Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe
-
Size
456KB
-
MD5
cdb1e57bdfa00fa8b9fc12c3c5331be1
-
SHA1
e31f2af6c65a1ae7640715749da46332f412374c
-
SHA256
a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b
-
SHA512
715fbb0bbcd12cca42fe8ab941c25d341d2d2cee7578e5545bedfc121411987838afce16d4e7d75beb4961df4f596ba6e2a937b271427415649c83a11ca604c9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRk:q7Tc2NYHUrAwfMp3CDRk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1640-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-129-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1920-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-148-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1920-146-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2976-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-375-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2652-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-734-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-840-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-853-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1556-885-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1576-1044-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2152-1084-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/764-1098-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-1153-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2640-1196-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2700-1215-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/832-1329-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1632 htntbb.exe 1652 3fflrxf.exe 2716 vdvdd.exe 2484 rxlrffr.exe 2276 pppvj.exe 2872 thtbhn.exe 2904 7htnbh.exe 2900 1rflxxf.exe 2804 pjvdj.exe 2656 1lxxfff.exe 2688 5thhtb.exe 2972 9xrrffr.exe 1408 xrlrflx.exe 2876 vjvpv.exe 1920 lflrffl.exe 3000 hbnthh.exe 2976 pjpvv.exe 2036 7tntbb.exe 2084 5jvdp.exe 808 bhbbnn.exe 1412 xrlrxxl.exe 656 bnhbtn.exe 884 ppdpp.exe 2268 nnnbtt.exe 2344 3pjvd.exe 908 ppdjp.exe 1704 llrrrff.exe 2352 rfxfllr.exe 2504 btbntb.exe 2184 frffflr.exe 1800 ntntbh.exe 2292 3xrrrrr.exe 1512 llfxflx.exe 1680 3jvpp.exe 1460 vjvpv.exe 2560 rrffxxf.exe 2728 3nhhnn.exe 2128 nbbbtt.exe 2836 dvvvj.exe 2772 pdppv.exe 2492 llfxlfl.exe 2816 htbhhh.exe 2676 jjddj.exe 2360 jvjdj.exe 2652 fffrxfr.exe 2592 5ntnnh.exe 1924 pjdjv.exe 1568 xlxrrrx.exe 2100 7lrxlrx.exe 2868 bnhhnn.exe 2896 jjvvd.exe 3060 1jdvp.exe 3020 rxrrxxl.exe 1840 7thnth.exe 2196 nbttbh.exe 1692 pdjvv.exe 1744 rlfrlfr.exe 300 bnnnnh.exe 696 hhbbnn.exe 808 5ddjv.exe 1764 7lxxfll.exe 2944 lfrxfll.exe 832 bbnnnn.exe 884 jdppv.exe -
resource yara_rule behavioral1/memory/1640-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-73-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2900-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-110-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2972-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-148-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1920-146-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2036-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-906-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-938-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-970-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-1084-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1704-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-1196-0x00000000001C0000-0x00000000001EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1632 1640 a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe 30 PID 1640 wrote to memory of 1632 1640 a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe 30 PID 1640 wrote to memory of 1632 1640 a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe 30 PID 1640 wrote to memory of 1632 1640 a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe 30 PID 1632 wrote to memory of 1652 1632 htntbb.exe 31 PID 1632 wrote to memory of 1652 1632 htntbb.exe 31 PID 1632 wrote to memory of 1652 1632 htntbb.exe 31 PID 1632 wrote to memory of 1652 1632 htntbb.exe 31 PID 1652 wrote to memory of 2716 1652 3fflrxf.exe 32 PID 1652 wrote to memory of 2716 1652 3fflrxf.exe 32 PID 1652 wrote to memory of 2716 1652 3fflrxf.exe 32 PID 1652 wrote to memory of 2716 1652 3fflrxf.exe 32 PID 2716 wrote to memory of 2484 2716 vdvdd.exe 33 PID 2716 wrote to memory of 2484 2716 vdvdd.exe 33 PID 2716 wrote to memory of 2484 2716 vdvdd.exe 33 PID 2716 wrote to memory of 2484 2716 vdvdd.exe 33 PID 2484 wrote to memory of 2276 2484 rxlrffr.exe 34 PID 2484 wrote to memory of 2276 2484 rxlrffr.exe 34 PID 2484 wrote to memory of 2276 2484 rxlrffr.exe 34 PID 2484 wrote to memory of 2276 2484 rxlrffr.exe 34 PID 2276 wrote to memory of 2872 2276 pppvj.exe 35 PID 2276 wrote to memory of 2872 2276 pppvj.exe 35 PID 2276 wrote to memory of 2872 2276 pppvj.exe 35 PID 2276 wrote to memory of 2872 2276 pppvj.exe 35 PID 2872 wrote to memory of 2904 2872 thtbhn.exe 36 PID 2872 wrote to memory of 2904 2872 thtbhn.exe 36 PID 2872 wrote to memory of 2904 2872 thtbhn.exe 36 PID 2872 wrote to memory of 2904 2872 thtbhn.exe 36 PID 2904 wrote to memory of 2900 2904 7htnbh.exe 37 PID 2904 wrote to memory of 2900 2904 7htnbh.exe 37 PID 2904 wrote to memory of 2900 2904 7htnbh.exe 37 PID 2904 wrote to memory of 2900 2904 7htnbh.exe 37 PID 2900 wrote to memory of 2804 2900 1rflxxf.exe 38 PID 2900 wrote to memory of 2804 2900 1rflxxf.exe 38 PID 2900 wrote to memory of 2804 2900 1rflxxf.exe 38 PID 2900 wrote to memory of 2804 2900 1rflxxf.exe 38 PID 2804 wrote to memory of 2656 2804 pjvdj.exe 39 PID 2804 wrote to memory of 2656 2804 pjvdj.exe 39 PID 2804 wrote to memory of 2656 2804 pjvdj.exe 39 PID 2804 wrote to memory of 2656 2804 pjvdj.exe 39 PID 2656 wrote to memory of 2688 2656 1lxxfff.exe 40 PID 2656 wrote to memory of 2688 2656 1lxxfff.exe 40 PID 2656 wrote to memory of 2688 2656 1lxxfff.exe 40 PID 2656 wrote to memory of 2688 2656 1lxxfff.exe 40 PID 2688 wrote to memory of 2972 2688 5thhtb.exe 41 PID 2688 wrote to memory of 2972 2688 5thhtb.exe 41 PID 2688 wrote to memory of 2972 2688 5thhtb.exe 41 PID 2688 wrote to memory of 2972 2688 5thhtb.exe 41 PID 2972 wrote to memory of 1408 2972 9xrrffr.exe 42 PID 2972 wrote to memory of 1408 2972 9xrrffr.exe 42 PID 2972 wrote to memory of 1408 2972 9xrrffr.exe 42 PID 2972 wrote to memory of 1408 2972 9xrrffr.exe 42 PID 1408 wrote to memory of 2876 1408 xrlrflx.exe 43 PID 1408 wrote to memory of 2876 1408 xrlrflx.exe 43 PID 1408 wrote to memory of 2876 1408 xrlrflx.exe 43 PID 1408 wrote to memory of 2876 1408 xrlrflx.exe 43 PID 2876 wrote to memory of 1920 2876 vjvpv.exe 44 PID 2876 wrote to memory of 1920 2876 vjvpv.exe 44 PID 2876 wrote to memory of 1920 2876 vjvpv.exe 44 PID 2876 wrote to memory of 1920 2876 vjvpv.exe 44 PID 1920 wrote to memory of 3000 1920 lflrffl.exe 45 PID 1920 wrote to memory of 3000 1920 lflrffl.exe 45 PID 1920 wrote to memory of 3000 1920 lflrffl.exe 45 PID 1920 wrote to memory of 3000 1920 lflrffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe"C:\Users\Admin\AppData\Local\Temp\a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\htntbb.exec:\htntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\3fflrxf.exec:\3fflrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\vdvdd.exec:\vdvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rxlrffr.exec:\rxlrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\pppvj.exec:\pppvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\thtbhn.exec:\thtbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\7htnbh.exec:\7htnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1rflxxf.exec:\1rflxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pjvdj.exec:\pjvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\1lxxfff.exec:\1lxxfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5thhtb.exec:\5thhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\9xrrffr.exec:\9xrrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xrlrflx.exec:\xrlrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\vjvpv.exec:\vjvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lflrffl.exec:\lflrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\hbnthh.exec:\hbnthh.exe17⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pjpvv.exec:\pjpvv.exe18⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7tntbb.exec:\7tntbb.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5jvdp.exec:\5jvdp.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bhbbnn.exec:\bhbbnn.exe21⤵
- Executes dropped EXE
PID:808 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe22⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bnhbtn.exec:\bnhbtn.exe23⤵
- Executes dropped EXE
PID:656 -
\??\c:\ppdpp.exec:\ppdpp.exe24⤵
- Executes dropped EXE
PID:884 -
\??\c:\nnnbtt.exec:\nnnbtt.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3pjvd.exec:\3pjvd.exe26⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ppdjp.exec:\ppdjp.exe27⤵
- Executes dropped EXE
PID:908 -
\??\c:\llrrrff.exec:\llrrrff.exe28⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rfxfllr.exec:\rfxfllr.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\btbntb.exec:\btbntb.exe30⤵
- Executes dropped EXE
PID:2504 -
\??\c:\frffflr.exec:\frffflr.exe31⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ntntbh.exec:\ntntbh.exe32⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3xrrrrr.exec:\3xrrrrr.exe33⤵
- Executes dropped EXE
PID:2292 -
\??\c:\llfxflx.exec:\llfxflx.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\3jvpp.exec:\3jvpp.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vjvpv.exec:\vjvpv.exe36⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rrffxxf.exec:\rrffxxf.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3nhhnn.exec:\3nhhnn.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nbbbtt.exec:\nbbbtt.exe39⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dvvvj.exec:\dvvvj.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pdppv.exec:\pdppv.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llfxlfl.exec:\llfxlfl.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\htbhhh.exec:\htbhhh.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jjddj.exec:\jjddj.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jvjdj.exec:\jvjdj.exe45⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fffrxfr.exec:\fffrxfr.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5ntnnh.exec:\5ntnnh.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pjdjv.exec:\pjdjv.exe48⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe49⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7lrxlrx.exec:\7lrxlrx.exe50⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bnhhnn.exec:\bnhhnn.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjvvd.exec:\jjvvd.exe52⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1jdvp.exec:\1jdvp.exe53⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rxrrxxl.exec:\rxrrxxl.exe54⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7thnth.exec:\7thnth.exe55⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nbttbh.exec:\nbttbh.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pdjvv.exec:\pdjvv.exe57⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rlfrlfr.exec:\rlfrlfr.exe58⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bnnnnh.exec:\bnnnnh.exe59⤵
- Executes dropped EXE
PID:300 -
\??\c:\hhbbnn.exec:\hhbbnn.exe60⤵
- Executes dropped EXE
PID:696 -
\??\c:\5ddjv.exec:\5ddjv.exe61⤵
- Executes dropped EXE
PID:808 -
\??\c:\7lxxfll.exec:\7lxxfll.exe62⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lfrxfll.exec:\lfrxfll.exe63⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bbnnnn.exec:\bbnnnn.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\jdppv.exec:\jdppv.exe65⤵
- Executes dropped EXE
PID:884 -
\??\c:\vpjvj.exec:\vpjvj.exe66⤵PID:980
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe67⤵PID:2344
-
\??\c:\nnbbhh.exec:\nnbbhh.exe68⤵PID:908
-
\??\c:\nbttbt.exec:\nbttbt.exe69⤵PID:1276
-
\??\c:\7pddv.exec:\7pddv.exe70⤵PID:1644
-
\??\c:\5lfxlff.exec:\5lfxlff.exe71⤵PID:2400
-
\??\c:\tthnnn.exec:\tthnnn.exe72⤵PID:764
-
\??\c:\thnhhb.exec:\thnhhb.exe73⤵PID:2164
-
\??\c:\pdvvd.exec:\pdvvd.exe74⤵PID:1364
-
\??\c:\3flfxrx.exec:\3flfxrx.exe75⤵PID:1828
-
\??\c:\3xlfllr.exec:\3xlfllr.exe76⤵PID:2292
-
\??\c:\thhbbt.exec:\thhbbt.exe77⤵PID:2568
-
\??\c:\dvvdv.exec:\dvvdv.exe78⤵PID:352
-
\??\c:\3djdv.exec:\3djdv.exe79⤵PID:2720
-
\??\c:\frflxxl.exec:\frflxxl.exe80⤵PID:1148
-
\??\c:\thhbtn.exec:\thhbtn.exe81⤵PID:2488
-
\??\c:\hthbbt.exec:\hthbbt.exe82⤵PID:2828
-
\??\c:\dpddd.exec:\dpddd.exe83⤵PID:2244
-
\??\c:\rflfrlr.exec:\rflfrlr.exe84⤵PID:2872
-
\??\c:\tnhhnh.exec:\tnhhnh.exe85⤵PID:2916
-
\??\c:\1hbnhh.exec:\1hbnhh.exe86⤵PID:2904
-
\??\c:\pdvpv.exec:\pdvpv.exe87⤵PID:2672
-
\??\c:\rlxrrxf.exec:\rlxrrxf.exe88⤵PID:2748
-
\??\c:\5xrrrrx.exec:\5xrrrrx.exe89⤵PID:2700
-
\??\c:\nhttbb.exec:\nhttbb.exe90⤵PID:2680
-
\??\c:\vpjjp.exec:\vpjjp.exe91⤵PID:1224
-
\??\c:\3vppj.exec:\3vppj.exe92⤵PID:668
-
\??\c:\lflflfl.exec:\lflflfl.exe93⤵PID:1560
-
\??\c:\btbntn.exec:\btbntn.exe94⤵PID:2952
-
\??\c:\bthnnh.exec:\bthnnh.exe95⤵PID:3024
-
\??\c:\1pjpv.exec:\1pjpv.exe96⤵PID:2988
-
\??\c:\rlrllfl.exec:\rlrllfl.exe97⤵PID:2884
-
\??\c:\nhhhtb.exec:\nhhhtb.exe98⤵PID:2032
-
\??\c:\tnbttn.exec:\tnbttn.exe99⤵PID:2028
-
\??\c:\5jvpj.exec:\5jvpj.exe100⤵PID:2976
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe101⤵PID:2404
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe102⤵PID:536
-
\??\c:\7nbbbn.exec:\7nbbbn.exe103⤵PID:632
-
\??\c:\dppvd.exec:\dppvd.exe104⤵PID:1016
-
\??\c:\1rlffxx.exec:\1rlffxx.exe105⤵PID:468
-
\??\c:\7frlrrr.exec:\7frlrrr.exe106⤵PID:1576
-
\??\c:\3httnn.exec:\3httnn.exe107⤵PID:408
-
\??\c:\pjddj.exec:\pjddj.exe108⤵PID:848
-
\??\c:\jdpjp.exec:\jdpjp.exe109⤵PID:1584
-
\??\c:\1rlfffl.exec:\1rlfffl.exe110⤵PID:1968
-
\??\c:\tnbhtt.exec:\tnbhtt.exe111⤵PID:2480
-
\??\c:\btbhhh.exec:\btbhhh.exe112⤵PID:2272
-
\??\c:\9pdpp.exec:\9pdpp.exe113⤵PID:2284
-
\??\c:\rlrxffl.exec:\rlrxffl.exe114⤵PID:2352
-
\??\c:\lxrrfxl.exec:\lxrrfxl.exe115⤵PID:1448
-
\??\c:\5nbbbh.exec:\5nbbbh.exe116⤵PID:896
-
\??\c:\9jvpj.exec:\9jvpj.exe117⤵PID:2600
-
\??\c:\7dpdj.exec:\7dpdj.exe118⤵PID:1792
-
\??\c:\frxrrfl.exec:\frxrrfl.exe119⤵PID:1904
-
\??\c:\3tnntt.exec:\3tnntt.exe120⤵PID:1628
-
\??\c:\nnbhhh.exec:\nnbhhh.exe121⤵PID:1556
-
\??\c:\jdddj.exec:\jdddj.exe122⤵PID:1652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-