Analysis
-
max time kernel
118s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe
-
Size
456KB
-
MD5
bcd03d2bfe25f8c17b07b6f38dbcf9d0
-
SHA1
b9725e856ff0b1bb855ed16809b0ce436126cd52
-
SHA256
a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510
-
SHA512
5c236f9c80de418d0a0d13e78f8206f49a6cb238c8a74daa56a9b456d9dd94d005cffca04c18a8f842b295447a13cdb4d94423bb85a9820a953b92607fa8a186
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRZ:q7Tc2NYHUrAwfMp3CDRZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/764-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-355-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2220-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-829-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-845-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2848-843-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1688-854-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-720-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2672-707-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-693-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/900-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-382-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2164-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-182-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2920-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-122-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2284-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-94-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2580-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-873-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2632-897-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/308-999-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2520-1029-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-1028-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-1081-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-1094-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3064-1113-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2376-1181-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1964-1184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2656 bthbhn.exe 1160 htnbtn.exe 2888 tnbbbb.exe 2720 nnbhtb.exe 2772 pdjdd.exe 2580 vpvpd.exe 2252 9lxxfxf.exe 2624 pdvvv.exe 2592 3xlrllx.exe 2284 xrxxfff.exe 2632 hbnntn.exe 2896 9vpdj.exe 2760 bnbntt.exe 2372 7nthhb.exe 2876 3dpvj.exe 1940 3rflrrx.exe 1132 bnnhhb.exe 2920 bbnntt.exe 1156 pdjjp.exe 2168 rfxxrrx.exe 1080 1nbhhn.exe 1928 rrllrxf.exe 1596 7ntttt.exe 2556 3btttt.exe 1664 dvjpv.exe 2388 9fllflf.exe 2240 fxffllr.exe 2160 1bhhnn.exe 1628 xffrxfx.exe 884 3xxxrxx.exe 2268 htnntt.exe 2052 btbhnn.exe 2332 jvpvv.exe 2148 lfrrrrr.exe 2776 9tnhhh.exe 2728 nnbbnn.exe 2712 dvddp.exe 1152 xrfllrf.exe 1708 tnhnbh.exe 2628 nhtbbt.exe 2576 ddjvd.exe 1512 vpdpd.exe 2164 rxrxrrf.exe 2220 7thbtn.exe 2192 ddvjv.exe 2836 dvpvd.exe 1292 lfxxlrf.exe 2092 5hhhnn.exe 2200 nnhtht.exe 1436 pppjd.exe 1908 1djdd.exe 2984 5lxllrf.exe 1132 htnttt.exe 1912 bnbbbh.exe 916 jvpdp.exe 700 1rffflf.exe 1840 7lfxffr.exe 2036 nbtthb.exe 1368 btntbh.exe 1424 3pddj.exe 1596 vjppp.exe 1732 1xfflrx.exe 1664 hbbhnt.exe 3056 dvvvv.exe -
resource yara_rule behavioral1/memory/764-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-854-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-873-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2632-895-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2760-925-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2936-956-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2520-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-1140-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1816-1209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-1216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-1253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-1279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-1304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-1317-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 764 wrote to memory of 2656 764 a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe 31 PID 764 wrote to memory of 2656 764 a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe 31 PID 764 wrote to memory of 2656 764 a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe 31 PID 764 wrote to memory of 2656 764 a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe 31 PID 2656 wrote to memory of 1160 2656 bthbhn.exe 32 PID 2656 wrote to memory of 1160 2656 bthbhn.exe 32 PID 2656 wrote to memory of 1160 2656 bthbhn.exe 32 PID 2656 wrote to memory of 1160 2656 bthbhn.exe 32 PID 1160 wrote to memory of 2888 1160 htnbtn.exe 103 PID 1160 wrote to memory of 2888 1160 htnbtn.exe 103 PID 1160 wrote to memory of 2888 1160 htnbtn.exe 103 PID 1160 wrote to memory of 2888 1160 htnbtn.exe 103 PID 2888 wrote to memory of 2720 2888 tnbbbb.exe 146 PID 2888 wrote to memory of 2720 2888 tnbbbb.exe 146 PID 2888 wrote to memory of 2720 2888 tnbbbb.exe 146 PID 2888 wrote to memory of 2720 2888 tnbbbb.exe 146 PID 2720 wrote to memory of 2772 2720 nnbhtb.exe 35 PID 2720 wrote to memory of 2772 2720 nnbhtb.exe 35 PID 2720 wrote to memory of 2772 2720 nnbhtb.exe 35 PID 2720 wrote to memory of 2772 2720 nnbhtb.exe 35 PID 2772 wrote to memory of 2580 2772 pdjdd.exe 36 PID 2772 wrote to memory of 2580 2772 pdjdd.exe 36 PID 2772 wrote to memory of 2580 2772 pdjdd.exe 36 PID 2772 wrote to memory of 2580 2772 pdjdd.exe 36 PID 2580 wrote to memory of 2252 2580 vpvpd.exe 37 PID 2580 wrote to memory of 2252 2580 vpvpd.exe 37 PID 2580 wrote to memory of 2252 2580 vpvpd.exe 37 PID 2580 wrote to memory of 2252 2580 vpvpd.exe 37 PID 2252 wrote to memory of 2624 2252 9lxxfxf.exe 38 PID 2252 wrote to memory of 2624 2252 9lxxfxf.exe 38 PID 2252 wrote to memory of 2624 2252 9lxxfxf.exe 38 PID 2252 wrote to memory of 2624 2252 9lxxfxf.exe 38 PID 2624 wrote to memory of 2592 2624 pdvvv.exe 39 PID 2624 wrote to memory of 2592 2624 pdvvv.exe 39 PID 2624 wrote to memory of 2592 2624 pdvvv.exe 39 PID 2624 wrote to memory of 2592 2624 pdvvv.exe 39 PID 2592 wrote to memory of 2284 2592 3xlrllx.exe 40 PID 2592 wrote to memory of 2284 2592 3xlrllx.exe 40 PID 2592 wrote to memory of 2284 2592 3xlrllx.exe 40 PID 2592 wrote to memory of 2284 2592 3xlrllx.exe 40 PID 2284 wrote to memory of 2632 2284 xrxxfff.exe 156 PID 2284 wrote to memory of 2632 2284 xrxxfff.exe 156 PID 2284 wrote to memory of 2632 2284 xrxxfff.exe 156 PID 2284 wrote to memory of 2632 2284 xrxxfff.exe 156 PID 2632 wrote to memory of 2896 2632 hbnntn.exe 42 PID 2632 wrote to memory of 2896 2632 hbnntn.exe 42 PID 2632 wrote to memory of 2896 2632 hbnntn.exe 42 PID 2632 wrote to memory of 2896 2632 hbnntn.exe 42 PID 2896 wrote to memory of 2760 2896 9vpdj.exe 43 PID 2896 wrote to memory of 2760 2896 9vpdj.exe 43 PID 2896 wrote to memory of 2760 2896 9vpdj.exe 43 PID 2896 wrote to memory of 2760 2896 9vpdj.exe 43 PID 2760 wrote to memory of 2372 2760 bnbntt.exe 44 PID 2760 wrote to memory of 2372 2760 bnbntt.exe 44 PID 2760 wrote to memory of 2372 2760 bnbntt.exe 44 PID 2760 wrote to memory of 2372 2760 bnbntt.exe 44 PID 2372 wrote to memory of 2876 2372 7nthhb.exe 45 PID 2372 wrote to memory of 2876 2372 7nthhb.exe 45 PID 2372 wrote to memory of 2876 2372 7nthhb.exe 45 PID 2372 wrote to memory of 2876 2372 7nthhb.exe 45 PID 2876 wrote to memory of 1940 2876 3dpvj.exe 46 PID 2876 wrote to memory of 1940 2876 3dpvj.exe 46 PID 2876 wrote to memory of 1940 2876 3dpvj.exe 46 PID 2876 wrote to memory of 1940 2876 3dpvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe"C:\Users\Admin\AppData\Local\Temp\a8243d78cd67f1d23df9d6a8882266baf5fee8b6c0699a31928cfbd3ccc50510N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\bthbhn.exec:\bthbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\htnbtn.exec:\htnbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\tnbbbb.exec:\tnbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nnbhtb.exec:\nnbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pdjdd.exec:\pdjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vpvpd.exec:\vpvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\9lxxfxf.exec:\9lxxfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\pdvvv.exec:\pdvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3xlrllx.exec:\3xlrllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xrxxfff.exec:\xrxxfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\hbnntn.exec:\hbnntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9vpdj.exec:\9vpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bnbntt.exec:\bnbntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7nthhb.exec:\7nthhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\3dpvj.exec:\3dpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\3rflrrx.exec:\3rflrrx.exe17⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bnnhhb.exec:\bnnhhb.exe18⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bbnntt.exec:\bbnntt.exe19⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdjjp.exec:\pdjjp.exe20⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rfxxrrx.exec:\rfxxrrx.exe21⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1nbhhn.exec:\1nbhhn.exe22⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rrllrxf.exec:\rrllrxf.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\7ntttt.exec:\7ntttt.exe24⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3btttt.exec:\3btttt.exe25⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvjpv.exec:\dvjpv.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9fllflf.exec:\9fllflf.exe27⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fxffllr.exec:\fxffllr.exe28⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1bhhnn.exec:\1bhhnn.exe29⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xffrxfx.exec:\xffrxfx.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3xxxrxx.exec:\3xxxrxx.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\htnntt.exec:\htnntt.exe32⤵
- Executes dropped EXE
PID:2268 -
\??\c:\btbhnn.exec:\btbhnn.exe33⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jvpvv.exec:\jvpvv.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe35⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9tnhhh.exec:\9tnhhh.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nnbbnn.exec:\nnbbnn.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvddp.exec:\dvddp.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xrfllrf.exec:\xrfllrf.exe39⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tnhnbh.exec:\tnhnbh.exe40⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nhtbbt.exec:\nhtbbt.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ddjvd.exec:\ddjvd.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vpdpd.exec:\vpdpd.exe43⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rxrxrrf.exec:\rxrxrrf.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7thbtn.exec:\7thbtn.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ddvjv.exec:\ddvjv.exe46⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dvpvd.exec:\dvpvd.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe48⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5hhhnn.exec:\5hhhnn.exe49⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nnhtht.exec:\nnhtht.exe50⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pppjd.exec:\pppjd.exe51⤵
- Executes dropped EXE
PID:1436 -
\??\c:\1djdd.exec:\1djdd.exe52⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5lxllrf.exec:\5lxllrf.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\htnttt.exec:\htnttt.exe54⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bnbbbh.exec:\bnbbbh.exe55⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jvpdp.exec:\jvpdp.exe56⤵
- Executes dropped EXE
PID:916 -
\??\c:\1rffflf.exec:\1rffflf.exe57⤵
- Executes dropped EXE
PID:700 -
\??\c:\7lfxffr.exec:\7lfxffr.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nbtthb.exec:\nbtthb.exe59⤵
- Executes dropped EXE
PID:2036 -
\??\c:\btntbh.exec:\btntbh.exe60⤵
- Executes dropped EXE
PID:1368 -
\??\c:\3pddj.exec:\3pddj.exe61⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vjppp.exec:\vjppp.exe62⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1xfflrx.exec:\1xfflrx.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbbhnt.exec:\hbbhnt.exe64⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dvvvv.exec:\dvvvv.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jdjvp.exec:\jdjvp.exe66⤵PID:900
-
\??\c:\frffllf.exec:\frffllf.exe67⤵PID:2384
-
\??\c:\3xlfllr.exec:\3xlfllr.exe68⤵PID:1668
-
\??\c:\bnbbhh.exec:\bnbbhh.exe69⤵PID:1036
-
\??\c:\ppvvp.exec:\ppvvp.exe70⤵PID:1584
-
\??\c:\pvddj.exec:\pvddj.exe71⤵PID:1580
-
\??\c:\1rlrflx.exec:\1rlrflx.exe72⤵PID:2492
-
\??\c:\fxxflrf.exec:\fxxflrf.exe73⤵PID:2488
-
\??\c:\ttbnnn.exec:\ttbnnn.exe74⤵PID:2888
-
\??\c:\bhtttt.exec:\bhtttt.exe75⤵PID:1688
-
\??\c:\7jpvj.exec:\7jpvj.exe76⤵PID:2716
-
\??\c:\llfrflf.exec:\llfrflf.exe77⤵PID:2688
-
\??\c:\7xxrxxx.exec:\7xxrxxx.exe78⤵PID:1188
-
\??\c:\bnbbhb.exec:\bnbbhb.exe79⤵PID:1848
-
\??\c:\bbbhbn.exec:\bbbhbn.exe80⤵PID:2608
-
\??\c:\3djdj.exec:\3djdj.exe81⤵PID:2572
-
\??\c:\pdjvj.exec:\pdjvj.exe82⤵PID:2844
-
\??\c:\frflrrx.exec:\frflrrx.exe83⤵PID:2604
-
\??\c:\xllffff.exec:\xllffff.exe84⤵PID:1136
-
\??\c:\nthbbn.exec:\nthbbn.exe85⤵PID:2980
-
\??\c:\5bnhbn.exec:\5bnhbn.exe86⤵PID:1696
-
\??\c:\5jddj.exec:\5jddj.exe87⤵PID:2812
-
\??\c:\vvpvd.exec:\vvpvd.exe88⤵PID:2820
-
\??\c:\xxrrffx.exec:\xxrrffx.exe89⤵PID:2760
-
\??\c:\xrflrlf.exec:\xrflrlf.exe90⤵PID:2092
-
\??\c:\hhhnnh.exec:\hhhnnh.exe91⤵PID:2868
-
\??\c:\thtbnt.exec:\thtbnt.exe92⤵PID:1984
-
\??\c:\9jddd.exec:\9jddd.exe93⤵PID:2968
-
\??\c:\pjvdj.exec:\pjvdj.exe94⤵PID:2352
-
\??\c:\lfxxffl.exec:\lfxxffl.exe95⤵PID:2952
-
\??\c:\frfllrf.exec:\frfllrf.exe96⤵PID:1132
-
\??\c:\ththhn.exec:\ththhn.exe97⤵PID:2672
-
\??\c:\9bbnbb.exec:\9bbnbb.exe98⤵PID:2212
-
\??\c:\jvddp.exec:\jvddp.exe99⤵PID:700
-
\??\c:\ffrxxlr.exec:\ffrxxlr.exe100⤵PID:2880
-
\??\c:\rlfflff.exec:\rlfflff.exe101⤵PID:308
-
\??\c:\thtnbt.exec:\thtnbt.exe102⤵PID:1532
-
\??\c:\hbnntt.exec:\hbnntt.exe103⤵PID:2144
-
\??\c:\5pjjp.exec:\5pjjp.exe104⤵PID:1768
-
\??\c:\5dppv.exec:\5dppv.exe105⤵PID:1604
-
\??\c:\9rffllf.exec:\9rffllf.exe106⤵PID:676
-
\??\c:\xlrrfff.exec:\xlrrfff.exe107⤵PID:612
-
\??\c:\hbbbnt.exec:\hbbbnt.exe108⤵PID:1756
-
\??\c:\htbbbb.exec:\htbbbb.exe109⤵PID:2136
-
\??\c:\1djdd.exec:\1djdd.exe110⤵PID:620
-
\??\c:\5vpvd.exec:\5vpvd.exe111⤵PID:884
-
\??\c:\7lrlrrx.exec:\7lrlrrx.exe112⤵PID:2404
-
\??\c:\7ffxlfr.exec:\7ffxlfr.exe113⤵PID:2052
-
\??\c:\btbbhh.exec:\btbbhh.exe114⤵PID:2328
-
\??\c:\nhtttt.exec:\nhtttt.exe115⤵PID:2700
-
\??\c:\1pddv.exec:\1pddv.exe116⤵PID:2784
-
\??\c:\xxrxrrr.exec:\xxrxrrr.exe117⤵PID:2720
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe118⤵PID:1688
-
\??\c:\tnbhhh.exec:\tnbhhh.exe119⤵PID:2848
-
\??\c:\1ntnhb.exec:\1ntnhb.exe120⤵PID:2916
-
\??\c:\dddpd.exec:\dddpd.exe121⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-