Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe
-
Size
454KB
-
MD5
d80eb677e63c0b0255d3e4f81ea2e370
-
SHA1
79de23938cdda816f87cbab03ce167af2c508497
-
SHA256
b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7
-
SHA512
35b2ade955bedd6e82ccce0162b081308d67ef8a7b672af4332060ec0ba7d7784493d517cdaee7db005f04fe24fdca46d6fec036fcc2e0f90e00854cebfa5282
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetk:q7Tc2NYHUrAwfMp3CDtk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-150-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-217-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1616-229-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1236-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-257-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2276-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/884-286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-325-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2360-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-370-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2616-377-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1284-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-432-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1644-439-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3052-446-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/480-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2284-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-568-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-589-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-751-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-817-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1572-842-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1524 7rfflrx.exe 2704 bhhtht.exe 2240 3bbhnb.exe 2112 nhtbnt.exe 2976 rfrxflf.exe 2196 1thnbb.exe 2724 dvdjp.exe 2796 fxrxflx.exe 2640 bthhtt.exe 2672 7pjvd.exe 2836 fxffrrx.exe 2936 hbtbnn.exe 2968 1vpvj.exe 1660 5bnnhh.exe 3004 dvppj.exe 2020 pjdjv.exe 480 hhbbnt.exe 264 ppppd.exe 1928 llflxfr.exe 2324 bnnbbn.exe 464 jdvdj.exe 996 ffxxxxl.exe 1616 nbtnnt.exe 1236 jjdpv.exe 608 tnhntb.exe 1508 pddjv.exe 336 btntht.exe 2276 pjvjv.exe 884 ffrfffl.exe 2532 tthnbb.exe 1372 ppjpd.exe 2388 7flllfl.exe 2208 tnbbhh.exe 2728 dvpvj.exe 2256 hhthnt.exe 2304 ddvjv.exe 2740 xfflrxf.exe 2828 xlfrfrf.exe 2788 nhttbb.exe 2360 vjvvd.exe 2796 rlrrllx.exe 2616 ffffrrx.exe 2744 btbttt.exe 1284 dvpdd.exe 3032 5jvjv.exe 1828 xrlrrrf.exe 2932 hbtnnt.exe 2968 nnnbhn.exe 3052 pjpvd.exe 1032 fxxxfrf.exe 1644 rxllrxf.exe 2336 thbhtt.exe 480 jdvjd.exe 680 rfxlrlf.exe 2204 9nhhhh.exe 2420 hhbbtn.exe 1428 vpjpv.exe 2600 lfrxfrl.exe 2808 xrflllr.exe 1876 hbnntn.exe 1616 vjdvd.exe 2164 pdpjv.exe 904 ffxfxlf.exe 1476 fxflffr.exe -
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-446-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/480-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-751-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/532-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-817-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1572-842-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2780-861-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1524 2532 b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe 31 PID 2532 wrote to memory of 1524 2532 b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe 31 PID 2532 wrote to memory of 1524 2532 b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe 31 PID 2532 wrote to memory of 1524 2532 b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe 31 PID 1524 wrote to memory of 2704 1524 7rfflrx.exe 32 PID 1524 wrote to memory of 2704 1524 7rfflrx.exe 32 PID 1524 wrote to memory of 2704 1524 7rfflrx.exe 32 PID 1524 wrote to memory of 2704 1524 7rfflrx.exe 32 PID 2704 wrote to memory of 2240 2704 bhhtht.exe 33 PID 2704 wrote to memory of 2240 2704 bhhtht.exe 33 PID 2704 wrote to memory of 2240 2704 bhhtht.exe 33 PID 2704 wrote to memory of 2240 2704 bhhtht.exe 33 PID 2240 wrote to memory of 2112 2240 3bbhnb.exe 34 PID 2240 wrote to memory of 2112 2240 3bbhnb.exe 34 PID 2240 wrote to memory of 2112 2240 3bbhnb.exe 34 PID 2240 wrote to memory of 2112 2240 3bbhnb.exe 34 PID 2112 wrote to memory of 2976 2112 nhtbnt.exe 35 PID 2112 wrote to memory of 2976 2112 nhtbnt.exe 35 PID 2112 wrote to memory of 2976 2112 nhtbnt.exe 35 PID 2112 wrote to memory of 2976 2112 nhtbnt.exe 35 PID 2976 wrote to memory of 2196 2976 rfrxflf.exe 36 PID 2976 wrote to memory of 2196 2976 rfrxflf.exe 36 PID 2976 wrote to memory of 2196 2976 rfrxflf.exe 36 PID 2976 wrote to memory of 2196 2976 rfrxflf.exe 36 PID 2196 wrote to memory of 2724 2196 1thnbb.exe 37 PID 2196 wrote to memory of 2724 2196 1thnbb.exe 37 PID 2196 wrote to memory of 2724 2196 1thnbb.exe 37 PID 2196 wrote to memory of 2724 2196 1thnbb.exe 37 PID 2724 wrote to memory of 2796 2724 dvdjp.exe 38 PID 2724 wrote to memory of 2796 2724 dvdjp.exe 38 PID 2724 wrote to memory of 2796 2724 dvdjp.exe 38 PID 2724 wrote to memory of 2796 2724 dvdjp.exe 38 PID 2796 wrote to memory of 2640 2796 fxrxflx.exe 39 PID 2796 wrote to memory of 2640 2796 fxrxflx.exe 39 PID 2796 wrote to memory of 2640 2796 fxrxflx.exe 39 PID 2796 wrote to memory of 2640 2796 fxrxflx.exe 39 PID 2640 wrote to memory of 2672 2640 bthhtt.exe 40 PID 2640 wrote to memory of 2672 2640 bthhtt.exe 40 PID 2640 wrote to memory of 2672 2640 bthhtt.exe 40 PID 2640 wrote to memory of 2672 2640 bthhtt.exe 40 PID 2672 wrote to memory of 2836 2672 7pjvd.exe 41 PID 2672 wrote to memory of 2836 2672 7pjvd.exe 41 PID 2672 wrote to memory of 2836 2672 7pjvd.exe 41 PID 2672 wrote to memory of 2836 2672 7pjvd.exe 41 PID 2836 wrote to memory of 2936 2836 fxffrrx.exe 42 PID 2836 wrote to memory of 2936 2836 fxffrrx.exe 42 PID 2836 wrote to memory of 2936 2836 fxffrrx.exe 42 PID 2836 wrote to memory of 2936 2836 fxffrrx.exe 42 PID 2936 wrote to memory of 2968 2936 hbtbnn.exe 43 PID 2936 wrote to memory of 2968 2936 hbtbnn.exe 43 PID 2936 wrote to memory of 2968 2936 hbtbnn.exe 43 PID 2936 wrote to memory of 2968 2936 hbtbnn.exe 43 PID 2968 wrote to memory of 1660 2968 1vpvj.exe 44 PID 2968 wrote to memory of 1660 2968 1vpvj.exe 44 PID 2968 wrote to memory of 1660 2968 1vpvj.exe 44 PID 2968 wrote to memory of 1660 2968 1vpvj.exe 44 PID 1660 wrote to memory of 3004 1660 5bnnhh.exe 45 PID 1660 wrote to memory of 3004 1660 5bnnhh.exe 45 PID 1660 wrote to memory of 3004 1660 5bnnhh.exe 45 PID 1660 wrote to memory of 3004 1660 5bnnhh.exe 45 PID 3004 wrote to memory of 2020 3004 dvppj.exe 46 PID 3004 wrote to memory of 2020 3004 dvppj.exe 46 PID 3004 wrote to memory of 2020 3004 dvppj.exe 46 PID 3004 wrote to memory of 2020 3004 dvppj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe"C:\Users\Admin\AppData\Local\Temp\b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\7rfflrx.exec:\7rfflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\bhhtht.exec:\bhhtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3bbhnb.exec:\3bbhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nhtbnt.exec:\nhtbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\rfrxflf.exec:\rfrxflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1thnbb.exec:\1thnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\dvdjp.exec:\dvdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxrxflx.exec:\fxrxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bthhtt.exec:\bthhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7pjvd.exec:\7pjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\fxffrrx.exec:\fxffrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hbtbnn.exec:\hbtbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\1vpvj.exec:\1vpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\5bnnhh.exec:\5bnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\dvppj.exec:\dvppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\pjdjv.exec:\pjdjv.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhbbnt.exec:\hhbbnt.exe18⤵
- Executes dropped EXE
PID:480 -
\??\c:\ppppd.exec:\ppppd.exe19⤵
- Executes dropped EXE
PID:264 -
\??\c:\llflxfr.exec:\llflxfr.exe20⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bnnbbn.exec:\bnnbbn.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jdvdj.exec:\jdvdj.exe22⤵
- Executes dropped EXE
PID:464 -
\??\c:\ffxxxxl.exec:\ffxxxxl.exe23⤵
- Executes dropped EXE
PID:996 -
\??\c:\nbtnnt.exec:\nbtnnt.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjdpv.exec:\jjdpv.exe25⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tnhntb.exec:\tnhntb.exe26⤵
- Executes dropped EXE
PID:608 -
\??\c:\pddjv.exec:\pddjv.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\btntht.exec:\btntht.exe28⤵
- Executes dropped EXE
PID:336 -
\??\c:\pjvjv.exec:\pjvjv.exe29⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ffrfffl.exec:\ffrfffl.exe30⤵
- Executes dropped EXE
PID:884 -
\??\c:\tthnbb.exec:\tthnbb.exe31⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ppjpd.exec:\ppjpd.exe32⤵
- Executes dropped EXE
PID:1372 -
\??\c:\7flllfl.exec:\7flllfl.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnbbhh.exec:\tnbbhh.exe34⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dvpvj.exec:\dvpvj.exe35⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hhthnt.exec:\hhthnt.exe36⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ddvjv.exec:\ddvjv.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xfflrxf.exec:\xfflrxf.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xlfrfrf.exec:\xlfrfrf.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nhttbb.exec:\nhttbb.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vjvvd.exec:\vjvvd.exe41⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rlrrllx.exec:\rlrrllx.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ffffrrx.exec:\ffffrrx.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\btbttt.exec:\btbttt.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dvpdd.exec:\dvpdd.exe45⤵
- Executes dropped EXE
PID:1284 -
\??\c:\5jvjv.exec:\5jvjv.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe47⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hbtnnt.exec:\hbtnnt.exe48⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nnnbhn.exec:\nnnbhn.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pjpvd.exec:\pjpvd.exe50⤵
- Executes dropped EXE
PID:3052 -
\??\c:\fxxxfrf.exec:\fxxxfrf.exe51⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rxllrxf.exec:\rxllrxf.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\thbhtt.exec:\thbhtt.exe53⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdvjd.exec:\jdvjd.exe54⤵
- Executes dropped EXE
PID:480 -
\??\c:\rfxlrlf.exec:\rfxlrlf.exe55⤵
- Executes dropped EXE
PID:680 -
\??\c:\9nhhhh.exec:\9nhhhh.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hhbbtn.exec:\hhbbtn.exe57⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vpjpv.exec:\vpjpv.exe58⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lfrxfrl.exec:\lfrxfrl.exe59⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xrflllr.exec:\xrflllr.exe60⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hbnntn.exec:\hbnntn.exe61⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vjdvd.exec:\vjdvd.exe62⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pdpjv.exec:\pdpjv.exe63⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ffxfxlf.exec:\ffxfxlf.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\fxflffr.exec:\fxflffr.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\htnntt.exec:\htnntt.exe66⤵PID:2284
-
\??\c:\ppjdp.exec:\ppjdp.exe67⤵PID:2408
-
\??\c:\xxrxllx.exec:\xxrxllx.exe68⤵PID:1832
-
\??\c:\lxrxflx.exec:\lxrxflx.exe69⤵PID:2400
-
\??\c:\nhttbb.exec:\nhttbb.exe70⤵PID:888
-
\??\c:\pvjvj.exec:\pvjvj.exe71⤵PID:1592
-
\??\c:\dvjdj.exec:\dvjdj.exe72⤵PID:1524
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe73⤵PID:2084
-
\??\c:\9bttbb.exec:\9bttbb.exe74⤵PID:2088
-
\??\c:\bhtbbh.exec:\bhtbbh.exe75⤵PID:2888
-
\??\c:\vpvdj.exec:\vpvdj.exe76⤵PID:2780
-
\??\c:\5frlxrx.exec:\5frlxrx.exe77⤵PID:2776
-
\??\c:\7lxflll.exec:\7lxflll.exe78⤵PID:2892
-
\??\c:\nhbhtt.exec:\nhbhtt.exe79⤵PID:2980
-
\??\c:\vjdvd.exec:\vjdvd.exe80⤵PID:2784
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe81⤵PID:2724
-
\??\c:\llxflfr.exec:\llxflfr.exe82⤵PID:2664
-
\??\c:\hbbhbn.exec:\hbbhbn.exe83⤵PID:2492
-
\??\c:\pvpdd.exec:\pvpdd.exe84⤵PID:2332
-
\??\c:\rflxxxr.exec:\rflxxxr.exe85⤵PID:2436
-
\??\c:\bbthnt.exec:\bbthnt.exe86⤵PID:2672
-
\??\c:\vdjjv.exec:\vdjjv.exe87⤵PID:3032
-
\??\c:\3vjpv.exec:\3vjpv.exe88⤵PID:2924
-
\??\c:\xxflrlr.exec:\xxflrlr.exe89⤵PID:2712
-
\??\c:\htbbhb.exec:\htbbhb.exe90⤵PID:1848
-
\??\c:\htnntb.exec:\htnntb.exe91⤵PID:2824
-
\??\c:\9jvjj.exec:\9jvjj.exe92⤵PID:856
-
\??\c:\xxlfrrx.exec:\xxlfrrx.exe93⤵PID:2816
-
\??\c:\rfxlxxl.exec:\rfxlxxl.exe94⤵PID:3064
-
\??\c:\tnhnnn.exec:\tnhnnn.exe95⤵PID:572
-
\??\c:\vjvdj.exec:\vjvdj.exe96⤵PID:2568
-
\??\c:\9dpdj.exec:\9dpdj.exe97⤵PID:1668
-
\??\c:\rrlxffr.exec:\rrlxffr.exe98⤵PID:836
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe99⤵PID:2420
-
\??\c:\tnnbnn.exec:\tnnbnn.exe100⤵PID:2324
-
\??\c:\jjdjj.exec:\jjdjj.exe101⤵PID:700
-
\??\c:\7jdjp.exec:\7jdjp.exe102⤵PID:2808
-
\??\c:\xlrrflx.exec:\xlrrflx.exe103⤵PID:1248
-
\??\c:\nnhnbh.exec:\nnhnbh.exe104⤵PID:532
-
\??\c:\5thbhb.exec:\5thbhb.exe105⤵PID:1736
-
\??\c:\vjdjp.exec:\vjdjp.exe106⤵PID:2132
-
\??\c:\1rllrlx.exec:\1rllrlx.exe107⤵PID:1144
-
\??\c:\tnbbnn.exec:\tnbbnn.exe108⤵PID:336
-
\??\c:\btntnh.exec:\btntnh.exe109⤵PID:648
-
\??\c:\ddjpv.exec:\ddjpv.exe110⤵PID:1956
-
\??\c:\rllllrx.exec:\rllllrx.exe111⤵PID:1712
-
\??\c:\9lffrlx.exec:\9lffrlx.exe112⤵PID:2532
-
\??\c:\bhnnnh.exec:\bhnnnh.exe113⤵PID:2544
-
\??\c:\9jppp.exec:\9jppp.exe114⤵PID:1572
-
\??\c:\lxrxrxf.exec:\lxrxrxf.exe115⤵PID:1648
-
\??\c:\btnthh.exec:\btnthh.exe116⤵PID:2088
-
\??\c:\bnhntt.exec:\bnhntt.exe117⤵PID:1872
-
\??\c:\jjvdv.exec:\jjvdv.exe118⤵PID:2780
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe119⤵PID:2812
-
\??\c:\1rrrfll.exec:\1rrrfll.exe120⤵PID:2196
-
\??\c:\nhnthn.exec:\nhnthn.exe121⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-