Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe
-
Size
453KB
-
MD5
4a50aec50881291c33b2e9731d648a20
-
SHA1
e0688793f7a506ebb688210a17e3aad747667a87
-
SHA256
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f
-
SHA512
2379134392b5000224f477c5fe48f7d0d1fd43d81b9c9f851278aca6947f96737114c46c7b8f93b37409b1eef538931459439cde477d4be0b827b5e6c4cc562a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-97-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2988-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-150-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1972-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-244-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2228-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-283-0x00000000779F0000-0x0000000077B0F000-memory.dmp family_blackmoon behavioral1/memory/1480-284-0x00000000778F0000-0x00000000779EA000-memory.dmp family_blackmoon behavioral1/memory/2812-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-297-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-324-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2536-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-751-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/700-760-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1124-773-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-988-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 fxxrrrx.exe 2920 5htttn.exe 2568 rlfrrfr.exe 2836 thbbbh.exe 2532 vpddv.exe 2712 bbnntb.exe 2260 dpddd.exe 1932 nhbntt.exe 2988 rllxffl.exe 2104 tnbbnn.exe 600 pdvdv.exe 780 nnhhbb.exe 1884 hhhthh.exe 712 xxllrxf.exe 1880 1lxxffl.exe 1972 1jvjd.exe 2940 7rfllrx.exe 2172 vpjjv.exe 2212 rlxrrrr.exe 1180 bttbhn.exe 2280 jdpvd.exe 1536 xlrrllr.exe 2488 hnhtbn.exe 1124 3xlrxfl.exe 2960 nbhnbb.exe 568 xfrrrrl.exe 2032 hhbntn.exe 1856 pppjd.exe 2228 nhtnbh.exe 1480 jvppj.exe 1628 dpvpj.exe 2928 lxxxffl.exe 2740 jjdpd.exe 2840 vpjjj.exe 2676 xlxxflr.exe 3012 hhtbnn.exe 2536 vvppj.exe 2712 7xlffll.exe 576 lflxfll.exe 2760 nhtbhh.exe 1932 ppddj.exe 3032 rlxrxxx.exe 2784 1tbhhb.exe 2348 vjvpp.exe 1852 3vddd.exe 760 lrxxxxx.exe 1644 htnnhh.exe 2872 bbhnnn.exe 2256 pdvdv.exe 2804 xrlrxxf.exe 1860 bnbttt.exe 2116 dvpvj.exe 2844 fxrrrxf.exe 2164 fxlrrrr.exe 2172 nhhnth.exe 1604 pdvvv.exe 2456 pdvvj.exe 2340 5fllrrx.exe 1832 nhhhtb.exe 688 5pppp.exe 1596 dvddj.exe 1608 xlrrxrx.exe 1228 hbhbnt.exe 2924 nnhhtt.exe -
resource yara_rule behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-115-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/780-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-233-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1124-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-284-0x00000000778F0000-0x00000000779EA000-memory.dmp upx behavioral1/memory/1628-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-307-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2740-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-979-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-988-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1632-1090-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-1097-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-1104-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2752 2664 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 31 PID 2664 wrote to memory of 2752 2664 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 31 PID 2664 wrote to memory of 2752 2664 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 31 PID 2664 wrote to memory of 2752 2664 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 31 PID 2752 wrote to memory of 2920 2752 fxxrrrx.exe 32 PID 2752 wrote to memory of 2920 2752 fxxrrrx.exe 32 PID 2752 wrote to memory of 2920 2752 fxxrrrx.exe 32 PID 2752 wrote to memory of 2920 2752 fxxrrrx.exe 32 PID 2920 wrote to memory of 2568 2920 5htttn.exe 33 PID 2920 wrote to memory of 2568 2920 5htttn.exe 33 PID 2920 wrote to memory of 2568 2920 5htttn.exe 33 PID 2920 wrote to memory of 2568 2920 5htttn.exe 33 PID 2568 wrote to memory of 2836 2568 rlfrrfr.exe 34 PID 2568 wrote to memory of 2836 2568 rlfrrfr.exe 34 PID 2568 wrote to memory of 2836 2568 rlfrrfr.exe 34 PID 2568 wrote to memory of 2836 2568 rlfrrfr.exe 34 PID 2836 wrote to memory of 2532 2836 thbbbh.exe 35 PID 2836 wrote to memory of 2532 2836 thbbbh.exe 35 PID 2836 wrote to memory of 2532 2836 thbbbh.exe 35 PID 2836 wrote to memory of 2532 2836 thbbbh.exe 35 PID 2532 wrote to memory of 2712 2532 vpddv.exe 36 PID 2532 wrote to memory of 2712 2532 vpddv.exe 36 PID 2532 wrote to memory of 2712 2532 vpddv.exe 36 PID 2532 wrote to memory of 2712 2532 vpddv.exe 36 PID 2712 wrote to memory of 2260 2712 bbnntb.exe 37 PID 2712 wrote to memory of 2260 2712 bbnntb.exe 37 PID 2712 wrote to memory of 2260 2712 bbnntb.exe 37 PID 2712 wrote to memory of 2260 2712 bbnntb.exe 37 PID 2260 wrote to memory of 1932 2260 dpddd.exe 38 PID 2260 wrote to memory of 1932 2260 dpddd.exe 38 PID 2260 wrote to memory of 1932 2260 dpddd.exe 38 PID 2260 wrote to memory of 1932 2260 dpddd.exe 38 PID 1932 wrote to memory of 2988 1932 nhbntt.exe 39 PID 1932 wrote to memory of 2988 1932 nhbntt.exe 39 PID 1932 wrote to memory of 2988 1932 nhbntt.exe 39 PID 1932 wrote to memory of 2988 1932 nhbntt.exe 39 PID 2988 wrote to memory of 2104 2988 rllxffl.exe 40 PID 2988 wrote to memory of 2104 2988 rllxffl.exe 40 PID 2988 wrote to memory of 2104 2988 rllxffl.exe 40 PID 2988 wrote to memory of 2104 2988 rllxffl.exe 40 PID 2104 wrote to memory of 600 2104 tnbbnn.exe 41 PID 2104 wrote to memory of 600 2104 tnbbnn.exe 41 PID 2104 wrote to memory of 600 2104 tnbbnn.exe 41 PID 2104 wrote to memory of 600 2104 tnbbnn.exe 41 PID 600 wrote to memory of 780 600 pdvdv.exe 42 PID 600 wrote to memory of 780 600 pdvdv.exe 42 PID 600 wrote to memory of 780 600 pdvdv.exe 42 PID 600 wrote to memory of 780 600 pdvdv.exe 42 PID 780 wrote to memory of 1884 780 nnhhbb.exe 43 PID 780 wrote to memory of 1884 780 nnhhbb.exe 43 PID 780 wrote to memory of 1884 780 nnhhbb.exe 43 PID 780 wrote to memory of 1884 780 nnhhbb.exe 43 PID 1884 wrote to memory of 712 1884 hhhthh.exe 44 PID 1884 wrote to memory of 712 1884 hhhthh.exe 44 PID 1884 wrote to memory of 712 1884 hhhthh.exe 44 PID 1884 wrote to memory of 712 1884 hhhthh.exe 44 PID 712 wrote to memory of 1880 712 xxllrxf.exe 45 PID 712 wrote to memory of 1880 712 xxllrxf.exe 45 PID 712 wrote to memory of 1880 712 xxllrxf.exe 45 PID 712 wrote to memory of 1880 712 xxllrxf.exe 45 PID 1880 wrote to memory of 1972 1880 1lxxffl.exe 46 PID 1880 wrote to memory of 1972 1880 1lxxffl.exe 46 PID 1880 wrote to memory of 1972 1880 1lxxffl.exe 46 PID 1880 wrote to memory of 1972 1880 1lxxffl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe"C:\Users\Admin\AppData\Local\Temp\b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\5htttn.exec:\5htttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rlfrrfr.exec:\rlfrrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\thbbbh.exec:\thbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vpddv.exec:\vpddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bbnntb.exec:\bbnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\dpddd.exec:\dpddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\nhbntt.exec:\nhbntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rllxffl.exec:\rllxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\tnbbnn.exec:\tnbbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pdvdv.exec:\pdvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\nnhhbb.exec:\nnhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\hhhthh.exec:\hhhthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\xxllrxf.exec:\xxllrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\1lxxffl.exec:\1lxxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\1jvjd.exec:\1jvjd.exe17⤵
- Executes dropped EXE
PID:1972 -
\??\c:\7rfllrx.exec:\7rfllrx.exe18⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vpjjv.exec:\vpjjv.exe19⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bttbhn.exec:\bttbhn.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1180 -
\??\c:\jdpvd.exec:\jdpvd.exe22⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xlrrllr.exec:\xlrrllr.exe23⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hnhtbn.exec:\hnhtbn.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3xlrxfl.exec:\3xlrxfl.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nbhnbb.exec:\nbhnbb.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xfrrrrl.exec:\xfrrrrl.exe27⤵
- Executes dropped EXE
PID:568 -
\??\c:\hhbntn.exec:\hhbntn.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pppjd.exec:\pppjd.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nhtnbh.exec:\nhtnbh.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jvppj.exec:\jvppj.exe31⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lffxxlr.exec:\lffxxlr.exe32⤵PID:2812
-
\??\c:\dpvpj.exec:\dpvpj.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lxxxffl.exec:\lxxxffl.exe34⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jjdpd.exec:\jjdpd.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vpjjj.exec:\vpjjj.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xlxxflr.exec:\xlxxflr.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\hhtbnn.exec:\hhtbnn.exe38⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vvppj.exec:\vvppj.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7xlffll.exec:\7xlffll.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lflxfll.exec:\lflxfll.exe41⤵
- Executes dropped EXE
PID:576 -
\??\c:\nhtbhh.exec:\nhtbhh.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ppddj.exec:\ppddj.exe43⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rlxrxxx.exec:\rlxrxxx.exe44⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1tbhhb.exec:\1tbhhb.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vjvpp.exec:\vjvpp.exe46⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3vddd.exec:\3vddd.exe47⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe48⤵
- Executes dropped EXE
PID:760 -
\??\c:\htnnhh.exec:\htnnhh.exe49⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bbhnnn.exec:\bbhnnn.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pdvdv.exec:\pdvdv.exe51⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe52⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bnbttt.exec:\bnbttt.exe53⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dvpvj.exec:\dvpvj.exe54⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxrrrxf.exec:\fxrrrxf.exe55⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fxlrrrr.exec:\fxlrrrr.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhhnth.exec:\nhhnth.exe57⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pdvvv.exec:\pdvvv.exe58⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pdvvj.exec:\pdvvj.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5fllrrx.exec:\5fllrrx.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhhhtb.exec:\nhhhtb.exe61⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5pppp.exec:\5pppp.exe62⤵
- Executes dropped EXE
PID:688 -
\??\c:\dvddj.exec:\dvddj.exe63⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xlrrxrx.exec:\xlrrxrx.exe64⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbhbnt.exec:\hbhbnt.exe65⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nnhhtt.exec:\nnhhtt.exe66⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvjjp.exec:\dvjjp.exe67⤵PID:2912
-
\??\c:\xrffllr.exec:\xrffllr.exe68⤵PID:2024
-
\??\c:\nhbhbb.exec:\nhbhbb.exe69⤵PID:2320
-
\??\c:\5nhhnh.exec:\5nhhnh.exe70⤵PID:1080
-
\??\c:\7rrrxfl.exec:\7rrrxfl.exe71⤵PID:1424
-
\??\c:\3xrxfff.exec:\3xrxfff.exe72⤵PID:1496
-
\??\c:\htnttt.exec:\htnttt.exe73⤵PID:1524
-
\??\c:\pdjpv.exec:\pdjpv.exe74⤵PID:2824
-
\??\c:\jvddv.exec:\jvddv.exe75⤵PID:2640
-
\??\c:\xrffrrf.exec:\xrffrrf.exe76⤵PID:2588
-
\??\c:\nnnhnh.exec:\nnnhnh.exe77⤵PID:2716
-
\??\c:\vppdp.exec:\vppdp.exe78⤵
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\lfrxlfr.exec:\lfrxlfr.exe79⤵PID:2080
-
\??\c:\bnhbbb.exec:\bnhbbb.exe80⤵PID:3028
-
\??\c:\ttnnbb.exec:\ttnnbb.exe81⤵PID:1216
-
\??\c:\1dpvj.exec:\1dpvj.exe82⤵PID:2260
-
\??\c:\frffllx.exec:\frffllx.exe83⤵PID:2632
-
\??\c:\rrflrrf.exec:\rrflrrf.exe84⤵PID:2636
-
\??\c:\9thhhn.exec:\9thhhn.exe85⤵PID:2384
-
\??\c:\9vddj.exec:\9vddj.exe86⤵PID:2052
-
\??\c:\xrflxrf.exec:\xrflxrf.exe87⤵PID:2044
-
\??\c:\lrlrffx.exec:\lrlrffx.exe88⤵PID:2600
-
\??\c:\5nbbhh.exec:\5nbbhh.exe89⤵PID:2008
-
\??\c:\1vppd.exec:\1vppd.exe90⤵PID:1508
-
\??\c:\vpvjv.exec:\vpvjv.exe91⤵PID:1252
-
\??\c:\fxrrxxr.exec:\fxrrxxr.exe92⤵PID:1420
-
\??\c:\bnnbhn.exec:\bnnbhn.exe93⤵PID:272
-
\??\c:\htnbbb.exec:\htnbbb.exe94⤵PID:1688
-
\??\c:\7jdvv.exec:\7jdvv.exe95⤵PID:2512
-
\??\c:\frfflfr.exec:\frfflfr.exe96⤵PID:2948
-
\??\c:\rxlrflx.exec:\rxlrflx.exe97⤵PID:2168
-
\??\c:\bthnbb.exec:\bthnbb.exe98⤵PID:844
-
\??\c:\pdpdj.exec:\pdpdj.exe99⤵PID:2212
-
\??\c:\fxllrxl.exec:\fxllrxl.exe100⤵PID:924
-
\??\c:\lfrrffr.exec:\lfrrffr.exe101⤵PID:2628
-
\??\c:\thtttt.exec:\thtttt.exe102⤵PID:2340
-
\??\c:\vpvvd.exec:\vpvvd.exe103⤵PID:700
-
\??\c:\jdvvj.exec:\jdvvj.exe104⤵PID:2448
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe105⤵PID:1124
-
\??\c:\btnthh.exec:\btnthh.exe106⤵PID:1608
-
\??\c:\7vvvp.exec:\7vvvp.exe107⤵PID:984
-
\??\c:\1pjpv.exec:\1pjpv.exe108⤵PID:1844
-
\??\c:\xlflrrf.exec:\xlflrrf.exe109⤵PID:2904
-
\??\c:\hbhhbt.exec:\hbhhbt.exe110⤵PID:1428
-
\??\c:\bbbbhn.exec:\bbbbhn.exe111⤵PID:904
-
\??\c:\vpdjp.exec:\vpdjp.exe112⤵PID:2328
-
\??\c:\dvvpd.exec:\dvvpd.exe113⤵PID:2228
-
\??\c:\frfxllx.exec:\frfxllx.exe114⤵PID:2660
-
\??\c:\tnntht.exec:\tnntht.exe115⤵PID:2268
-
\??\c:\9pppd.exec:\9pppd.exe116⤵PID:2652
-
\??\c:\dvddp.exec:\dvddp.exe117⤵PID:2560
-
\??\c:\xlflrrf.exec:\xlflrrf.exe118⤵PID:2740
-
\??\c:\tbttnb.exec:\tbttnb.exe119⤵PID:2876
-
\??\c:\nhnnnt.exec:\nhnnnt.exe120⤵PID:3040
-
\??\c:\jvjjj.exec:\jvjjj.exe121⤵PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-