Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe
-
Size
453KB
-
MD5
fd126e0c26dafcfb66d137c4ebef3d60
-
SHA1
d6966232c847765c88bc1c3f765de026d90fc736
-
SHA256
2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40
-
SHA512
6c60fabf2b66edb6835f656ef466442ea63891cd8a7a6913b440ae44c7bf0f0bbaf819f40d866a4bc180273c08cbf78bda7a9936098c22ee630ee3f671d4c6ce
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/2544-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-86-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2172-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-84-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/3044-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-109-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1884-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-347-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-368-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-413-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/848-452-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-505-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/564-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-590-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2708-623-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-630-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-849-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-856-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-1003-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-1010-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-1029-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2124-1054-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1000-1079-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-1125-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2684-1176-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2600-1183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/904-1301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-1314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 lffflxr.exe 2540 tnttbb.exe 1260 btntbh.exe 3008 pjvjd.exe 2724 3xllflx.exe 2732 hthnnt.exe 2076 rxflrfr.exe 2172 nbntnt.exe 2628 lxlrllx.exe 2612 xxlllrr.exe 3044 1vjjp.exe 1884 1rlrxfr.exe 1968 dvpjv.exe 1976 9htbhn.exe 1848 vpvdj.exe 1812 9fxflrf.exe 1472 5vjdj.exe 1204 dpjjv.exe 1556 vppvd.exe 2972 jvpvd.exe 992 5hnhnh.exe 480 jpjvv.exe 1416 btnnbb.exe 2168 5vjjv.exe 2792 llfrffr.exe 772 ttnbbt.exe 2032 5bnntb.exe 644 vjvpv.exe 2104 lfxfllx.exe 1432 1nbhnn.exe 2472 xrflfrx.exe 1312 hbnttb.exe 2164 7vpjj.exe 2664 3llrfll.exe 2496 bbnnnt.exe 2288 hbnthn.exe 1804 3vpjp.exe 2768 lxrxffl.exe 2128 tnbbhh.exe 2588 3thhhn.exe 2852 pjdvv.exe 2740 rrlrfrr.exe 2804 rrflxfr.exe 2656 dvjjj.exe 2748 3pdjp.exe 1980 rlffffl.exe 3012 tttbhh.exe 1888 hbhbnb.exe 236 jdvpd.exe 328 5lxfllr.exe 1876 5bnnnn.exe 1552 nhbthh.exe 1456 ppjvj.exe 2872 ffxxllr.exe 848 rlfrffl.exe 836 btbbbn.exe 2464 pdvvd.exe 2224 vpjpd.exe 840 1llrlll.exe 264 5bbhbn.exe 1564 9dvdj.exe 916 dpvpv.exe 844 lrffxfr.exe 1648 9nbbhb.exe -
resource yara_rule behavioral1/memory/2544-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-46-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2732-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-299-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1312-297-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1312-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-334-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2852-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-413-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/848-452-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/836-458-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2464-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-472-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/844-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-590-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2684-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-630-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2628-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-856-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3008-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-1003-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-1105-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2500-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-1138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-1202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-1215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-1264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-1301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-1314-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2544 2352 2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe 30 PID 2352 wrote to memory of 2544 2352 2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe 30 PID 2352 wrote to memory of 2544 2352 2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe 30 PID 2352 wrote to memory of 2544 2352 2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe 30 PID 2544 wrote to memory of 2540 2544 lffflxr.exe 31 PID 2544 wrote to memory of 2540 2544 lffflxr.exe 31 PID 2544 wrote to memory of 2540 2544 lffflxr.exe 31 PID 2544 wrote to memory of 2540 2544 lffflxr.exe 31 PID 2540 wrote to memory of 1260 2540 tnttbb.exe 32 PID 2540 wrote to memory of 1260 2540 tnttbb.exe 32 PID 2540 wrote to memory of 1260 2540 tnttbb.exe 32 PID 2540 wrote to memory of 1260 2540 tnttbb.exe 32 PID 1260 wrote to memory of 3008 1260 btntbh.exe 33 PID 1260 wrote to memory of 3008 1260 btntbh.exe 33 PID 1260 wrote to memory of 3008 1260 btntbh.exe 33 PID 1260 wrote to memory of 3008 1260 btntbh.exe 33 PID 3008 wrote to memory of 2724 3008 pjvjd.exe 34 PID 3008 wrote to memory of 2724 3008 pjvjd.exe 34 PID 3008 wrote to memory of 2724 3008 pjvjd.exe 34 PID 3008 wrote to memory of 2724 3008 pjvjd.exe 34 PID 2724 wrote to memory of 2732 2724 3xllflx.exe 35 PID 2724 wrote to memory of 2732 2724 3xllflx.exe 35 PID 2724 wrote to memory of 2732 2724 3xllflx.exe 35 PID 2724 wrote to memory of 2732 2724 3xllflx.exe 35 PID 2732 wrote to memory of 2076 2732 hthnnt.exe 36 PID 2732 wrote to memory of 2076 2732 hthnnt.exe 36 PID 2732 wrote to memory of 2076 2732 hthnnt.exe 36 PID 2732 wrote to memory of 2076 2732 hthnnt.exe 36 PID 2076 wrote to memory of 2172 2076 rxflrfr.exe 37 PID 2076 wrote to memory of 2172 2076 rxflrfr.exe 37 PID 2076 wrote to memory of 2172 2076 rxflrfr.exe 37 PID 2076 wrote to memory of 2172 2076 rxflrfr.exe 37 PID 2172 wrote to memory of 2628 2172 nbntnt.exe 38 PID 2172 wrote to memory of 2628 2172 nbntnt.exe 38 PID 2172 wrote to memory of 2628 2172 nbntnt.exe 38 PID 2172 wrote to memory of 2628 2172 nbntnt.exe 38 PID 2628 wrote to memory of 2612 2628 lxlrllx.exe 39 PID 2628 wrote to memory of 2612 2628 lxlrllx.exe 39 PID 2628 wrote to memory of 2612 2628 lxlrllx.exe 39 PID 2628 wrote to memory of 2612 2628 lxlrllx.exe 39 PID 2612 wrote to memory of 3044 2612 xxlllrr.exe 40 PID 2612 wrote to memory of 3044 2612 xxlllrr.exe 40 PID 2612 wrote to memory of 3044 2612 xxlllrr.exe 40 PID 2612 wrote to memory of 3044 2612 xxlllrr.exe 40 PID 3044 wrote to memory of 1884 3044 1vjjp.exe 41 PID 3044 wrote to memory of 1884 3044 1vjjp.exe 41 PID 3044 wrote to memory of 1884 3044 1vjjp.exe 41 PID 3044 wrote to memory of 1884 3044 1vjjp.exe 41 PID 1884 wrote to memory of 1968 1884 1rlrxfr.exe 42 PID 1884 wrote to memory of 1968 1884 1rlrxfr.exe 42 PID 1884 wrote to memory of 1968 1884 1rlrxfr.exe 42 PID 1884 wrote to memory of 1968 1884 1rlrxfr.exe 42 PID 1968 wrote to memory of 1976 1968 dvpjv.exe 43 PID 1968 wrote to memory of 1976 1968 dvpjv.exe 43 PID 1968 wrote to memory of 1976 1968 dvpjv.exe 43 PID 1968 wrote to memory of 1976 1968 dvpjv.exe 43 PID 1976 wrote to memory of 1848 1976 9htbhn.exe 44 PID 1976 wrote to memory of 1848 1976 9htbhn.exe 44 PID 1976 wrote to memory of 1848 1976 9htbhn.exe 44 PID 1976 wrote to memory of 1848 1976 9htbhn.exe 44 PID 1848 wrote to memory of 1812 1848 vpvdj.exe 45 PID 1848 wrote to memory of 1812 1848 vpvdj.exe 45 PID 1848 wrote to memory of 1812 1848 vpvdj.exe 45 PID 1848 wrote to memory of 1812 1848 vpvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe"C:\Users\Admin\AppData\Local\Temp\2ce68fc1a596f8ea2e381e810270fff1421696a5db6ec89700eacf8010d8ed40N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lffflxr.exec:\lffflxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\tnttbb.exec:\tnttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\btntbh.exec:\btntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pjvjd.exec:\pjvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\3xllflx.exec:\3xllflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hthnnt.exec:\hthnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rxflrfr.exec:\rxflrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\nbntnt.exec:\nbntnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\lxlrllx.exec:\lxlrllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xxlllrr.exec:\xxlllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1vjjp.exec:\1vjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\1rlrxfr.exec:\1rlrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\dvpjv.exec:\dvpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\9htbhn.exec:\9htbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vpvdj.exec:\vpvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\9fxflrf.exec:\9fxflrf.exe17⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5vjdj.exec:\5vjdj.exe18⤵
- Executes dropped EXE
PID:1472 -
\??\c:\dpjjv.exec:\dpjjv.exe19⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vppvd.exec:\vppvd.exe20⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jvpvd.exec:\jvpvd.exe21⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5hnhnh.exec:\5hnhnh.exe22⤵
- Executes dropped EXE
PID:992 -
\??\c:\jpjvv.exec:\jpjvv.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:480 -
\??\c:\btnnbb.exec:\btnnbb.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\5vjjv.exec:\5vjjv.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\llfrffr.exec:\llfrffr.exe26⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ttnbbt.exec:\ttnbbt.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\5bnntb.exec:\5bnntb.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vjvpv.exec:\vjvpv.exe29⤵
- Executes dropped EXE
PID:644 -
\??\c:\lfxfllx.exec:\lfxfllx.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\1nbhnn.exec:\1nbhnn.exe31⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xrflfrx.exec:\xrflfrx.exe32⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbnttb.exec:\hbnttb.exe33⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7vpjj.exec:\7vpjj.exe34⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3llrfll.exec:\3llrfll.exe35⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bbnnnt.exec:\bbnnnt.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbnthn.exec:\hbnthn.exe37⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3vpjp.exec:\3vpjp.exe38⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lxrxffl.exec:\lxrxffl.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\tnbbhh.exec:\tnbbhh.exe40⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3thhhn.exec:\3thhhn.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\pjdvv.exec:\pjdvv.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrlrfrr.exec:\rrlrfrr.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rrflxfr.exec:\rrflxfr.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dvjjj.exec:\dvjjj.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3pdjp.exec:\3pdjp.exe46⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlffffl.exec:\rlffffl.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tttbhh.exec:\tttbhh.exe48⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hbhbnb.exec:\hbhbnb.exe49⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jdvpd.exec:\jdvpd.exe50⤵
- Executes dropped EXE
PID:236 -
\??\c:\5lxfllr.exec:\5lxfllr.exe51⤵
- Executes dropped EXE
PID:328 -
\??\c:\5bnnnn.exec:\5bnnnn.exe52⤵
- Executes dropped EXE
PID:1876 -
\??\c:\nhbthh.exec:\nhbthh.exe53⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ppjvj.exec:\ppjvj.exe54⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ffxxllr.exec:\ffxxllr.exe55⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlfrffl.exec:\rlfrffl.exe56⤵
- Executes dropped EXE
PID:848 -
\??\c:\btbbbn.exec:\btbbbn.exe57⤵
- Executes dropped EXE
PID:836 -
\??\c:\pdvvd.exec:\pdvvd.exe58⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vpjpd.exec:\vpjpd.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1llrlll.exec:\1llrlll.exe60⤵
- Executes dropped EXE
PID:840 -
\??\c:\5bbhbn.exec:\5bbhbn.exe61⤵
- Executes dropped EXE
PID:264 -
\??\c:\9dvdj.exec:\9dvdj.exe62⤵
- Executes dropped EXE
PID:1564 -
\??\c:\dpvpv.exec:\dpvpv.exe63⤵
- Executes dropped EXE
PID:916 -
\??\c:\lrffxfr.exec:\lrffxfr.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\9nbbhb.exec:\9nbbhb.exe65⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5pjvd.exec:\5pjvd.exe66⤵PID:564
-
\??\c:\vdvpv.exec:\vdvpv.exe67⤵PID:1644
-
\??\c:\1lflllr.exec:\1lflllr.exe68⤵PID:1608
-
\??\c:\9btbbn.exec:\9btbbn.exe69⤵PID:576
-
\??\c:\bbthnn.exec:\bbthnn.exe70⤵PID:2640
-
\??\c:\dpjdd.exec:\dpjdd.exe71⤵PID:2104
-
\??\c:\frxxxrx.exec:\frxxxrx.exe72⤵PID:2380
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe73⤵PID:2272
-
\??\c:\1bthnn.exec:\1bthnn.exe74⤵PID:2152
-
\??\c:\jdddp.exec:\jdddp.exe75⤵PID:2148
-
\??\c:\jvvvd.exec:\jvvvd.exe76⤵PID:1628
-
\??\c:\5fxllff.exec:\5fxllff.exe77⤵PID:2540
-
\??\c:\5bnnnn.exec:\5bnnnn.exe78⤵PID:2512
-
\??\c:\pjdjp.exec:\pjdjp.exe79⤵PID:2324
-
\??\c:\ppdvd.exec:\ppdvd.exe80⤵PID:2708
-
\??\c:\xxxlffl.exec:\xxxlffl.exe81⤵PID:2704
-
\??\c:\3ntnnn.exec:\3ntnnn.exe82⤵PID:2684
-
\??\c:\tnnbth.exec:\tnnbth.exe83⤵PID:2820
-
\??\c:\1vvpv.exec:\1vvpv.exe84⤵PID:2604
-
\??\c:\7xxxxrx.exec:\7xxxxrx.exe85⤵PID:2172
-
\??\c:\tnhntt.exec:\tnhntt.exe86⤵PID:2628
-
\??\c:\nbnnbb.exec:\nbnnbb.exe87⤵PID:2592
-
\??\c:\jjvdd.exec:\jjvdd.exe88⤵PID:2992
-
\??\c:\rfrllll.exec:\rfrllll.exe89⤵PID:1860
-
\??\c:\rffxlfr.exec:\rffxlfr.exe90⤵PID:2276
-
\??\c:\thnnnn.exec:\thnnnn.exe91⤵PID:1764
-
\??\c:\jvppv.exec:\jvppv.exe92⤵PID:1960
-
\??\c:\ddppv.exec:\ddppv.exe93⤵PID:1828
-
\??\c:\7xllfff.exec:\7xllfff.exe94⤵PID:1848
-
\??\c:\tntttt.exec:\tntttt.exe95⤵PID:2336
-
\??\c:\pjpvd.exec:\pjpvd.exe96⤵PID:1812
-
\??\c:\dpdvd.exec:\dpdvd.exe97⤵PID:1080
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe98⤵PID:1200
-
\??\c:\hbtbhn.exec:\hbtbhn.exe99⤵PID:2812
-
\??\c:\nnhhnn.exec:\nnhhnn.exe100⤵PID:2876
-
\??\c:\5djdv.exec:\5djdv.exe101⤵PID:2972
-
\??\c:\9llfffr.exec:\9llfffr.exe102⤵PID:1408
-
\??\c:\xrxfffl.exec:\xrxfffl.exe103⤵PID:840
-
\??\c:\bnnntt.exec:\bnnntt.exe104⤵PID:2444
-
\??\c:\9pvjj.exec:\9pvjj.exe105⤵PID:812
-
\??\c:\dvddj.exec:\dvddj.exe106⤵PID:2932
-
\??\c:\fxfflrx.exec:\fxfflrx.exe107⤵PID:2940
-
\??\c:\1tbhnt.exec:\1tbhnt.exe108⤵PID:2124
-
\??\c:\7htbth.exec:\7htbth.exe109⤵PID:2424
-
\??\c:\jdpvv.exec:\jdpvv.exe110⤵PID:2316
-
\??\c:\flxflrr.exec:\flxflrr.exe111⤵PID:2032
-
\??\c:\frffllr.exec:\frffllr.exe112⤵PID:644
-
\??\c:\thtbbt.exec:\thtbbt.exe113⤵PID:2132
-
\??\c:\jdvvj.exec:\jdvvj.exe114⤵PID:2436
-
\??\c:\3dpdv.exec:\3dpdv.exe115⤵PID:2428
-
\??\c:\frlfllf.exec:\frlfllf.exe116⤵PID:1640
-
\??\c:\hbtbhh.exec:\hbtbhh.exe117⤵PID:2092
-
\??\c:\tntttt.exec:\tntttt.exe118⤵PID:2544
-
\??\c:\dvdvv.exec:\dvdvv.exe119⤵PID:2100
-
\??\c:\lxfxflr.exec:\lxfxflr.exe120⤵PID:2496
-
\??\c:\fxrrrlx.exec:\fxrrrlx.exe121⤵PID:2672
-
\??\c:\btttbh.exec:\btttbh.exe122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-