Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe
-
Size
453KB
-
MD5
30af677f840dab1de3a5aa63e3f959e1
-
SHA1
70ee9544183d8c91d638921b675318c39f17d9e7
-
SHA256
5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707
-
SHA512
d0b66a7c0cad8e46f6d2d0f8d9e1db532ad6a3e58a87a8421952c422f62054773ab383b7984ef8147d1a397e98d271240ea87b339986436f34c15108a5fd47a6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-74-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2876-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-95-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2272-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-130-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2284-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/392-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-393-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2604-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/392-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-595-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-733-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1156-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-768-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-935-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 3hnbtb.exe 2692 jjdjd.exe 2408 ppjvd.exe 2576 tbnntb.exe 2712 5pjvp.exe 2556 5fxrlrf.exe 3032 bhbbth.exe 1592 jjjjd.exe 2876 9bhhth.exe 2928 9dvjd.exe 2272 ttnnbn.exe 2640 1ffxffr.exe 2284 tnhhtb.exe 1904 xrllrrl.exe 1056 bttbth.exe 2884 3lxfllx.exe 1232 tnhnbh.exe 2984 9lrxxrx.exe 2120 hnhnhn.exe 2304 5xxxrxf.exe 392 bnttbb.exe 1320 fxrxflf.exe 892 bhbbhn.exe 1772 1frxxxf.exe 2476 bbtnbb.exe 2392 flfrflf.exe 564 ntttnt.exe 236 lxlrxfx.exe 1856 bbbhbn.exe 1664 vpddp.exe 2096 llxxlrf.exe 1500 djddp.exe 2772 1lxxflr.exe 2380 7hnthh.exe 2960 3pvdv.exe 2956 ddpvj.exe 2408 7rrrfxl.exe 480 ttnthh.exe 2680 1pvjp.exe 2608 vjvdp.exe 2664 flrrllx.exe 3056 1nhbht.exe 2036 djdjd.exe 1652 fffrflx.exe 2924 fffxrfr.exe 3040 btnhtt.exe 2604 vjvdv.exe 2368 rxfrflx.exe 1432 llflrfl.exe 1216 tnnntb.exe 1904 jdppj.exe 2740 5fxlfrf.exe 2128 xrlrxxr.exe 1436 tttnht.exe 1676 jddjp.exe 1556 dvdjp.exe 2400 7lxxllx.exe 2124 tntthh.exe 2116 nhbnbh.exe 1960 dvddd.exe 392 rrrxlrf.exe 696 rrlllrf.exe 1192 hhbnhn.exe 2332 jdddj.exe -
resource yara_rule behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-813-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2136-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-921-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2780 2688 5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe 31 PID 2688 wrote to memory of 2780 2688 5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe 31 PID 2688 wrote to memory of 2780 2688 5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe 31 PID 2688 wrote to memory of 2780 2688 5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe 31 PID 2780 wrote to memory of 2692 2780 3hnbtb.exe 32 PID 2780 wrote to memory of 2692 2780 3hnbtb.exe 32 PID 2780 wrote to memory of 2692 2780 3hnbtb.exe 32 PID 2780 wrote to memory of 2692 2780 3hnbtb.exe 32 PID 2692 wrote to memory of 2408 2692 jjdjd.exe 33 PID 2692 wrote to memory of 2408 2692 jjdjd.exe 33 PID 2692 wrote to memory of 2408 2692 jjdjd.exe 33 PID 2692 wrote to memory of 2408 2692 jjdjd.exe 33 PID 2408 wrote to memory of 2576 2408 ppjvd.exe 34 PID 2408 wrote to memory of 2576 2408 ppjvd.exe 34 PID 2408 wrote to memory of 2576 2408 ppjvd.exe 34 PID 2408 wrote to memory of 2576 2408 ppjvd.exe 34 PID 2576 wrote to memory of 2712 2576 tbnntb.exe 35 PID 2576 wrote to memory of 2712 2576 tbnntb.exe 35 PID 2576 wrote to memory of 2712 2576 tbnntb.exe 35 PID 2576 wrote to memory of 2712 2576 tbnntb.exe 35 PID 2712 wrote to memory of 2556 2712 5pjvp.exe 36 PID 2712 wrote to memory of 2556 2712 5pjvp.exe 36 PID 2712 wrote to memory of 2556 2712 5pjvp.exe 36 PID 2712 wrote to memory of 2556 2712 5pjvp.exe 36 PID 2556 wrote to memory of 3032 2556 5fxrlrf.exe 37 PID 2556 wrote to memory of 3032 2556 5fxrlrf.exe 37 PID 2556 wrote to memory of 3032 2556 5fxrlrf.exe 37 PID 2556 wrote to memory of 3032 2556 5fxrlrf.exe 37 PID 3032 wrote to memory of 1592 3032 bhbbth.exe 38 PID 3032 wrote to memory of 1592 3032 bhbbth.exe 38 PID 3032 wrote to memory of 1592 3032 bhbbth.exe 38 PID 3032 wrote to memory of 1592 3032 bhbbth.exe 38 PID 1592 wrote to memory of 2876 1592 jjjjd.exe 39 PID 1592 wrote to memory of 2876 1592 jjjjd.exe 39 PID 1592 wrote to memory of 2876 1592 jjjjd.exe 39 PID 1592 wrote to memory of 2876 1592 jjjjd.exe 39 PID 2876 wrote to memory of 2928 2876 9bhhth.exe 40 PID 2876 wrote to memory of 2928 2876 9bhhth.exe 40 PID 2876 wrote to memory of 2928 2876 9bhhth.exe 40 PID 2876 wrote to memory of 2928 2876 9bhhth.exe 40 PID 2928 wrote to memory of 2272 2928 9dvjd.exe 41 PID 2928 wrote to memory of 2272 2928 9dvjd.exe 41 PID 2928 wrote to memory of 2272 2928 9dvjd.exe 41 PID 2928 wrote to memory of 2272 2928 9dvjd.exe 41 PID 2272 wrote to memory of 2640 2272 ttnnbn.exe 42 PID 2272 wrote to memory of 2640 2272 ttnnbn.exe 42 PID 2272 wrote to memory of 2640 2272 ttnnbn.exe 42 PID 2272 wrote to memory of 2640 2272 ttnnbn.exe 42 PID 2640 wrote to memory of 2284 2640 1ffxffr.exe 43 PID 2640 wrote to memory of 2284 2640 1ffxffr.exe 43 PID 2640 wrote to memory of 2284 2640 1ffxffr.exe 43 PID 2640 wrote to memory of 2284 2640 1ffxffr.exe 43 PID 2284 wrote to memory of 1904 2284 tnhhtb.exe 44 PID 2284 wrote to memory of 1904 2284 tnhhtb.exe 44 PID 2284 wrote to memory of 1904 2284 tnhhtb.exe 44 PID 2284 wrote to memory of 1904 2284 tnhhtb.exe 44 PID 1904 wrote to memory of 1056 1904 xrllrrl.exe 45 PID 1904 wrote to memory of 1056 1904 xrllrrl.exe 45 PID 1904 wrote to memory of 1056 1904 xrllrrl.exe 45 PID 1904 wrote to memory of 1056 1904 xrllrrl.exe 45 PID 1056 wrote to memory of 2884 1056 bttbth.exe 46 PID 1056 wrote to memory of 2884 1056 bttbth.exe 46 PID 1056 wrote to memory of 2884 1056 bttbth.exe 46 PID 1056 wrote to memory of 2884 1056 bttbth.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe"C:\Users\Admin\AppData\Local\Temp\5815618ec8ffa011de184f396f389326ae2153c176e6e38624ebae4785f0a707.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\3hnbtb.exec:\3hnbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jjdjd.exec:\jjdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ppjvd.exec:\ppjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\tbnntb.exec:\tbnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5pjvp.exec:\5pjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5fxrlrf.exec:\5fxrlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\bhbbth.exec:\bhbbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jjjjd.exec:\jjjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\9bhhth.exec:\9bhhth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\9dvjd.exec:\9dvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ttnnbn.exec:\ttnnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\1ffxffr.exec:\1ffxffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tnhhtb.exec:\tnhhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xrllrrl.exec:\xrllrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\bttbth.exec:\bttbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\3lxfllx.exec:\3lxfllx.exe17⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tnhnbh.exec:\tnhnbh.exe18⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9lrxxrx.exec:\9lrxxrx.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hnhnhn.exec:\hnhnhn.exe20⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5xxxrxf.exec:\5xxxrxf.exe21⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnttbb.exec:\bnttbb.exe22⤵
- Executes dropped EXE
PID:392 -
\??\c:\fxrxflf.exec:\fxrxflf.exe23⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bhbbhn.exec:\bhbbhn.exe24⤵
- Executes dropped EXE
PID:892 -
\??\c:\1frxxxf.exec:\1frxxxf.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bbtnbb.exec:\bbtnbb.exe26⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flfrflf.exec:\flfrflf.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ntttnt.exec:\ntttnt.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\lxlrxfx.exec:\lxlrxfx.exe29⤵
- Executes dropped EXE
PID:236 -
\??\c:\bbbhbn.exec:\bbbhbn.exe30⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vpddp.exec:\vpddp.exe31⤵
- Executes dropped EXE
PID:1664 -
\??\c:\llxxlrf.exec:\llxxlrf.exe32⤵
- Executes dropped EXE
PID:2096 -
\??\c:\djddp.exec:\djddp.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1lxxflr.exec:\1lxxflr.exe34⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7hnthh.exec:\7hnthh.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\3pvdv.exec:\3pvdv.exe36⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ddpvj.exec:\ddpvj.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7rrrfxl.exec:\7rrrfxl.exe38⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ttnthh.exec:\ttnthh.exe39⤵
- Executes dropped EXE
PID:480 -
\??\c:\1pvjp.exec:\1pvjp.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vjvdp.exec:\vjvdp.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\flrrllx.exec:\flrrllx.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1nhbht.exec:\1nhbht.exe43⤵
- Executes dropped EXE
PID:3056 -
\??\c:\djdjd.exec:\djdjd.exe44⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fffrflx.exec:\fffrflx.exe45⤵
- Executes dropped EXE
PID:1652 -
\??\c:\fffxrfr.exec:\fffxrfr.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\btnhtt.exec:\btnhtt.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vjvdv.exec:\vjvdv.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rxfrflx.exec:\rxfrflx.exe49⤵
- Executes dropped EXE
PID:2368 -
\??\c:\llflrfl.exec:\llflrfl.exe50⤵
- Executes dropped EXE
PID:1432 -
\??\c:\tnnntb.exec:\tnnntb.exe51⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jdppj.exec:\jdppj.exe52⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5fxlfrf.exec:\5fxlfrf.exe53⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe54⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tttnht.exec:\tttnht.exe55⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jddjp.exec:\jddjp.exe56⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dvdjp.exec:\dvdjp.exe57⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7lxxllx.exec:\7lxxllx.exe58⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tntthh.exec:\tntthh.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhbnbh.exec:\nhbnbh.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dvddd.exec:\dvddd.exe61⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe62⤵
- Executes dropped EXE
PID:392 -
\??\c:\rrlllrf.exec:\rrlllrf.exe63⤵
- Executes dropped EXE
PID:696 -
\??\c:\hhbnhn.exec:\hhbnhn.exe64⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jdddj.exec:\jdddj.exe65⤵
- Executes dropped EXE
PID:2332 -
\??\c:\llffrxx.exec:\llffrxx.exe66⤵PID:1636
-
\??\c:\llfrffr.exec:\llfrffr.exe67⤵PID:1564
-
\??\c:\hnnbnt.exec:\hnnbnt.exe68⤵PID:2392
-
\??\c:\ddppj.exec:\ddppj.exe69⤵PID:2472
-
\??\c:\jjddj.exec:\jjddj.exe70⤵PID:2232
-
\??\c:\rlffrxl.exec:\rlffrxl.exe71⤵PID:236
-
\??\c:\nnhnbn.exec:\nnhnbn.exe72⤵PID:1004
-
\??\c:\hbnhnn.exec:\hbnhnn.exe73⤵PID:348
-
\??\c:\ppddj.exec:\ppddj.exe74⤵PID:2000
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe75⤵PID:1504
-
\??\c:\9thnhn.exec:\9thnhn.exe76⤵PID:1500
-
\??\c:\vvppv.exec:\vvppv.exe77⤵PID:2824
-
\??\c:\pjdvd.exec:\pjdvd.exe78⤵PID:2696
-
\??\c:\xlflrrl.exec:\xlflrrl.exe79⤵PID:2548
-
\??\c:\tnntbh.exec:\tnntbh.exe80⤵PID:2840
-
\??\c:\ppjdj.exec:\ppjdj.exe81⤵PID:2588
-
\??\c:\7pjpj.exec:\7pjpj.exe82⤵PID:480
-
\??\c:\xrffrlr.exec:\xrffrlr.exe83⤵PID:2680
-
\??\c:\tnbhtb.exec:\tnbhtb.exe84⤵PID:2168
-
\??\c:\pjjjp.exec:\pjjjp.exe85⤵PID:2360
-
\??\c:\7jpjp.exec:\7jpjp.exe86⤵PID:1952
-
\??\c:\lxrlxxf.exec:\lxrlxxf.exe87⤵PID:2920
-
\??\c:\nhtbbh.exec:\nhtbbh.exe88⤵PID:2720
-
\??\c:\5bttht.exec:\5bttht.exe89⤵PID:2812
-
\??\c:\dvjdp.exec:\dvjdp.exe90⤵PID:2376
-
\??\c:\7frrxxf.exec:\7frrxxf.exe91⤵PID:2728
-
\??\c:\hhbtbb.exec:\hhbtbb.exe92⤵PID:2604
-
\??\c:\hbtbbb.exec:\hbtbbb.exe93⤵PID:768
-
\??\c:\9vjpv.exec:\9vjpv.exe94⤵PID:1432
-
\??\c:\fxfxlfl.exec:\fxfxlfl.exe95⤵PID:1216
-
\??\c:\llxrffr.exec:\llxrffr.exe96⤵PID:1780
-
\??\c:\tnhhtt.exec:\tnhhtt.exe97⤵PID:1892
-
\??\c:\vdpvp.exec:\vdpvp.exe98⤵PID:1848
-
\??\c:\1djjj.exec:\1djjj.exe99⤵PID:812
-
\??\c:\fxxrflf.exec:\fxxrflf.exe100⤵PID:2904
-
\??\c:\5bttnn.exec:\5bttnn.exe101⤵PID:2208
-
\??\c:\tttbnt.exec:\tttbnt.exe102⤵PID:2120
-
\??\c:\pjddj.exec:\pjddj.exe103⤵PID:2172
-
\??\c:\rfllrrx.exec:\rfllrrx.exe104⤵PID:1156
-
\??\c:\rlxxflr.exec:\rlxxflr.exe105⤵PID:2268
-
\??\c:\3hthtt.exec:\3hthtt.exe106⤵PID:392
-
\??\c:\pjppv.exec:\pjppv.exe107⤵PID:2196
-
\??\c:\xrxffrl.exec:\xrxffrl.exe108⤵PID:1192
-
\??\c:\fxllrfr.exec:\fxllrfr.exe109⤵PID:2504
-
\??\c:\ttbbhh.exec:\ttbbhh.exe110⤵PID:1120
-
\??\c:\7jddj.exec:\7jddj.exe111⤵PID:1564
-
\??\c:\5lxfrxl.exec:\5lxfrxl.exe112⤵PID:2392
-
\??\c:\9rxfrrx.exec:\9rxfrrx.exe113⤵PID:2136
-
\??\c:\bhbhnt.exec:\bhbhnt.exe114⤵PID:3000
-
\??\c:\7ddjv.exec:\7ddjv.exe115⤵PID:880
-
\??\c:\jdjpv.exec:\jdjpv.exe116⤵PID:2440
-
\??\c:\3xrrxfr.exec:\3xrrxfr.exe117⤵PID:1512
-
\??\c:\vjvpv.exec:\vjvpv.exe118⤵PID:1508
-
\??\c:\vvppd.exec:\vvppd.exe119⤵PID:1600
-
\??\c:\lxlflfx.exec:\lxlflfx.exe120⤵PID:2668
-
\??\c:\bthhtt.exec:\bthhtt.exe121⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-