Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe
-
Size
453KB
-
MD5
f95e69e5fc628ec55c522b2128e8bafc
-
SHA1
af783c9c79fe3f85fd6e6433dbe562104cc0995f
-
SHA256
5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672
-
SHA512
e69f440a4e123733a7b202c682a79867ae07fb772f9538999481c7147d0c1e84256f288dd88feecf60347a014d6ee9516c33079028bcbff73fcb2a7fa9e56816
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2384-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-348-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2672-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-365-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3068-363-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1596-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-485-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2520-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-559-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1432-565-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-693-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2872-719-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2596-909-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2680 bhhbtb.exe 2820 bnthbh.exe 2684 7dddp.exe 2584 lrxlffx.exe 2716 ttnnbn.exe 2564 vvpdp.exe 3024 bhhtnb.exe 1484 jjjpd.exe 2900 nnnhbh.exe 1664 jjdpj.exe 1596 tbntnh.exe 832 bhhhnt.exe 2348 vvvpd.exe 2756 5tnbht.exe 792 pppvp.exe 1036 tntbnn.exe 1792 ttnhhh.exe 2288 vjdjp.exe 1964 7bnntb.exe 1732 lxxrlxr.exe 2008 hhbhbh.exe 1920 rfflfrr.exe 1016 tttnbb.exe 2432 rrlrfxl.exe 1240 1frlflx.exe 1652 dddvp.exe 2500 xfflfrf.exe 2284 jjdjj.exe 2488 vvdjv.exe 1380 llrfflf.exe 2468 dpjdj.exe 3032 hhbbnt.exe 2700 9ppvj.exe 1656 rllrxfr.exe 2704 tnhnnb.exe 2248 djjjd.exe 2832 fffrflx.exe 2668 5nntbh.exe 2596 1hhnht.exe 2548 9vjvp.exe 2672 flfrflx.exe 3068 tbbnbn.exe 1160 9vvpv.exe 3016 xxxlxlf.exe 1956 ntthbb.exe 2376 nhbhth.exe 1080 dvppv.exe 1596 rrllrfr.exe 1172 hbbhnb.exe 768 bnnbnh.exe 2640 1vvdp.exe 2756 fxxfrrx.exe 944 1hnnhn.exe 1800 btntnb.exe 2960 jjjvj.exe 1600 llflrfr.exe 1988 lllxxlx.exe 1796 ntthhh.exe 2200 5pdpd.exe 1864 fffrfrx.exe 2520 bbbntn.exe 664 9btbnb.exe 1928 1ppvj.exe 1224 ffxffrr.exe -
resource yara_rule behavioral1/memory/2384-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-56-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3024-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-348-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2672-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-973-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-999-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2680 2384 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2384 wrote to memory of 2680 2384 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2384 wrote to memory of 2680 2384 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2384 wrote to memory of 2680 2384 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2680 wrote to memory of 2820 2680 bhhbtb.exe 31 PID 2680 wrote to memory of 2820 2680 bhhbtb.exe 31 PID 2680 wrote to memory of 2820 2680 bhhbtb.exe 31 PID 2680 wrote to memory of 2820 2680 bhhbtb.exe 31 PID 2820 wrote to memory of 2684 2820 bnthbh.exe 32 PID 2820 wrote to memory of 2684 2820 bnthbh.exe 32 PID 2820 wrote to memory of 2684 2820 bnthbh.exe 32 PID 2820 wrote to memory of 2684 2820 bnthbh.exe 32 PID 2684 wrote to memory of 2584 2684 7dddp.exe 33 PID 2684 wrote to memory of 2584 2684 7dddp.exe 33 PID 2684 wrote to memory of 2584 2684 7dddp.exe 33 PID 2684 wrote to memory of 2584 2684 7dddp.exe 33 PID 2584 wrote to memory of 2716 2584 lrxlffx.exe 34 PID 2584 wrote to memory of 2716 2584 lrxlffx.exe 34 PID 2584 wrote to memory of 2716 2584 lrxlffx.exe 34 PID 2584 wrote to memory of 2716 2584 lrxlffx.exe 34 PID 2716 wrote to memory of 2564 2716 ttnnbn.exe 35 PID 2716 wrote to memory of 2564 2716 ttnnbn.exe 35 PID 2716 wrote to memory of 2564 2716 ttnnbn.exe 35 PID 2716 wrote to memory of 2564 2716 ttnnbn.exe 35 PID 2564 wrote to memory of 3024 2564 vvpdp.exe 36 PID 2564 wrote to memory of 3024 2564 vvpdp.exe 36 PID 2564 wrote to memory of 3024 2564 vvpdp.exe 36 PID 2564 wrote to memory of 3024 2564 vvpdp.exe 36 PID 3024 wrote to memory of 1484 3024 bhhtnb.exe 37 PID 3024 wrote to memory of 1484 3024 bhhtnb.exe 37 PID 3024 wrote to memory of 1484 3024 bhhtnb.exe 37 PID 3024 wrote to memory of 1484 3024 bhhtnb.exe 37 PID 1484 wrote to memory of 2900 1484 jjjpd.exe 38 PID 1484 wrote to memory of 2900 1484 jjjpd.exe 38 PID 1484 wrote to memory of 2900 1484 jjjpd.exe 38 PID 1484 wrote to memory of 2900 1484 jjjpd.exe 38 PID 2900 wrote to memory of 1664 2900 nnnhbh.exe 39 PID 2900 wrote to memory of 1664 2900 nnnhbh.exe 39 PID 2900 wrote to memory of 1664 2900 nnnhbh.exe 39 PID 2900 wrote to memory of 1664 2900 nnnhbh.exe 39 PID 1664 wrote to memory of 1596 1664 jjdpj.exe 40 PID 1664 wrote to memory of 1596 1664 jjdpj.exe 40 PID 1664 wrote to memory of 1596 1664 jjdpj.exe 40 PID 1664 wrote to memory of 1596 1664 jjdpj.exe 40 PID 1596 wrote to memory of 832 1596 tbntnh.exe 41 PID 1596 wrote to memory of 832 1596 tbntnh.exe 41 PID 1596 wrote to memory of 832 1596 tbntnh.exe 41 PID 1596 wrote to memory of 832 1596 tbntnh.exe 41 PID 832 wrote to memory of 2348 832 bhhhnt.exe 42 PID 832 wrote to memory of 2348 832 bhhhnt.exe 42 PID 832 wrote to memory of 2348 832 bhhhnt.exe 42 PID 832 wrote to memory of 2348 832 bhhhnt.exe 42 PID 2348 wrote to memory of 2756 2348 vvvpd.exe 43 PID 2348 wrote to memory of 2756 2348 vvvpd.exe 43 PID 2348 wrote to memory of 2756 2348 vvvpd.exe 43 PID 2348 wrote to memory of 2756 2348 vvvpd.exe 43 PID 2756 wrote to memory of 792 2756 5tnbht.exe 44 PID 2756 wrote to memory of 792 2756 5tnbht.exe 44 PID 2756 wrote to memory of 792 2756 5tnbht.exe 44 PID 2756 wrote to memory of 792 2756 5tnbht.exe 44 PID 792 wrote to memory of 1036 792 pppvp.exe 45 PID 792 wrote to memory of 1036 792 pppvp.exe 45 PID 792 wrote to memory of 1036 792 pppvp.exe 45 PID 792 wrote to memory of 1036 792 pppvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe"C:\Users\Admin\AppData\Local\Temp\5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\bhhbtb.exec:\bhhbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bnthbh.exec:\bnthbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7dddp.exec:\7dddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lrxlffx.exec:\lrxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ttnnbn.exec:\ttnnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vvpdp.exec:\vvpdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bhhtnb.exec:\bhhtnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jjjpd.exec:\jjjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\nnnhbh.exec:\nnnhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jjdpj.exec:\jjdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\tbntnh.exec:\tbntnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\bhhhnt.exec:\bhhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\vvvpd.exec:\vvvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\5tnbht.exec:\5tnbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\pppvp.exec:\pppvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\tntbnn.exec:\tntbnn.exe17⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ttnhhh.exec:\ttnhhh.exe18⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vjdjp.exec:\vjdjp.exe19⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7bnntb.exec:\7bnntb.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lxxrlxr.exec:\lxxrlxr.exe21⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hhbhbh.exec:\hhbhbh.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rfflfrr.exec:\rfflfrr.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tttnbb.exec:\tttnbb.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rrlrfxl.exec:\rrlrfxl.exe25⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1frlflx.exec:\1frlflx.exe26⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dddvp.exec:\dddvp.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xfflfrf.exec:\xfflfrf.exe28⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jjdjj.exec:\jjdjj.exe29⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vvdjv.exec:\vvdjv.exe30⤵
- Executes dropped EXE
PID:2488 -
\??\c:\llrfflf.exec:\llrfflf.exe31⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dpjdj.exec:\dpjdj.exe32⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hhbbnt.exec:\hhbbnt.exe33⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9ppvj.exec:\9ppvj.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rllrxfr.exec:\rllrxfr.exe35⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnhnnb.exec:\tnhnnb.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\djjjd.exec:\djjjd.exe37⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fffrflx.exec:\fffrflx.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5nntbh.exec:\5nntbh.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1hhnht.exec:\1hhnht.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9vjvp.exec:\9vjvp.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\flfrflx.exec:\flfrflx.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tbbnbn.exec:\tbbnbn.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9vvpv.exec:\9vvpv.exe44⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe45⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ntthbb.exec:\ntthbb.exe46⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhbhth.exec:\nhbhth.exe47⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dvppv.exec:\dvppv.exe48⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rrllrfr.exec:\rrllrfr.exe49⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hbbhnb.exec:\hbbhnb.exe50⤵
- Executes dropped EXE
PID:1172 -
\??\c:\bnnbnh.exec:\bnnbnh.exe51⤵
- Executes dropped EXE
PID:768 -
\??\c:\1vvdp.exec:\1vvdp.exe52⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe53⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1hnnhn.exec:\1hnnhn.exe54⤵
- Executes dropped EXE
PID:944 -
\??\c:\btntnb.exec:\btntnb.exe55⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jjjvj.exec:\jjjvj.exe56⤵
- Executes dropped EXE
PID:2960 -
\??\c:\llflrfr.exec:\llflrfr.exe57⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lllxxlx.exec:\lllxxlx.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ntthhh.exec:\ntthhh.exe59⤵
- Executes dropped EXE
PID:1796 -
\??\c:\5pdpd.exec:\5pdpd.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\fffrfrx.exec:\fffrfrx.exe61⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bbbntn.exec:\bbbntn.exe62⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9btbnb.exec:\9btbnb.exe63⤵
- Executes dropped EXE
PID:664 -
\??\c:\1ppvj.exec:\1ppvj.exe64⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ffxffrr.exec:\ffxffrr.exe65⤵
- Executes dropped EXE
PID:1224 -
\??\c:\7nhnbb.exec:\7nhnbb.exe66⤵PID:1680
-
\??\c:\ppvjd.exec:\ppvjd.exe67⤵PID:2036
-
\??\c:\lrrfxlf.exec:\lrrfxlf.exe68⤵PID:1260
-
\??\c:\tbttht.exec:\tbttht.exe69⤵PID:3048
-
\??\c:\ttbnhb.exec:\ttbnhb.exe70⤵PID:1728
-
\??\c:\dvvvp.exec:\dvvvp.exe71⤵PID:548
-
\??\c:\3xlrxfr.exec:\3xlrxfr.exe72⤵PID:1380
-
\??\c:\nhhnhb.exec:\nhhnhb.exe73⤵PID:1432
-
\??\c:\hnhthb.exec:\hnhthb.exe74⤵PID:2256
-
\??\c:\pdddp.exec:\pdddp.exe75⤵PID:1532
-
\??\c:\9xrfflf.exec:\9xrfflf.exe76⤵PID:2804
-
\??\c:\tbbnbn.exec:\tbbnbn.exe77⤵PID:2760
-
\??\c:\bhbnbt.exec:\bhbnbt.exe78⤵PID:2768
-
\??\c:\ppvdv.exec:\ppvdv.exe79⤵PID:2940
-
\??\c:\1flrlfx.exec:\1flrlfx.exe80⤵PID:2556
-
\??\c:\nthnth.exec:\nthnth.exe81⤵PID:2668
-
\??\c:\bbbnnh.exec:\bbbnnh.exe82⤵PID:2596
-
\??\c:\vddpd.exec:\vddpd.exe83⤵PID:2552
-
\??\c:\rllrxlx.exec:\rllrxlx.exe84⤵PID:3020
-
\??\c:\rrlrflf.exec:\rrlrflf.exe85⤵PID:1616
-
\??\c:\ntbnht.exec:\ntbnht.exe86⤵PID:2924
-
\??\c:\9ddpv.exec:\9ddpv.exe87⤵PID:2876
-
\??\c:\5vpdp.exec:\5vpdp.exe88⤵
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\ffflxlr.exec:\ffflxlr.exe89⤵PID:2844
-
\??\c:\hbnhbn.exec:\hbnhbn.exe90⤵PID:1208
-
\??\c:\ttnnbn.exec:\ttnnbn.exe91⤵PID:2344
-
\??\c:\dpddd.exec:\dpddd.exe92⤵PID:800
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe93⤵PID:2276
-
\??\c:\lfxfrff.exec:\lfxfrff.exe94⤵PID:2852
-
\??\c:\1ppdp.exec:\1ppdp.exe95⤵PID:2880
-
\??\c:\7pjjv.exec:\7pjjv.exe96⤵PID:2872
-
\??\c:\ffxllxr.exec:\ffxllxr.exe97⤵PID:1036
-
\??\c:\3hnbth.exec:\3hnbth.exe98⤵PID:2392
-
\??\c:\hhnbnn.exec:\hhnbnn.exe99⤵PID:2260
-
\??\c:\pddjj.exec:\pddjj.exe100⤵PID:452
-
\??\c:\1xlrrxl.exec:\1xlrrxl.exe101⤵PID:936
-
\??\c:\ttthbh.exec:\ttthbh.exe102⤵PID:1548
-
\??\c:\1hbnbb.exec:\1hbnbb.exe103⤵PID:1120
-
\??\c:\pvvjd.exec:\pvvjd.exe104⤵PID:2436
-
\??\c:\lrrrxfr.exec:\lrrrxfr.exe105⤵PID:828
-
\??\c:\rlrllxl.exec:\rlrllxl.exe106⤵PID:2092
-
\??\c:\tttnbn.exec:\tttnbn.exe107⤵PID:2060
-
\??\c:\vdjvj.exec:\vdjvj.exe108⤵PID:1676
-
\??\c:\llrxflr.exec:\llrxflr.exe109⤵PID:1744
-
\??\c:\rrlrrfx.exec:\rrlrrfx.exe110⤵PID:1516
-
\??\c:\nhhnbh.exec:\nhhnbh.exe111⤵PID:1708
-
\??\c:\pppdp.exec:\pppdp.exe112⤵PID:1716
-
\??\c:\dvvpd.exec:\dvvpd.exe113⤵PID:1728
-
\??\c:\fxrrffr.exec:\fxrrffr.exe114⤵PID:548
-
\??\c:\nnntnt.exec:\nnntnt.exe115⤵PID:892
-
\??\c:\tnhhbh.exec:\tnhhbh.exe116⤵PID:1972
-
\??\c:\rrlrxlf.exec:\rrlrxlf.exe117⤵PID:3032
-
\??\c:\9tthtb.exec:\9tthtb.exe118⤵PID:2708
-
\??\c:\hbthtb.exec:\hbthtb.exe119⤵PID:2680
-
\??\c:\jdjdp.exec:\jdjdp.exe120⤵PID:2824
-
\??\c:\llfflrx.exec:\llfflrx.exe121⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-