Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 21:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe
-
Size
454KB
-
MD5
8bc6bbb8b8e2f2375732fb110ca9f6ec
-
SHA1
1e4cd5513ce1fb6a3f1de378c75c26db3296a5db
-
SHA256
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2
-
SHA512
9a39c12d6cede91b3e8c180ccf26f5f8472eecf02070587dd1f680332a7c522dfd6943ee3b32ad36e707eb9e996708879d3e8a7468b4c059441a23c57b887830
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1868-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-80-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2940-95-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-307-0x0000000076FE0000-0x00000000770FF000-memory.dmp family_blackmoon behavioral1/memory/2908-308-0x0000000076EE0000-0x0000000076FDA000-memory.dmp family_blackmoon behavioral1/memory/2580-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-353-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-458-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2548-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-485-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/920-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-663-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1968-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-893-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1292-904-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2692-932-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-945-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1328-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-1147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2276 3xxfrxf.exe 1676 rxlxllx.exe 2784 hthhnt.exe 2596 7ddjj.exe 2728 ttnnhn.exe 2740 5dpvd.exe 2604 3ttthh.exe 2992 pjvdv.exe 2488 tthtbb.exe 2940 5nhnhn.exe 2956 5ppdv.exe 2044 tntbnn.exe 2820 1rffllx.exe 2960 tnbhhh.exe 2004 1dpvj.exe 1236 xrfrxrl.exe 2344 7vvjp.exe 2028 7xlrffr.exe 1932 3dddd.exe 2332 lfrrflr.exe 1060 jjvvj.exe 1484 xxxfxfx.exe 936 nbthtb.exe 1528 dvvdj.exe 3032 hhbhnn.exe 944 5hbhbh.exe 1092 jdvjd.exe 1776 lffflrf.exe 1628 1tthnn.exe 2204 1lffrxx.exe 2072 vpjpv.exe 1044 frlrffr.exe 2980 ppjjv.exe 2444 xrllfxr.exe 2908 bthhnn.exe 2420 nhbbtb.exe 2412 9hbhtt.exe 2668 dvjjv.exe 2580 xffxlfx.exe 2636 hhhbbb.exe 2372 pdvdv.exe 2728 pjpvj.exe 2736 xxxlxxl.exe 2760 bbthtb.exe 2652 nnbntb.exe 2508 dvpvp.exe 2944 fxxflrf.exe 2552 tnbhnt.exe 344 thtbhn.exe 2324 jjvpv.exe 2812 lfxflrf.exe 2916 1bbhbn.exe 3052 9nhnbb.exe 2960 ppvpp.exe 1716 lflrfll.exe 668 hhnhbb.exe 2548 nhnthb.exe 1936 jdvvd.exe 2264 rxrllfl.exe 1932 nbhbbn.exe 1644 7pjpv.exe 740 ddvdj.exe 2880 xlfflfl.exe 584 hnnnbb.exe -
resource yara_rule behavioral1/memory/1868-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-485-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/920-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-724-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/292-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-893-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1292-904-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2692-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-1011-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-1147-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1168-1155-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2276 1868 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 28 PID 1868 wrote to memory of 2276 1868 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 28 PID 1868 wrote to memory of 2276 1868 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 28 PID 1868 wrote to memory of 2276 1868 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 28 PID 2276 wrote to memory of 1676 2276 3xxfrxf.exe 29 PID 2276 wrote to memory of 1676 2276 3xxfrxf.exe 29 PID 2276 wrote to memory of 1676 2276 3xxfrxf.exe 29 PID 2276 wrote to memory of 1676 2276 3xxfrxf.exe 29 PID 1676 wrote to memory of 2784 1676 rxlxllx.exe 30 PID 1676 wrote to memory of 2784 1676 rxlxllx.exe 30 PID 1676 wrote to memory of 2784 1676 rxlxllx.exe 30 PID 1676 wrote to memory of 2784 1676 rxlxllx.exe 30 PID 2784 wrote to memory of 2596 2784 hthhnt.exe 31 PID 2784 wrote to memory of 2596 2784 hthhnt.exe 31 PID 2784 wrote to memory of 2596 2784 hthhnt.exe 31 PID 2784 wrote to memory of 2596 2784 hthhnt.exe 31 PID 2596 wrote to memory of 2728 2596 7ddjj.exe 32 PID 2596 wrote to memory of 2728 2596 7ddjj.exe 32 PID 2596 wrote to memory of 2728 2596 7ddjj.exe 32 PID 2596 wrote to memory of 2728 2596 7ddjj.exe 32 PID 2728 wrote to memory of 2740 2728 ttnnhn.exe 33 PID 2728 wrote to memory of 2740 2728 ttnnhn.exe 33 PID 2728 wrote to memory of 2740 2728 ttnnhn.exe 33 PID 2728 wrote to memory of 2740 2728 ttnnhn.exe 33 PID 2740 wrote to memory of 2604 2740 5dpvd.exe 34 PID 2740 wrote to memory of 2604 2740 5dpvd.exe 34 PID 2740 wrote to memory of 2604 2740 5dpvd.exe 34 PID 2740 wrote to memory of 2604 2740 5dpvd.exe 34 PID 2604 wrote to memory of 2992 2604 3ttthh.exe 35 PID 2604 wrote to memory of 2992 2604 3ttthh.exe 35 PID 2604 wrote to memory of 2992 2604 3ttthh.exe 35 PID 2604 wrote to memory of 2992 2604 3ttthh.exe 35 PID 2992 wrote to memory of 2488 2992 pjvdv.exe 36 PID 2992 wrote to memory of 2488 2992 pjvdv.exe 36 PID 2992 wrote to memory of 2488 2992 pjvdv.exe 36 PID 2992 wrote to memory of 2488 2992 pjvdv.exe 36 PID 2488 wrote to memory of 2940 2488 tthtbb.exe 37 PID 2488 wrote to memory of 2940 2488 tthtbb.exe 37 PID 2488 wrote to memory of 2940 2488 tthtbb.exe 37 PID 2488 wrote to memory of 2940 2488 tthtbb.exe 37 PID 2940 wrote to memory of 2956 2940 5nhnhn.exe 38 PID 2940 wrote to memory of 2956 2940 5nhnhn.exe 38 PID 2940 wrote to memory of 2956 2940 5nhnhn.exe 38 PID 2940 wrote to memory of 2956 2940 5nhnhn.exe 38 PID 2956 wrote to memory of 2044 2956 5ppdv.exe 39 PID 2956 wrote to memory of 2044 2956 5ppdv.exe 39 PID 2956 wrote to memory of 2044 2956 5ppdv.exe 39 PID 2956 wrote to memory of 2044 2956 5ppdv.exe 39 PID 2044 wrote to memory of 2820 2044 tntbnn.exe 40 PID 2044 wrote to memory of 2820 2044 tntbnn.exe 40 PID 2044 wrote to memory of 2820 2044 tntbnn.exe 40 PID 2044 wrote to memory of 2820 2044 tntbnn.exe 40 PID 2820 wrote to memory of 2960 2820 1rffllx.exe 41 PID 2820 wrote to memory of 2960 2820 1rffllx.exe 41 PID 2820 wrote to memory of 2960 2820 1rffllx.exe 41 PID 2820 wrote to memory of 2960 2820 1rffllx.exe 41 PID 2960 wrote to memory of 2004 2960 tnbhhh.exe 42 PID 2960 wrote to memory of 2004 2960 tnbhhh.exe 42 PID 2960 wrote to memory of 2004 2960 tnbhhh.exe 42 PID 2960 wrote to memory of 2004 2960 tnbhhh.exe 42 PID 2004 wrote to memory of 1236 2004 1dpvj.exe 43 PID 2004 wrote to memory of 1236 2004 1dpvj.exe 43 PID 2004 wrote to memory of 1236 2004 1dpvj.exe 43 PID 2004 wrote to memory of 1236 2004 1dpvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe"C:\Users\Admin\AppData\Local\Temp\fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\3xxfrxf.exec:\3xxfrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\rxlxllx.exec:\rxlxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\hthhnt.exec:\hthhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\7ddjj.exec:\7ddjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ttnnhn.exec:\ttnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5dpvd.exec:\5dpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\3ttthh.exec:\3ttthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pjvdv.exec:\pjvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tthtbb.exec:\tthtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\5nhnhn.exec:\5nhnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5ppdv.exec:\5ppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tntbnn.exec:\tntbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\1rffllx.exec:\1rffllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tnbhhh.exec:\tnbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\1dpvj.exec:\1dpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xrfrxrl.exec:\xrfrxrl.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\7vvjp.exec:\7vvjp.exe18⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7xlrffr.exec:\7xlrffr.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3dddd.exec:\3dddd.exe20⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lfrrflr.exec:\lfrrflr.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jjvvj.exec:\jjvvj.exe22⤵
- Executes dropped EXE
PID:1060 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe23⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nbthtb.exec:\nbthtb.exe24⤵
- Executes dropped EXE
PID:936 -
\??\c:\dvvdj.exec:\dvvdj.exe25⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hhbhnn.exec:\hhbhnn.exe26⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5hbhbh.exec:\5hbhbh.exe27⤵
- Executes dropped EXE
PID:944 -
\??\c:\jdvjd.exec:\jdvjd.exe28⤵
- Executes dropped EXE
PID:1092 -
\??\c:\lffflrf.exec:\lffflrf.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1tthnn.exec:\1tthnn.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1lffrxx.exec:\1lffrxx.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vpjpv.exec:\vpjpv.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\frlrffr.exec:\frlrffr.exe33⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ppjjv.exec:\ppjjv.exe34⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrllfxr.exec:\xrllfxr.exe35⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bthhnn.exec:\bthhnn.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tnnnhh.exec:\tnnnhh.exe37⤵PID:1588
-
\??\c:\nhbbtb.exec:\nhbbtb.exe38⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9hbhtt.exec:\9hbhtt.exe39⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dvjjv.exec:\dvjjv.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xffxlfx.exec:\xffxlfx.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hhhbbb.exec:\hhhbbb.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pdvdv.exec:\pdvdv.exe43⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pjpvj.exec:\pjpvj.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xxxlxxl.exec:\xxxlxxl.exe45⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bbthtb.exec:\bbthtb.exe46⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnbntb.exec:\nnbntb.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dvpvp.exec:\dvpvp.exe48⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fxxflrf.exec:\fxxflrf.exe49⤵
- Executes dropped EXE
PID:2944 -
\??\c:\tnbhnt.exec:\tnbhnt.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thtbhn.exec:\thtbhn.exe51⤵
- Executes dropped EXE
PID:344 -
\??\c:\jjvpv.exec:\jjvpv.exe52⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lfxflrf.exec:\lfxflrf.exe53⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1bbhbn.exec:\1bbhbn.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9nhnbb.exec:\9nhnbb.exe55⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ppvpp.exec:\ppvpp.exe56⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lflrfll.exec:\lflrfll.exe57⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hhnhbb.exec:\hhnhbb.exe58⤵
- Executes dropped EXE
PID:668 -
\??\c:\nhnthb.exec:\nhnthb.exe59⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jdvvd.exec:\jdvvd.exe60⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rxrllfl.exec:\rxrllfl.exe61⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nbhbbn.exec:\nbhbbn.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7pjpv.exec:\7pjpv.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ddvdj.exec:\ddvdj.exe64⤵
- Executes dropped EXE
PID:740 -
\??\c:\xlfflfl.exec:\xlfflfl.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\hnnnbb.exec:\hnnnbb.exe66⤵
- Executes dropped EXE
PID:584 -
\??\c:\jjddv.exec:\jjddv.exe67⤵PID:936
-
\??\c:\pppvp.exec:\pppvp.exe68⤵PID:1556
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe69⤵PID:2192
-
\??\c:\btnbbh.exec:\btnbbh.exe70⤵PID:348
-
\??\c:\ddjjj.exec:\ddjjj.exe71⤵PID:1704
-
\??\c:\ddvdj.exec:\ddvdj.exe72⤵PID:920
-
\??\c:\1xrxlrx.exec:\1xrxlrx.exe73⤵PID:3044
-
\??\c:\5nhhtb.exec:\5nhhtb.exe74⤵PID:1964
-
\??\c:\9ddjd.exec:\9ddjd.exe75⤵PID:684
-
\??\c:\vpjpd.exec:\vpjpd.exe76⤵PID:984
-
\??\c:\ffxxrfr.exec:\ffxxrfr.exe77⤵PID:2096
-
\??\c:\ttnbnt.exec:\ttnbnt.exe78⤵PID:2060
-
\??\c:\dvpvd.exec:\dvpvd.exe79⤵PID:3024
-
\??\c:\5ddpv.exec:\5ddpv.exe80⤵PID:1720
-
\??\c:\rrlllxf.exec:\rrlllxf.exe81⤵PID:2920
-
\??\c:\tnnthn.exec:\tnnthn.exe82⤵PID:2456
-
\??\c:\3hbbnn.exec:\3hbbnn.exe83⤵PID:2260
-
\??\c:\vvjjv.exec:\vvjjv.exe84⤵PID:2100
-
\??\c:\1frxfll.exec:\1frxfll.exe85⤵PID:2568
-
\??\c:\tnbhnb.exec:\tnbhnb.exe86⤵PID:2784
-
\??\c:\tnhhtb.exec:\tnhhtb.exe87⤵PID:2700
-
\??\c:\dvppd.exec:\dvppd.exe88⤵PID:2748
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe89⤵PID:2644
-
\??\c:\bttbtt.exec:\bttbtt.exe90⤵PID:2108
-
\??\c:\3ttthh.exec:\3ttthh.exe91⤵PID:2716
-
\??\c:\9vpjp.exec:\9vpjp.exe92⤵PID:2760
-
\??\c:\pjdjp.exec:\pjdjp.exe93⤵PID:2652
-
\??\c:\rllxxfr.exec:\rllxxfr.exe94⤵PID:2756
-
\??\c:\thbhnn.exec:\thbhnn.exe95⤵PID:2944
-
\??\c:\3pvpp.exec:\3pvpp.exe96⤵PID:2560
-
\??\c:\1xrxffr.exec:\1xrxffr.exe97⤵PID:2808
-
\??\c:\hhnbbt.exec:\hhnbbt.exe98⤵PID:2816
-
\??\c:\7thhnn.exec:\7thhnn.exe99⤵PID:2844
-
\??\c:\dvjpd.exec:\dvjpd.exe100⤵PID:2936
-
\??\c:\rrfxllr.exec:\rrfxllr.exe101⤵PID:3052
-
\??\c:\thtnbt.exec:\thtnbt.exe102⤵PID:2960
-
\??\c:\5tbbnn.exec:\5tbbnn.exe103⤵PID:1716
-
\??\c:\jjvvd.exec:\jjvvd.exe104⤵PID:668
-
\??\c:\7xlflfr.exec:\7xlflfr.exe105⤵PID:2548
-
\??\c:\hhbhnh.exec:\hhbhnh.exe106⤵PID:1924
-
\??\c:\9btthn.exec:\9btthn.exe107⤵PID:2352
-
\??\c:\7djpv.exec:\7djpv.exe108⤵PID:1768
-
\??\c:\lxllrrx.exec:\lxllrrx.exe109⤵PID:900
-
\??\c:\5bbbbh.exec:\5bbbbh.exe110⤵PID:2892
-
\??\c:\hbnhtb.exec:\hbnhtb.exe111⤵PID:1488
-
\??\c:\dvppj.exec:\dvppj.exe112⤵PID:2800
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe113⤵PID:2164
-
\??\c:\llfxxxf.exec:\llfxxxf.exe114⤵PID:2200
-
\??\c:\nnhntb.exec:\nnhntb.exe115⤵PID:700
-
\??\c:\dpjdp.exec:\dpjdp.exe116⤵PID:628
-
\??\c:\vvvdj.exec:\vvvdj.exe117⤵PID:1724
-
\??\c:\lfllffr.exec:\lfllffr.exe118⤵PID:1092
-
\??\c:\3pvpp.exec:\3pvpp.exe119⤵PID:752
-
\??\c:\1lrfffl.exec:\1lrfffl.exe120⤵PID:292
-
\??\c:\bhbntb.exec:\bhbntb.exe121⤵PID:284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-