Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe
-
Size
453KB
-
MD5
fd8dbb17c599827a6332649f852252ef
-
SHA1
09c8574e07688fec4792a8a4d3b0f1a267a6c555
-
SHA256
1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8
-
SHA512
a35102d5c7522f144754c15393d338839d224ed8ab5b6c30a0965251c07c2be8d28b7b132ad5f1c0f2b120bdaec5623f015a1ce9c4bd0e2d8597932a1e351a17
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2528-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-289-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2788-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-347-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2908-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-584-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-596-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-598-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1564-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-650-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2572-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-671-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-692-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2552-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-739-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1432-741-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2252-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-896-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-946-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-965-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/888-1045-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-1142-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-1212-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1112-1317-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2512-1324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-1327-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2896-1340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1568 vpjjp.exe 680 1dppp.exe 2504 hbtbbb.exe 2284 ppddp.exe 2820 btthbh.exe 2252 3rrxflf.exe 2888 hhbhhh.exe 2724 tbnnbn.exe 2580 ppvdp.exe 2324 rrrlflx.exe 1656 hnnthn.exe 2816 jjdvv.exe 2020 xxrxlrl.exe 2572 hnhnnt.exe 2408 jjdpj.exe 756 fxffrxl.exe 760 hbthhh.exe 1672 1pjvp.exe 2904 llxfrxl.exe 2460 nnhnbn.exe 1192 jjdpp.exe 1244 1fxllxr.exe 3032 5thhbh.exe 1280 xrrlfxf.exe 1888 ttnbnb.exe 2468 bbthnn.exe 2132 bhbhtt.exe 2352 1nbhnb.exe 1660 1rfllrx.exe 304 nhbthn.exe 1112 jddjv.exe 1484 5ntthh.exe 1568 llxlxfx.exe 2996 hththh.exe 2376 vjppj.exe 2508 3lxfxxl.exe 2788 vpppd.exe 2820 jvpjp.exe 2736 3rlfrrf.exe 2796 tnhhbb.exe 2908 1vpjj.exe 2584 dpppp.exe 2224 3hntbh.exe 1768 hhtthn.exe 2664 1jdvd.exe 2016 5rrlflf.exe 2644 llffllx.exe 1912 5nthnt.exe 2832 jdjjp.exe 1552 vdppp.exe 2940 xrfxxxl.exe 1456 hhbbnh.exe 2956 5bthnn.exe 2980 djjvv.exe 2268 9frrlrf.exe 1156 ththhh.exe 1872 bbnthh.exe 2236 jdddp.exe 2972 xxrfrxl.exe 2912 frfxlrr.exe 2160 tttthn.exe 1292 5pddd.exe 752 ppdpd.exe 1064 1xfxllr.exe -
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-254-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2508-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-692-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2552-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-739-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2252-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-965-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/792-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-1045-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2728-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-1193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-1238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-1324-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1568 2528 1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe 30 PID 2528 wrote to memory of 1568 2528 1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe 30 PID 2528 wrote to memory of 1568 2528 1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe 30 PID 2528 wrote to memory of 1568 2528 1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe 30 PID 1568 wrote to memory of 680 1568 vpjjp.exe 31 PID 1568 wrote to memory of 680 1568 vpjjp.exe 31 PID 1568 wrote to memory of 680 1568 vpjjp.exe 31 PID 1568 wrote to memory of 680 1568 vpjjp.exe 31 PID 680 wrote to memory of 2504 680 1dppp.exe 32 PID 680 wrote to memory of 2504 680 1dppp.exe 32 PID 680 wrote to memory of 2504 680 1dppp.exe 32 PID 680 wrote to memory of 2504 680 1dppp.exe 32 PID 2504 wrote to memory of 2284 2504 hbtbbb.exe 33 PID 2504 wrote to memory of 2284 2504 hbtbbb.exe 33 PID 2504 wrote to memory of 2284 2504 hbtbbb.exe 33 PID 2504 wrote to memory of 2284 2504 hbtbbb.exe 33 PID 2284 wrote to memory of 2820 2284 ppddp.exe 34 PID 2284 wrote to memory of 2820 2284 ppddp.exe 34 PID 2284 wrote to memory of 2820 2284 ppddp.exe 34 PID 2284 wrote to memory of 2820 2284 ppddp.exe 34 PID 2820 wrote to memory of 2252 2820 btthbh.exe 35 PID 2820 wrote to memory of 2252 2820 btthbh.exe 35 PID 2820 wrote to memory of 2252 2820 btthbh.exe 35 PID 2820 wrote to memory of 2252 2820 btthbh.exe 35 PID 2252 wrote to memory of 2888 2252 3rrxflf.exe 36 PID 2252 wrote to memory of 2888 2252 3rrxflf.exe 36 PID 2252 wrote to memory of 2888 2252 3rrxflf.exe 36 PID 2252 wrote to memory of 2888 2252 3rrxflf.exe 36 PID 2888 wrote to memory of 2724 2888 hhbhhh.exe 38 PID 2888 wrote to memory of 2724 2888 hhbhhh.exe 38 PID 2888 wrote to memory of 2724 2888 hhbhhh.exe 38 PID 2888 wrote to memory of 2724 2888 hhbhhh.exe 38 PID 2724 wrote to memory of 2580 2724 tbnnbn.exe 39 PID 2724 wrote to memory of 2580 2724 tbnnbn.exe 39 PID 2724 wrote to memory of 2580 2724 tbnnbn.exe 39 PID 2724 wrote to memory of 2580 2724 tbnnbn.exe 39 PID 2580 wrote to memory of 2324 2580 ppvdp.exe 40 PID 2580 wrote to memory of 2324 2580 ppvdp.exe 40 PID 2580 wrote to memory of 2324 2580 ppvdp.exe 40 PID 2580 wrote to memory of 2324 2580 ppvdp.exe 40 PID 2324 wrote to memory of 1656 2324 rrrlflx.exe 41 PID 2324 wrote to memory of 1656 2324 rrrlflx.exe 41 PID 2324 wrote to memory of 1656 2324 rrrlflx.exe 41 PID 2324 wrote to memory of 1656 2324 rrrlflx.exe 41 PID 1656 wrote to memory of 2816 1656 hnnthn.exe 42 PID 1656 wrote to memory of 2816 1656 hnnthn.exe 42 PID 1656 wrote to memory of 2816 1656 hnnthn.exe 42 PID 1656 wrote to memory of 2816 1656 hnnthn.exe 42 PID 2816 wrote to memory of 2020 2816 jjdvv.exe 43 PID 2816 wrote to memory of 2020 2816 jjdvv.exe 43 PID 2816 wrote to memory of 2020 2816 jjdvv.exe 43 PID 2816 wrote to memory of 2020 2816 jjdvv.exe 43 PID 2020 wrote to memory of 2572 2020 xxrxlrl.exe 44 PID 2020 wrote to memory of 2572 2020 xxrxlrl.exe 44 PID 2020 wrote to memory of 2572 2020 xxrxlrl.exe 44 PID 2020 wrote to memory of 2572 2020 xxrxlrl.exe 44 PID 2572 wrote to memory of 2408 2572 hnhnnt.exe 45 PID 2572 wrote to memory of 2408 2572 hnhnnt.exe 45 PID 2572 wrote to memory of 2408 2572 hnhnnt.exe 45 PID 2572 wrote to memory of 2408 2572 hnhnnt.exe 45 PID 2408 wrote to memory of 756 2408 jjdpj.exe 46 PID 2408 wrote to memory of 756 2408 jjdpj.exe 46 PID 2408 wrote to memory of 756 2408 jjdpj.exe 46 PID 2408 wrote to memory of 756 2408 jjdpj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe"C:\Users\Admin\AppData\Local\Temp\1421136caf0ec438a81b1924e5d24fd84b268a18227ec3217859fc20071d27f8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vpjjp.exec:\vpjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\1dppp.exec:\1dppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\hbtbbb.exec:\hbtbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\ppddp.exec:\ppddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\btthbh.exec:\btthbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3rrxflf.exec:\3rrxflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hhbhhh.exec:\hhbhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tbnnbn.exec:\tbnnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\ppvdp.exec:\ppvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rrrlflx.exec:\rrrlflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\hnnthn.exec:\hnnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\jjdvv.exec:\jjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\hnhnnt.exec:\hnhnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jjdpj.exec:\jjdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\fxffrxl.exec:\fxffrxl.exe17⤵
- Executes dropped EXE
PID:756 -
\??\c:\hbthhh.exec:\hbthhh.exe18⤵
- Executes dropped EXE
PID:760 -
\??\c:\1pjvp.exec:\1pjvp.exe19⤵
- Executes dropped EXE
PID:1672 -
\??\c:\llxfrxl.exec:\llxfrxl.exe20⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnhnbn.exec:\nnhnbn.exe21⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjdpp.exec:\jjdpp.exe22⤵
- Executes dropped EXE
PID:1192 -
\??\c:\1fxllxr.exec:\1fxllxr.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5thhbh.exec:\5thhbh.exe24⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xrrlfxf.exec:\xrrlfxf.exe25⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ttnbnb.exec:\ttnbnb.exe26⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bbthnn.exec:\bbthnn.exe27⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bhbhtt.exec:\bhbhtt.exe28⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1nbhnb.exec:\1nbhnb.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1rfllrx.exec:\1rfllrx.exe30⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhbthn.exec:\nhbthn.exe31⤵
- Executes dropped EXE
PID:304 -
\??\c:\jddjv.exec:\jddjv.exe32⤵
- Executes dropped EXE
PID:1112 -
\??\c:\5ntthh.exec:\5ntthh.exe33⤵
- Executes dropped EXE
PID:1484 -
\??\c:\llxlxfx.exec:\llxlxfx.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hththh.exec:\hththh.exe35⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vjppj.exec:\vjppj.exe36⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3lxfxxl.exec:\3lxfxxl.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpppd.exec:\vpppd.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jvpjp.exec:\jvpjp.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3rlfrrf.exec:\3rlfrrf.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tnhhbb.exec:\tnhhbb.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1vpjj.exec:\1vpjj.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dpppp.exec:\dpppp.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3hntbh.exec:\3hntbh.exe44⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hhtthn.exec:\hhtthn.exe45⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1jdvd.exec:\1jdvd.exe46⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5rrlflf.exec:\5rrlflf.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\llffllx.exec:\llffllx.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\5nthnt.exec:\5nthnt.exe49⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jdjjp.exec:\jdjjp.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vdppp.exec:\vdppp.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hhbbnh.exec:\hhbbnh.exe53⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5bthnn.exec:\5bthnn.exe54⤵
- Executes dropped EXE
PID:2956 -
\??\c:\djjvv.exec:\djjvv.exe55⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9frrlrf.exec:\9frrlrf.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ththhh.exec:\ththhh.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bbnthh.exec:\bbnthh.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jdddp.exec:\jdddp.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe60⤵
- Executes dropped EXE
PID:2972 -
\??\c:\frfxlrr.exec:\frfxlrr.exe61⤵
- Executes dropped EXE
PID:2912 -
\??\c:\tttthn.exec:\tttthn.exe62⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5pddd.exec:\5pddd.exe63⤵
- Executes dropped EXE
PID:1292 -
\??\c:\ppdpd.exec:\ppdpd.exe64⤵
- Executes dropped EXE
PID:752 -
\??\c:\1xfxllr.exec:\1xfxllr.exe65⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nhtnbb.exec:\nhtnbb.exe66⤵PID:1452
-
\??\c:\jvddv.exec:\jvddv.exe67⤵PID:2308
-
\??\c:\jdjpd.exec:\jdjpd.exe68⤵PID:556
-
\??\c:\3flflrr.exec:\3flflrr.exe69⤵PID:2668
-
\??\c:\9tnnbb.exec:\9tnnbb.exe70⤵PID:2992
-
\??\c:\nbttbb.exec:\nbttbb.exe71⤵PID:2424
-
\??\c:\7dvjp.exec:\7dvjp.exe72⤵PID:2512
-
\??\c:\lfrrffr.exec:\lfrrffr.exe73⤵PID:1516
-
\??\c:\thnttt.exec:\thnttt.exe74⤵PID:1628
-
\??\c:\nthbnh.exec:\nthbnh.exe75⤵PID:2124
-
\??\c:\pdpvj.exec:\pdpvj.exe76⤵PID:2496
-
\??\c:\3lxlflr.exec:\3lxlflr.exe77⤵PID:2256
-
\??\c:\xfrxfrf.exec:\xfrxfrf.exe78⤵PID:1740
-
\??\c:\bbbhtt.exec:\bbbhtt.exe79⤵PID:2784
-
\??\c:\dvjjj.exec:\dvjjj.exe80⤵PID:3008
-
\??\c:\9fxfrxl.exec:\9fxfrxl.exe81⤵PID:2800
-
\??\c:\rlxrlxl.exec:\rlxrlxl.exe82⤵PID:2700
-
\??\c:\5bnhnt.exec:\5bnhnt.exe83⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\pppjp.exec:\pppjp.exe84⤵PID:2208
-
\??\c:\5vpvd.exec:\5vpvd.exe85⤵PID:1200
-
\??\c:\rrlfxff.exec:\rrlfxff.exe86⤵PID:2612
-
\??\c:\tbbtnt.exec:\tbbtnt.exe87⤵PID:1924
-
\??\c:\1dpdj.exec:\1dpdj.exe88⤵PID:1380
-
\??\c:\7dpvv.exec:\7dpvv.exe89⤵PID:2016
-
\??\c:\7rlxffr.exec:\7rlxffr.exe90⤵PID:2644
-
\??\c:\hbntth.exec:\hbntth.exe91⤵PID:2572
-
\??\c:\3vpdj.exec:\3vpdj.exe92⤵PID:756
-
\??\c:\7jdjj.exec:\7jdjj.exe93⤵PID:1384
-
\??\c:\1lffrrl.exec:\1lffrrl.exe94⤵PID:1672
-
\??\c:\flfxlrf.exec:\flfxlrf.exe95⤵PID:2944
-
\??\c:\nhbhtn.exec:\nhbhtn.exe96⤵PID:2904
-
\??\c:\ppjjv.exec:\ppjjv.exe97⤵PID:2552
-
\??\c:\ffflxfr.exec:\ffflxfr.exe98⤵PID:2624
-
\??\c:\rlrxrlr.exec:\rlrxrlr.exe99⤵PID:2676
-
\??\c:\hbntbb.exec:\hbntbb.exe100⤵
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\tnnnbt.exec:\tnnnbt.exe101⤵PID:2204
-
\??\c:\ppjpd.exec:\ppjpd.exe102⤵PID:1172
-
\??\c:\9lrrrxx.exec:\9lrrrxx.exe103⤵PID:1432
-
\??\c:\nnthtb.exec:\nnthtb.exe104⤵PID:540
-
\??\c:\tnhbnt.exec:\tnhbnt.exe105⤵PID:824
-
\??\c:\5jdvd.exec:\5jdvd.exe106⤵PID:572
-
\??\c:\rrrfxlr.exec:\rrrfxlr.exe107⤵PID:2132
-
\??\c:\tththb.exec:\tththb.exe108⤵PID:2448
-
\??\c:\nhtthh.exec:\nhtthh.exe109⤵PID:924
-
\??\c:\vpjdp.exec:\vpjdp.exe110⤵PID:1416
-
\??\c:\9frrlfr.exec:\9frrlfr.exe111⤵PID:2296
-
\??\c:\rflfxlr.exec:\rflfxlr.exe112⤵PID:2544
-
\??\c:\hhbnhh.exec:\hhbnhh.exe113⤵PID:2512
-
\??\c:\vjvvd.exec:\vjvvd.exe114⤵PID:1568
-
\??\c:\pdvvd.exec:\pdvvd.exe115⤵PID:2300
-
\??\c:\7fflfrr.exec:\7fflfrr.exe116⤵PID:580
-
\??\c:\btbnhn.exec:\btbnhn.exe117⤵PID:2732
-
\??\c:\thttbt.exec:\thttbt.exe118⤵PID:2508
-
\??\c:\ppppp.exec:\ppppp.exe119⤵PID:2808
-
\??\c:\flflffl.exec:\flflffl.exe120⤵PID:2444
-
\??\c:\fxlllrx.exec:\fxlllrx.exe121⤵PID:1108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-