Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe
-
Size
454KB
-
MD5
402565796f96c59c175eadf18a9fc0f7
-
SHA1
a1c2138440280e3b2b9175adfb0fe828f63fb7ed
-
SHA256
067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3
-
SHA512
c2110e9d319d9e9ef4383782d5f09ab8f719fae9b38b5459a4dcd48a045f2e9bb5f7fd8c7c6b0d2dc0f4114c969e04d323832646bfcaaf3ac2b44ea1c90cf405
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet8:q7Tc2NYHUrAwfMp3CDt8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2288-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-91-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2640-89-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2596-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-184-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1856-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-290-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2196-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-377-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2176-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-589-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-621-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2628-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/848-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-844-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2088-848-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2268-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-997-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-1024-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-1118-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-1180-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 7vpdd.exe 2016 rrlfllx.exe 2104 hhbbnt.exe 2112 5jdpv.exe 1676 7frxfrl.exe 2196 nhtthn.exe 2576 7hhnhh.exe 2724 7btbnt.exe 2640 tbbhhn.exe 2600 vvjpp.exe 2672 tbtnbn.exe 2596 xrflxfx.exe 2556 bhtnbh.exe 2068 tttbtt.exe 844 nnnbtb.exe 1716 rlxfrrf.exe 1708 bbtbnb.exe 1772 fxlxrlr.exe 1184 xfflffx.exe 2024 hbbhhh.exe 1856 lrlrlrf.exe 2704 hthhbn.exe 2520 rflrxxl.exe 2316 vppvd.exe 1132 lrffrrl.exe 1368 lfxfrxr.exe 2420 vpddp.exe 1304 bbnnhh.exe 2352 7vjjp.exe 2368 hnhthn.exe 2188 vvpvd.exe 2092 xfxxffx.exe 2052 hhthbh.exe 1576 dvdjv.exe 2120 vvpdv.exe 1080 5fxxflr.exe 1036 hthhnn.exe 1056 pjjpd.exe 2056 5ddvv.exe 1684 lrxfxxl.exe 2196 hhbbnt.exe 2664 tnbhtt.exe 2748 jdppd.exe 2760 1ffxfrx.exe 2176 7rflrrx.exe 2516 nhhnhn.exe 2684 9ppjd.exe 2528 1vppp.exe 2548 7flrxlr.exe 2132 1thhnn.exe 2652 bbtbbb.exe 1780 djpvp.exe 1996 rlxflrr.exe 2380 bhtbtt.exe 1284 bnhnnn.exe 2000 pppjd.exe 1768 fxlrfrx.exe 1792 7bhntt.exe 2424 bbbhth.exe 1848 jdvpj.exe 2708 7xxxlrf.exe 2704 xfrxllx.exe 2932 bbntnn.exe 2580 nttttt.exe -
resource yara_rule behavioral1/memory/2288-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-53-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2724-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-104-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2596-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-284-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2092-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-377-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2176-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-960-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-1010-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1924-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-1137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-1188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-1208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-1287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-1360-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2396 2288 067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe 28 PID 2288 wrote to memory of 2396 2288 067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe 28 PID 2288 wrote to memory of 2396 2288 067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe 28 PID 2288 wrote to memory of 2396 2288 067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe 28 PID 2396 wrote to memory of 2016 2396 7vpdd.exe 29 PID 2396 wrote to memory of 2016 2396 7vpdd.exe 29 PID 2396 wrote to memory of 2016 2396 7vpdd.exe 29 PID 2396 wrote to memory of 2016 2396 7vpdd.exe 29 PID 2016 wrote to memory of 2104 2016 rrlfllx.exe 30 PID 2016 wrote to memory of 2104 2016 rrlfllx.exe 30 PID 2016 wrote to memory of 2104 2016 rrlfllx.exe 30 PID 2016 wrote to memory of 2104 2016 rrlfllx.exe 30 PID 2104 wrote to memory of 2112 2104 hhbbnt.exe 31 PID 2104 wrote to memory of 2112 2104 hhbbnt.exe 31 PID 2104 wrote to memory of 2112 2104 hhbbnt.exe 31 PID 2104 wrote to memory of 2112 2104 hhbbnt.exe 31 PID 2112 wrote to memory of 1676 2112 5jdpv.exe 32 PID 2112 wrote to memory of 1676 2112 5jdpv.exe 32 PID 2112 wrote to memory of 1676 2112 5jdpv.exe 32 PID 2112 wrote to memory of 1676 2112 5jdpv.exe 32 PID 1676 wrote to memory of 2196 1676 7frxfrl.exe 33 PID 1676 wrote to memory of 2196 1676 7frxfrl.exe 33 PID 1676 wrote to memory of 2196 1676 7frxfrl.exe 33 PID 1676 wrote to memory of 2196 1676 7frxfrl.exe 33 PID 2196 wrote to memory of 2576 2196 nhtthn.exe 34 PID 2196 wrote to memory of 2576 2196 nhtthn.exe 34 PID 2196 wrote to memory of 2576 2196 nhtthn.exe 34 PID 2196 wrote to memory of 2576 2196 nhtthn.exe 34 PID 2576 wrote to memory of 2724 2576 7hhnhh.exe 35 PID 2576 wrote to memory of 2724 2576 7hhnhh.exe 35 PID 2576 wrote to memory of 2724 2576 7hhnhh.exe 35 PID 2576 wrote to memory of 2724 2576 7hhnhh.exe 35 PID 2724 wrote to memory of 2640 2724 7btbnt.exe 36 PID 2724 wrote to memory of 2640 2724 7btbnt.exe 36 PID 2724 wrote to memory of 2640 2724 7btbnt.exe 36 PID 2724 wrote to memory of 2640 2724 7btbnt.exe 36 PID 2640 wrote to memory of 2600 2640 tbbhhn.exe 37 PID 2640 wrote to memory of 2600 2640 tbbhhn.exe 37 PID 2640 wrote to memory of 2600 2640 tbbhhn.exe 37 PID 2640 wrote to memory of 2600 2640 tbbhhn.exe 37 PID 2600 wrote to memory of 2672 2600 vvjpp.exe 38 PID 2600 wrote to memory of 2672 2600 vvjpp.exe 38 PID 2600 wrote to memory of 2672 2600 vvjpp.exe 38 PID 2600 wrote to memory of 2672 2600 vvjpp.exe 38 PID 2672 wrote to memory of 2596 2672 tbtnbn.exe 39 PID 2672 wrote to memory of 2596 2672 tbtnbn.exe 39 PID 2672 wrote to memory of 2596 2672 tbtnbn.exe 39 PID 2672 wrote to memory of 2596 2672 tbtnbn.exe 39 PID 2596 wrote to memory of 2556 2596 xrflxfx.exe 40 PID 2596 wrote to memory of 2556 2596 xrflxfx.exe 40 PID 2596 wrote to memory of 2556 2596 xrflxfx.exe 40 PID 2596 wrote to memory of 2556 2596 xrflxfx.exe 40 PID 2556 wrote to memory of 2068 2556 bhtnbh.exe 41 PID 2556 wrote to memory of 2068 2556 bhtnbh.exe 41 PID 2556 wrote to memory of 2068 2556 bhtnbh.exe 41 PID 2556 wrote to memory of 2068 2556 bhtnbh.exe 41 PID 2068 wrote to memory of 844 2068 tttbtt.exe 42 PID 2068 wrote to memory of 844 2068 tttbtt.exe 42 PID 2068 wrote to memory of 844 2068 tttbtt.exe 42 PID 2068 wrote to memory of 844 2068 tttbtt.exe 42 PID 844 wrote to memory of 1716 844 nnnbtb.exe 43 PID 844 wrote to memory of 1716 844 nnnbtb.exe 43 PID 844 wrote to memory of 1716 844 nnnbtb.exe 43 PID 844 wrote to memory of 1716 844 nnnbtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe"C:\Users\Admin\AppData\Local\Temp\067489b9d62e3c85fb962c7089877993b031a6c54b2fef6459a89af56f68c1e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\7vpdd.exec:\7vpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\rrlfllx.exec:\rrlfllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\hhbbnt.exec:\hhbbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5jdpv.exec:\5jdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\7frxfrl.exec:\7frxfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\nhtthn.exec:\nhtthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\7hhnhh.exec:\7hhnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7btbnt.exec:\7btbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tbbhhn.exec:\tbbhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vvjpp.exec:\vvjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\tbtnbn.exec:\tbtnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xrflxfx.exec:\xrflxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bhtnbh.exec:\bhtnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\tttbtt.exec:\tttbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\nnnbtb.exec:\nnnbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe17⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bbtbnb.exec:\bbtbnb.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxlxrlr.exec:\fxlxrlr.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xfflffx.exec:\xfflffx.exe20⤵
- Executes dropped EXE
PID:1184 -
\??\c:\hbbhhh.exec:\hbbhhh.exe21⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe22⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hthhbn.exec:\hthhbn.exe23⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rflrxxl.exec:\rflrxxl.exe24⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vppvd.exec:\vppvd.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lrffrrl.exec:\lrffrrl.exe26⤵
- Executes dropped EXE
PID:1132 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vpddp.exec:\vpddp.exe28⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bbnnhh.exec:\bbnnhh.exe29⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7vjjp.exec:\7vjjp.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hnhthn.exec:\hnhthn.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vvpvd.exec:\vvpvd.exe32⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xfxxffx.exec:\xfxxffx.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hhthbh.exec:\hhthbh.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dvdjv.exec:\dvdjv.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vvpdv.exec:\vvpdv.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5fxxflr.exec:\5fxxflr.exe37⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hthhnn.exec:\hthhnn.exe38⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjjpd.exec:\pjjpd.exe39⤵
- Executes dropped EXE
PID:1056 -
\??\c:\5ddvv.exec:\5ddvv.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lrxfxxl.exec:\lrxfxxl.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hhbbnt.exec:\hhbbnt.exe42⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnbhtt.exec:\tnbhtt.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdppd.exec:\jdppd.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1ffxfrx.exec:\1ffxfrx.exe45⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7rflrrx.exec:\7rflrrx.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nhhnhn.exec:\nhhnhn.exe47⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9ppjd.exec:\9ppjd.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1vppp.exec:\1vppp.exe49⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7flrxlr.exec:\7flrxlr.exe50⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1thhnn.exec:\1thhnn.exe51⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbtbbb.exec:\bbtbbb.exe52⤵
- Executes dropped EXE
PID:2652 -
\??\c:\djpvp.exec:\djpvp.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rlxflrr.exec:\rlxflrr.exe54⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bhtbtt.exec:\bhtbtt.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bnhnnn.exec:\bnhnnn.exe56⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pppjd.exec:\pppjd.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\fxlrfrx.exec:\fxlrfrx.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7bhntt.exec:\7bhntt.exe59⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bbbhth.exec:\bbbhth.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jdvpj.exec:\jdvpj.exe61⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7xxxlrf.exec:\7xxxlrf.exe62⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xfrxllx.exec:\xfrxllx.exe63⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbntnn.exec:\bbntnn.exe64⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nttttt.exec:\nttttt.exe65⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdvjv.exec:\jdvjv.exe66⤵PID:2344
-
\??\c:\rlflxxl.exec:\rlflxxl.exe67⤵PID:2780
-
\??\c:\lrllxll.exec:\lrllxll.exe68⤵
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\tnhthh.exec:\tnhthh.exe69⤵PID:1712
-
\??\c:\pjddj.exec:\pjddj.exe70⤵PID:564
-
\??\c:\rrlrlrx.exec:\rrlrlrx.exe71⤵PID:3028
-
\??\c:\lfxxlxl.exec:\lfxxlxl.exe72⤵PID:1988
-
\??\c:\ttnbht.exec:\ttnbht.exe73⤵PID:2352
-
\??\c:\jddpp.exec:\jddpp.exe74⤵PID:1740
-
\??\c:\pdppp.exec:\pdppp.exe75⤵PID:2100
-
\??\c:\xxfxlrf.exec:\xxfxlrf.exe76⤵PID:2088
-
\??\c:\bntnnh.exec:\bntnnh.exe77⤵PID:1584
-
\??\c:\ttnnbb.exec:\ttnnbb.exe78⤵PID:2396
-
\??\c:\vdvdp.exec:\vdvdp.exe79⤵PID:316
-
\??\c:\ffrrlrf.exec:\ffrrlrf.exe80⤵PID:1920
-
\??\c:\bnhntb.exec:\bnhntb.exe81⤵PID:2076
-
\??\c:\9bthbb.exec:\9bthbb.exe82⤵PID:1036
-
\??\c:\djdjd.exec:\djdjd.exe83⤵PID:2844
-
\??\c:\rxfrrfr.exec:\rxfrrfr.exe84⤵PID:2248
-
\??\c:\3xxflxf.exec:\3xxflxf.exe85⤵PID:2116
-
\??\c:\7tntbh.exec:\7tntbh.exe86⤵PID:2628
-
\??\c:\9pjjv.exec:\9pjjv.exe87⤵PID:2732
-
\??\c:\5lxllrl.exec:\5lxllrl.exe88⤵PID:2608
-
\??\c:\7lffrrx.exec:\7lffrrx.exe89⤵PID:2640
-
\??\c:\5ntntb.exec:\5ntntb.exe90⤵PID:2856
-
\??\c:\1thnhn.exec:\1thnhn.exe91⤵PID:2516
-
\??\c:\vvjvj.exec:\vvjvj.exe92⤵PID:2688
-
\??\c:\1ffllrr.exec:\1ffllrr.exe93⤵PID:2604
-
\??\c:\9hbbhn.exec:\9hbbhn.exe94⤵PID:2532
-
\??\c:\bhbhth.exec:\bhbhth.exe95⤵PID:2944
-
\??\c:\1jjpv.exec:\1jjpv.exe96⤵
- System Location Discovery: System Language Discovery
PID:2952 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe97⤵PID:2868
-
\??\c:\lrrxrfx.exec:\lrrxrfx.exe98⤵PID:1344
-
\??\c:\5nbbht.exec:\5nbbht.exe99⤵PID:1916
-
\??\c:\1jvpv.exec:\1jvpv.exe100⤵PID:1708
-
\??\c:\7dvjv.exec:\7dvjv.exe101⤵PID:1772
-
\??\c:\lfrrlxl.exec:\lfrrlxl.exe102⤵PID:1972
-
\??\c:\9hntnt.exec:\9hntnt.exe103⤵PID:1184
-
\??\c:\hhtntb.exec:\hhtntb.exe104⤵PID:1912
-
\??\c:\ddpjd.exec:\ddpjd.exe105⤵PID:2572
-
\??\c:\llrrlxx.exec:\llrrlxx.exe106⤵PID:2700
-
\??\c:\9hhnbn.exec:\9hhnbn.exe107⤵PID:2800
-
\??\c:\hhtthh.exec:\hhtthh.exe108⤵PID:2372
-
\??\c:\7vpvj.exec:\7vpvj.exe109⤵PID:552
-
\??\c:\ffxlflx.exec:\ffxlflx.exe110⤵PID:2320
-
\??\c:\fxlfrfx.exec:\fxlfrfx.exe111⤵PID:2804
-
\??\c:\bhbbtt.exec:\bhbbtt.exe112⤵PID:848
-
\??\c:\7jddp.exec:\7jddp.exe113⤵PID:2420
-
\??\c:\jjddv.exec:\jjddv.exe114⤵PID:1304
-
\??\c:\rxlrxfx.exec:\rxlrxfx.exe115⤵PID:2888
-
\??\c:\hbthtn.exec:\hbthtn.exe116⤵PID:1688
-
\??\c:\ntnbnb.exec:\ntnbnb.exe117⤵PID:988
-
\??\c:\vvjpj.exec:\vvjpj.exe118⤵PID:2912
-
\??\c:\pjddp.exec:\pjddp.exe119⤵PID:760
-
\??\c:\xfrlxfl.exec:\xfrlxfl.exe120⤵PID:2088
-
\??\c:\bbnbth.exec:\bbnbth.exe121⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-