Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe
-
Size
453KB
-
MD5
b6f648b8637a1ed82ab482a4113b8850
-
SHA1
42a2c38d25444334d5f2cb78a4f764782f9da0e4
-
SHA256
abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1
-
SHA512
a66d9ea0a65b018c9f0d89fc21dc428a6901483e11584ec5f6c3efcc5d1d91466e6dd6ae979db44a325b39dadfb962c721e42c15d907b121b1df0f0b270acd60
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1176-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/740-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-337-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2644-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-480-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-479-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-487-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-556-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2668-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-875-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-1032-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-1133-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/880-1160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-1174-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1888 3pvpp.exe 2456 9btbhh.exe 2892 jdppd.exe 2752 9jdjv.exe 3008 pdppd.exe 2728 rrlxlrf.exe 2808 ppvvd.exe 2724 thttnt.exe 2624 1djpd.exe 2228 jjvjp.exe 1628 hhbbnt.exe 1532 rfxrfxf.exe 2956 btnntt.exe 1556 nhbntt.exe 1176 nbnhhb.exe 2900 7jddj.exe 580 hbhttb.exe 1964 ppjdj.exe 2348 fxllrrx.exe 2244 jjdpd.exe 2208 rlxfrrl.exe 1420 rlfrxxl.exe 740 5jjjp.exe 2204 xrxxllr.exe 664 5vpvd.exe 676 5rlrfxx.exe 2084 btnhhn.exe 3000 jdppd.exe 2512 bhhtnt.exe 1416 dvddp.exe 2528 ffxfllr.exe 1620 lfrrffx.exe 2540 9lffrrx.exe 2704 bthnbb.exe 340 dvppv.exe 2840 xlxrrxl.exe 2764 5lflrrx.exe 2736 1hnttt.exe 2644 jdjdj.exe 2888 pdpvj.exe 2808 rrrrxrf.exe 2612 bbtntb.exe 1988 nnbhhh.exe 2264 1jdvd.exe 1316 fxlrxrf.exe 556 rlflrxf.exe 1004 7bnnhn.exe 1704 vjddj.exe 2956 vpjpv.exe 1896 1lrrllx.exe 796 nnbhnn.exe 1308 jdjdj.exe 1464 dpvvv.exe 2964 lfxfxxr.exe 1964 fllfxll.exe 1728 nhhnbh.exe 2348 jdvpj.exe 2136 pjdjp.exe 2152 xrrrlrl.exe 2580 nntbhn.exe 2588 dvvdp.exe 640 pdvdj.exe 1288 llxfxxl.exe 1900 nhnnbn.exe -
resource yara_rule behavioral1/memory/1888-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-249-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1620-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-556-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1620-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-855-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3024-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-1032-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/880-1160-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1888 2528 abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe 30 PID 2528 wrote to memory of 1888 2528 abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe 30 PID 2528 wrote to memory of 1888 2528 abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe 30 PID 2528 wrote to memory of 1888 2528 abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe 30 PID 1888 wrote to memory of 2456 1888 3pvpp.exe 31 PID 1888 wrote to memory of 2456 1888 3pvpp.exe 31 PID 1888 wrote to memory of 2456 1888 3pvpp.exe 31 PID 1888 wrote to memory of 2456 1888 3pvpp.exe 31 PID 2456 wrote to memory of 2892 2456 9btbhh.exe 32 PID 2456 wrote to memory of 2892 2456 9btbhh.exe 32 PID 2456 wrote to memory of 2892 2456 9btbhh.exe 32 PID 2456 wrote to memory of 2892 2456 9btbhh.exe 32 PID 2892 wrote to memory of 2752 2892 jdppd.exe 33 PID 2892 wrote to memory of 2752 2892 jdppd.exe 33 PID 2892 wrote to memory of 2752 2892 jdppd.exe 33 PID 2892 wrote to memory of 2752 2892 jdppd.exe 33 PID 2752 wrote to memory of 3008 2752 9jdjv.exe 34 PID 2752 wrote to memory of 3008 2752 9jdjv.exe 34 PID 2752 wrote to memory of 3008 2752 9jdjv.exe 34 PID 2752 wrote to memory of 3008 2752 9jdjv.exe 34 PID 3008 wrote to memory of 2728 3008 pdppd.exe 35 PID 3008 wrote to memory of 2728 3008 pdppd.exe 35 PID 3008 wrote to memory of 2728 3008 pdppd.exe 35 PID 3008 wrote to memory of 2728 3008 pdppd.exe 35 PID 2728 wrote to memory of 2808 2728 rrlxlrf.exe 36 PID 2728 wrote to memory of 2808 2728 rrlxlrf.exe 36 PID 2728 wrote to memory of 2808 2728 rrlxlrf.exe 36 PID 2728 wrote to memory of 2808 2728 rrlxlrf.exe 36 PID 2808 wrote to memory of 2724 2808 ppvvd.exe 37 PID 2808 wrote to memory of 2724 2808 ppvvd.exe 37 PID 2808 wrote to memory of 2724 2808 ppvvd.exe 37 PID 2808 wrote to memory of 2724 2808 ppvvd.exe 37 PID 2724 wrote to memory of 2624 2724 thttnt.exe 38 PID 2724 wrote to memory of 2624 2724 thttnt.exe 38 PID 2724 wrote to memory of 2624 2724 thttnt.exe 38 PID 2724 wrote to memory of 2624 2724 thttnt.exe 38 PID 2624 wrote to memory of 2228 2624 1djpd.exe 39 PID 2624 wrote to memory of 2228 2624 1djpd.exe 39 PID 2624 wrote to memory of 2228 2624 1djpd.exe 39 PID 2624 wrote to memory of 2228 2624 1djpd.exe 39 PID 2228 wrote to memory of 1628 2228 jjvjp.exe 40 PID 2228 wrote to memory of 1628 2228 jjvjp.exe 40 PID 2228 wrote to memory of 1628 2228 jjvjp.exe 40 PID 2228 wrote to memory of 1628 2228 jjvjp.exe 40 PID 1628 wrote to memory of 1532 1628 hhbbnt.exe 41 PID 1628 wrote to memory of 1532 1628 hhbbnt.exe 41 PID 1628 wrote to memory of 1532 1628 hhbbnt.exe 41 PID 1628 wrote to memory of 1532 1628 hhbbnt.exe 41 PID 1532 wrote to memory of 2956 1532 rfxrfxf.exe 42 PID 1532 wrote to memory of 2956 1532 rfxrfxf.exe 42 PID 1532 wrote to memory of 2956 1532 rfxrfxf.exe 42 PID 1532 wrote to memory of 2956 1532 rfxrfxf.exe 42 PID 2956 wrote to memory of 1556 2956 btnntt.exe 43 PID 2956 wrote to memory of 1556 2956 btnntt.exe 43 PID 2956 wrote to memory of 1556 2956 btnntt.exe 43 PID 2956 wrote to memory of 1556 2956 btnntt.exe 43 PID 1556 wrote to memory of 1176 1556 nhbntt.exe 44 PID 1556 wrote to memory of 1176 1556 nhbntt.exe 44 PID 1556 wrote to memory of 1176 1556 nhbntt.exe 44 PID 1556 wrote to memory of 1176 1556 nhbntt.exe 44 PID 1176 wrote to memory of 2900 1176 nbnhhb.exe 45 PID 1176 wrote to memory of 2900 1176 nbnhhb.exe 45 PID 1176 wrote to memory of 2900 1176 nbnhhb.exe 45 PID 1176 wrote to memory of 2900 1176 nbnhhb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe"C:\Users\Admin\AppData\Local\Temp\abf5d520564d1998b5f5f8070ef1e466edc8403fda93fb9e48766948ef8407f1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\3pvpp.exec:\3pvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\9btbhh.exec:\9btbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jdppd.exec:\jdppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9jdjv.exec:\9jdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pdppd.exec:\pdppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ppvvd.exec:\ppvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\thttnt.exec:\thttnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1djpd.exec:\1djpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jjvjp.exec:\jjvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\hhbbnt.exec:\hhbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\rfxrfxf.exec:\rfxrfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\btnntt.exec:\btnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nhbntt.exec:\nhbntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\nbnhhb.exec:\nbnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\7jddj.exec:\7jddj.exe17⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbhttb.exec:\hbhttb.exe18⤵
- Executes dropped EXE
PID:580 -
\??\c:\ppjdj.exec:\ppjdj.exe19⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fxllrrx.exec:\fxllrrx.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jjdpd.exec:\jjdpd.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rlfrxxl.exec:\rlfrxxl.exe23⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5jjjp.exec:\5jjjp.exe24⤵
- Executes dropped EXE
PID:740 -
\??\c:\xrxxllr.exec:\xrxxllr.exe25⤵
- Executes dropped EXE
PID:2204 -
\??\c:\5vpvd.exec:\5vpvd.exe26⤵
- Executes dropped EXE
PID:664 -
\??\c:\5rlrfxx.exec:\5rlrfxx.exe27⤵
- Executes dropped EXE
PID:676 -
\??\c:\btnhhn.exec:\btnhhn.exe28⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jdppd.exec:\jdppd.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bhhtnt.exec:\bhhtnt.exe30⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dvddp.exec:\dvddp.exe31⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ffxfllr.exec:\ffxfllr.exe32⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lfrrffx.exec:\lfrrffx.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9lffrrx.exec:\9lffrrx.exe34⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bthnbb.exec:\bthnbb.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dvppv.exec:\dvppv.exe36⤵
- Executes dropped EXE
PID:340 -
\??\c:\xlxrrxl.exec:\xlxrrxl.exe37⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5lflrrx.exec:\5lflrrx.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1hnttt.exec:\1hnttt.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jdjdj.exec:\jdjdj.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pdpvj.exec:\pdpvj.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rrrrxrf.exec:\rrrrxrf.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bbtntb.exec:\bbtntb.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nnbhhh.exec:\nnbhhh.exe44⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1jdvd.exec:\1jdvd.exe45⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxlrxrf.exec:\fxlrxrf.exe46⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rlflrxf.exec:\rlflrxf.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\7bnnhn.exec:\7bnnhn.exe48⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vjddj.exec:\vjddj.exe49⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vpjpv.exec:\vpjpv.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1lrrllx.exec:\1lrrllx.exe51⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nnbhnn.exec:\nnbhnn.exe52⤵
- Executes dropped EXE
PID:796 -
\??\c:\jdjdj.exec:\jdjdj.exe53⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dpvvv.exec:\dpvvv.exe54⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lfxfxxr.exec:\lfxfxxr.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fllfxll.exec:\fllfxll.exe56⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhhnbh.exec:\nhhnbh.exe57⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdvpj.exec:\jdvpj.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pjdjp.exec:\pjdjp.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe60⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nntbhn.exec:\nntbhn.exe61⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvvdp.exec:\dvvdp.exe62⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pdvdj.exec:\pdvdj.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\llxfxxl.exec:\llxfxxl.exe64⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nhnnbn.exec:\nhnnbn.exe65⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jdvvd.exec:\jdvvd.exe66⤵PID:2060
-
\??\c:\jjdjd.exec:\jjdjd.exe67⤵PID:1364
-
\??\c:\7lfflrx.exec:\7lfflrx.exe68⤵PID:2896
-
\??\c:\nbbnbh.exec:\nbbnbh.exe69⤵PID:3000
-
\??\c:\5thnnb.exec:\5thnnb.exe70⤵PID:2552
-
\??\c:\djvjv.exec:\djvjv.exe71⤵PID:2352
-
\??\c:\3rffllx.exec:\3rffllx.exe72⤵PID:1484
-
\??\c:\fxxfrfr.exec:\fxxfrfr.exe73⤵PID:2984
-
\??\c:\tbnbnn.exec:\tbnbnn.exe74⤵PID:1620
-
\??\c:\ddvdp.exec:\ddvdp.exe75⤵PID:712
-
\??\c:\9xrlrfl.exec:\9xrlrfl.exe76⤵PID:2344
-
\??\c:\lfrxllf.exec:\lfrxllf.exe77⤵PID:2996
-
\??\c:\7thtbn.exec:\7thtbn.exe78⤵PID:2832
-
\??\c:\vvddj.exec:\vvddj.exe79⤵PID:764
-
\??\c:\jvppv.exec:\jvppv.exe80⤵PID:2836
-
\??\c:\xlxxfxr.exec:\xlxxfxr.exe81⤵PID:2904
-
\??\c:\7thhnn.exec:\7thhnn.exe82⤵PID:2776
-
\??\c:\jvjjj.exec:\jvjjj.exe83⤵PID:2668
-
\??\c:\7pjpv.exec:\7pjpv.exe84⤵PID:2640
-
\??\c:\xllrxxl.exec:\xllrxxl.exe85⤵PID:2176
-
\??\c:\nnhbbh.exec:\nnhbbh.exe86⤵PID:1636
-
\??\c:\tnbbbb.exec:\tnbbbb.exe87⤵PID:1972
-
\??\c:\dvddj.exec:\dvddj.exe88⤵PID:748
-
\??\c:\rlxfrxr.exec:\rlxfrxr.exe89⤵PID:2700
-
\??\c:\fxrrflx.exec:\fxrrflx.exe90⤵PID:848
-
\??\c:\tnntbb.exec:\tnntbb.exe91⤵PID:1556
-
\??\c:\ddvvj.exec:\ddvvj.exe92⤵PID:2956
-
\??\c:\rffxlrf.exec:\rffxlrf.exe93⤵PID:2680
-
\??\c:\5xlrxfr.exec:\5xlrxfr.exe94⤵PID:1564
-
\??\c:\nhhnbb.exec:\nhhnbb.exe95⤵PID:1308
-
\??\c:\nhnttt.exec:\nhnttt.exe96⤵PID:1356
-
\??\c:\jppvj.exec:\jppvj.exe97⤵PID:1668
-
\??\c:\ffllfrr.exec:\ffllfrr.exe98⤵PID:2976
-
\??\c:\7hhnbn.exec:\7hhnbn.exe99⤵PID:2448
-
\??\c:\jpjpp.exec:\jpjpp.exe100⤵PID:2708
-
\??\c:\jjvdd.exec:\jjvdd.exe101⤵PID:2064
-
\??\c:\frlfffr.exec:\frlfffr.exe102⤵PID:884
-
\??\c:\9hbbhn.exec:\9hbbhn.exe103⤵PID:2580
-
\??\c:\bttbbn.exec:\bttbbn.exe104⤵PID:2328
-
\??\c:\pdpjp.exec:\pdpjp.exe105⤵PID:1524
-
\??\c:\rlfllrx.exec:\rlfllrx.exe106⤵PID:1304
-
\??\c:\5rfrrrx.exec:\5rfrrrx.exe107⤵PID:1740
-
\??\c:\tntbbb.exec:\tntbbb.exe108⤵PID:2324
-
\??\c:\3ppdp.exec:\3ppdp.exe109⤵PID:2004
-
\??\c:\7pjvv.exec:\7pjvv.exe110⤵PID:1640
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe111⤵PID:2396
-
\??\c:\tbbbbb.exec:\tbbbbb.exe112⤵PID:1416
-
\??\c:\jjpvj.exec:\jjpvj.exe113⤵PID:1400
-
\??\c:\ppdjp.exec:\ppdjp.exe114⤵PID:1232
-
\??\c:\rxrflrf.exec:\rxrflrf.exe115⤵PID:2452
-
\??\c:\3nnbhn.exec:\3nnbhn.exe116⤵PID:2424
-
\??\c:\nnhhnt.exec:\nnhhnt.exe117⤵PID:2164
-
\??\c:\jdpvp.exec:\jdpvp.exe118⤵PID:2716
-
\??\c:\dvvdj.exec:\dvvdj.exe119⤵PID:2752
-
\??\c:\9rlrlll.exec:\9rlrlll.exe120⤵PID:2616
-
\??\c:\hbhhnn.exec:\hbhhnn.exe121⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-