PID 2032 wrote to memory of 2376 2032 nhtbbt.exe 32 PID 2032 wrote to memory of 2376 2032 nhtbbt.exe 32 PID 2032 wrote to memory of 2376 2032 nhtbbt.exe 32 PID 2032 wrote to memory of 2376 2032 nhtbbt.exe 32 PID 2376 wrote to memory of 2288 2376 3vjpj.exe 33 PID 2376 wrote to memory of 2288 2376 3vjpj.exe 33 PID 2376 wrote to memory of 2288 2376 3vjpj.exe 33 PID 2376 wrote to memory of 2288 2376 3vjpj.exe 33 PID 2288 wrote to memory of 2172 2288 3lxxlrx.exe 34 PID 2288 wrote to memory of 2172 2288 3lxxlrx.exe 34 PID 2288 wrote to memory of 2172 2288 3lxxlrx.exe 34 PID 2288 wrote to memory of 2172 2288 3lxxlrx.exe 34 PID 2172 wrote to memory of 2776 2172 nhttth.exe 35 PID 2172 wrote to memory of 2776 2172 nhttth.exe 35 PID 2172 wrote to memory of 2776 2172 nhttth.exe 35 PID 2172 wrote to memory of 2776 2172 nhttth.exe 35 PID 2776 wrote to memory of 2976 2776 pjvdv.exe 36 PID 2776 wrote to memory of 2976 2776 pjvdv.exe 36 PID 2776 wrote to memory of 2976 2776 pjvdv.exe 36 PID 2776 wrote to memory of 2976 2776 pjvdv.exe 36 PID 2976 wrote to memory of 2868 2976 dvjpd.exe 37 PID 2976 wrote to memory of 2868 2976 dvjpd.exe 37 PID 2976 wrote to memory of 2868 2976 dvjpd.exe 37 PID 2976 wrote to memory of 2868 2976 dvjpd.exe 37 PID 2868 wrote to memory of 2016 2868 pvdvp.exe 38 PID 2868 wrote to memory of 2016 2868 pvdvp.exe 38 PID 2868 wrote to memory of 2016 2868 pvdvp.exe 38 PID 2868 wrote to memory of 2016 2868 pvdvp.exe 38 PID 2016 wrote to memory of 2568 2016 vvvjv.exe 39 PID 2016 wrote to memory of 2568 2016 vvvjv.exe 39 PID 2016 wrote to memory of 2568 2016 vvvjv.exe 39 PID 2016 wrote to memory of 2568 2016 vvvjv.exe 39 PID 2568 wrote to memory of 2688 2568 pjdpv.exe 40 PID 2568 wrote to memory of 2688 2568 pjdpv.exe 40 PID 2568 wrote to memory of 2688 2568 pjdpv.exe 40 PID 2568 wrote to memory of 2688 2568 pjdpv.exe 40 PID 2688 wrote to memory of 3064 2688 btnbhh.exe 41 PID 2688 wrote to memory of 3064 2688 btnbhh.exe 41 PID 2688 wrote to memory of 3064 2688 btnbhh.exe 41 PID 2688 wrote to memory of 3064 2688 btnbhh.exe 41 PID 3064 wrote to memory of 2824 3064 ffffxxl.exe 42 PID 3064 wrote to memory of 2824 3064 ffffxxl.exe 42 PID 3064 wrote to memory of 2824 3064 ffffxxl.exe 42 PID 3064 wrote to memory of 2824 3064 ffffxxl.exe 42 PID 2824 wrote to memory of 2472 2824 3htbtb.exe 43 PID 2824 wrote to memory of 2472 2824 3htbtb.exe 43 PID 2824 wrote to memory of 2472 2824 3htbtb.exe 43 PID 2824 wrote to memory of 2472 2824 3htbtb.exe 43 PID 2472 wrote to memory of 592 2472 vdvdv.exe 44 PID 2472 wrote to memory of 592 2472 vdvdv.exe 44 PID 2472 wrote to memory of 592 2472 vdvdv.exe 44 PID 2472 wrote to memory of 592 2472 vdvdv.exe 44 PID 592 wrote to memory of 1348 592 1tnnbh.exe 45 PID 592 wrote to memory of 1348 592 1tnnbh.exe 45 PID 592 wrote to memory of 1348 592 1tnnbh.exe 45 PID 592 wrote to memory of 1348 592 1tnnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe"C:\Users\Admin\AppData\Local\Temp\d38b7878c6b6593e2a7225fb9bda060657ff4a1dde9d57b178c858b0016994da.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\bbthnt.exec:\bbthnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\nhtbbt.exec:\nhtbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\3vjpj.exec:\3vjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\3lxxlrx.exec:\3lxxlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\nhttth.exec:\nhttth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\pjvdv.exec:\pjvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\dvjpd.exec:\dvjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\pvdvp.exec:\pvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vvvjv.exec:\vvvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\pjdpv.exec:\pjdpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\btnbhh.exec:\btnbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ffffxxl.exec:\ffffxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\3htbtb.exec:\3htbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vdvdv.exec:\vdvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\1tnnbh.exec:\1tnnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\vvppd.exec:\vvppd.exe17⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7bbthh.exec:\7bbthh.exe18⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3vpvj.exec:\3vpvj.exe19⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1hntbh.exec:\1hntbh.exe20⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5bhtbb.exec:\5bhtbb.exe21⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hnhnbh.exec:\hnhnbh.exe22⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vvppv.exec:\vvppv.exe23⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7rllxxr.exec:\7rllxxr.exe24⤵
- Executes dropped EXE
PID:880 -
\??\c:\7frrxxl.exec:\7frrxxl.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\9bnhht.exec:\9bnhht.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dppvj.exec:\dppvj.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\tnbbnt.exec:\tnbbnt.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\pjdjd.exec:\pjdjd.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhtbhn.exec:\nhtbhn.exe30⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3hbbbh.exec:\3hbbbh.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hhbbnt.exec:\hhbbnt.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lfxfllr.exec:\lfxfllr.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3hnnnh.exec:\3hnnnh.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdvjv.exec:\jdvjv.exe35⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7vppj.exec:\7vppj.exe36⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe37⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hbhhnt.exec:\hbhhnt.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5hbbnt.exec:\5hbbnt.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ddvvd.exec:\ddvvd.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlfxxrl.exec:\rlfxxrl.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hhntbb.exec:\hhntbb.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tnhbhh.exec:\tnhbhh.exe43⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3pddd.exec:\3pddd.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rrllrrx.exec:\rrllrrx.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhbbhh.exec:\nhbbhh.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jjvjd.exec:\jjvjd.exe48⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1rrfrxf.exec:\1rrfrxf.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\rxrxllx.exec:\rxrxllx.exe50⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ttnttt.exec:\ttnttt.exe51⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5pddj.exec:\5pddj.exe52⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3xxfllx.exec:\3xxfllx.exe53⤵
- Executes dropped EXE
PID:980 -
\??\c:\5xlrxfl.exec:\5xlrxfl.exe54⤵
- Executes dropped EXE
PID:272 -
\??\c:\3tnnhn.exec:\3tnnhn.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ddvvv.exec:\ddvvv.exe56⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vvpvv.exec:\vvpvv.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lfflrrx.exec:\lfflrrx.exe58⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rrxflxf.exec:\rrxflxf.exe59⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bthhnn.exec:\bthhnn.exe60⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ppjpv.exec:\ppjpv.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\5rlfrrl.exec:\5rlfrrl.exe63⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nnhhnh.exec:\nnhhnh.exe64⤵
- Executes dropped EXE
PID:968 -
\??\c:\jdjvd.exec:\jdjvd.exe65⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpdjp.exec:\vpdjp.exe66⤵PID:2080
-
\??\c:\7lxxlll.exec:\7lxxlll.exe67⤵PID:1692
-
\??\c:\5nbtth.exec:\5nbtth.exe68⤵PID:2440
-
\??\c:\hhbhtt.exec:\hhbhtt.exe69⤵PID:560
-
\??\c:\jvjpv.exec:\jvjpv.exe70⤵PID:2304
-
\??\c:\7lflrxf.exec:\7lflrxf.exe71⤵PID:2192
-
\??\c:\tthhnn.exec:\tthhnn.exe72⤵PID:3012
-
\??\c:\thnhbt.exec:\thnhbt.exe73⤵PID:2104
-
\??\c:\jvjdd.exec:\jvjdd.exe74⤵PID:2196
-
\??\c:\xlflrxf.exec:\xlflrxf.exe75⤵PID:1696
-
\??\c:\7nbbhh.exec:\7nbbhh.exe76⤵PID:1584
-
\??\c:\5bnhhn.exec:\5bnhhn.exe77⤵PID:3036
-
\??\c:\jdppj.exec:\jdppj.exe78⤵PID:2332
-
\??\c:\ppvdd.exec:\ppvdd.exe79⤵PID:2280
-
\??\c:\9frlrrf.exec:\9frlrrf.exe80⤵PID:860
-
\??\c:\nhnnbb.exec:\nhnnbb.exe81⤵PID:2444
-
\??\c:\dvddp.exec:\dvddp.exe82⤵PID:2724
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe83⤵PID:2764
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe84⤵PID:2692
-
\??\c:\bnhhnt.exec:\bnhhnt.exe85⤵PID:2576
-
\??\c:\pjvpv.exec:\pjvpv.exe86⤵PID:2920
-
\??\c:\ppjvd.exec:\ppjvd.exe87⤵PID:2756
-
\??\c:\ffxrffl.exec:\ffxrffl.exe88⤵PID:2612
-
\??\c:\hhthnt.exec:\hhthnt.exe89⤵PID:3048
-
\??\c:\vvppp.exec:\vvppp.exe90⤵PID:788
-
\??\c:\3pdjd.exec:\3pdjd.exe91⤵PID:568
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe92⤵PID:1264
-
\??\c:\nbnntt.exec:\nbnntt.exe93⤵PID:1856
-
\??\c:\ttbthh.exec:\ttbthh.exe94⤵PID:2472
-
\??\c:\7dvdp.exec:\7dvdp.exe95⤵PID:1004
-
\??\c:\lxffllr.exec:\lxffllr.exe96⤵PID:1548
-
\??\c:\nnbhth.exec:\nnbhth.exe97⤵PID:2820
-
\??\c:\tnbhbb.exec:\tnbhbb.exe98⤵PID:1660
-
\??\c:\jpjpd.exec:\jpjpd.exe99⤵PID:2940
-
\??\c:\9rfxxxx.exec:\9rfxxxx.exe100⤵PID:2252
-
\??\c:\lflflll.exec:\lflflll.exe101⤵PID:2752
-
\??\c:\djvdp.exec:\djvdp.exe102⤵PID:3028
-
\??\c:\9rflxxx.exec:\9rflxxx.exe103⤵PID:2256
-
\??\c:\5frrxff.exec:\5frrxff.exe104⤵PID:584
-
\??\c:\1htbtb.exec:\1htbtb.exe105⤵PID:868
-
\??\c:\vjvdp.exec:\vjvdp.exe106⤵PID:1372
-
\??\c:\1dddd.exec:\1dddd.exe107⤵PID:1352
-
\??\c:\5lxxrxf.exec:\5lxxrxf.exe108⤵PID:2152
-
\??\c:\thtthh.exec:\thtthh.exe109⤵
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\hbnhnn.exec:\hbnhnn.exe110⤵PID:3000
-
\??\c:\jdvvj.exec:\jdvvj.exe111⤵PID:2440
-
\??\c:\5xlfxxf.exec:\5xlfxxf.exe112⤵PID:696
-
\??\c:\btntnt.exec:\btntnt.exe113⤵PID:2188
-
\??\c:\nbhhhh.exec:\nbhhhh.exe114⤵PID:2192
-
\??\c:\5vpjd.exec:\5vpjd.exe115⤵PID:3012
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe116⤵PID:2104
-
\??\c:\xlffllr.exec:\xlffllr.exe117⤵PID:2272
-
\??\c:\ttttbh.exec:\ttttbh.exe118⤵PID:1580
-
\??\c:\jvddv.exec:\jvddv.exe119⤵PID:1584
-
\??\c:\9rfrffx.exec:\9rfrffx.exe120⤵PID:1252
-
\??\c:\nhtnnn.exec:\nhtnnn.exe121⤵PID:2336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-