Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 21:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe
-
Size
454KB
-
MD5
8bc6bbb8b8e2f2375732fb110ca9f6ec
-
SHA1
1e4cd5513ce1fb6a3f1de378c75c26db3296a5db
-
SHA256
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2
-
SHA512
9a39c12d6cede91b3e8c180ccf26f5f8472eecf02070587dd1f680332a7c522dfd6943ee3b32ad36e707eb9e996708879d3e8a7468b4c059441a23c57b887830
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2264-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-85-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-96-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2548-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-115-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3048-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1184-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-153-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/568-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-189-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2460-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-294-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1412-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-330-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-446-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1936-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-480-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-505-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1564-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-588-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2240-595-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2644-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-698-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-719-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2480-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-761-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-771-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1540-778-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1420-817-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2180-887-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2508-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2176 lflfffl.exe 2692 5hnnbh.exe 2396 pjvvj.exe 2800 3xlflfl.exe 2716 ddvpp.exe 2868 xrfrflr.exe 2852 htbtbh.exe 2932 vpjjp.exe 2548 9rxxrxl.exe 2620 3hhhbt.exe 3048 vppvd.exe 2028 hnhnhn.exe 1184 7nhthh.exe 1708 ffrrfxl.exe 1428 lxxfrxl.exe 1204 pdpvp.exe 568 7xrrxfl.exe 1548 nnbnhn.exe 2668 jjppv.exe 2460 xxrrffl.exe 2300 llflrrf.exe 1800 rllllrx.exe 1104 7bnntb.exe 2696 jjvjv.exe 1284 btbhhn.exe 2184 vvjpd.exe 2520 fxlxllx.exe 2292 vvvpv.exe 2104 3lflrxf.exe 1888 7nbhht.exe 1412 vjdjv.exe 2572 9fxflrf.exe 1248 nnbhtb.exe 1604 dvpvj.exe 2420 3vppd.exe 2484 rrxxffx.exe 2324 llffxxr.exe 2836 nbnhnn.exe 2828 dpdjp.exe 2820 xrfrfrf.exe 2732 lxffrrx.exe 2500 nhthtt.exe 2780 7jjjv.exe 2636 jvjjp.exe 2548 7ffxlrx.exe 3012 nhtttt.exe 2544 hbthnh.exe 3004 pjvvd.exe 1504 lxxfrfx.exe 1184 fxrlxxf.exe 1708 tnhtbh.exe 1016 jddjj.exe 848 vvppp.exe 1204 3rrxflx.exe 1884 7btbnt.exe 1936 nhnnnt.exe 1360 vvjpv.exe 2320 lfrlrrf.exe 2496 1frrffr.exe 2312 3bbhnb.exe 1656 9pjjv.exe 2244 dvpvj.exe 448 frlxxxf.exe 1040 bthbhh.exe -
resource yara_rule behavioral1/memory/2264-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-27-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2716-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-446-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2320-463-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2312-480-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2244-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-927-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2176 2264 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 30 PID 2264 wrote to memory of 2176 2264 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 30 PID 2264 wrote to memory of 2176 2264 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 30 PID 2264 wrote to memory of 2176 2264 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 30 PID 2176 wrote to memory of 2692 2176 lflfffl.exe 31 PID 2176 wrote to memory of 2692 2176 lflfffl.exe 31 PID 2176 wrote to memory of 2692 2176 lflfffl.exe 31 PID 2176 wrote to memory of 2692 2176 lflfffl.exe 31 PID 2692 wrote to memory of 2396 2692 5hnnbh.exe 32 PID 2692 wrote to memory of 2396 2692 5hnnbh.exe 32 PID 2692 wrote to memory of 2396 2692 5hnnbh.exe 32 PID 2692 wrote to memory of 2396 2692 5hnnbh.exe 32 PID 2396 wrote to memory of 2800 2396 pjvvj.exe 33 PID 2396 wrote to memory of 2800 2396 pjvvj.exe 33 PID 2396 wrote to memory of 2800 2396 pjvvj.exe 33 PID 2396 wrote to memory of 2800 2396 pjvvj.exe 33 PID 2800 wrote to memory of 2716 2800 3xlflfl.exe 34 PID 2800 wrote to memory of 2716 2800 3xlflfl.exe 34 PID 2800 wrote to memory of 2716 2800 3xlflfl.exe 34 PID 2800 wrote to memory of 2716 2800 3xlflfl.exe 34 PID 2716 wrote to memory of 2868 2716 ddvpp.exe 35 PID 2716 wrote to memory of 2868 2716 ddvpp.exe 35 PID 2716 wrote to memory of 2868 2716 ddvpp.exe 35 PID 2716 wrote to memory of 2868 2716 ddvpp.exe 35 PID 2868 wrote to memory of 2852 2868 xrfrflr.exe 36 PID 2868 wrote to memory of 2852 2868 xrfrflr.exe 36 PID 2868 wrote to memory of 2852 2868 xrfrflr.exe 36 PID 2868 wrote to memory of 2852 2868 xrfrflr.exe 36 PID 2852 wrote to memory of 2932 2852 htbtbh.exe 37 PID 2852 wrote to memory of 2932 2852 htbtbh.exe 37 PID 2852 wrote to memory of 2932 2852 htbtbh.exe 37 PID 2852 wrote to memory of 2932 2852 htbtbh.exe 37 PID 2932 wrote to memory of 2548 2932 vpjjp.exe 38 PID 2932 wrote to memory of 2548 2932 vpjjp.exe 38 PID 2932 wrote to memory of 2548 2932 vpjjp.exe 38 PID 2932 wrote to memory of 2548 2932 vpjjp.exe 38 PID 2548 wrote to memory of 2620 2548 9rxxrxl.exe 39 PID 2548 wrote to memory of 2620 2548 9rxxrxl.exe 39 PID 2548 wrote to memory of 2620 2548 9rxxrxl.exe 39 PID 2548 wrote to memory of 2620 2548 9rxxrxl.exe 39 PID 2620 wrote to memory of 3048 2620 3hhhbt.exe 40 PID 2620 wrote to memory of 3048 2620 3hhhbt.exe 40 PID 2620 wrote to memory of 3048 2620 3hhhbt.exe 40 PID 2620 wrote to memory of 3048 2620 3hhhbt.exe 40 PID 3048 wrote to memory of 2028 3048 vppvd.exe 41 PID 3048 wrote to memory of 2028 3048 vppvd.exe 41 PID 3048 wrote to memory of 2028 3048 vppvd.exe 41 PID 3048 wrote to memory of 2028 3048 vppvd.exe 41 PID 2028 wrote to memory of 1184 2028 hnhnhn.exe 42 PID 2028 wrote to memory of 1184 2028 hnhnhn.exe 42 PID 2028 wrote to memory of 1184 2028 hnhnhn.exe 42 PID 2028 wrote to memory of 1184 2028 hnhnhn.exe 42 PID 1184 wrote to memory of 1708 1184 7nhthh.exe 43 PID 1184 wrote to memory of 1708 1184 7nhthh.exe 43 PID 1184 wrote to memory of 1708 1184 7nhthh.exe 43 PID 1184 wrote to memory of 1708 1184 7nhthh.exe 43 PID 1708 wrote to memory of 1428 1708 ffrrfxl.exe 44 PID 1708 wrote to memory of 1428 1708 ffrrfxl.exe 44 PID 1708 wrote to memory of 1428 1708 ffrrfxl.exe 44 PID 1708 wrote to memory of 1428 1708 ffrrfxl.exe 44 PID 1428 wrote to memory of 1204 1428 lxxfrxl.exe 45 PID 1428 wrote to memory of 1204 1428 lxxfrxl.exe 45 PID 1428 wrote to memory of 1204 1428 lxxfrxl.exe 45 PID 1428 wrote to memory of 1204 1428 lxxfrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe"C:\Users\Admin\AppData\Local\Temp\fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\lflfffl.exec:\lflfffl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\5hnnbh.exec:\5hnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\pjvvj.exec:\pjvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\3xlflfl.exec:\3xlflfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ddvpp.exec:\ddvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xrfrflr.exec:\xrfrflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\htbtbh.exec:\htbtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vpjjp.exec:\vpjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\9rxxrxl.exec:\9rxxrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\3hhhbt.exec:\3hhhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vppvd.exec:\vppvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hnhnhn.exec:\hnhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7nhthh.exec:\7nhthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\ffrrfxl.exec:\ffrrfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lxxfrxl.exec:\lxxfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\pdpvp.exec:\pdpvp.exe17⤵
- Executes dropped EXE
PID:1204 -
\??\c:\7xrrxfl.exec:\7xrrxfl.exe18⤵
- Executes dropped EXE
PID:568 -
\??\c:\nnbnhn.exec:\nnbnhn.exe19⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jjppv.exec:\jjppv.exe20⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xxrrffl.exec:\xxrrffl.exe21⤵
- Executes dropped EXE
PID:2460 -
\??\c:\llflrrf.exec:\llflrrf.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rllllrx.exec:\rllllrx.exe23⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7bnntb.exec:\7bnntb.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jjvjv.exec:\jjvjv.exe25⤵
- Executes dropped EXE
PID:2696 -
\??\c:\btbhhn.exec:\btbhhn.exe26⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vvjpd.exec:\vvjpd.exe27⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fxlxllx.exec:\fxlxllx.exe28⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vvvpv.exec:\vvvpv.exe29⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3lflrxf.exec:\3lflrxf.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7nbhht.exec:\7nbhht.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vjdjv.exec:\vjdjv.exe32⤵
- Executes dropped EXE
PID:1412 -
\??\c:\9fxflrf.exec:\9fxflrf.exe33⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nnbhtb.exec:\nnbhtb.exe34⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dvpvj.exec:\dvpvj.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3vppd.exec:\3vppd.exe36⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rrxxffx.exec:\rrxxffx.exe37⤵
- Executes dropped EXE
PID:2484 -
\??\c:\llffxxr.exec:\llffxxr.exe38⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nbnhnn.exec:\nbnhnn.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dpdjp.exec:\dpdjp.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xrfrfrf.exec:\xrfrfrf.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lxffrrx.exec:\lxffrrx.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhthtt.exec:\nhthtt.exe43⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7jjjv.exec:\7jjjv.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jvjjp.exec:\jvjjp.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\7ffxlrx.exec:\7ffxlrx.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nhtttt.exec:\nhtttt.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hbthnh.exec:\hbthnh.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjvvd.exec:\pjvvd.exe49⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lxxfrfx.exec:\lxxfrfx.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe51⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tnhtbh.exec:\tnhtbh.exe52⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jddjj.exec:\jddjj.exe53⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vvppp.exec:\vvppp.exe54⤵
- Executes dropped EXE
PID:848 -
\??\c:\3rrxflx.exec:\3rrxflx.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\7btbnt.exec:\7btbnt.exe56⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nhnnnt.exec:\nhnnnt.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vvjpv.exec:\vvjpv.exe58⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe59⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1frrffr.exec:\1frrffr.exe60⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3bbhnb.exec:\3bbhnb.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9pjjv.exec:\9pjjv.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dvpvj.exec:\dvpvj.exe63⤵
- Executes dropped EXE
PID:2244 -
\??\c:\frlxxxf.exec:\frlxxxf.exe64⤵
- Executes dropped EXE
PID:448 -
\??\c:\bthbhh.exec:\bthbhh.exe65⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hhbbnn.exec:\hhbbnn.exe66⤵PID:1556
-
\??\c:\rlfflrx.exec:\rlfflrx.exe67⤵PID:1368
-
\??\c:\nnbhnn.exec:\nnbhnn.exe68⤵PID:2492
-
\??\c:\hbntnt.exec:\hbntnt.exe69⤵PID:1676
-
\??\c:\jjjjv.exec:\jjjjv.exe70⤵PID:352
-
\??\c:\xxlrrrr.exec:\xxlrrrr.exe71⤵PID:1992
-
\??\c:\tntbhn.exec:\tntbhn.exe72⤵PID:2368
-
\??\c:\bhhnnt.exec:\bhhnnt.exe73⤵PID:1564
-
\??\c:\jdppv.exec:\jdppv.exe74⤵PID:1636
-
\??\c:\xrllxxf.exec:\xrllxxf.exe75⤵PID:2384
-
\??\c:\9lflrxf.exec:\9lflrxf.exe76⤵PID:2356
-
\??\c:\bnbbhh.exec:\bnbbhh.exe77⤵PID:2088
-
\??\c:\pjvvd.exec:\pjvvd.exe78⤵PID:2240
-
\??\c:\xlxxxfr.exec:\xlxxxfr.exe79⤵PID:2372
-
\??\c:\rflfffx.exec:\rflfffx.exe80⤵PID:2204
-
\??\c:\thbhnt.exec:\thbhnt.exe81⤵PID:2872
-
\??\c:\9jpjj.exec:\9jpjj.exe82⤵PID:2716
-
\??\c:\dpjdd.exec:\dpjdd.exe83⤵PID:2868
-
\??\c:\xrlrflf.exec:\xrlrflf.exe84⤵PID:2708
-
\??\c:\5nhhbh.exec:\5nhhbh.exe85⤵PID:2644
-
\??\c:\bbntbb.exec:\bbntbb.exe86⤵PID:2904
-
\??\c:\5djpj.exec:\5djpj.exe87⤵PID:2720
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe88⤵PID:2624
-
\??\c:\bntttt.exec:\bntttt.exe89⤵PID:2684
-
\??\c:\nhtthh.exec:\nhtthh.exe90⤵PID:1552
-
\??\c:\7vdvv.exec:\7vdvv.exe91⤵PID:2028
-
\??\c:\lfllxxl.exec:\lfllxxl.exe92⤵PID:1772
-
\??\c:\3xrrrxf.exec:\3xrrrxf.exe93⤵PID:1716
-
\??\c:\thbhtn.exec:\thbhtn.exe94⤵PID:1864
-
\??\c:\bbnthn.exec:\bbnthn.exe95⤵PID:2436
-
\??\c:\jjvdp.exec:\jjvdp.exe96⤵PID:1204
-
\??\c:\xllfxlx.exec:\xllfxlx.exe97⤵PID:1680
-
\??\c:\xlflllx.exec:\xlflllx.exe98⤵PID:2804
-
\??\c:\1tbbnt.exec:\1tbbnt.exe99⤵PID:2480
-
\??\c:\3dvpp.exec:\3dvpp.exe100⤵PID:2488
-
\??\c:\9dvdp.exec:\9dvdp.exe101⤵PID:2704
-
\??\c:\rfxffrr.exec:\rfxffrr.exe102⤵PID:1800
-
\??\c:\thbbnb.exec:\thbbnb.exe103⤵PID:2896
-
\??\c:\pjddp.exec:\pjddp.exe104⤵PID:1104
-
\??\c:\9pjjd.exec:\9pjjd.exe105⤵PID:1540
-
\??\c:\3rrxlfl.exec:\3rrxlfl.exe106⤵PID:700
-
\??\c:\5tnbnn.exec:\5tnbnn.exe107⤵PID:1052
-
\??\c:\jjppd.exec:\jjppd.exe108⤵PID:600
-
\??\c:\9vpvd.exec:\9vpvd.exe109⤵PID:1044
-
\??\c:\xrllrxl.exec:\xrllrxl.exe110⤵PID:2020
-
\??\c:\bbtbbb.exec:\bbtbbb.exe111⤵PID:1420
-
\??\c:\btnnbh.exec:\btnnbh.exe112⤵PID:2148
-
\??\c:\dvpvj.exec:\dvpvj.exe113⤵PID:1512
-
\??\c:\xrffrxf.exec:\xrffrxf.exe114⤵PID:2176
-
\??\c:\bttbhb.exec:\bttbhb.exe115⤵PID:1704
-
\??\c:\hhnthh.exec:\hhnthh.exe116⤵PID:2692
-
\??\c:\9vdvv.exec:\9vdvv.exe117⤵PID:2688
-
\??\c:\vvppd.exec:\vvppd.exe118⤵PID:1524
-
\??\c:\llffrxl.exec:\llffrxl.exe119⤵PID:992
-
\??\c:\hhbntt.exec:\hhbntt.exe120⤵PID:2012
-
\??\c:\hhbtbb.exec:\hhbtbb.exe121⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-