Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe
-
Size
454KB
-
MD5
b984be71c510dcf66b1bfccfc5908d70
-
SHA1
451b737b815e2a62bcf3afadc4747469003575d7
-
SHA256
53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4
-
SHA512
16496e910079a1028160c0ecd03d4e89b12031b002dd7e1695fda6691998ed644e50a396b04199a513a4185f39d7dc87aa30b0c7348215313d9f93f08700d6d2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2148-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-277-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2300-298-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2896-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-448-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1364-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-461-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2480-469-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2324-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1032-666-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-698-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2324-785-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2324-805-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1604-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-812-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-863-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2628-871-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2148 hbhhhn.exe 2388 dvddj.exe 2156 xlllllr.exe 2756 vjppv.exe 2876 xxxfffl.exe 2456 3nbbhb.exe 2912 dpvvp.exe 2780 9dvvv.exe 2636 bnbtbb.exe 600 pjppp.exe 2344 5xffllf.exe 2440 dpddj.exe 1300 nbhthh.exe 1432 3tnnbh.exe 2692 9rxfllr.exe 2940 3rxxxrf.exe 3056 pjvdd.exe 2184 9xxrrrr.exe 1264 3dppp.exe 956 3rfffrf.exe 2008 rfrxflr.exe 1492 thbthh.exe 1696 pjjdd.exe 1340 fxlllff.exe 2448 thnntn.exe 1768 jvpdj.exe 712 thnnht.exe 308 vpdjp.exe 1616 3rxrrll.exe 1708 5fxxxff.exe 2300 5vpvd.exe 2896 1ffffxf.exe 2028 9httbb.exe 2764 dpddv.exe 2760 9lxffxf.exe 2612 xrffxxf.exe 2708 hthttn.exe 2832 9pddv.exe 2912 flfxxxx.exe 2824 xrxxxxf.exe 2720 1bnnnh.exe 2656 jpvpp.exe 1052 dvppv.exe 2344 fxlrrxl.exe 1040 3fffffl.exe 2440 tnbttt.exe 1448 7pdpp.exe 1928 vjppv.exe 2436 rfxxfff.exe 2692 1thhhb.exe 272 dpppv.exe 2952 dpdvv.exe 2480 rxlffff.exe 2224 1htttb.exe 1364 thnhnh.exe 3036 vpdvd.exe 2128 xfrffxx.exe 840 ffrxfff.exe 960 3nhbbt.exe 1332 dpvpp.exe 576 7vpjj.exe 1976 frxrxrf.exe 2520 rxfxxll.exe 2324 tbtbtn.exe -
resource yara_rule behavioral1/memory/2160-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-879-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffffxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2148 2160 53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe 30 PID 2160 wrote to memory of 2148 2160 53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe 30 PID 2160 wrote to memory of 2148 2160 53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe 30 PID 2160 wrote to memory of 2148 2160 53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe 30 PID 2148 wrote to memory of 2388 2148 hbhhhn.exe 31 PID 2148 wrote to memory of 2388 2148 hbhhhn.exe 31 PID 2148 wrote to memory of 2388 2148 hbhhhn.exe 31 PID 2148 wrote to memory of 2388 2148 hbhhhn.exe 31 PID 2388 wrote to memory of 2156 2388 dvddj.exe 33 PID 2388 wrote to memory of 2156 2388 dvddj.exe 33 PID 2388 wrote to memory of 2156 2388 dvddj.exe 33 PID 2388 wrote to memory of 2156 2388 dvddj.exe 33 PID 2156 wrote to memory of 2756 2156 xlllllr.exe 34 PID 2156 wrote to memory of 2756 2156 xlllllr.exe 34 PID 2156 wrote to memory of 2756 2156 xlllllr.exe 34 PID 2156 wrote to memory of 2756 2156 xlllllr.exe 34 PID 2756 wrote to memory of 2876 2756 vjppv.exe 35 PID 2756 wrote to memory of 2876 2756 vjppv.exe 35 PID 2756 wrote to memory of 2876 2756 vjppv.exe 35 PID 2756 wrote to memory of 2876 2756 vjppv.exe 35 PID 2876 wrote to memory of 2456 2876 xxxfffl.exe 36 PID 2876 wrote to memory of 2456 2876 xxxfffl.exe 36 PID 2876 wrote to memory of 2456 2876 xxxfffl.exe 36 PID 2876 wrote to memory of 2456 2876 xxxfffl.exe 36 PID 2456 wrote to memory of 2912 2456 3nbbhb.exe 37 PID 2456 wrote to memory of 2912 2456 3nbbhb.exe 37 PID 2456 wrote to memory of 2912 2456 3nbbhb.exe 37 PID 2456 wrote to memory of 2912 2456 3nbbhb.exe 37 PID 2912 wrote to memory of 2780 2912 dpvvp.exe 38 PID 2912 wrote to memory of 2780 2912 dpvvp.exe 38 PID 2912 wrote to memory of 2780 2912 dpvvp.exe 38 PID 2912 wrote to memory of 2780 2912 dpvvp.exe 38 PID 2780 wrote to memory of 2636 2780 9dvvv.exe 39 PID 2780 wrote to memory of 2636 2780 9dvvv.exe 39 PID 2780 wrote to memory of 2636 2780 9dvvv.exe 39 PID 2780 wrote to memory of 2636 2780 9dvvv.exe 39 PID 2636 wrote to memory of 600 2636 bnbtbb.exe 40 PID 2636 wrote to memory of 600 2636 bnbtbb.exe 40 PID 2636 wrote to memory of 600 2636 bnbtbb.exe 40 PID 2636 wrote to memory of 600 2636 bnbtbb.exe 40 PID 600 wrote to memory of 2344 600 pjppp.exe 41 PID 600 wrote to memory of 2344 600 pjppp.exe 41 PID 600 wrote to memory of 2344 600 pjppp.exe 41 PID 600 wrote to memory of 2344 600 pjppp.exe 41 PID 2344 wrote to memory of 2440 2344 5xffllf.exe 42 PID 2344 wrote to memory of 2440 2344 5xffllf.exe 42 PID 2344 wrote to memory of 2440 2344 5xffllf.exe 42 PID 2344 wrote to memory of 2440 2344 5xffllf.exe 42 PID 2440 wrote to memory of 1300 2440 dpddj.exe 43 PID 2440 wrote to memory of 1300 2440 dpddj.exe 43 PID 2440 wrote to memory of 1300 2440 dpddj.exe 43 PID 2440 wrote to memory of 1300 2440 dpddj.exe 43 PID 1300 wrote to memory of 1432 1300 nbhthh.exe 44 PID 1300 wrote to memory of 1432 1300 nbhthh.exe 44 PID 1300 wrote to memory of 1432 1300 nbhthh.exe 44 PID 1300 wrote to memory of 1432 1300 nbhthh.exe 44 PID 1432 wrote to memory of 2692 1432 3tnnbh.exe 45 PID 1432 wrote to memory of 2692 1432 3tnnbh.exe 45 PID 1432 wrote to memory of 2692 1432 3tnnbh.exe 45 PID 1432 wrote to memory of 2692 1432 3tnnbh.exe 45 PID 2692 wrote to memory of 2940 2692 9rxfllr.exe 46 PID 2692 wrote to memory of 2940 2692 9rxfllr.exe 46 PID 2692 wrote to memory of 2940 2692 9rxfllr.exe 46 PID 2692 wrote to memory of 2940 2692 9rxfllr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe"C:\Users\Admin\AppData\Local\Temp\53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\hbhhhn.exec:\hbhhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dvddj.exec:\dvddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\xlllllr.exec:\xlllllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\vjppv.exec:\vjppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xxxfffl.exec:\xxxfffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\3nbbhb.exec:\3nbbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dpvvp.exec:\dpvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9dvvv.exec:\9dvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bnbtbb.exec:\bnbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pjppp.exec:\pjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\5xffllf.exec:\5xffllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\dpddj.exec:\dpddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nbhthh.exec:\nbhthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\3tnnbh.exec:\3tnnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\9rxfllr.exec:\9rxfllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3rxxxrf.exec:\3rxxxrf.exe17⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjvdd.exec:\pjvdd.exe18⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9xxrrrr.exec:\9xxrrrr.exe19⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3dppp.exec:\3dppp.exe20⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3rfffrf.exec:\3rfffrf.exe21⤵
- Executes dropped EXE
PID:956 -
\??\c:\rfrxflr.exec:\rfrxflr.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thbthh.exec:\thbthh.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pjjdd.exec:\pjjdd.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxlllff.exec:\fxlllff.exe25⤵
- Executes dropped EXE
PID:1340 -
\??\c:\thnntn.exec:\thnntn.exe26⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jvpdj.exec:\jvpdj.exe27⤵
- Executes dropped EXE
PID:1768 -
\??\c:\thnnht.exec:\thnnht.exe28⤵
- Executes dropped EXE
PID:712 -
\??\c:\vpdjp.exec:\vpdjp.exe29⤵
- Executes dropped EXE
PID:308 -
\??\c:\3rxrrll.exec:\3rxrrll.exe30⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5fxxxff.exec:\5fxxxff.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5vpvd.exec:\5vpvd.exe32⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1ffffxf.exec:\1ffffxf.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\9httbb.exec:\9httbb.exe34⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dpddv.exec:\dpddv.exe35⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9lxffxf.exec:\9lxffxf.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrffxxf.exec:\xrffxxf.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hthttn.exec:\hthttn.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9pddv.exec:\9pddv.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\flfxxxx.exec:\flfxxxx.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1bnnnh.exec:\1bnnnh.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jpvpp.exec:\jpvpp.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvppv.exec:\dvppv.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fxlrrxl.exec:\fxlrrxl.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3fffffl.exec:\3fffffl.exe46⤵
- Executes dropped EXE
PID:1040 -
\??\c:\tnbttt.exec:\tnbttt.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7pdpp.exec:\7pdpp.exe48⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vjppv.exec:\vjppv.exe49⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rfxxfff.exec:\rfxxfff.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\1thhhb.exec:\1thhhb.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dpppv.exec:\dpppv.exe52⤵
- Executes dropped EXE
PID:272 -
\??\c:\dpdvv.exec:\dpdvv.exe53⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rxlffff.exec:\rxlffff.exe54⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1htttb.exec:\1htttb.exe55⤵
- Executes dropped EXE
PID:2224 -
\??\c:\thnhnh.exec:\thnhnh.exe56⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vpdvd.exec:\vpdvd.exe57⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xfrffxx.exec:\xfrffxx.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ffrxfff.exec:\ffrxfff.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\3nhbbt.exec:\3nhbbt.exe60⤵
- Executes dropped EXE
PID:960 -
\??\c:\dpvpp.exec:\dpvpp.exe61⤵
- Executes dropped EXE
PID:1332 -
\??\c:\7vpjj.exec:\7vpjj.exe62⤵
- Executes dropped EXE
PID:576 -
\??\c:\frxrxrf.exec:\frxrxrf.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rxfxxll.exec:\rxfxxll.exe64⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tbtbtn.exec:\tbtbtn.exe65⤵
- Executes dropped EXE
PID:2324 -
\??\c:\htbtbb.exec:\htbtbb.exe66⤵PID:1812
-
\??\c:\dpddj.exec:\dpddj.exe67⤵PID:556
-
\??\c:\lxxllfx.exec:\lxxllfx.exe68⤵PID:308
-
\??\c:\lxlrxxx.exec:\lxlrxxx.exe69⤵PID:2160
-
\??\c:\3bhhhb.exec:\3bhhhb.exe70⤵PID:2516
-
\??\c:\pdppd.exec:\pdppd.exe71⤵PID:2384
-
\??\c:\1xxlfff.exec:\1xxlfff.exe72⤵PID:2220
-
\??\c:\rlrxffx.exec:\rlrxffx.exe73⤵PID:2388
-
\??\c:\nhbbbb.exec:\nhbbbb.exe74⤵PID:2144
-
\??\c:\dvddd.exec:\dvddd.exe75⤵PID:2024
-
\??\c:\jdjdd.exec:\jdjdd.exe76⤵PID:2764
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe77⤵PID:2976
-
\??\c:\rxfffxr.exec:\rxfffxr.exe78⤵PID:2456
-
\??\c:\7bnnhh.exec:\7bnnhh.exe79⤵PID:2860
-
\??\c:\thtttt.exec:\thtttt.exe80⤵PID:2740
-
\??\c:\pdjdd.exec:\pdjdd.exe81⤵PID:2668
-
\??\c:\lrffxrr.exec:\lrffxrr.exe82⤵PID:1296
-
\??\c:\frrlfxx.exec:\frrlfxx.exe83⤵PID:2620
-
\??\c:\hntntn.exec:\hntntn.exe84⤵PID:2636
-
\??\c:\pjvvj.exec:\pjvvj.exe85⤵PID:2608
-
\??\c:\vdvpp.exec:\vdvpp.exe86⤵PID:2344
-
\??\c:\7xlxffl.exec:\7xlxffl.exe87⤵PID:108
-
\??\c:\bthnnh.exec:\bthnnh.exe88⤵PID:1032
-
\??\c:\tnntbn.exec:\tnntbn.exe89⤵PID:1432
-
\??\c:\pdpjj.exec:\pdpjj.exe90⤵PID:1928
-
\??\c:\llxfllx.exec:\llxfllx.exe91⤵PID:2436
-
\??\c:\lxlfffr.exec:\lxlfffr.exe92⤵PID:2692
-
\??\c:\9tnnnn.exec:\9tnnnn.exe93⤵PID:2940
-
\??\c:\nbnntn.exec:\nbnntn.exe94⤵PID:2700
-
\??\c:\pdjpj.exec:\pdjpj.exe95⤵PID:2480
-
\??\c:\xlxrrxx.exec:\xlxrrxx.exe96⤵PID:2184
-
\??\c:\frffllx.exec:\frffllx.exe97⤵PID:1364
-
\??\c:\hbbbbb.exec:\hbbbbb.exe98⤵PID:3036
-
\??\c:\jdppd.exec:\jdppd.exe99⤵PID:328
-
\??\c:\7dppj.exec:\7dppj.exe100⤵PID:1652
-
\??\c:\rfllrrf.exec:\rfllrrf.exe101⤵
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\frxrfxx.exec:\frxrfxx.exe102⤵PID:1552
-
\??\c:\hbnbtb.exec:\hbnbtb.exe103⤵PID:1540
-
\??\c:\vjvvv.exec:\vjvvv.exe104⤵PID:2328
-
\??\c:\rfrfffx.exec:\rfrfffx.exe105⤵PID:2520
-
\??\c:\rfxxffl.exec:\rfxxffl.exe106⤵PID:2324
-
\??\c:\1htthh.exec:\1htthh.exe107⤵PID:1812
-
\??\c:\pjvvd.exec:\pjvvd.exe108⤵PID:556
-
\??\c:\dpdvd.exec:\dpdvd.exe109⤵PID:1480
-
\??\c:\3lfflrx.exec:\3lfflrx.exe110⤵PID:1604
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe111⤵PID:2392
-
\??\c:\9bthtt.exec:\9bthtt.exe112⤵PID:2816
-
\??\c:\7vdjj.exec:\7vdjj.exe113⤵PID:2308
-
\??\c:\1fxxxff.exec:\1fxxxff.exe114⤵PID:1956
-
\??\c:\lxrllfr.exec:\lxrllfr.exe115⤵PID:2732
-
\??\c:\hthhtt.exec:\hthhtt.exe116⤵PID:2800
-
\??\c:\ththnt.exec:\ththnt.exe117⤵PID:2320
-
\??\c:\jdppv.exec:\jdppv.exe118⤵PID:2828
-
\??\c:\fxrxffx.exec:\fxrxffx.exe119⤵PID:2628
-
\??\c:\httntt.exec:\httntt.exe120⤵PID:2880
-
\??\c:\jdvpv.exec:\jdvpv.exe121⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-