Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe
-
Size
454KB
-
MD5
e9c67b045418d5ca6bf22f4028e31407
-
SHA1
b919b145bb1ee2163288f5806fc183ae883c8e70
-
SHA256
027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458
-
SHA512
5b19505daef27dadc2fce7e67515d7d30c54c8757d8ff688cba4b6495d9a43791cbd7d97d2a17f525a5b0ac4b143a353161462e0b6144b45fdaef5724bdeea20
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetM:q7Tc2NYHUrAwfMp3CDtM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2384-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-118-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2912-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-229-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1788-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-435-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2920-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-469-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1764-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-512-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2816-538-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1688-539-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-607-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-864-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1620-867-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2700-982-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-1003-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 nhthnn.exe 2368 jvpdj.exe 2928 hhhntb.exe 2128 jdvdv.exe 2424 flxrxxl.exe 2232 jdvvd.exe 2712 vpjjp.exe 2624 nbntnn.exe 2164 dvpvd.exe 2456 hhttbh.exe 2488 dvjvd.exe 2912 pdvvv.exe 1512 nttnbb.exe 664 jdjjp.exe 1760 lfffllf.exe 1680 vjvdj.exe 1352 lfrxflx.exe 2056 3tbbhn.exe 1520 pvjdp.exe 1536 9xrxlll.exe 2732 7bbnth.exe 2788 vpddj.exe 2676 tnbtbb.exe 2552 djvvj.exe 1144 fxlrxfl.exe 1788 7tbbbb.exe 300 jjvvv.exe 1896 xxrrflr.exe 564 hbnttb.exe 3056 xrllxfl.exe 580 3nnnbt.exe 2188 dpddj.exe 2084 fxffllr.exe 2212 7tnntt.exe 2080 3dvpp.exe 1604 dpjjd.exe 2360 xlxxlll.exe 2368 bnhhnn.exe 2896 bthtbb.exe 2072 vdvvd.exe 2784 9ffxxxx.exe 2392 9lxxffl.exe 2748 nbnnbb.exe 2696 ddvdj.exe 2644 1ddjj.exe 2760 lxrlllr.exe 2836 5hnhhh.exe 2164 3jvjv.exe 2456 jjdvd.exe 2540 lxxxflx.exe 2536 btnhtb.exe 2492 jdddp.exe 2920 dvjjp.exe 2308 9lfflrx.exe 2272 5lrrrrf.exe 2276 9btbbb.exe 1260 tnbtbh.exe 796 vjddd.exe 1284 lxllllr.exe 1372 rrffllx.exe 1764 nbtbbb.exe 1612 jvpjp.exe 2816 lxrrrrx.exe 2940 frllrrx.exe -
resource yara_rule behavioral1/memory/2384-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-599-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1912-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-615-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1268-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2004 2384 027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe 28 PID 2384 wrote to memory of 2004 2384 027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe 28 PID 2384 wrote to memory of 2004 2384 027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe 28 PID 2384 wrote to memory of 2004 2384 027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe 28 PID 2004 wrote to memory of 2368 2004 nhthnn.exe 29 PID 2004 wrote to memory of 2368 2004 nhthnn.exe 29 PID 2004 wrote to memory of 2368 2004 nhthnn.exe 29 PID 2004 wrote to memory of 2368 2004 nhthnn.exe 29 PID 2368 wrote to memory of 2928 2368 jvpdj.exe 30 PID 2368 wrote to memory of 2928 2368 jvpdj.exe 30 PID 2368 wrote to memory of 2928 2368 jvpdj.exe 30 PID 2368 wrote to memory of 2928 2368 jvpdj.exe 30 PID 2928 wrote to memory of 2128 2928 hhhntb.exe 31 PID 2928 wrote to memory of 2128 2928 hhhntb.exe 31 PID 2928 wrote to memory of 2128 2928 hhhntb.exe 31 PID 2928 wrote to memory of 2128 2928 hhhntb.exe 31 PID 2128 wrote to memory of 2424 2128 jdvdv.exe 32 PID 2128 wrote to memory of 2424 2128 jdvdv.exe 32 PID 2128 wrote to memory of 2424 2128 jdvdv.exe 32 PID 2128 wrote to memory of 2424 2128 jdvdv.exe 32 PID 2424 wrote to memory of 2232 2424 flxrxxl.exe 33 PID 2424 wrote to memory of 2232 2424 flxrxxl.exe 33 PID 2424 wrote to memory of 2232 2424 flxrxxl.exe 33 PID 2424 wrote to memory of 2232 2424 flxrxxl.exe 33 PID 2232 wrote to memory of 2712 2232 jdvvd.exe 34 PID 2232 wrote to memory of 2712 2232 jdvvd.exe 34 PID 2232 wrote to memory of 2712 2232 jdvvd.exe 34 PID 2232 wrote to memory of 2712 2232 jdvvd.exe 34 PID 2712 wrote to memory of 2624 2712 vpjjp.exe 35 PID 2712 wrote to memory of 2624 2712 vpjjp.exe 35 PID 2712 wrote to memory of 2624 2712 vpjjp.exe 35 PID 2712 wrote to memory of 2624 2712 vpjjp.exe 35 PID 2624 wrote to memory of 2164 2624 nbntnn.exe 36 PID 2624 wrote to memory of 2164 2624 nbntnn.exe 36 PID 2624 wrote to memory of 2164 2624 nbntnn.exe 36 PID 2624 wrote to memory of 2164 2624 nbntnn.exe 36 PID 2164 wrote to memory of 2456 2164 dvpvd.exe 37 PID 2164 wrote to memory of 2456 2164 dvpvd.exe 37 PID 2164 wrote to memory of 2456 2164 dvpvd.exe 37 PID 2164 wrote to memory of 2456 2164 dvpvd.exe 37 PID 2456 wrote to memory of 2488 2456 hhttbh.exe 38 PID 2456 wrote to memory of 2488 2456 hhttbh.exe 38 PID 2456 wrote to memory of 2488 2456 hhttbh.exe 38 PID 2456 wrote to memory of 2488 2456 hhttbh.exe 38 PID 2488 wrote to memory of 2912 2488 dvjvd.exe 39 PID 2488 wrote to memory of 2912 2488 dvjvd.exe 39 PID 2488 wrote to memory of 2912 2488 dvjvd.exe 39 PID 2488 wrote to memory of 2912 2488 dvjvd.exe 39 PID 2912 wrote to memory of 1512 2912 pdvvv.exe 40 PID 2912 wrote to memory of 1512 2912 pdvvv.exe 40 PID 2912 wrote to memory of 1512 2912 pdvvv.exe 40 PID 2912 wrote to memory of 1512 2912 pdvvv.exe 40 PID 1512 wrote to memory of 664 1512 nttnbb.exe 41 PID 1512 wrote to memory of 664 1512 nttnbb.exe 41 PID 1512 wrote to memory of 664 1512 nttnbb.exe 41 PID 1512 wrote to memory of 664 1512 nttnbb.exe 41 PID 664 wrote to memory of 1760 664 jdjjp.exe 42 PID 664 wrote to memory of 1760 664 jdjjp.exe 42 PID 664 wrote to memory of 1760 664 jdjjp.exe 42 PID 664 wrote to memory of 1760 664 jdjjp.exe 42 PID 1760 wrote to memory of 1680 1760 lfffllf.exe 43 PID 1760 wrote to memory of 1680 1760 lfffllf.exe 43 PID 1760 wrote to memory of 1680 1760 lfffllf.exe 43 PID 1760 wrote to memory of 1680 1760 lfffllf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe"C:\Users\Admin\AppData\Local\Temp\027535a35bf13178692250b8e04e49d100e62522e25decfa2b8df9cfc6b37458.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nhthnn.exec:\nhthnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jvpdj.exec:\jvpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hhhntb.exec:\hhhntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jdvdv.exec:\jdvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\flxrxxl.exec:\flxrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jdvvd.exec:\jdvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vpjjp.exec:\vpjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nbntnn.exec:\nbntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\dvpvd.exec:\dvpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\hhttbh.exec:\hhttbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dvjvd.exec:\dvjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pdvvv.exec:\pdvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nttnbb.exec:\nttnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jdjjp.exec:\jdjjp.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\lfffllf.exec:\lfffllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\vjvdj.exec:\vjvdj.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lfrxflx.exec:\lfrxflx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1352 -
\??\c:\3tbbhn.exec:\3tbbhn.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pvjdp.exec:\pvjdp.exe20⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9xrxlll.exec:\9xrxlll.exe21⤵
- Executes dropped EXE
PID:1536 -
\??\c:\7bbnth.exec:\7bbnth.exe22⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vpddj.exec:\vpddj.exe23⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tnbtbb.exec:\tnbtbb.exe24⤵
- Executes dropped EXE
PID:2676 -
\??\c:\djvvj.exec:\djvvj.exe25⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe26⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7tbbbb.exec:\7tbbbb.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jjvvv.exec:\jjvvv.exe28⤵
- Executes dropped EXE
PID:300 -
\??\c:\xxrrflr.exec:\xxrrflr.exe29⤵
- Executes dropped EXE
PID:1896 -
\??\c:\hbnttb.exec:\hbnttb.exe30⤵
- Executes dropped EXE
PID:564 -
\??\c:\xrllxfl.exec:\xrllxfl.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3nnnbt.exec:\3nnnbt.exe32⤵
- Executes dropped EXE
PID:580 -
\??\c:\dpddj.exec:\dpddj.exe33⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxffllr.exec:\fxffllr.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7tnntt.exec:\7tnntt.exe35⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3dvpp.exec:\3dvpp.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\dpjjd.exec:\dpjjd.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xlxxlll.exec:\xlxxlll.exe38⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bnhhnn.exec:\bnhhnn.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bthtbb.exec:\bthtbb.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vdvvd.exec:\vdvvd.exe41⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9ffxxxx.exec:\9ffxxxx.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9lxxffl.exec:\9lxxffl.exe43⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nbnnbb.exec:\nbnnbb.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ddvdj.exec:\ddvdj.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1ddjj.exec:\1ddjj.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lxrlllr.exec:\lxrlllr.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5hnhhh.exec:\5hnhhh.exe48⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3jvjv.exec:\3jvjv.exe49⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jjdvd.exec:\jjdvd.exe50⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lxxxflx.exec:\lxxxflx.exe51⤵
- Executes dropped EXE
PID:2540 -
\??\c:\btnhtb.exec:\btnhtb.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdddp.exec:\jdddp.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dvjjp.exec:\dvjjp.exe54⤵
- Executes dropped EXE
PID:2920 -
\??\c:\9lfflrx.exec:\9lfflrx.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5lrrrrf.exec:\5lrrrrf.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9btbbb.exec:\9btbbb.exe57⤵
- Executes dropped EXE
PID:2276 -
\??\c:\tnbtbh.exec:\tnbtbh.exe58⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vjddd.exec:\vjddd.exe59⤵
- Executes dropped EXE
PID:796 -
\??\c:\lxllllr.exec:\lxllllr.exe60⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rrffllx.exec:\rrffllx.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nbtbbb.exec:\nbtbbb.exe62⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jvpjp.exec:\jvpjp.exe63⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe64⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frllrrx.exec:\frllrrx.exe65⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bnbbnn.exec:\bnbbnn.exe66⤵PID:1124
-
\??\c:\9pjpv.exec:\9pjpv.exe67⤵PID:2196
-
\??\c:\frfxlll.exec:\frfxlll.exe68⤵PID:1688
-
\??\c:\rrffllr.exec:\rrffllr.exe69⤵PID:1876
-
\??\c:\hbbhhn.exec:\hbbhhn.exe70⤵PID:2352
-
\??\c:\pjvdd.exec:\pjvdd.exe71⤵PID:340
-
\??\c:\vjddv.exec:\vjddv.exe72⤵PID:1376
-
\??\c:\frffllx.exec:\frffllx.exe73⤵PID:872
-
\??\c:\thntbb.exec:\thntbb.exe74⤵PID:2404
-
\??\c:\nbtbth.exec:\nbtbth.exe75⤵PID:2672
-
\??\c:\5pdvd.exec:\5pdvd.exe76⤵PID:2076
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe77⤵PID:2068
-
\??\c:\rrrrffl.exec:\rrrrffl.exe78⤵PID:1912
-
\??\c:\htbbbb.exec:\htbbbb.exe79⤵PID:1940
-
\??\c:\vppvd.exec:\vppvd.exe80⤵PID:1696
-
\??\c:\5ddvj.exec:\5ddvj.exe81⤵PID:2876
-
\??\c:\1lrllrx.exec:\1lrllrx.exe82⤵PID:1324
-
\??\c:\1bbhhb.exec:\1bbhhb.exe83⤵PID:2572
-
\??\c:\pvjjd.exec:\pvjjd.exe84⤵PID:1268
-
\??\c:\jpjpd.exec:\jpjpd.exe85⤵PID:2128
-
\??\c:\xxffrrf.exec:\xxffrrf.exe86⤵PID:2916
-
\??\c:\thbtbh.exec:\thbtbh.exe87⤵PID:2600
-
\??\c:\1ttttn.exec:\1ttttn.exe88⤵PID:2780
-
\??\c:\jjdjp.exec:\jjdjp.exe89⤵PID:2844
-
\??\c:\frllrrx.exec:\frllrrx.exe90⤵PID:2640
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe91⤵PID:2832
-
\??\c:\7nnntt.exec:\7nnntt.exe92⤵PID:2624
-
\??\c:\3jjjj.exec:\3jjjj.exe93⤵PID:2652
-
\??\c:\xffrflf.exec:\xffrflf.exe94⤵PID:2744
-
\??\c:\lllrfxl.exec:\lllrfxl.exe95⤵PID:2556
-
\??\c:\bbthnb.exec:\bbthnb.exe96⤵PID:2908
-
\??\c:\pdvvd.exec:\pdvvd.exe97⤵PID:2260
-
\??\c:\rlffrrx.exec:\rlffrrx.exe98⤵PID:2568
-
\??\c:\xlffllx.exec:\xlffllx.exe99⤵PID:1148
-
\??\c:\7bhhnt.exec:\7bhhnt.exe100⤵PID:1356
-
\??\c:\bthbbh.exec:\bthbbh.exe101⤵PID:1740
-
\??\c:\dvddj.exec:\dvddj.exe102⤵PID:752
-
\??\c:\fxlxffl.exec:\fxlxffl.exe103⤵PID:1256
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe104⤵PID:1960
-
\??\c:\tnbntt.exec:\tnbntt.exe105⤵PID:328
-
\??\c:\3ttbnh.exec:\3ttbnh.exe106⤵PID:1632
-
\??\c:\jdjpd.exec:\jdjpd.exe107⤵PID:1280
-
\??\c:\xxllllr.exec:\xxllllr.exe108⤵PID:624
-
\??\c:\frlfllx.exec:\frlfllx.exe109⤵PID:3016
-
\??\c:\bthhnt.exec:\bthhnt.exe110⤵PID:2732
-
\??\c:\vjjjp.exec:\vjjjp.exe111⤵PID:1292
-
\??\c:\vjddv.exec:\vjddv.exe112⤵PID:2156
-
\??\c:\lxffllr.exec:\lxffllr.exe113⤵PID:2724
-
\??\c:\thnnnh.exec:\thnnnh.exe114⤵PID:1848
-
\??\c:\7hbbhb.exec:\7hbbhb.exe115⤵PID:804
-
\??\c:\1jjjj.exec:\1jjjj.exe116⤵PID:1620
-
\??\c:\xrlrrlx.exec:\xrlrrlx.exe117⤵PID:2352
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe118⤵PID:1564
-
\??\c:\nhhhnh.exec:\nhhhnh.exe119⤵PID:1948
-
\??\c:\thttbb.exec:\thttbb.exe120⤵PID:740
-
\??\c:\5jddv.exec:\5jddv.exe121⤵PID:2052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-