Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe
-
Size
456KB
-
MD5
1652b465f36fe980db0a7d5c09af7bc9
-
SHA1
16d232bc616088fd199c86953585cfa693c84cbc
-
SHA256
12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1
-
SHA512
8b7428c85488a69150a901c96f49367abba8fe1d5f26459d848cfd2677a69de6f6e205dda8af0c002737523f01286d2962922098a3143410bcb692b9a2a164a9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2408-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-135-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1008-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-266-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-354-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2772-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-405-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1912-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-549-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2068-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-574-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-587-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3024-612-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3024-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-626-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-1013-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-1247-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1976-1309-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2448-1318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 5rllrxl.exe 1552 1llrfrl.exe 632 7nhhnt.exe 2764 3jvdp.exe 3032 tthnhn.exe 2880 bbtthh.exe 2640 rlrfrrl.exe 2780 bbnthh.exe 2600 dpddp.exe 2156 3btbhn.exe 2000 vppvp.exe 2360 rlxfrxf.exe 1264 hbntbt.exe 1008 9vppp.exe 1192 lfxxflr.exe 1200 rfxxxxl.exe 2152 thbhtt.exe 2700 rfllllx.exe 2140 tnbhhn.exe 444 jjvvp.exe 2236 lfxrlrl.exe 1300 ppvdp.exe 1908 9xxlxxr.exe 1424 hbbhnn.exe 1464 pjjdp.exe 728 rlxflrl.exe 2280 jvvvd.exe 1652 vvddp.exe 1280 rllrlfx.exe 1420 vvvdp.exe 2252 5rlxflx.exe 264 ntnthn.exe 3012 rlflxfr.exe 2508 nnbhnt.exe 2072 nnhthh.exe 708 1pjvd.exe 2904 ffxlffl.exe 2896 lfxfrxf.exe 2864 nhbbnn.exe 2876 7vdpd.exe 2644 9pvvd.exe 2772 lfrlrrx.exe 2780 btnthh.exe 2680 nhhnbh.exe 944 vvppd.exe 1900 lxllxfl.exe 1704 nhthnb.exe 1828 tnhnbt.exe 2424 jjvdj.exe 1912 ffrrrrf.exe 1008 frxfffl.exe 1692 9nnbbh.exe 1344 vdvvd.exe 1540 9dvvp.exe 2192 9rffffl.exe 2812 nhnnnt.exe 2228 nhbhhn.exe 300 ddppd.exe 2584 ffxlrfr.exe 1256 lxrrxxf.exe 1772 bhhtbb.exe 624 jdvdj.exe 2948 3vppv.exe 2580 fllflll.exe -
resource yara_rule behavioral1/memory/2408-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-99-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1264-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-279-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2896-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-1113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-1139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-1211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-1240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-1318-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2532 2408 12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe 31 PID 2408 wrote to memory of 2532 2408 12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe 31 PID 2408 wrote to memory of 2532 2408 12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe 31 PID 2408 wrote to memory of 2532 2408 12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe 31 PID 2532 wrote to memory of 1552 2532 5rllrxl.exe 32 PID 2532 wrote to memory of 1552 2532 5rllrxl.exe 32 PID 2532 wrote to memory of 1552 2532 5rllrxl.exe 32 PID 2532 wrote to memory of 1552 2532 5rllrxl.exe 32 PID 1552 wrote to memory of 632 1552 1llrfrl.exe 33 PID 1552 wrote to memory of 632 1552 1llrfrl.exe 33 PID 1552 wrote to memory of 632 1552 1llrfrl.exe 33 PID 1552 wrote to memory of 632 1552 1llrfrl.exe 33 PID 632 wrote to memory of 2764 632 7nhhnt.exe 34 PID 632 wrote to memory of 2764 632 7nhhnt.exe 34 PID 632 wrote to memory of 2764 632 7nhhnt.exe 34 PID 632 wrote to memory of 2764 632 7nhhnt.exe 34 PID 2764 wrote to memory of 3032 2764 3jvdp.exe 35 PID 2764 wrote to memory of 3032 2764 3jvdp.exe 35 PID 2764 wrote to memory of 3032 2764 3jvdp.exe 35 PID 2764 wrote to memory of 3032 2764 3jvdp.exe 35 PID 3032 wrote to memory of 2880 3032 tthnhn.exe 36 PID 3032 wrote to memory of 2880 3032 tthnhn.exe 36 PID 3032 wrote to memory of 2880 3032 tthnhn.exe 36 PID 3032 wrote to memory of 2880 3032 tthnhn.exe 36 PID 2880 wrote to memory of 2640 2880 bbtthh.exe 37 PID 2880 wrote to memory of 2640 2880 bbtthh.exe 37 PID 2880 wrote to memory of 2640 2880 bbtthh.exe 37 PID 2880 wrote to memory of 2640 2880 bbtthh.exe 37 PID 2640 wrote to memory of 2780 2640 rlrfrrl.exe 38 PID 2640 wrote to memory of 2780 2640 rlrfrrl.exe 38 PID 2640 wrote to memory of 2780 2640 rlrfrrl.exe 38 PID 2640 wrote to memory of 2780 2640 rlrfrrl.exe 38 PID 2780 wrote to memory of 2600 2780 bbnthh.exe 39 PID 2780 wrote to memory of 2600 2780 bbnthh.exe 39 PID 2780 wrote to memory of 2600 2780 bbnthh.exe 39 PID 2780 wrote to memory of 2600 2780 bbnthh.exe 39 PID 2600 wrote to memory of 2156 2600 dpddp.exe 40 PID 2600 wrote to memory of 2156 2600 dpddp.exe 40 PID 2600 wrote to memory of 2156 2600 dpddp.exe 40 PID 2600 wrote to memory of 2156 2600 dpddp.exe 40 PID 2156 wrote to memory of 2000 2156 3btbhn.exe 41 PID 2156 wrote to memory of 2000 2156 3btbhn.exe 41 PID 2156 wrote to memory of 2000 2156 3btbhn.exe 41 PID 2156 wrote to memory of 2000 2156 3btbhn.exe 41 PID 2000 wrote to memory of 2360 2000 vppvp.exe 42 PID 2000 wrote to memory of 2360 2000 vppvp.exe 42 PID 2000 wrote to memory of 2360 2000 vppvp.exe 42 PID 2000 wrote to memory of 2360 2000 vppvp.exe 42 PID 2360 wrote to memory of 1264 2360 rlxfrxf.exe 43 PID 2360 wrote to memory of 1264 2360 rlxfrxf.exe 43 PID 2360 wrote to memory of 1264 2360 rlxfrxf.exe 43 PID 2360 wrote to memory of 1264 2360 rlxfrxf.exe 43 PID 1264 wrote to memory of 1008 1264 hbntbt.exe 44 PID 1264 wrote to memory of 1008 1264 hbntbt.exe 44 PID 1264 wrote to memory of 1008 1264 hbntbt.exe 44 PID 1264 wrote to memory of 1008 1264 hbntbt.exe 44 PID 1008 wrote to memory of 1192 1008 9vppp.exe 45 PID 1008 wrote to memory of 1192 1008 9vppp.exe 45 PID 1008 wrote to memory of 1192 1008 9vppp.exe 45 PID 1008 wrote to memory of 1192 1008 9vppp.exe 45 PID 1192 wrote to memory of 1200 1192 lfxxflr.exe 46 PID 1192 wrote to memory of 1200 1192 lfxxflr.exe 46 PID 1192 wrote to memory of 1200 1192 lfxxflr.exe 46 PID 1192 wrote to memory of 1200 1192 lfxxflr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe"C:\Users\Admin\AppData\Local\Temp\12eac72aebf4a6e63be87d1786b73d73b62b4af7f5800327b0176b2ebc35ccb1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\5rllrxl.exec:\5rllrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1llrfrl.exec:\1llrfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\7nhhnt.exec:\7nhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\3jvdp.exec:\3jvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tthnhn.exec:\tthnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\bbtthh.exec:\bbtthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rlrfrrl.exec:\rlrfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bbnthh.exec:\bbnthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\dpddp.exec:\dpddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\3btbhn.exec:\3btbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\vppvp.exec:\vppvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\hbntbt.exec:\hbntbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\9vppp.exec:\9vppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\lfxxflr.exec:\lfxxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\rfxxxxl.exec:\rfxxxxl.exe17⤵
- Executes dropped EXE
PID:1200 -
\??\c:\thbhtt.exec:\thbhtt.exe18⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rfllllx.exec:\rfllllx.exe19⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tnbhhn.exec:\tnbhhn.exe20⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jjvvp.exec:\jjvvp.exe21⤵
- Executes dropped EXE
PID:444 -
\??\c:\lfxrlrl.exec:\lfxrlrl.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ppvdp.exec:\ppvdp.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\9xxlxxr.exec:\9xxlxxr.exe24⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hbbhnn.exec:\hbbhnn.exe25⤵
- Executes dropped EXE
PID:1424 -
\??\c:\pjjdp.exec:\pjjdp.exe26⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rlxflrl.exec:\rlxflrl.exe27⤵
- Executes dropped EXE
PID:728 -
\??\c:\jvvvd.exec:\jvvvd.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vvddp.exec:\vvddp.exe29⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rllrlfx.exec:\rllrlfx.exe30⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vvvdp.exec:\vvvdp.exe31⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5rlxflx.exec:\5rlxflx.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ntnthn.exec:\ntnthn.exe33⤵
- Executes dropped EXE
PID:264 -
\??\c:\rlflxfr.exec:\rlflxfr.exe34⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nnbhnt.exec:\nnbhnt.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nnhthh.exec:\nnhthh.exe36⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1pjvd.exec:\1pjvd.exe37⤵
- Executes dropped EXE
PID:708 -
\??\c:\ffxlffl.exec:\ffxlffl.exe38⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhbbnn.exec:\nhbbnn.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7vdpd.exec:\7vdpd.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9pvvd.exec:\9pvvd.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\btnthh.exec:\btnthh.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nhhnbh.exec:\nhhnbh.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vvppd.exec:\vvppd.exe46⤵
- Executes dropped EXE
PID:944 -
\??\c:\lxllxfl.exec:\lxllxfl.exe47⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nhthnb.exec:\nhthnb.exe48⤵
- Executes dropped EXE
PID:1704 -
\??\c:\tnhnbt.exec:\tnhnbt.exe49⤵
- Executes dropped EXE
PID:1828 -
\??\c:\jjvdj.exec:\jjvdj.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffrrrrf.exec:\ffrrrrf.exe51⤵
- Executes dropped EXE
PID:1912 -
\??\c:\frxfffl.exec:\frxfffl.exe52⤵
- Executes dropped EXE
PID:1008 -
\??\c:\9nnbbh.exec:\9nnbbh.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vdvvd.exec:\vdvvd.exe54⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9dvvp.exec:\9dvvp.exe55⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9rffffl.exec:\9rffffl.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhnnnt.exec:\nhnnnt.exe57⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nhbhhn.exec:\nhbhhn.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ddppd.exec:\ddppd.exe59⤵
- Executes dropped EXE
PID:300 -
\??\c:\ffxlrfr.exec:\ffxlrfr.exe60⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe61⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bhhtbb.exec:\bhhtbb.exe62⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdvdj.exec:\jdvdj.exe63⤵
- Executes dropped EXE
PID:624 -
\??\c:\3vppv.exec:\3vppv.exe64⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fllflll.exec:\fllflll.exe65⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bnbbnn.exec:\bnbbnn.exe66⤵PID:936
-
\??\c:\tntthn.exec:\tntthn.exe67⤵PID:2244
-
\??\c:\ddpjj.exec:\ddpjj.exe68⤵PID:2456
-
\??\c:\flfxlfl.exec:\flfxlfl.exe69⤵PID:1820
-
\??\c:\1flrfff.exec:\1flrfff.exe70⤵PID:2592
-
\??\c:\nnnntb.exec:\nnnntb.exe71⤵PID:316
-
\??\c:\1dppv.exec:\1dppv.exe72⤵PID:872
-
\??\c:\9dddd.exec:\9dddd.exe73⤵PID:876
-
\??\c:\lflrlrx.exec:\lflrlrx.exe74⤵PID:2068
-
\??\c:\thbbht.exec:\thbbht.exe75⤵PID:2524
-
\??\c:\thttbh.exec:\thttbh.exe76⤵PID:2408
-
\??\c:\9vjpd.exec:\9vjpd.exe77⤵PID:2388
-
\??\c:\7xlllrf.exec:\7xlllrf.exe78⤵PID:2508
-
\??\c:\rlllflf.exec:\rlllflf.exe79⤵PID:2072
-
\??\c:\hbnttb.exec:\hbnttb.exe80⤵PID:708
-
\??\c:\3vpvd.exec:\3vpvd.exe81⤵PID:3024
-
\??\c:\pjppv.exec:\pjppv.exe82⤵PID:2764
-
\??\c:\fflrflx.exec:\fflrflx.exe83⤵PID:2864
-
\??\c:\5bbhnn.exec:\5bbhnn.exe84⤵PID:2876
-
\??\c:\nnhbhn.exec:\nnhbhn.exe85⤵PID:2632
-
\??\c:\vvjpj.exec:\vvjpj.exe86⤵PID:2772
-
\??\c:\xlllffx.exec:\xlllffx.exe87⤵PID:2780
-
\??\c:\rlxfllx.exec:\rlxfllx.exe88⤵PID:2412
-
\??\c:\5nbhnn.exec:\5nbhnn.exe89⤵PID:944
-
\??\c:\vpjvj.exec:\vpjvj.exe90⤵PID:1716
-
\??\c:\pvjjp.exec:\pvjjp.exe91⤵PID:2664
-
\??\c:\xxrxllx.exec:\xxrxllx.exe92⤵PID:2420
-
\??\c:\7tnnhn.exec:\7tnnhn.exe93⤵PID:1624
-
\??\c:\3tnntb.exec:\3tnntb.exe94⤵PID:1644
-
\??\c:\vpvdv.exec:\vpvdv.exe95⤵PID:1188
-
\??\c:\rrllxxl.exec:\rrllxxl.exe96⤵PID:1360
-
\??\c:\bbtbnn.exec:\bbtbnn.exe97⤵PID:1200
-
\??\c:\nhbhnh.exec:\nhbhnh.exe98⤵PID:2328
-
\??\c:\5djjj.exec:\5djjj.exe99⤵PID:2960
-
\??\c:\jppjj.exec:\jppjj.exe100⤵PID:2952
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe101⤵PID:2956
-
\??\c:\nhtbhb.exec:\nhtbhb.exe102⤵PID:3044
-
\??\c:\nnhnnn.exec:\nnhnnn.exe103⤵PID:1092
-
\??\c:\3dddj.exec:\3dddj.exe104⤵PID:1932
-
\??\c:\rlrrffr.exec:\rlrrffr.exe105⤵PID:1172
-
\??\c:\flrxffr.exec:\flrxffr.exe106⤵PID:1448
-
\??\c:\3tnthn.exec:\3tnthn.exe107⤵PID:1136
-
\??\c:\pjvvj.exec:\pjvvj.exe108⤵PID:1588
-
\??\c:\dvjpd.exec:\dvjpd.exe109⤵PID:1476
-
\??\c:\rlflxfr.exec:\rlflxfr.exe110⤵PID:936
-
\??\c:\tbbbtb.exec:\tbbbtb.exe111⤵PID:2244
-
\??\c:\5btttt.exec:\5btttt.exe112⤵PID:2092
-
\??\c:\5pjvv.exec:\5pjvv.exe113⤵PID:1820
-
\??\c:\ffxllxf.exec:\ffxllxf.exe114⤵PID:2248
-
\??\c:\5xrfflr.exec:\5xrfflr.exe115⤵PID:316
-
\??\c:\tntbtt.exec:\tntbtt.exe116⤵PID:872
-
\??\c:\3tnntt.exec:\3tnntt.exe117⤵PID:2076
-
\??\c:\jdvvp.exec:\jdvvp.exe118⤵PID:1520
-
\??\c:\9xrxfll.exec:\9xrxfll.exe119⤵PID:2552
-
\??\c:\rlxxrxf.exec:\rlxxrxf.exe120⤵PID:3012
-
\??\c:\7hnntt.exec:\7hnntt.exe121⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-