Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 03:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe
-
Size
453KB
-
MD5
25270dba82b4387dce3ee39afb168b5e
-
SHA1
53e312f75105cbb6c9f9a24e25916a48648f3f55
-
SHA256
9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028
-
SHA512
01955c33abdd340645e44caf784420c6042b5d2df06dca6214c781adcfc0278f0ecc832856b42b1f6d60b2462940c3f2813403b6d9b30436ee713f3497af6afc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2440-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-118-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2556-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2556-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1968-147-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2380-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-183-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1200-198-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1912-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-224-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-222-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-335-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2428-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-398-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-432-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-542-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2348-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-785-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2832-793-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3044-806-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1648-898-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2620-960-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-1066-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1240-1173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-1309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-1322-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-1334-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1660-1376-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2848 rlllffl.exe 2016 9nbbht.exe 1804 9pvdj.exe 1080 xlxfllr.exe 2412 tthtbt.exe 1260 pdpvp.exe 2116 ddppv.exe 2740 htnnbh.exe 2632 vpvdp.exe 2644 nnnthh.exe 2672 vpddj.exe 2756 bnhhnn.exe 2556 vpdjv.exe 2280 pdjjp.exe 1968 vpvvd.exe 2380 bbbnbt.exe 1200 5dvdv.exe 2040 hbtttt.exe 1060 tnhtbh.exe 2424 ppjvp.exe 1912 hbtbbb.exe 2708 fxlrllx.exe 2932 hbnbhn.exe 2812 hbhhnh.exe 1524 9xxrrxl.exe 1516 1ntbtt.exe 1900 9jppd.exe 2792 1xrxllr.exe 1224 llfrfxl.exe 668 vpdjj.exe 2996 xrrrffr.exe 2912 jdpvd.exe 2184 9xrfxxl.exe 2108 5hbbhh.exe 316 bbnbnn.exe 1920 jjdpp.exe 2776 1lffxfl.exe 2292 7flrlff.exe 1292 nnbbnt.exe 2196 vjvvv.exe 2428 djdpv.exe 3012 3xlflrr.exe 2732 hbhhtt.exe 2764 nhbhbb.exe 3020 dvpvd.exe 2608 lfflrxl.exe 2980 9xllllr.exe 2528 hhthnb.exe 2476 5vjjj.exe 2984 jdpdj.exe 2216 3lxxfff.exe 568 bthnbh.exe 1412 bnhhhh.exe 2032 vjppp.exe 2380 xlffllr.exe 1400 1tnntb.exe 1992 nhnnbt.exe 1748 pjvvj.exe 2024 rflllrx.exe 1940 fxrfrxr.exe 2788 7thnnn.exe 2704 vjdvv.exe 1616 dpdjj.exe 2520 rfffrrf.exe -
resource yara_rule behavioral1/memory/2440-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-147-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2380-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-224-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1516-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-710-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/756-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-898-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1064-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-960-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-1073-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-1086-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-1099-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-1138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-1369-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2848 2440 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 28 PID 2440 wrote to memory of 2848 2440 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 28 PID 2440 wrote to memory of 2848 2440 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 28 PID 2440 wrote to memory of 2848 2440 9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe 28 PID 2848 wrote to memory of 2016 2848 rlllffl.exe 29 PID 2848 wrote to memory of 2016 2848 rlllffl.exe 29 PID 2848 wrote to memory of 2016 2848 rlllffl.exe 29 PID 2848 wrote to memory of 2016 2848 rlllffl.exe 29 PID 2016 wrote to memory of 1804 2016 9nbbht.exe 30 PID 2016 wrote to memory of 1804 2016 9nbbht.exe 30 PID 2016 wrote to memory of 1804 2016 9nbbht.exe 30 PID 2016 wrote to memory of 1804 2016 9nbbht.exe 30 PID 1804 wrote to memory of 1080 1804 9pvdj.exe 31 PID 1804 wrote to memory of 1080 1804 9pvdj.exe 31 PID 1804 wrote to memory of 1080 1804 9pvdj.exe 31 PID 1804 wrote to memory of 1080 1804 9pvdj.exe 31 PID 1080 wrote to memory of 2412 1080 xlxfllr.exe 32 PID 1080 wrote to memory of 2412 1080 xlxfllr.exe 32 PID 1080 wrote to memory of 2412 1080 xlxfllr.exe 32 PID 1080 wrote to memory of 2412 1080 xlxfllr.exe 32 PID 2412 wrote to memory of 1260 2412 tthtbt.exe 33 PID 2412 wrote to memory of 1260 2412 tthtbt.exe 33 PID 2412 wrote to memory of 1260 2412 tthtbt.exe 33 PID 2412 wrote to memory of 1260 2412 tthtbt.exe 33 PID 1260 wrote to memory of 2116 1260 pdpvp.exe 34 PID 1260 wrote to memory of 2116 1260 pdpvp.exe 34 PID 1260 wrote to memory of 2116 1260 pdpvp.exe 34 PID 1260 wrote to memory of 2116 1260 pdpvp.exe 34 PID 2116 wrote to memory of 2740 2116 ddppv.exe 35 PID 2116 wrote to memory of 2740 2116 ddppv.exe 35 PID 2116 wrote to memory of 2740 2116 ddppv.exe 35 PID 2116 wrote to memory of 2740 2116 ddppv.exe 35 PID 2740 wrote to memory of 2632 2740 htnnbh.exe 36 PID 2740 wrote to memory of 2632 2740 htnnbh.exe 36 PID 2740 wrote to memory of 2632 2740 htnnbh.exe 36 PID 2740 wrote to memory of 2632 2740 htnnbh.exe 36 PID 2632 wrote to memory of 2644 2632 vpvdp.exe 37 PID 2632 wrote to memory of 2644 2632 vpvdp.exe 37 PID 2632 wrote to memory of 2644 2632 vpvdp.exe 37 PID 2632 wrote to memory of 2644 2632 vpvdp.exe 37 PID 2644 wrote to memory of 2672 2644 nnnthh.exe 38 PID 2644 wrote to memory of 2672 2644 nnnthh.exe 38 PID 2644 wrote to memory of 2672 2644 nnnthh.exe 38 PID 2644 wrote to memory of 2672 2644 nnnthh.exe 38 PID 2672 wrote to memory of 2756 2672 vpddj.exe 39 PID 2672 wrote to memory of 2756 2672 vpddj.exe 39 PID 2672 wrote to memory of 2756 2672 vpddj.exe 39 PID 2672 wrote to memory of 2756 2672 vpddj.exe 39 PID 2756 wrote to memory of 2556 2756 bnhhnn.exe 40 PID 2756 wrote to memory of 2556 2756 bnhhnn.exe 40 PID 2756 wrote to memory of 2556 2756 bnhhnn.exe 40 PID 2756 wrote to memory of 2556 2756 bnhhnn.exe 40 PID 2556 wrote to memory of 2280 2556 vpdjv.exe 41 PID 2556 wrote to memory of 2280 2556 vpdjv.exe 41 PID 2556 wrote to memory of 2280 2556 vpdjv.exe 41 PID 2556 wrote to memory of 2280 2556 vpdjv.exe 41 PID 2280 wrote to memory of 1968 2280 pdjjp.exe 42 PID 2280 wrote to memory of 1968 2280 pdjjp.exe 42 PID 2280 wrote to memory of 1968 2280 pdjjp.exe 42 PID 2280 wrote to memory of 1968 2280 pdjjp.exe 42 PID 1968 wrote to memory of 2380 1968 vpvvd.exe 43 PID 1968 wrote to memory of 2380 1968 vpvvd.exe 43 PID 1968 wrote to memory of 2380 1968 vpvvd.exe 43 PID 1968 wrote to memory of 2380 1968 vpvvd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe"C:\Users\Admin\AppData\Local\Temp\9570346b269aa867e821c88325699e8eefb2310b3c94118e745c5dd7db3a6028.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\rlllffl.exec:\rlllffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9nbbht.exec:\9nbbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\9pvdj.exec:\9pvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\xlxfllr.exec:\xlxfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\tthtbt.exec:\tthtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pdpvp.exec:\pdpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\ddppv.exec:\ddppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\htnnbh.exec:\htnnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vpvdp.exec:\vpvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nnnthh.exec:\nnnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vpddj.exec:\vpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bnhhnn.exec:\bnhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vpdjv.exec:\vpdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pdjjp.exec:\pdjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vpvvd.exec:\vpvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\bbbnbt.exec:\bbbnbt.exe17⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5dvdv.exec:\5dvdv.exe18⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hbtttt.exec:\hbtttt.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tnhtbh.exec:\tnhtbh.exe20⤵
- Executes dropped EXE
PID:1060 -
\??\c:\ppjvp.exec:\ppjvp.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hbtbbb.exec:\hbtbbb.exe22⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fxlrllx.exec:\fxlrllx.exe23⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hbnbhn.exec:\hbnbhn.exe24⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hbhhnh.exec:\hbhhnh.exe25⤵
- Executes dropped EXE
PID:2812 -
\??\c:\9xxrrxl.exec:\9xxrrxl.exe26⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1ntbtt.exec:\1ntbtt.exe27⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9jppd.exec:\9jppd.exe28⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1xrxllr.exec:\1xrxllr.exe29⤵
- Executes dropped EXE
PID:2792 -
\??\c:\llfrfxl.exec:\llfrfxl.exe30⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vpdjj.exec:\vpdjj.exe31⤵
- Executes dropped EXE
PID:668 -
\??\c:\xrrrffr.exec:\xrrrffr.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jdpvd.exec:\jdpvd.exe33⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9xrfxxl.exec:\9xrfxxl.exe34⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5hbbhh.exec:\5hbbhh.exe35⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bbnbnn.exec:\bbnbnn.exe36⤵
- Executes dropped EXE
PID:316 -
\??\c:\jjdpp.exec:\jjdpp.exe37⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1lffxfl.exec:\1lffxfl.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7flrlff.exec:\7flrlff.exe39⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nnbbnt.exec:\nnbbnt.exe40⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vjvvv.exec:\vjvvv.exe41⤵
- Executes dropped EXE
PID:2196 -
\??\c:\djdpv.exec:\djdpv.exe42⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3xlflrr.exec:\3xlflrr.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hbhhtt.exec:\hbhhtt.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhbhbb.exec:\nhbhbb.exe45⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvpvd.exec:\dvpvd.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lfflrxl.exec:\lfflrxl.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9xllllr.exec:\9xllllr.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hhthnb.exec:\hhthnb.exe49⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5vjjj.exec:\5vjjj.exe50⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jdpdj.exec:\jdpdj.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\3lxxfff.exec:\3lxxfff.exe52⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bthnbh.exec:\bthnbh.exe53⤵
- Executes dropped EXE
PID:568 -
\??\c:\bnhhhh.exec:\bnhhhh.exe54⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vjppp.exec:\vjppp.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlffllr.exec:\xlffllr.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1tnntb.exec:\1tnntb.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nhnnbt.exec:\nhnnbt.exe58⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjvvj.exec:\pjvvj.exe59⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rflllrx.exec:\rflllrx.exe60⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe61⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7thnnn.exec:\7thnnn.exe62⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vjdvv.exec:\vjdvv.exe63⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dpdjj.exec:\dpdjj.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rfffrrf.exec:\rfffrrf.exe65⤵
- Executes dropped EXE
PID:2520 -
\??\c:\btntnn.exec:\btntnn.exe66⤵PID:552
-
\??\c:\3ttttt.exec:\3ttttt.exe67⤵PID:3044
-
\??\c:\ddvvp.exec:\ddvvp.exe68⤵PID:2356
-
\??\c:\7lflllr.exec:\7lflllr.exe69⤵PID:1660
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe70⤵PID:2364
-
\??\c:\nnhtnn.exec:\nnhtnn.exe71⤵PID:2148
-
\??\c:\ddppv.exec:\ddppv.exe72⤵PID:564
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe73⤵PID:2792
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe74⤵PID:2348
-
\??\c:\btnhnh.exec:\btnhnh.exe75⤵PID:952
-
\??\c:\hhnbbb.exec:\hhnbbb.exe76⤵PID:2208
-
\??\c:\pdppp.exec:\pdppp.exe77⤵PID:876
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe78⤵PID:1380
-
\??\c:\1xrrxfl.exec:\1xrrxfl.exe79⤵PID:2440
-
\??\c:\tbnntn.exec:\tbnntn.exe80⤵PID:836
-
\??\c:\dvdjv.exec:\dvdjv.exe81⤵PID:2920
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe82⤵PID:1648
-
\??\c:\rlffllf.exec:\rlffllf.exe83⤵PID:1212
-
\??\c:\tnbbhn.exec:\tnbbhn.exe84⤵PID:548
-
\??\c:\5jvvv.exec:\5jvvv.exe85⤵PID:852
-
\??\c:\jjvdv.exec:\jjvdv.exe86⤵PID:1292
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe87⤵PID:2956
-
\??\c:\hbnhtt.exec:\hbnhtt.exe88⤵PID:2428
-
\??\c:\nhtnnh.exec:\nhtnnh.exe89⤵PID:2744
-
\??\c:\7dpjj.exec:\7dpjj.exe90⤵PID:2732
-
\??\c:\rlfrrrx.exec:\rlfrrrx.exe91⤵PID:1808
-
\??\c:\rrffxxf.exec:\rrffxxf.exe92⤵PID:2728
-
\??\c:\9ntntt.exec:\9ntntt.exe93⤵PID:2608
-
\??\c:\pjvdv.exec:\pjvdv.exe94⤵PID:2688
-
\??\c:\5dvpd.exec:\5dvpd.exe95⤵PID:2536
-
\??\c:\rlfrflr.exec:\rlfrflr.exe96⤵PID:2936
-
\??\c:\7hhhnt.exec:\7hhhnt.exe97⤵PID:2940
-
\??\c:\bhnnth.exec:\bhnnth.exe98⤵PID:2524
-
\??\c:\jdpjp.exec:\jdpjp.exe99⤵PID:2948
-
\??\c:\dvjpd.exec:\dvjpd.exe100⤵PID:1668
-
\??\c:\fxxfffr.exec:\fxxfffr.exe101⤵PID:2240
-
\??\c:\bbbnbb.exec:\bbbnbb.exe102⤵PID:1284
-
\??\c:\vvvdv.exec:\vvvdv.exe103⤵PID:1796
-
\??\c:\7jvvj.exec:\7jvvj.exe104⤵PID:756
-
\??\c:\5llrxxl.exec:\5llrxxl.exe105⤵PID:1748
-
\??\c:\7thhbt.exec:\7thhbt.exe106⤵PID:1960
-
\??\c:\3hbtth.exec:\3hbtth.exe107⤵PID:1940
-
\??\c:\jjpdv.exec:\jjpdv.exe108⤵PID:2584
-
\??\c:\vjvvv.exec:\vjvvv.exe109⤵PID:2700
-
\??\c:\lxlrffr.exec:\lxlrffr.exe110⤵PID:2676
-
\??\c:\nbtntb.exec:\nbtntb.exe111⤵PID:2832
-
\??\c:\5tnbtb.exec:\5tnbtb.exe112⤵PID:552
-
\??\c:\dpjjp.exec:\dpjjp.exe113⤵PID:3044
-
\??\c:\lxrrffr.exec:\lxrrffr.exe114⤵PID:1656
-
\??\c:\hbnthb.exec:\hbnthb.exe115⤵PID:2420
-
\??\c:\thtbbt.exec:\thtbbt.exe116⤵PID:1372
-
\??\c:\vpddj.exec:\vpddj.exe117⤵PID:2888
-
\??\c:\xrflrxr.exec:\xrflrxr.exe118⤵PID:544
-
\??\c:\1xxxflr.exec:\1xxxflr.exe119⤵PID:1612
-
\??\c:\nnhhnt.exec:\nnhhnt.exe120⤵PID:2164
-
\??\c:\vpdvd.exec:\vpdvd.exe121⤵PID:952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-