Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe
-
Size
454KB
-
MD5
2ee18af53d3d1a78dd64d155ee6be0b4
-
SHA1
cc9a3fb76a74c17830048a3125e6aaf2a1acfd04
-
SHA256
c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49
-
SHA512
0c236db0e50a520347efd95aad45f22f5ad7bcda817f14c1aea431e222de992f057949e655819d5c8ee8dc3ebc47b378287bdf1273a251dea49eee59e548f4d0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-81-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2200-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-228-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-453-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1044-466-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1852-485-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-531-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1132-551-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3032-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-583-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2584-597-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2968-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-880-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-905-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-1040-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1808-1045-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/564-1071-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-1084-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2968-1147-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2304-1198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-1200-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1116-1306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-1349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 340 ppjpd.exe 2400 rfxrrlf.exe 2544 jvdjv.exe 2232 1vdvp.exe 2716 nhtbnb.exe 2764 bhhbhb.exe 2980 5lxxfll.exe 2960 9bnntn.exe 1424 nbnnhh.exe 2656 rfrrxrr.exe 2200 nhnhhb.exe 576 vjvdj.exe 2900 thbbhb.exe 1692 dvddd.exe 1136 5hnhbt.exe 2680 dpdjd.exe 1572 flxrlff.exe 1920 3nbbbb.exe 1144 7vjpp.exe 3060 fllxlfx.exe 2172 tnhhnn.exe 2208 dvdjj.exe 2140 rflffxf.exe 1636 tnnthb.exe 692 5rrrrlf.exe 1508 tnbbbt.exe 2392 jvdpd.exe 1796 flxlxxx.exe 3028 5bhbbb.exe 1840 1jjjj.exe 1804 thnhht.exe 2972 1nbbbt.exe 1580 rlrlllr.exe 2068 1ntnnn.exe 2084 thhnhn.exe 264 9jpdd.exe 1236 lrxrlff.exe 2220 nnhttt.exe 2756 3vppp.exe 2848 jvppv.exe 2852 frxxxff.exe 2632 9httnh.exe 2844 pdpdj.exe 2644 pdpvp.exe 1276 rfllxfr.exe 2436 lxlxrfx.exe 2304 hthhtt.exe 1600 pdpjv.exe 576 5fllfxr.exe 1244 lrxllxf.exe 1204 5hnhhb.exe 384 djdpp.exe 2116 3lxxllr.exe 1432 fxffxxf.exe 2964 thttbt.exe 1652 1jjjp.exe 1108 3pvvv.exe 1044 xllfxll.exe 2180 tbnhtn.exe 2080 tbhhnt.exe 1852 pjvdd.exe 2208 rxfxxrr.exe 3012 ntbhtn.exe 2992 hthnbt.exe -
resource yara_rule behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-1012-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-1160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-1186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-1198-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1952-1231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-1275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-1337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-1376-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 340 2536 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 2536 wrote to memory of 340 2536 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 2536 wrote to memory of 340 2536 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 2536 wrote to memory of 340 2536 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 340 wrote to memory of 2400 340 ppjpd.exe 31 PID 340 wrote to memory of 2400 340 ppjpd.exe 31 PID 340 wrote to memory of 2400 340 ppjpd.exe 31 PID 340 wrote to memory of 2400 340 ppjpd.exe 31 PID 2400 wrote to memory of 2544 2400 rfxrrlf.exe 32 PID 2400 wrote to memory of 2544 2400 rfxrrlf.exe 32 PID 2400 wrote to memory of 2544 2400 rfxrrlf.exe 32 PID 2400 wrote to memory of 2544 2400 rfxrrlf.exe 32 PID 2544 wrote to memory of 2232 2544 jvdjv.exe 33 PID 2544 wrote to memory of 2232 2544 jvdjv.exe 33 PID 2544 wrote to memory of 2232 2544 jvdjv.exe 33 PID 2544 wrote to memory of 2232 2544 jvdjv.exe 33 PID 2232 wrote to memory of 2716 2232 1vdvp.exe 34 PID 2232 wrote to memory of 2716 2232 1vdvp.exe 34 PID 2232 wrote to memory of 2716 2232 1vdvp.exe 34 PID 2232 wrote to memory of 2716 2232 1vdvp.exe 34 PID 2716 wrote to memory of 2764 2716 nhtbnb.exe 35 PID 2716 wrote to memory of 2764 2716 nhtbnb.exe 35 PID 2716 wrote to memory of 2764 2716 nhtbnb.exe 35 PID 2716 wrote to memory of 2764 2716 nhtbnb.exe 35 PID 2764 wrote to memory of 2980 2764 bhhbhb.exe 36 PID 2764 wrote to memory of 2980 2764 bhhbhb.exe 36 PID 2764 wrote to memory of 2980 2764 bhhbhb.exe 36 PID 2764 wrote to memory of 2980 2764 bhhbhb.exe 36 PID 2980 wrote to memory of 2960 2980 5lxxfll.exe 37 PID 2980 wrote to memory of 2960 2980 5lxxfll.exe 37 PID 2980 wrote to memory of 2960 2980 5lxxfll.exe 37 PID 2980 wrote to memory of 2960 2980 5lxxfll.exe 37 PID 2960 wrote to memory of 1424 2960 9bnntn.exe 38 PID 2960 wrote to memory of 1424 2960 9bnntn.exe 38 PID 2960 wrote to memory of 1424 2960 9bnntn.exe 38 PID 2960 wrote to memory of 1424 2960 9bnntn.exe 38 PID 1424 wrote to memory of 2656 1424 nbnnhh.exe 39 PID 1424 wrote to memory of 2656 1424 nbnnhh.exe 39 PID 1424 wrote to memory of 2656 1424 nbnnhh.exe 39 PID 1424 wrote to memory of 2656 1424 nbnnhh.exe 39 PID 2656 wrote to memory of 2200 2656 rfrrxrr.exe 40 PID 2656 wrote to memory of 2200 2656 rfrrxrr.exe 40 PID 2656 wrote to memory of 2200 2656 rfrrxrr.exe 40 PID 2656 wrote to memory of 2200 2656 rfrrxrr.exe 40 PID 2200 wrote to memory of 576 2200 nhnhhb.exe 41 PID 2200 wrote to memory of 576 2200 nhnhhb.exe 41 PID 2200 wrote to memory of 576 2200 nhnhhb.exe 41 PID 2200 wrote to memory of 576 2200 nhnhhb.exe 41 PID 576 wrote to memory of 2900 576 vjvdj.exe 42 PID 576 wrote to memory of 2900 576 vjvdj.exe 42 PID 576 wrote to memory of 2900 576 vjvdj.exe 42 PID 576 wrote to memory of 2900 576 vjvdj.exe 42 PID 2900 wrote to memory of 1692 2900 thbbhb.exe 43 PID 2900 wrote to memory of 1692 2900 thbbhb.exe 43 PID 2900 wrote to memory of 1692 2900 thbbhb.exe 43 PID 2900 wrote to memory of 1692 2900 thbbhb.exe 43 PID 1692 wrote to memory of 1136 1692 dvddd.exe 44 PID 1692 wrote to memory of 1136 1692 dvddd.exe 44 PID 1692 wrote to memory of 1136 1692 dvddd.exe 44 PID 1692 wrote to memory of 1136 1692 dvddd.exe 44 PID 1136 wrote to memory of 2680 1136 5hnhbt.exe 45 PID 1136 wrote to memory of 2680 1136 5hnhbt.exe 45 PID 1136 wrote to memory of 2680 1136 5hnhbt.exe 45 PID 1136 wrote to memory of 2680 1136 5hnhbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe"C:\Users\Admin\AppData\Local\Temp\c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ppjpd.exec:\ppjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\rfxrrlf.exec:\rfxrrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jvdjv.exec:\jvdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1vdvp.exec:\1vdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\nhtbnb.exec:\nhtbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bhhbhb.exec:\bhhbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5lxxfll.exec:\5lxxfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\9bnntn.exec:\9bnntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nbnnhh.exec:\nbnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\rfrrxrr.exec:\rfrrxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\nhnhhb.exec:\nhnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vjvdj.exec:\vjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\thbbhb.exec:\thbbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\dvddd.exec:\dvddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\5hnhbt.exec:\5hnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\dpdjd.exec:\dpdjd.exe17⤵
- Executes dropped EXE
PID:2680 -
\??\c:\flxrlff.exec:\flxrlff.exe18⤵
- Executes dropped EXE
PID:1572 -
\??\c:\3nbbbb.exec:\3nbbbb.exe19⤵
- Executes dropped EXE
PID:1920 -
\??\c:\7vjpp.exec:\7vjpp.exe20⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fllxlfx.exec:\fllxlfx.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tnhhnn.exec:\tnhhnn.exe22⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvdjj.exec:\dvdjj.exe23⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rflffxf.exec:\rflffxf.exe24⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tnnthb.exec:\tnnthb.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5rrrrlf.exec:\5rrrrlf.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\tnbbbt.exec:\tnbbbt.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jvdpd.exec:\jvdpd.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\flxlxxx.exec:\flxlxxx.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\5bhbbb.exec:\5bhbbb.exe30⤵
- Executes dropped EXE
PID:3028 -
\??\c:\1jjjj.exec:\1jjjj.exe31⤵
- Executes dropped EXE
PID:1840 -
\??\c:\thnhht.exec:\thnhht.exe32⤵
- Executes dropped EXE
PID:1804 -
\??\c:\1nbbbt.exec:\1nbbbt.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rlrlllr.exec:\rlrlllr.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1ntnnn.exec:\1ntnnn.exe35⤵
- Executes dropped EXE
PID:2068 -
\??\c:\thhnhn.exec:\thhnhn.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9jpdd.exec:\9jpdd.exe37⤵
- Executes dropped EXE
PID:264 -
\??\c:\lrxrlff.exec:\lrxrlff.exe38⤵
- Executes dropped EXE
PID:1236 -
\??\c:\nnhttt.exec:\nnhttt.exe39⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3vppp.exec:\3vppp.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jvppv.exec:\jvppv.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\frxxxff.exec:\frxxxff.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9httnh.exec:\9httnh.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pdpdj.exec:\pdpdj.exe44⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pdpvp.exec:\pdpvp.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rfllxfr.exec:\rfllxfr.exe46⤵
- Executes dropped EXE
PID:1276 -
\??\c:\lxlxrfx.exec:\lxlxrfx.exe47⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hthhtt.exec:\hthhtt.exe48⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pdpjv.exec:\pdpjv.exe49⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5fllfxr.exec:\5fllfxr.exe50⤵
- Executes dropped EXE
PID:576 -
\??\c:\lrxllxf.exec:\lrxllxf.exe51⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5hnhhb.exec:\5hnhhb.exe52⤵
- Executes dropped EXE
PID:1204 -
\??\c:\djdpp.exec:\djdpp.exe53⤵
- Executes dropped EXE
PID:384 -
\??\c:\3lxxllr.exec:\3lxxllr.exe54⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxffxxf.exec:\fxffxxf.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\thttbt.exec:\thttbt.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1jjjp.exec:\1jjjp.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3pvvv.exec:\3pvvv.exe58⤵
- Executes dropped EXE
PID:1108 -
\??\c:\xllfxll.exec:\xllfxll.exe59⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tbnhtn.exec:\tbnhtn.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tbhhnt.exec:\tbhhnt.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjvdd.exec:\pjvdd.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ntbhtn.exec:\ntbhtn.exe64⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hthnbt.exec:\hthnbt.exe65⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9pjpd.exec:\9pjpd.exe66⤵PID:1956
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe67⤵PID:2920
-
\??\c:\rfrrffr.exec:\rfrrffr.exe68⤵PID:3036
-
\??\c:\5bbbhb.exec:\5bbbhb.exe69⤵PID:1132
-
\??\c:\jdppp.exec:\jdppp.exe70⤵PID:1672
-
\??\c:\vjvdd.exec:\vjvdd.exe71⤵PID:1780
-
\??\c:\rfrlrxf.exec:\rfrlrxf.exe72⤵PID:1292
-
\??\c:\5tthnh.exec:\5tthnh.exe73⤵PID:3032
-
\??\c:\dvppp.exec:\dvppp.exe74⤵PID:1640
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe75⤵PID:1576
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe76⤵PID:2584
-
\??\c:\nhtbtt.exec:\nhtbtt.exe77⤵PID:2356
-
\??\c:\jdddv.exec:\jdddv.exe78⤵PID:2704
-
\??\c:\dpjvv.exec:\dpjvv.exe79⤵PID:1988
-
\??\c:\7xrflrx.exec:\7xrflrx.exe80⤵PID:2968
-
\??\c:\7rlxxll.exec:\7rlxxll.exe81⤵PID:2736
-
\??\c:\7thntt.exec:\7thntt.exe82⤵PID:2740
-
\??\c:\vpvpp.exec:\vpvpp.exe83⤵PID:2928
-
\??\c:\rrxxffl.exec:\rrxxffl.exe84⤵PID:2980
-
\??\c:\frxrrrr.exec:\frxrrrr.exe85⤵PID:2872
-
\??\c:\3hhbbb.exec:\3hhbbb.exe86⤵PID:2636
-
\??\c:\pjvdp.exec:\pjvdp.exe87⤵PID:2652
-
\??\c:\dpjpv.exec:\dpjpv.exe88⤵PID:2604
-
\??\c:\rffrrlf.exec:\rffrrlf.exe89⤵PID:2328
-
\??\c:\ttntbh.exec:\ttntbh.exe90⤵PID:1340
-
\??\c:\bthnnt.exec:\bthnnt.exe91⤵PID:300
-
\??\c:\vjvvp.exec:\vjvvp.exe92⤵PID:2952
-
\??\c:\5flllfl.exec:\5flllfl.exe93⤵PID:2892
-
\??\c:\fxllffl.exec:\fxllffl.exe94⤵PID:1080
-
\??\c:\tnntbt.exec:\tnntbt.exe95⤵PID:1204
-
\??\c:\1vppp.exec:\1vppp.exe96⤵PID:1916
-
\??\c:\9xllllr.exec:\9xllllr.exe97⤵PID:2116
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe98⤵PID:2076
-
\??\c:\3bbbhn.exec:\3bbbhn.exe99⤵PID:2024
-
\??\c:\1jjpp.exec:\1jjpp.exe100⤵PID:1704
-
\??\c:\5djjj.exec:\5djjj.exe101⤵PID:1620
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe102⤵PID:1936
-
\??\c:\vvdpp.exec:\vvdpp.exe103⤵PID:2100
-
\??\c:\jvjpp.exec:\jvjpp.exe104⤵PID:2592
-
\??\c:\rfrxxrx.exec:\rfrxxrx.exe105⤵PID:2204
-
\??\c:\tnbbnn.exec:\tnbbnn.exe106⤵PID:2236
-
\??\c:\hthhnn.exec:\hthhnn.exe107⤵PID:1644
-
\??\c:\pdjdp.exec:\pdjdp.exe108⤵PID:1068
-
\??\c:\xxlflff.exec:\xxlflff.exe109⤵PID:1992
-
\??\c:\1lxxffl.exec:\1lxxffl.exe110⤵PID:2052
-
\??\c:\bntnnh.exec:\bntnnh.exe111⤵PID:3020
-
\??\c:\jpvdp.exec:\jpvdp.exe112⤵PID:1532
-
\??\c:\jvddj.exec:\jvddj.exe113⤵PID:1796
-
\??\c:\1lxrrrr.exec:\1lxrrrr.exe114⤵PID:1740
-
\??\c:\tbhhhb.exec:\tbhhhb.exe115⤵PID:2560
-
\??\c:\thntnh.exec:\thntnh.exe116⤵PID:1324
-
\??\c:\1dppd.exec:\1dppd.exe117⤵PID:3032
-
\??\c:\xlrxflr.exec:\xlrxflr.exe118⤵PID:1640
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe119⤵PID:1580
-
\??\c:\7hbbhb.exec:\7hbbhb.exe120⤵PID:1788
-
\??\c:\pjvvv.exec:\pjvvv.exe121⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-