Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe
-
Size
454KB
-
MD5
6a829c2cca9bad48df121cd5598df5d3
-
SHA1
d8bba79f523fe09c255f35b2f85eff0ff79c0a45
-
SHA256
325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b
-
SHA512
75a085c854836aa4a298fa55b07b5eb6f8ff9fbff6b0634b0df531db87e9b5a43a0f9146b58a3d03bdcc38223a0505c9876b3f25bed3f27732106739cf4ff1f5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2520-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-35-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2540-33-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2852-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-89-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1512-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-144-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-214-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-219-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1528-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-301-0x0000000077680000-0x000000007779F000-memory.dmp family_blackmoon behavioral1/memory/2148-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-373-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-412-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1924-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-434-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2796-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-509-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-530-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-783-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1936-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-982-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-997-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-1175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2580 hnbbhn.exe 1216 pjvjp.exe 2540 djjdd.exe 1940 xrlrflx.exe 2852 hhbtbh.exe 2464 5tnthh.exe 2616 dvjpv.exe 3004 9xxxrlx.exe 2772 bththh.exe 2624 5lfrlxr.exe 2168 btbbnt.exe 1512 xfrlffr.exe 628 fllxxfr.exe 2784 3nhbhn.exe 1916 xffxxrl.exe 1580 rlxrffr.exe 1980 5nbbhn.exe 2292 1rlrxxl.exe 2696 btnbnb.exe 2208 flfrfrf.exe 2304 llxfllr.exe 2232 ddpvj.exe 2864 djvpj.exe 1936 vpddj.exe 1528 jdvdj.exe 1920 jddjj.exe 1328 jdvdj.exe 608 bbntbh.exe 1752 7jpvj.exe 1028 7rllrrx.exe 1652 nnhttb.exe 856 lllrfrf.exe 1620 ttttbh.exe 888 xxrfrlx.exe 2104 7fflrrf.exe 1716 3frfxlr.exe 2148 7btbth.exe 2700 9dvvd.exe 2880 9rfflfl.exe 3036 lxlfrrr.exe 2848 ntthtb.exe 2824 vjdvp.exe 2632 xrlrffr.exe 2636 xrlrxxf.exe 1984 btnbhh.exe 2640 vpjpj.exe 2656 vvjjp.exe 2112 7lflxfl.exe 2012 hbnbnt.exe 1868 bbbtht.exe 2920 jpdvv.exe 2156 rlxfrfl.exe 1924 lxlrllx.exe 2936 hhbtht.exe 2000 djvpp.exe 2872 lfxlrrx.exe 2796 flxrxrx.exe 2192 7btbth.exe 2704 pvjvp.exe 2456 xxrxllr.exe 1524 xrlrxfl.exe 1120 tntbhn.exe 1368 ddvdj.exe 940 1lxfxxf.exe -
resource yara_rule behavioral1/memory/2520-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-33-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2852-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-89-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1512-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-144-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1916-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-301-0x0000000077680000-0x000000007779F000-memory.dmp upx behavioral1/memory/2104-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-508-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1772-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-634-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2664-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-982-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-1008-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/408-1021-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-1254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-1328-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2580 2520 325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe 30 PID 2520 wrote to memory of 2580 2520 325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe 30 PID 2520 wrote to memory of 2580 2520 325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe 30 PID 2520 wrote to memory of 2580 2520 325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe 30 PID 2580 wrote to memory of 1216 2580 hnbbhn.exe 31 PID 2580 wrote to memory of 1216 2580 hnbbhn.exe 31 PID 2580 wrote to memory of 1216 2580 hnbbhn.exe 31 PID 2580 wrote to memory of 1216 2580 hnbbhn.exe 31 PID 1216 wrote to memory of 2540 1216 pjvjp.exe 32 PID 1216 wrote to memory of 2540 1216 pjvjp.exe 32 PID 1216 wrote to memory of 2540 1216 pjvjp.exe 32 PID 1216 wrote to memory of 2540 1216 pjvjp.exe 32 PID 2540 wrote to memory of 1940 2540 djjdd.exe 33 PID 2540 wrote to memory of 1940 2540 djjdd.exe 33 PID 2540 wrote to memory of 1940 2540 djjdd.exe 33 PID 2540 wrote to memory of 1940 2540 djjdd.exe 33 PID 1940 wrote to memory of 2852 1940 xrlrflx.exe 34 PID 1940 wrote to memory of 2852 1940 xrlrflx.exe 34 PID 1940 wrote to memory of 2852 1940 xrlrflx.exe 34 PID 1940 wrote to memory of 2852 1940 xrlrflx.exe 34 PID 2852 wrote to memory of 2464 2852 hhbtbh.exe 35 PID 2852 wrote to memory of 2464 2852 hhbtbh.exe 35 PID 2852 wrote to memory of 2464 2852 hhbtbh.exe 35 PID 2852 wrote to memory of 2464 2852 hhbtbh.exe 35 PID 2464 wrote to memory of 2616 2464 5tnthh.exe 36 PID 2464 wrote to memory of 2616 2464 5tnthh.exe 36 PID 2464 wrote to memory of 2616 2464 5tnthh.exe 36 PID 2464 wrote to memory of 2616 2464 5tnthh.exe 36 PID 2616 wrote to memory of 3004 2616 dvjpv.exe 37 PID 2616 wrote to memory of 3004 2616 dvjpv.exe 37 PID 2616 wrote to memory of 3004 2616 dvjpv.exe 37 PID 2616 wrote to memory of 3004 2616 dvjpv.exe 37 PID 3004 wrote to memory of 2772 3004 9xxxrlx.exe 38 PID 3004 wrote to memory of 2772 3004 9xxxrlx.exe 38 PID 3004 wrote to memory of 2772 3004 9xxxrlx.exe 38 PID 3004 wrote to memory of 2772 3004 9xxxrlx.exe 38 PID 2772 wrote to memory of 2624 2772 bththh.exe 39 PID 2772 wrote to memory of 2624 2772 bththh.exe 39 PID 2772 wrote to memory of 2624 2772 bththh.exe 39 PID 2772 wrote to memory of 2624 2772 bththh.exe 39 PID 2624 wrote to memory of 2168 2624 5lfrlxr.exe 40 PID 2624 wrote to memory of 2168 2624 5lfrlxr.exe 40 PID 2624 wrote to memory of 2168 2624 5lfrlxr.exe 40 PID 2624 wrote to memory of 2168 2624 5lfrlxr.exe 40 PID 2168 wrote to memory of 1512 2168 btbbnt.exe 41 PID 2168 wrote to memory of 1512 2168 btbbnt.exe 41 PID 2168 wrote to memory of 1512 2168 btbbnt.exe 41 PID 2168 wrote to memory of 1512 2168 btbbnt.exe 41 PID 1512 wrote to memory of 628 1512 xfrlffr.exe 42 PID 1512 wrote to memory of 628 1512 xfrlffr.exe 42 PID 1512 wrote to memory of 628 1512 xfrlffr.exe 42 PID 1512 wrote to memory of 628 1512 xfrlffr.exe 42 PID 628 wrote to memory of 2784 628 fllxxfr.exe 43 PID 628 wrote to memory of 2784 628 fllxxfr.exe 43 PID 628 wrote to memory of 2784 628 fllxxfr.exe 43 PID 628 wrote to memory of 2784 628 fllxxfr.exe 43 PID 2784 wrote to memory of 1916 2784 3nhbhn.exe 44 PID 2784 wrote to memory of 1916 2784 3nhbhn.exe 44 PID 2784 wrote to memory of 1916 2784 3nhbhn.exe 44 PID 2784 wrote to memory of 1916 2784 3nhbhn.exe 44 PID 1916 wrote to memory of 1580 1916 xffxxrl.exe 45 PID 1916 wrote to memory of 1580 1916 xffxxrl.exe 45 PID 1916 wrote to memory of 1580 1916 xffxxrl.exe 45 PID 1916 wrote to memory of 1580 1916 xffxxrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe"C:\Users\Admin\AppData\Local\Temp\325624d8b88367a32c84160ba60c3dd877ad6d9f8331b0049202e37fa7e89a4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hnbbhn.exec:\hnbbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pjvjp.exec:\pjvjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\djjdd.exec:\djjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xrlrflx.exec:\xrlrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\hhbtbh.exec:\hhbtbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5tnthh.exec:\5tnthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\dvjpv.exec:\dvjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\9xxxrlx.exec:\9xxxrlx.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bththh.exec:\bththh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\5lfrlxr.exec:\5lfrlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\btbbnt.exec:\btbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xfrlffr.exec:\xfrlffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\fllxxfr.exec:\fllxxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\3nhbhn.exec:\3nhbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xffxxrl.exec:\xffxxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rlxrffr.exec:\rlxrffr.exe17⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5nbbhn.exec:\5nbbhn.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1rlrxxl.exec:\1rlrxxl.exe19⤵
- Executes dropped EXE
PID:2292 -
\??\c:\btnbnb.exec:\btnbnb.exe20⤵
- Executes dropped EXE
PID:2696 -
\??\c:\flfrfrf.exec:\flfrfrf.exe21⤵
- Executes dropped EXE
PID:2208 -
\??\c:\llxfllr.exec:\llxfllr.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ddpvj.exec:\ddpvj.exe23⤵
- Executes dropped EXE
PID:2232 -
\??\c:\djvpj.exec:\djvpj.exe24⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vpddj.exec:\vpddj.exe25⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdvdj.exec:\jdvdj.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jddjj.exec:\jddjj.exe27⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jdvdj.exec:\jdvdj.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bbntbh.exec:\bbntbh.exe29⤵
- Executes dropped EXE
PID:608 -
\??\c:\7jpvj.exec:\7jpvj.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7rllrrx.exec:\7rllrrx.exe31⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nnhttb.exec:\nnhttb.exe32⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lllrfrf.exec:\lllrfrf.exe33⤵
- Executes dropped EXE
PID:856 -
\??\c:\ttttbh.exec:\ttttbh.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xxrfrlx.exec:\xxrfrlx.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\xxfrrff.exec:\xxfrrff.exe36⤵PID:1592
-
\??\c:\7fflrrf.exec:\7fflrrf.exe37⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3frfxlr.exec:\3frfxlr.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7btbth.exec:\7btbth.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9dvvd.exec:\9dvvd.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9rfflfl.exec:\9rfflfl.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lxlfrrr.exec:\lxlfrrr.exe42⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ntthtb.exec:\ntthtb.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vjdvp.exec:\vjdvp.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xrlrffr.exec:\xrlrffr.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btnbhh.exec:\btnbhh.exe47⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vpjpj.exec:\vpjpj.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vvjjp.exec:\vvjjp.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\7lflxfl.exec:\7lflxfl.exe50⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hbnbnt.exec:\hbnbnt.exe51⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bbbtht.exec:\bbbtht.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jpdvv.exec:\jpdvv.exe53⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rlxfrfl.exec:\rlxfrfl.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\lxlrllx.exec:\lxlrllx.exe55⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hhbtht.exec:\hhbtht.exe56⤵
- Executes dropped EXE
PID:2936 -
\??\c:\djvpp.exec:\djvpp.exe57⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\flxrxrx.exec:\flxrxrx.exe59⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7btbth.exec:\7btbth.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pvjvp.exec:\pvjvp.exe61⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xxrxllr.exec:\xxrxllr.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe63⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tntbhn.exec:\tntbhn.exe64⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ddvdj.exec:\ddvdj.exe65⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1lxfxxf.exec:\1lxfxxf.exe66⤵
- Executes dropped EXE
PID:940 -
\??\c:\7lflflx.exec:\7lflflx.exe67⤵PID:1936
-
\??\c:\bhtbbh.exec:\bhtbbh.exe68⤵PID:1508
-
\??\c:\pdjjv.exec:\pdjjv.exe69⤵PID:2276
-
\??\c:\dvjvv.exec:\dvjvv.exe70⤵PID:1080
-
\??\c:\rlflxfl.exec:\rlflxfl.exe71⤵PID:1772
-
\??\c:\thbhtn.exec:\thbhtn.exe72⤵PID:3032
-
\??\c:\pdvjp.exec:\pdvjp.exe73⤵PID:984
-
\??\c:\jpjpv.exec:\jpjpv.exe74⤵PID:1316
-
\??\c:\frlfffr.exec:\frlfffr.exe75⤵PID:980
-
\??\c:\nbnnbb.exec:\nbnnbb.exe76⤵PID:872
-
\??\c:\nnbtnt.exec:\nnbtnt.exe77⤵PID:2416
-
\??\c:\1jvpj.exec:\1jvpj.exe78⤵PID:2492
-
\??\c:\lxlrrrf.exec:\lxlrrrf.exe79⤵PID:2056
-
\??\c:\lxlxllx.exec:\lxlxllx.exe80⤵PID:2376
-
\??\c:\nnbntt.exec:\nnbntt.exe81⤵PID:2524
-
\??\c:\vjdjp.exec:\vjdjp.exe82⤵PID:2544
-
\??\c:\ppdjv.exec:\ppdjv.exe83⤵PID:2540
-
\??\c:\1frxfxx.exec:\1frxfxx.exe84⤵PID:2844
-
\??\c:\nhnhht.exec:\nhnhht.exe85⤵PID:1376
-
\??\c:\jjvjv.exec:\jjvjv.exe86⤵PID:2732
-
\??\c:\pjjpj.exec:\pjjpj.exe87⤵PID:2464
-
\??\c:\1xlrlrx.exec:\1xlrlrx.exe88⤵PID:2900
-
\??\c:\7bbbnt.exec:\7bbbnt.exe89⤵PID:2896
-
\??\c:\3nhtbb.exec:\3nhtbb.exe90⤵PID:2664
-
\??\c:\jdvvd.exec:\jdvvd.exe91⤵PID:2772
-
\??\c:\9lffrrr.exec:\9lffrrr.exe92⤵PID:2624
-
\??\c:\nbtnbb.exec:\nbtnbb.exe93⤵PID:2144
-
\??\c:\hbtbtt.exec:\hbtbtt.exe94⤵PID:568
-
\??\c:\vpjpv.exec:\vpjpv.exe95⤵PID:688
-
\??\c:\7lxlxfr.exec:\7lxlxfr.exe96⤵PID:2924
-
\??\c:\1tbbhn.exec:\1tbbhn.exe97⤵PID:2792
-
\??\c:\ttthtb.exec:\ttthtb.exe98⤵PID:356
-
\??\c:\pjdjp.exec:\pjdjp.exe99⤵PID:788
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe100⤵PID:1704
-
\??\c:\9xlxfrx.exec:\9xlxfrx.exe101⤵PID:1960
-
\??\c:\hbbhhn.exec:\hbbhhn.exe102⤵PID:2648
-
\??\c:\dddvj.exec:\dddvj.exe103⤵PID:2972
-
\??\c:\vjvjj.exec:\vjvjj.exe104⤵PID:2944
-
\??\c:\rxxlxxl.exec:\rxxlxxl.exe105⤵PID:2192
-
\??\c:\tnthbb.exec:\tnthbb.exe106⤵PID:1780
-
\??\c:\pjvvd.exec:\pjvvd.exe107⤵PID:2304
-
\??\c:\pjvvv.exec:\pjvvv.exe108⤵PID:3052
-
\??\c:\lxllxfl.exec:\lxllxfl.exe109⤵PID:1120
-
\??\c:\nhthbh.exec:\nhthbh.exe110⤵
- System Location Discovery: System Language Discovery
PID:1368 -
\??\c:\nhhtbh.exec:\nhhtbh.exe111⤵PID:840
-
\??\c:\vpdpd.exec:\vpdpd.exe112⤵PID:1936
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe113⤵PID:752
-
\??\c:\7nbntb.exec:\7nbntb.exe114⤵PID:1352
-
\??\c:\5hntbh.exec:\5hntbh.exe115⤵PID:696
-
\??\c:\jdddj.exec:\jdddj.exe116⤵PID:1932
-
\??\c:\7fxxlrf.exec:\7fxxlrf.exe117⤵PID:2484
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe118⤵PID:1784
-
\??\c:\hhhbnt.exec:\hhhbnt.exe119⤵PID:1844
-
\??\c:\xfrrxfr.exec:\xfrrxfr.exe120⤵PID:1652
-
\??\c:\1nbtbn.exec:\1nbtbn.exe121⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-