Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:56
Behavioral task
behavioral1
Sample
1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe
-
Size
334KB
-
MD5
b206099ab570ea0899a95a80f12c345c
-
SHA1
de96077ce89f0c48091e35ca2c6cdb2960e1c2aa
-
SHA256
1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71
-
SHA512
d0a74a17315e1925df252d525a1ad18bdd0a940ef070571c36fa2d46c4f7a0088a8636ac994c0a3786cc55ee7f51a658ac16afa7e71487fcc174a903d73cc02f
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRh:R4wFHoSHYHUrAwfMp3CDRh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2148-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-92-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/644-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-150-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1288-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-250-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1744-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-311-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2348-317-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2956-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-390-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-399-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1552-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-459-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1248-469-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2680-526-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2112-533-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2112-532-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1592-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-562-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/600-568-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2736-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-642-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2392-641-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1820-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-670-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1528-729-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/812-730-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-785-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2484-18488-0x0000000077100000-0x000000007721F000-memory.dmp family_blackmoon behavioral1/memory/2484-22662-0x0000000077100000-0x000000007721F000-memory.dmp family_blackmoon behavioral1/memory/2484-22939-0x0000000077100000-0x000000007721F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 nbhbhh.exe 2176 bbbhtn.exe 2352 7vdvj.exe 2864 thttbt.exe 2736 dpddd.exe 2836 3lrrrrx.exe 1632 frxxxll.exe 2440 dvvvd.exe 2780 rflrlrx.exe 1804 nbnnbt.exe 2652 5dpjj.exe 2668 rxxrxrl.exe 644 nhbttt.exe 2464 vvvjj.exe 1864 fxlrfxx.exe 2312 7tnnnn.exe 808 5djjp.exe 2904 lxxrlff.exe 1288 hnbbbb.exe 1168 jdjvj.exe 3068 9xlllrx.exe 2208 nbhntn.exe 1440 7dvjj.exe 2068 vdddj.exe 2452 rxlfxfx.exe 1676 hnhbhb.exe 912 3lrrrrl.exe 2240 1ntnth.exe 344 5djpp.exe 316 7lfxxrr.exe 2960 htbbbt.exe 1744 bnthbb.exe 2680 fxlxxrr.exe 2496 lxlflxr.exe 816 hbhtth.exe 2340 nhtttn.exe 2276 djjdd.exe 1588 7djdd.exe 1488 rlfrrrr.exe 2688 5bhhhb.exe 2348 htnntt.exe 2956 pdjdd.exe 2804 flrrlff.exe 2796 1llrxrx.exe 2940 nbnhhb.exe 2756 jvddj.exe 2812 vjvvv.exe 2760 rlrrxlr.exe 2612 flfrrlr.exe 2660 hbhbbb.exe 2640 bhbntn.exe 3052 vpdjp.exe 1920 vpvpp.exe 2888 rlxflfx.exe 2552 7ffxrrl.exe 2312 9bnhtt.exe 1856 pvdvv.exe 2584 pvppv.exe 1552 lfllllr.exe 2128 hthbnh.exe 1308 9ntbtt.exe 2248 pjvvv.exe 3028 9dppd.exe 1872 7frrrrl.exe -
resource yara_rule behavioral1/memory/2148-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-8.dat upx behavioral1/memory/2148-6-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2148-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ab9-18.dat upx behavioral1/memory/2676-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2352-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c56-28.dat upx behavioral1/memory/2176-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cc5-45.dat upx behavioral1/memory/2864-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c73-37.dat upx behavioral1/files/0x0007000000016ce7-53.dat upx behavioral1/memory/2736-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1d-61.dat upx behavioral1/files/0x0008000000016d2e-68.dat upx behavioral1/memory/2440-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d36-75.dat upx behavioral1/files/0x00060000000175e7-84.dat upx behavioral1/memory/2780-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018669-93.dat upx behavioral1/memory/2652-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001400000001866f-101.dat upx behavioral1/files/0x0011000000018682-109.dat upx behavioral1/memory/644-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001868b-118.dat upx behavioral1/files/0x00050000000186f2-125.dat upx behavioral1/memory/2464-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1864-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f8-134.dat upx behavioral1/files/0x0005000000018731-142.dat upx behavioral1/memory/2312-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-141-0x00000000003D0000-0x00000000003F7000-memory.dmp upx behavioral1/files/0x0005000000018742-151.dat upx behavioral1/files/0x0005000000018781-158.dat upx behavioral1/files/0x000500000001878c-166.dat upx behavioral1/memory/1288-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bf3-173.dat upx behavioral1/memory/3068-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019227-181.dat upx behavioral1/files/0x00090000000165a7-188.dat upx behavioral1/memory/1440-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001922c-196.dat upx behavioral1/memory/2068-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-203.dat upx behavioral1/files/0x0005000000019261-212.dat upx behavioral1/memory/2452-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926a-219.dat upx behavioral1/memory/912-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019279-227.dat upx behavioral1/files/0x0005000000019284-234.dat upx behavioral1/memory/316-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/344-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a9-241.dat upx behavioral1/files/0x0005000000019379-251.dat upx behavioral1/files/0x000500000001939d-259.dat upx behavioral1/memory/1744-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/816-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-311-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2676 2148 1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe 30 PID 2148 wrote to memory of 2676 2148 1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe 30 PID 2148 wrote to memory of 2676 2148 1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe 30 PID 2148 wrote to memory of 2676 2148 1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe 30 PID 2676 wrote to memory of 2176 2676 nbhbhh.exe 31 PID 2676 wrote to memory of 2176 2676 nbhbhh.exe 31 PID 2676 wrote to memory of 2176 2676 nbhbhh.exe 31 PID 2676 wrote to memory of 2176 2676 nbhbhh.exe 31 PID 2176 wrote to memory of 2352 2176 bbbhtn.exe 32 PID 2176 wrote to memory of 2352 2176 bbbhtn.exe 32 PID 2176 wrote to memory of 2352 2176 bbbhtn.exe 32 PID 2176 wrote to memory of 2352 2176 bbbhtn.exe 32 PID 2352 wrote to memory of 2864 2352 7vdvj.exe 33 PID 2352 wrote to memory of 2864 2352 7vdvj.exe 33 PID 2352 wrote to memory of 2864 2352 7vdvj.exe 33 PID 2352 wrote to memory of 2864 2352 7vdvj.exe 33 PID 2864 wrote to memory of 2736 2864 thttbt.exe 34 PID 2864 wrote to memory of 2736 2864 thttbt.exe 34 PID 2864 wrote to memory of 2736 2864 thttbt.exe 34 PID 2864 wrote to memory of 2736 2864 thttbt.exe 34 PID 2736 wrote to memory of 2836 2736 dpddd.exe 35 PID 2736 wrote to memory of 2836 2736 dpddd.exe 35 PID 2736 wrote to memory of 2836 2736 dpddd.exe 35 PID 2736 wrote to memory of 2836 2736 dpddd.exe 35 PID 2836 wrote to memory of 1632 2836 3lrrrrx.exe 36 PID 2836 wrote to memory of 1632 2836 3lrrrrx.exe 36 PID 2836 wrote to memory of 1632 2836 3lrrrrx.exe 36 PID 2836 wrote to memory of 1632 2836 3lrrrrx.exe 36 PID 1632 wrote to memory of 2440 1632 frxxxll.exe 37 PID 1632 wrote to memory of 2440 1632 frxxxll.exe 37 PID 1632 wrote to memory of 2440 1632 frxxxll.exe 37 PID 1632 wrote to memory of 2440 1632 frxxxll.exe 37 PID 2440 wrote to memory of 2780 2440 dvvvd.exe 38 PID 2440 wrote to memory of 2780 2440 dvvvd.exe 38 PID 2440 wrote to memory of 2780 2440 dvvvd.exe 38 PID 2440 wrote to memory of 2780 2440 dvvvd.exe 38 PID 2780 wrote to memory of 1804 2780 rflrlrx.exe 39 PID 2780 wrote to memory of 1804 2780 rflrlrx.exe 39 PID 2780 wrote to memory of 1804 2780 rflrlrx.exe 39 PID 2780 wrote to memory of 1804 2780 rflrlrx.exe 39 PID 1804 wrote to memory of 2652 1804 nbnnbt.exe 40 PID 1804 wrote to memory of 2652 1804 nbnnbt.exe 40 PID 1804 wrote to memory of 2652 1804 nbnnbt.exe 40 PID 1804 wrote to memory of 2652 1804 nbnnbt.exe 40 PID 2652 wrote to memory of 2668 2652 5dpjj.exe 41 PID 2652 wrote to memory of 2668 2652 5dpjj.exe 41 PID 2652 wrote to memory of 2668 2652 5dpjj.exe 41 PID 2652 wrote to memory of 2668 2652 5dpjj.exe 41 PID 2668 wrote to memory of 644 2668 rxxrxrl.exe 42 PID 2668 wrote to memory of 644 2668 rxxrxrl.exe 42 PID 2668 wrote to memory of 644 2668 rxxrxrl.exe 42 PID 2668 wrote to memory of 644 2668 rxxrxrl.exe 42 PID 644 wrote to memory of 2464 644 nhbttt.exe 43 PID 644 wrote to memory of 2464 644 nhbttt.exe 43 PID 644 wrote to memory of 2464 644 nhbttt.exe 43 PID 644 wrote to memory of 2464 644 nhbttt.exe 43 PID 2464 wrote to memory of 1864 2464 vvvjj.exe 44 PID 2464 wrote to memory of 1864 2464 vvvjj.exe 44 PID 2464 wrote to memory of 1864 2464 vvvjj.exe 44 PID 2464 wrote to memory of 1864 2464 vvvjj.exe 44 PID 1864 wrote to memory of 2312 1864 fxlrfxx.exe 45 PID 1864 wrote to memory of 2312 1864 fxlrfxx.exe 45 PID 1864 wrote to memory of 2312 1864 fxlrfxx.exe 45 PID 1864 wrote to memory of 2312 1864 fxlrfxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe"C:\Users\Admin\AppData\Local\Temp\1dd4f29f673b9621a798a9ae0e47b6b7c673e9596481afd39ef041787b4d4d71.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\nbhbhh.exec:\nbhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bbbhtn.exec:\bbbhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7vdvj.exec:\7vdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\thttbt.exec:\thttbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dpddd.exec:\dpddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3lrrrrx.exec:\3lrrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\frxxxll.exec:\frxxxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\dvvvd.exec:\dvvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\rflrlrx.exec:\rflrlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nbnnbt.exec:\nbnnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\5dpjj.exec:\5dpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rxxrxrl.exec:\rxxrxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhbttt.exec:\nhbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\vvvjj.exec:\vvvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\fxlrfxx.exec:\fxlrfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\7tnnnn.exec:\7tnnnn.exe17⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5djjp.exec:\5djjp.exe18⤵
- Executes dropped EXE
PID:808 -
\??\c:\lxxrlff.exec:\lxxrlff.exe19⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hnbbbb.exec:\hnbbbb.exe20⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jdjvj.exec:\jdjvj.exe21⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9xlllrx.exec:\9xlllrx.exe22⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nbhntn.exec:\nbhntn.exe23⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7dvjj.exec:\7dvjj.exe24⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vdddj.exec:\vdddj.exe25⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rxlfxfx.exec:\rxlfxfx.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hnhbhb.exec:\hnhbhb.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3lrrrrl.exec:\3lrrrrl.exe28⤵
- Executes dropped EXE
PID:912 -
\??\c:\1ntnth.exec:\1ntnth.exe29⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5djpp.exec:\5djpp.exe30⤵
- Executes dropped EXE
PID:344 -
\??\c:\7lfxxrr.exec:\7lfxxrr.exe31⤵
- Executes dropped EXE
PID:316 -
\??\c:\htbbbt.exec:\htbbbt.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bnthbb.exec:\bnthbb.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fxlxxrr.exec:\fxlxxrr.exe34⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lxlflxr.exec:\lxlflxr.exe35⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbhtth.exec:\hbhtth.exe36⤵
- Executes dropped EXE
PID:816 -
\??\c:\nhtttn.exec:\nhtttn.exe37⤵
- Executes dropped EXE
PID:2340 -
\??\c:\djjdd.exec:\djjdd.exe38⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7djdd.exec:\7djdd.exe39⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rlfrrrr.exec:\rlfrrrr.exe40⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5bhhhb.exec:\5bhhhb.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\htnntt.exec:\htnntt.exe42⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pdjdd.exec:\pdjdd.exe43⤵
- Executes dropped EXE
PID:2956 -
\??\c:\flrrlff.exec:\flrrlff.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1llrxrx.exec:\1llrxrx.exe45⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nbnhhb.exec:\nbnhhb.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jvddj.exec:\jvddj.exe47⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vjvvv.exec:\vjvvv.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rlrrxlr.exec:\rlrrxlr.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\flfrrlr.exec:\flfrrlr.exe50⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hbhbbb.exec:\hbhbbb.exe51⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bhbntn.exec:\bhbntn.exe52⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpdjp.exec:\vpdjp.exe53⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vpvpp.exec:\vpvpp.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlxflfx.exec:\rlxflfx.exe55⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe56⤵
- Executes dropped EXE
PID:2552 -
\??\c:\9bnhtt.exec:\9bnhtt.exe57⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pvdvv.exec:\pvdvv.exe58⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pvppv.exec:\pvppv.exe59⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lfllllr.exec:\lfllllr.exe60⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hthbnh.exec:\hthbnh.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9ntbtt.exec:\9ntbtt.exe62⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pjvvv.exec:\pjvvv.exe63⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9dppd.exec:\9dppd.exe64⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7frrrrl.exec:\7frrrrl.exe65⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lrxffxx.exec:\lrxffxx.exe66⤵PID:1440
-
\??\c:\bnbbbb.exec:\bnbbbb.exe67⤵PID:1476
-
\??\c:\htbbbb.exec:\htbbbb.exe68⤵PID:1276
-
\??\c:\3jvvd.exec:\3jvvd.exe69⤵PID:1248
-
\??\c:\jpdpp.exec:\jpdpp.exe70⤵PID:1676
-
\??\c:\rfxxrxx.exec:\rfxxrxx.exe71⤵PID:1532
-
\??\c:\1tttbb.exec:\1tttbb.exe72⤵PID:968
-
\??\c:\btbhnn.exec:\btbhnn.exe73⤵PID:1048
-
\??\c:\7pddd.exec:\7pddd.exe74⤵PID:2460
-
\??\c:\pdvpp.exec:\pdvpp.exe75⤵PID:2324
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe76⤵PID:696
-
\??\c:\1lxffxx.exec:\1lxffxx.exe77⤵PID:2532
-
\??\c:\htbtbt.exec:\htbtbt.exe78⤵PID:1744
-
\??\c:\dpvdd.exec:\dpvdd.exe79⤵PID:2680
-
\??\c:\pjvpv.exec:\pjvpv.exe80⤵PID:2112
-
\??\c:\rxxllfr.exec:\rxxllfr.exe81⤵PID:2224
-
\??\c:\fxxffxx.exec:\fxxffxx.exe82⤵PID:2340
-
\??\c:\tnbhhn.exec:\tnbhhn.exe83⤵PID:600
-
\??\c:\jpppv.exec:\jpppv.exe84⤵PID:1592
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe85⤵PID:1912
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe86⤵PID:2744
-
\??\c:\1hnnnn.exec:\1hnnnn.exe87⤵PID:2736
-
\??\c:\djjvv.exec:\djjvv.exe88⤵PID:2956
-
\??\c:\7djpv.exec:\7djpv.exe89⤵PID:576
-
\??\c:\frflxrr.exec:\frflxrr.exe90⤵PID:2740
-
\??\c:\xffllff.exec:\xffllff.exe91⤵PID:2852
-
\??\c:\htbhnh.exec:\htbhnh.exe92⤵PID:2632
-
\??\c:\5jpdd.exec:\5jpdd.exe93⤵PID:2768
-
\??\c:\vpdvp.exec:\vpdvp.exe94⤵PID:2812
-
\??\c:\lrxrrlr.exec:\lrxrrlr.exe95⤵PID:2764
-
\??\c:\5bnnnn.exec:\5bnnnn.exe96⤵PID:2652
-
\??\c:\ntbtbt.exec:\ntbtbt.exe97⤵PID:2392
-
\??\c:\5dppj.exec:\5dppj.exe98⤵PID:940
-
\??\c:\pdpdd.exec:\pdpdd.exe99⤵PID:2668
-
\??\c:\lxllxll.exec:\lxllxll.exe100⤵PID:2064
-
\??\c:\7xrllrr.exec:\7xrllrr.exe101⤵PID:1956
-
\??\c:\nbhbhh.exec:\nbhbhh.exe102⤵PID:2920
-
\??\c:\pjdjp.exec:\pjdjp.exe103⤵PID:1820
-
\??\c:\dpjdj.exec:\dpjdj.exe104⤵PID:808
-
\??\c:\rfrxrlx.exec:\rfrxrlx.exe105⤵PID:2584
-
\??\c:\hntbbt.exec:\hntbbt.exe106⤵PID:1936
-
\??\c:\1bhhnh.exec:\1bhhnh.exe107⤵PID:2260
-
\??\c:\djjdp.exec:\djjdp.exe108⤵PID:1308
-
\??\c:\vjvvp.exec:\vjvvp.exe109⤵PID:2248
-
\??\c:\7rfxxrx.exec:\7rfxxrx.exe110⤵PID:2020
-
\??\c:\xffxrll.exec:\xffxrll.exe111⤵PID:1872
-
\??\c:\nbhtbh.exec:\nbhtbh.exe112⤵PID:2556
-
\??\c:\htbttn.exec:\htbttn.exe113⤵PID:2124
-
\??\c:\7vvvv.exec:\7vvvv.exe114⤵PID:2544
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe115⤵PID:1248
-
\??\c:\1lfrxxr.exec:\1lfrxxr.exe116⤵PID:1528
-
\??\c:\3thntb.exec:\3thntb.exe117⤵PID:812
-
\??\c:\nhttbn.exec:\nhttbn.exe118⤵PID:320
-
\??\c:\dvjpp.exec:\dvjpp.exe119⤵PID:2564
-
\??\c:\ddppv.exec:\ddppv.exe120⤵PID:2172
-
\??\c:\xfrxxxl.exec:\xfrxxxl.exe121⤵PID:316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-