Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe
-
Size
454KB
-
MD5
92706b185a0a7917dc5a89d83c9d8c4c
-
SHA1
7ca2503787c32721b5a5c53d08d8a6282045b099
-
SHA256
5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c
-
SHA512
39e25fdf2fbb4f4bfe7ccf3fa5b4805570715e549b97d3543e2635aa8249519087bbd7688115e72f0c055796f7002b74d166bd5aa2bac661c92d35ee928e6448
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2124-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-154-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2292-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-400-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2768-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-499-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/844-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-607-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-644-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/264-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-721-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2244-752-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1300-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-787-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/996-808-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-842-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-861-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/760-893-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 hbbnbn.exe 2700 vjdvj.exe 2712 3rlfrxf.exe 2816 hhttnh.exe 1884 vpjjp.exe 2688 frlflxr.exe 2612 hhnttn.exe 1636 rfrrxlr.exe 2124 rlxfrrl.exe 1852 bthnhn.exe 1948 xlxfrrx.exe 1420 3bnnbb.exe 2296 vjppv.exe 1200 rlxlxxx.exe 2744 9thntt.exe 692 rxffrll.exe 2292 frlrrrx.exe 1836 btbbhh.exe 3000 pdpjp.exe 444 5xlllrx.exe 2368 5dpvd.exe 1244 3fllxrx.exe 1856 ttbhtb.exe 2004 7vjpd.exe 1696 lxrxlrx.exe 2212 9htbnt.exe 2532 1vpvj.exe 2496 1frxllx.exe 2036 htbbbb.exe 108 1jppp.exe 2068 xrxrxff.exe 1552 5djjp.exe 2860 jdvvp.exe 2980 rfrllxr.exe 2856 hnbhth.exe 2564 7vddj.exe 2948 lfxfrlx.exe 2904 jvvvv.exe 2640 rlrrffl.exe 1112 nhttbn.exe 3024 ppppv.exe 2936 tnbhth.exe 2800 djddp.exe 2224 pdvpv.exe 1956 xrxxllx.exe 1948 thbbbb.exe 2768 tnbbnn.exe 2064 vjvpd.exe 804 xxlrxxf.exe 2808 llxflrx.exe 2440 thbbhh.exe 264 jdpdj.exe 828 7vjpp.exe 2924 5llrllf.exe 344 bnbbbb.exe 1680 btbtbt.exe 3000 5dddp.exe 1084 xrlllrx.exe 444 1xlfrrr.exe 1996 nnnttt.exe 2464 dvjpv.exe 900 dvpdp.exe 992 rlffffl.exe 1600 nbnntb.exe -
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2840 2672 5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe 30 PID 2672 wrote to memory of 2840 2672 5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe 30 PID 2672 wrote to memory of 2840 2672 5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe 30 PID 2672 wrote to memory of 2840 2672 5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe 30 PID 2840 wrote to memory of 2700 2840 hbbnbn.exe 31 PID 2840 wrote to memory of 2700 2840 hbbnbn.exe 31 PID 2840 wrote to memory of 2700 2840 hbbnbn.exe 31 PID 2840 wrote to memory of 2700 2840 hbbnbn.exe 31 PID 2700 wrote to memory of 2712 2700 vjdvj.exe 32 PID 2700 wrote to memory of 2712 2700 vjdvj.exe 32 PID 2700 wrote to memory of 2712 2700 vjdvj.exe 32 PID 2700 wrote to memory of 2712 2700 vjdvj.exe 32 PID 2712 wrote to memory of 2816 2712 3rlfrxf.exe 33 PID 2712 wrote to memory of 2816 2712 3rlfrxf.exe 33 PID 2712 wrote to memory of 2816 2712 3rlfrxf.exe 33 PID 2712 wrote to memory of 2816 2712 3rlfrxf.exe 33 PID 2816 wrote to memory of 1884 2816 hhttnh.exe 34 PID 2816 wrote to memory of 1884 2816 hhttnh.exe 34 PID 2816 wrote to memory of 1884 2816 hhttnh.exe 34 PID 2816 wrote to memory of 1884 2816 hhttnh.exe 34 PID 1884 wrote to memory of 2688 1884 vpjjp.exe 35 PID 1884 wrote to memory of 2688 1884 vpjjp.exe 35 PID 1884 wrote to memory of 2688 1884 vpjjp.exe 35 PID 1884 wrote to memory of 2688 1884 vpjjp.exe 35 PID 2688 wrote to memory of 2612 2688 frlflxr.exe 36 PID 2688 wrote to memory of 2612 2688 frlflxr.exe 36 PID 2688 wrote to memory of 2612 2688 frlflxr.exe 36 PID 2688 wrote to memory of 2612 2688 frlflxr.exe 36 PID 2612 wrote to memory of 1636 2612 hhnttn.exe 37 PID 2612 wrote to memory of 1636 2612 hhnttn.exe 37 PID 2612 wrote to memory of 1636 2612 hhnttn.exe 37 PID 2612 wrote to memory of 1636 2612 hhnttn.exe 37 PID 1636 wrote to memory of 2124 1636 rfrrxlr.exe 38 PID 1636 wrote to memory of 2124 1636 rfrrxlr.exe 38 PID 1636 wrote to memory of 2124 1636 rfrrxlr.exe 38 PID 1636 wrote to memory of 2124 1636 rfrrxlr.exe 38 PID 2124 wrote to memory of 1852 2124 rlxfrrl.exe 39 PID 2124 wrote to memory of 1852 2124 rlxfrrl.exe 39 PID 2124 wrote to memory of 1852 2124 rlxfrrl.exe 39 PID 2124 wrote to memory of 1852 2124 rlxfrrl.exe 39 PID 1852 wrote to memory of 1948 1852 bthnhn.exe 40 PID 1852 wrote to memory of 1948 1852 bthnhn.exe 40 PID 1852 wrote to memory of 1948 1852 bthnhn.exe 40 PID 1852 wrote to memory of 1948 1852 bthnhn.exe 40 PID 1948 wrote to memory of 1420 1948 xlxfrrx.exe 41 PID 1948 wrote to memory of 1420 1948 xlxfrrx.exe 41 PID 1948 wrote to memory of 1420 1948 xlxfrrx.exe 41 PID 1948 wrote to memory of 1420 1948 xlxfrrx.exe 41 PID 1420 wrote to memory of 2296 1420 3bnnbb.exe 42 PID 1420 wrote to memory of 2296 1420 3bnnbb.exe 42 PID 1420 wrote to memory of 2296 1420 3bnnbb.exe 42 PID 1420 wrote to memory of 2296 1420 3bnnbb.exe 42 PID 2296 wrote to memory of 1200 2296 vjppv.exe 43 PID 2296 wrote to memory of 1200 2296 vjppv.exe 43 PID 2296 wrote to memory of 1200 2296 vjppv.exe 43 PID 2296 wrote to memory of 1200 2296 vjppv.exe 43 PID 1200 wrote to memory of 2744 1200 rlxlxxx.exe 44 PID 1200 wrote to memory of 2744 1200 rlxlxxx.exe 44 PID 1200 wrote to memory of 2744 1200 rlxlxxx.exe 44 PID 1200 wrote to memory of 2744 1200 rlxlxxx.exe 44 PID 2744 wrote to memory of 692 2744 9thntt.exe 45 PID 2744 wrote to memory of 692 2744 9thntt.exe 45 PID 2744 wrote to memory of 692 2744 9thntt.exe 45 PID 2744 wrote to memory of 692 2744 9thntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe"C:\Users\Admin\AppData\Local\Temp\5c4a0c40d4832b1aa6ae36a9d1185aae4b75027cd54755471949e325d93b8f5c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\hbbnbn.exec:\hbbnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vjdvj.exec:\vjdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\3rlfrxf.exec:\3rlfrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hhttnh.exec:\hhttnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vpjjp.exec:\vpjjp.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\frlflxr.exec:\frlflxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hhnttn.exec:\hhnttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rfrrxlr.exec:\rfrrxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\bthnhn.exec:\bthnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xlxfrrx.exec:\xlxfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\3bnnbb.exec:\3bnnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\vjppv.exec:\vjppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rlxlxxx.exec:\rlxlxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\9thntt.exec:\9thntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rxffrll.exec:\rxffrll.exe17⤵
- Executes dropped EXE
PID:692 -
\??\c:\frlrrrx.exec:\frlrrrx.exe18⤵
- Executes dropped EXE
PID:2292 -
\??\c:\btbbhh.exec:\btbbhh.exe19⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pdpjp.exec:\pdpjp.exe20⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5xlllrx.exec:\5xlllrx.exe21⤵
- Executes dropped EXE
PID:444 -
\??\c:\5dpvd.exec:\5dpvd.exe22⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3fllxrx.exec:\3fllxrx.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ttbhtb.exec:\ttbhtb.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7vjpd.exec:\7vjpd.exe25⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lxrxlrx.exec:\lxrxlrx.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9htbnt.exec:\9htbnt.exe27⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1vpvj.exec:\1vpvj.exe28⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1frxllx.exec:\1frxllx.exe29⤵
- Executes dropped EXE
PID:2496 -
\??\c:\htbbbb.exec:\htbbbb.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1jppp.exec:\1jppp.exe31⤵
- Executes dropped EXE
PID:108 -
\??\c:\xrxrxff.exec:\xrxrxff.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5djjp.exec:\5djjp.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jdvvp.exec:\jdvvp.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rfrllxr.exec:\rfrllxr.exe35⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hnbhth.exec:\hnbhth.exe36⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7vddj.exec:\7vddj.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe38⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jvvvv.exec:\jvvvv.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlrrffl.exec:\rlrrffl.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nhttbn.exec:\nhttbn.exe41⤵
- Executes dropped EXE
PID:1112 -
\??\c:\ppppv.exec:\ppppv.exe42⤵
- Executes dropped EXE
PID:3024 -
\??\c:\tnbhth.exec:\tnbhth.exe43⤵
- Executes dropped EXE
PID:2936 -
\??\c:\djddp.exec:\djddp.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pdvpv.exec:\pdvpv.exe45⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrxxllx.exec:\xrxxllx.exe46⤵
- Executes dropped EXE
PID:1956 -
\??\c:\thbbbb.exec:\thbbbb.exe47⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tnbbnn.exec:\tnbbnn.exe48⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vjvpd.exec:\vjvpd.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe50⤵
- Executes dropped EXE
PID:804 -
\??\c:\llxflrx.exec:\llxflrx.exe51⤵
- Executes dropped EXE
PID:2808 -
\??\c:\thbbhh.exec:\thbbhh.exe52⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdpdj.exec:\jdpdj.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\7vjpp.exec:\7vjpp.exe54⤵
- Executes dropped EXE
PID:828 -
\??\c:\5llrllf.exec:\5llrllf.exe55⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bnbbbb.exec:\bnbbbb.exe56⤵
- Executes dropped EXE
PID:344 -
\??\c:\btbtbt.exec:\btbtbt.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5dddp.exec:\5dddp.exe58⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xrlllrx.exec:\xrlllrx.exe59⤵
- Executes dropped EXE
PID:1084 -
\??\c:\1xlfrrr.exec:\1xlfrrr.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\nnnttt.exec:\nnnttt.exe61⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvjpv.exec:\dvjpv.exe62⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dvpdp.exec:\dvpdp.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\rlffffl.exec:\rlffffl.exe64⤵
- Executes dropped EXE
PID:992 -
\??\c:\nbnntb.exec:\nbnntb.exe65⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tnbbtn.exec:\tnbbtn.exe66⤵PID:2872
-
\??\c:\jdppv.exec:\jdppv.exe67⤵PID:1656
-
\??\c:\9xlrflr.exec:\9xlrflr.exe68⤵PID:1020
-
\??\c:\1bnntt.exec:\1bnntt.exe69⤵PID:844
-
\??\c:\nhtthh.exec:\nhtthh.exe70⤵PID:2956
-
\??\c:\9jvdj.exec:\9jvdj.exe71⤵PID:1000
-
\??\c:\1llfffr.exec:\1llfffr.exe72⤵PID:2460
-
\??\c:\xrfffff.exec:\xrfffff.exe73⤵PID:1412
-
\??\c:\hhthnh.exec:\hhthnh.exe74⤵PID:2652
-
\??\c:\dpddj.exec:\dpddj.exe75⤵PID:2968
-
\??\c:\pdjjp.exec:\pdjjp.exe76⤵PID:2756
-
\??\c:\9flflfl.exec:\9flflfl.exe77⤵PID:2720
-
\??\c:\3frxfff.exec:\3frxfff.exe78⤵PID:2740
-
\??\c:\ntnthn.exec:\ntnthn.exe79⤵PID:2248
-
\??\c:\jdpvd.exec:\jdpvd.exe80⤵PID:2564
-
\??\c:\xlxrfxf.exec:\xlxrfxf.exe81⤵PID:2684
-
\??\c:\fxlrrrr.exec:\fxlrrrr.exe82⤵PID:3052
-
\??\c:\tnttbb.exec:\tnttbb.exe83⤵PID:2640
-
\??\c:\pdppv.exec:\pdppv.exe84⤵PID:2888
-
\??\c:\jjdjj.exec:\jjdjj.exe85⤵PID:2620
-
\??\c:\llflxxr.exec:\llflxxr.exe86⤵PID:2552
-
\??\c:\5hnhnn.exec:\5hnhnn.exe87⤵PID:2628
-
\??\c:\jjvvj.exec:\jjvvj.exe88⤵PID:1016
-
\??\c:\vpjdd.exec:\vpjdd.exe89⤵PID:2804
-
\??\c:\frlllll.exec:\frlllll.exe90⤵PID:1592
-
\??\c:\hbnntt.exec:\hbnntt.exe91⤵PID:1864
-
\??\c:\9nthhb.exec:\9nthhb.exe92⤵PID:464
-
\??\c:\djpdd.exec:\djpdd.exe93⤵PID:1240
-
\??\c:\xlxrxll.exec:\xlxrxll.exe94⤵PID:2808
-
\??\c:\lfrfllx.exec:\lfrfllx.exe95⤵PID:2412
-
\??\c:\5bbbhh.exec:\5bbbhh.exe96⤵PID:264
-
\??\c:\pjpjd.exec:\pjpjd.exe97⤵PID:1560
-
\??\c:\pdpvv.exec:\pdpvv.exe98⤵PID:1836
-
\??\c:\9lxxrll.exec:\9lxxrll.exe99⤵PID:1156
-
\??\c:\hthnnn.exec:\hthnnn.exe100⤵PID:2028
-
\??\c:\vpvvp.exec:\vpvvp.exe101⤵PID:2260
-
\??\c:\pdppv.exec:\pdppv.exe102⤵PID:2244
-
\??\c:\llxfllx.exec:\llxfllx.exe103⤵PID:1300
-
\??\c:\5bhtnn.exec:\5bhtnn.exe104⤵PID:1244
-
\??\c:\nbnbhh.exec:\nbnbhh.exe105⤵PID:1856
-
\??\c:\pjvvj.exec:\pjvvj.exe106⤵PID:2384
-
\??\c:\5xxxffl.exec:\5xxxffl.exe107⤵PID:2184
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe108⤵PID:2352
-
\??\c:\htbbht.exec:\htbbht.exe109⤵PID:2420
-
\??\c:\jvvdd.exec:\jvvdd.exe110⤵PID:996
-
\??\c:\9xfxxxx.exec:\9xfxxxx.exe111⤵PID:2196
-
\??\c:\tnhhnh.exec:\tnhhnh.exe112⤵PID:2956
-
\??\c:\3hbbnt.exec:\3hbbnt.exe113⤵PID:2040
-
\??\c:\djvjd.exec:\djvjd.exe114⤵PID:2460
-
\??\c:\lxllrxr.exec:\lxllrxr.exe115⤵PID:1516
-
\??\c:\rrfflrx.exec:\rrfflrx.exe116⤵PID:2832
-
\??\c:\7tnntb.exec:\7tnntb.exe117⤵PID:2596
-
\??\c:\pjppv.exec:\pjppv.exe118⤵PID:2756
-
\??\c:\xrflxfx.exec:\xrflxfx.exe119⤵PID:2892
-
\??\c:\5xllllr.exec:\5xllllr.exe120⤵PID:2588
-
\??\c:\hthnnn.exec:\hthnnn.exe121⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-