Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe
-
Size
454KB
-
MD5
d2bd3fc95c6d821deb4aedd51acf9e22
-
SHA1
07e87305e9abb7dbd3f7eed30dc471b7f4447be3
-
SHA256
bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535
-
SHA512
416694643c205787146b0f7547f5e9eba54b50ef6d75328634cb04eeab2d50ebf2f1fb9ccd40d94d3e841daa7cdae57ee5c4cf085679653e6e0c29aebdeb12cc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2616-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-98-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2592-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-118-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-135-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2768-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-202-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2032-247-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2232-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-274-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1956-286-0x00000000775A0000-0x000000007769A000-memory.dmp family_blackmoon behavioral1/memory/1792-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-285-0x00000000776A0000-0x00000000777BF000-memory.dmp family_blackmoon behavioral1/memory/800-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-387-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-454-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1484-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-468-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2372-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-554-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-567-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2556-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-637-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3008-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2264-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-710-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1308-759-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1744-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-847-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1992-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-913-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/908-1029-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3032-1054-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2612-1104-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2616 nnbbtt.exe 2320 5htbnh.exe 3048 vvjpd.exe 2144 1httnn.exe 2796 djvjj.exe 2540 tttbnn.exe 2568 5jjpv.exe 2668 hhhhbb.exe 2528 vvjdd.exe 2980 btbhnn.exe 2288 dvppd.exe 1724 xxrfxxx.exe 2592 1hbhnn.exe 1920 jdjvv.exe 1508 fxrrflx.exe 2768 dvpvj.exe 1268 9thnbb.exe 1160 jjvpj.exe 2572 3thhhb.exe 2220 ppjpj.exe 2500 9btnbh.exe 2940 hnbbtb.exe 1744 pjvpj.exe 1700 tnntbb.exe 2112 lfxfrfl.exe 740 thbhnt.exe 2032 jdppd.exe 2232 5rlxfrl.exe 3036 tnbthn.exe 2468 pdvdj.exe 1928 bthntt.exe 1956 dvvdp.exe 800 nhtbbb.exe 2992 bnnnnn.exe 2624 5hbbhn.exe 2680 jdjjp.exe 2788 xrfflfl.exe 2684 ttntnt.exe 2908 5ttbtb.exe 2820 7vvvp.exe 3004 ffxlllx.exe 2644 frflrlr.exe 2596 bttbhh.exe 2544 jvvpp.exe 3000 pjvdp.exe 1848 lfxrrrx.exe 1800 tnbnhh.exe 2776 ppdjp.exe 492 ddpvd.exe 896 xllfffr.exe 852 hhnnhn.exe 1632 jdvdp.exe 2876 jdpvd.exe 1404 3flffxx.exe 1676 hbnnbt.exe 2708 jddjv.exe 1484 jjppv.exe 2116 xfxffrl.exe 2368 1hhnbb.exe 1016 7vpvj.exe 1744 lxrxxxl.exe 612 5tnhnh.exe 2492 btnthh.exe 2136 jjdpv.exe -
resource yara_rule behavioral1/memory/2616-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-285-0x00000000776A0000-0x00000000777BF000-memory.dmp upx behavioral1/memory/2992-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-387-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1848-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-468-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1016-482-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2372-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-567-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1596-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-710-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1308-759-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1744-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-913-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2764-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1085-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2612-1104-0x00000000003A0000-0x00000000003CA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2616 1648 bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe 31 PID 1648 wrote to memory of 2616 1648 bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe 31 PID 1648 wrote to memory of 2616 1648 bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe 31 PID 1648 wrote to memory of 2616 1648 bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe 31 PID 2616 wrote to memory of 2320 2616 nnbbtt.exe 32 PID 2616 wrote to memory of 2320 2616 nnbbtt.exe 32 PID 2616 wrote to memory of 2320 2616 nnbbtt.exe 32 PID 2616 wrote to memory of 2320 2616 nnbbtt.exe 32 PID 2320 wrote to memory of 3048 2320 5htbnh.exe 33 PID 2320 wrote to memory of 3048 2320 5htbnh.exe 33 PID 2320 wrote to memory of 3048 2320 5htbnh.exe 33 PID 2320 wrote to memory of 3048 2320 5htbnh.exe 33 PID 3048 wrote to memory of 2144 3048 vvjpd.exe 34 PID 3048 wrote to memory of 2144 3048 vvjpd.exe 34 PID 3048 wrote to memory of 2144 3048 vvjpd.exe 34 PID 3048 wrote to memory of 2144 3048 vvjpd.exe 34 PID 2144 wrote to memory of 2796 2144 1httnn.exe 35 PID 2144 wrote to memory of 2796 2144 1httnn.exe 35 PID 2144 wrote to memory of 2796 2144 1httnn.exe 35 PID 2144 wrote to memory of 2796 2144 1httnn.exe 35 PID 2796 wrote to memory of 2540 2796 djvjj.exe 36 PID 2796 wrote to memory of 2540 2796 djvjj.exe 36 PID 2796 wrote to memory of 2540 2796 djvjj.exe 36 PID 2796 wrote to memory of 2540 2796 djvjj.exe 36 PID 2540 wrote to memory of 2568 2540 tttbnn.exe 37 PID 2540 wrote to memory of 2568 2540 tttbnn.exe 37 PID 2540 wrote to memory of 2568 2540 tttbnn.exe 37 PID 2540 wrote to memory of 2568 2540 tttbnn.exe 37 PID 2568 wrote to memory of 2668 2568 5jjpv.exe 38 PID 2568 wrote to memory of 2668 2568 5jjpv.exe 38 PID 2568 wrote to memory of 2668 2568 5jjpv.exe 38 PID 2568 wrote to memory of 2668 2568 5jjpv.exe 38 PID 2668 wrote to memory of 2528 2668 hhhhbb.exe 39 PID 2668 wrote to memory of 2528 2668 hhhhbb.exe 39 PID 2668 wrote to memory of 2528 2668 hhhhbb.exe 39 PID 2668 wrote to memory of 2528 2668 hhhhbb.exe 39 PID 2528 wrote to memory of 2980 2528 vvjdd.exe 40 PID 2528 wrote to memory of 2980 2528 vvjdd.exe 40 PID 2528 wrote to memory of 2980 2528 vvjdd.exe 40 PID 2528 wrote to memory of 2980 2528 vvjdd.exe 40 PID 2980 wrote to memory of 2288 2980 btbhnn.exe 41 PID 2980 wrote to memory of 2288 2980 btbhnn.exe 41 PID 2980 wrote to memory of 2288 2980 btbhnn.exe 41 PID 2980 wrote to memory of 2288 2980 btbhnn.exe 41 PID 2288 wrote to memory of 1724 2288 dvppd.exe 42 PID 2288 wrote to memory of 1724 2288 dvppd.exe 42 PID 2288 wrote to memory of 1724 2288 dvppd.exe 42 PID 2288 wrote to memory of 1724 2288 dvppd.exe 42 PID 1724 wrote to memory of 2592 1724 xxrfxxx.exe 43 PID 1724 wrote to memory of 2592 1724 xxrfxxx.exe 43 PID 1724 wrote to memory of 2592 1724 xxrfxxx.exe 43 PID 1724 wrote to memory of 2592 1724 xxrfxxx.exe 43 PID 2592 wrote to memory of 1920 2592 1hbhnn.exe 44 PID 2592 wrote to memory of 1920 2592 1hbhnn.exe 44 PID 2592 wrote to memory of 1920 2592 1hbhnn.exe 44 PID 2592 wrote to memory of 1920 2592 1hbhnn.exe 44 PID 1920 wrote to memory of 1508 1920 jdjvv.exe 45 PID 1920 wrote to memory of 1508 1920 jdjvv.exe 45 PID 1920 wrote to memory of 1508 1920 jdjvv.exe 45 PID 1920 wrote to memory of 1508 1920 jdjvv.exe 45 PID 1508 wrote to memory of 2768 1508 fxrrflx.exe 46 PID 1508 wrote to memory of 2768 1508 fxrrflx.exe 46 PID 1508 wrote to memory of 2768 1508 fxrrflx.exe 46 PID 1508 wrote to memory of 2768 1508 fxrrflx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe"C:\Users\Admin\AppData\Local\Temp\bc3d7216242570c96bc6fefab24697b4fe31eae2f4bbc392b27a9dd22fdce535.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nnbbtt.exec:\nnbbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5htbnh.exec:\5htbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\vvjpd.exec:\vvjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\1httnn.exec:\1httnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\djvjj.exec:\djvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tttbnn.exec:\tttbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5jjpv.exec:\5jjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hhhhbb.exec:\hhhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vvjdd.exec:\vvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\btbhnn.exec:\btbhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\dvppd.exec:\dvppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\xxrfxxx.exec:\xxrfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\1hbhnn.exec:\1hbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jdjvv.exec:\jdjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\fxrrflx.exec:\fxrrflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\dvpvj.exec:\dvpvj.exe17⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9thnbb.exec:\9thnbb.exe18⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jjvpj.exec:\jjvpj.exe19⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3thhhb.exec:\3thhhb.exe20⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ppjpj.exec:\ppjpj.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9btnbh.exec:\9btnbh.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hnbbtb.exec:\hnbbtb.exe23⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjvpj.exec:\pjvpj.exe24⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tnntbb.exec:\tnntbb.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700 -
\??\c:\lfxfrfl.exec:\lfxfrfl.exe26⤵
- Executes dropped EXE
PID:2112 -
\??\c:\thbhnt.exec:\thbhnt.exe27⤵
- Executes dropped EXE
PID:740 -
\??\c:\jdppd.exec:\jdppd.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5rlxfrl.exec:\5rlxfrl.exe29⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tnbthn.exec:\tnbthn.exe30⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pdvdj.exec:\pdvdj.exe31⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bthntt.exec:\bthntt.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dvvdp.exec:\dvvdp.exe33⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3hhtbh.exec:\3hhtbh.exe34⤵PID:1792
-
\??\c:\nhtbbb.exec:\nhtbbb.exe35⤵
- Executes dropped EXE
PID:800 -
\??\c:\bnnnnn.exec:\bnnnnn.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5hbbhn.exec:\5hbbhn.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jdjjp.exec:\jdjjp.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrfflfl.exec:\xrfflfl.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ttntnt.exec:\ttntnt.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5ttbtb.exec:\5ttbtb.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7vvvp.exec:\7vvvp.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ffxlllx.exec:\ffxlllx.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\frflrlr.exec:\frflrlr.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bttbhh.exec:\bttbhh.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jvvpp.exec:\jvvpp.exe46⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjvdp.exec:\pjvdp.exe47⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe48⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tnbnhh.exec:\tnbnhh.exe49⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ppdjp.exec:\ppdjp.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ddpvd.exec:\ddpvd.exe51⤵
- Executes dropped EXE
PID:492 -
\??\c:\xllfffr.exec:\xllfffr.exe52⤵
- Executes dropped EXE
PID:896 -
\??\c:\hhnnhn.exec:\hhnnhn.exe53⤵
- Executes dropped EXE
PID:852 -
\??\c:\jdvdp.exec:\jdvdp.exe54⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdpvd.exec:\jdpvd.exe55⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3flffxx.exec:\3flffxx.exe56⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hbnnbt.exec:\hbnnbt.exe57⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jddjv.exec:\jddjv.exe58⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jjppv.exec:\jjppv.exe59⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xfxffrl.exec:\xfxffrl.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1hhnbb.exec:\1hhnbb.exe61⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7vpvj.exec:\7vpvj.exe62⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lxrxxxl.exec:\lxrxxxl.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5tnhnh.exec:\5tnhnh.exe64⤵
- Executes dropped EXE
PID:612 -
\??\c:\btnthh.exec:\btnthh.exe65⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjdpv.exec:\jjdpv.exe66⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fffflrx.exec:\fffflrx.exe67⤵PID:2140
-
\??\c:\lflfxxf.exec:\lflfxxf.exe68⤵PID:2960
-
\??\c:\bbntbh.exec:\bbntbh.exe69⤵PID:1576
-
\??\c:\5jvvv.exec:\5jvvv.exe70⤵PID:992
-
\??\c:\lfflrrr.exec:\lfflrrr.exe71⤵PID:1004
-
\??\c:\5thnnt.exec:\5thnnt.exe72⤵PID:2460
-
\??\c:\nhttbb.exec:\nhttbb.exe73⤵PID:2372
-
\??\c:\dvjdd.exec:\dvjdd.exe74⤵PID:548
-
\??\c:\rflxrll.exec:\rflxrll.exe75⤵PID:2224
-
\??\c:\tnhhnn.exec:\tnhhnn.exe76⤵PID:2108
-
\??\c:\nntnth.exec:\nntnth.exe77⤵PID:1596
-
\??\c:\vpddd.exec:\vpddd.exe78⤵PID:3048
-
\??\c:\xlxxllr.exec:\xlxxllr.exe79⤵PID:2640
-
\??\c:\thbbhh.exec:\thbbhh.exe80⤵PID:2736
-
\??\c:\9thhnt.exec:\9thhnt.exe81⤵PID:2752
-
\??\c:\pdppv.exec:\pdppv.exe82⤵PID:2076
-
\??\c:\3xrrrlr.exec:\3xrrrlr.exe83⤵PID:2556
-
\??\c:\3btbnn.exec:\3btbnn.exe84⤵PID:2576
-
\??\c:\dvppd.exec:\dvppd.exe85⤵PID:2588
-
\??\c:\xrllxxf.exec:\xrllxxf.exe86⤵PID:3008
-
\??\c:\lfxflrf.exec:\lfxflrf.exe87⤵PID:2544
-
\??\c:\3nbttt.exec:\3nbttt.exe88⤵PID:3000
-
\??\c:\5djvp.exec:\5djvp.exe89⤵PID:1392
-
\??\c:\rrflxfx.exec:\rrflxfx.exe90⤵PID:2064
-
\??\c:\1frrrfx.exec:\1frrrfx.exe91⤵PID:2264
-
\??\c:\nnbhht.exec:\nnbhht.exe92⤵PID:2828
-
\??\c:\ddvvp.exec:\ddvvp.exe93⤵PID:1524
-
\??\c:\frrlrxf.exec:\frrlrxf.exe94⤵PID:852
-
\??\c:\rlxxffl.exec:\rlxxffl.exe95⤵PID:1980
-
\??\c:\tnbbhh.exec:\tnbbhh.exe96⤵
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\jdvdj.exec:\jdvdj.exe97⤵PID:1604
-
\??\c:\xxllrxf.exec:\xxllrxf.exe98⤵PID:2884
-
\??\c:\fxlllrf.exec:\fxlllrf.exe99⤵PID:2572
-
\??\c:\hbttbb.exec:\hbttbb.exe100⤵PID:2160
-
\??\c:\7vppv.exec:\7vppv.exe101⤵PID:1664
-
\??\c:\jdvdj.exec:\jdvdj.exe102⤵PID:444
-
\??\c:\1xlrrrx.exec:\1xlrrrx.exe103⤵PID:316
-
\??\c:\5hbbhh.exec:\5hbbhh.exe104⤵PID:1308
-
\??\c:\pdvpd.exec:\pdvpd.exe105⤵PID:1744
-
\??\c:\9djjj.exec:\9djjj.exe106⤵PID:1916
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe107⤵PID:2292
-
\??\c:\nthhbt.exec:\nthhbt.exe108⤵PID:3028
-
\??\c:\bttthh.exec:\bttthh.exe109⤵PID:2964
-
\??\c:\dvjvj.exec:\dvjvj.exe110⤵PID:1784
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe111⤵PID:2428
-
\??\c:\hntbbh.exec:\hntbbh.exe112⤵PID:3040
-
\??\c:\hhhnbb.exec:\hhhnbb.exe113⤵PID:1004
-
\??\c:\dpjpp.exec:\dpjpp.exe114⤵PID:2944
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe115⤵PID:2616
-
\??\c:\7lfrxfr.exec:\7lfrxfr.exe116⤵PID:2256
-
\??\c:\5tbtbb.exec:\5tbtbb.exe117⤵PID:2004
-
\??\c:\vddvv.exec:\vddvv.exe118⤵PID:1052
-
\??\c:\rlfrllf.exec:\rlfrllf.exe119⤵PID:3044
-
\??\c:\hbbbtt.exec:\hbbbtt.exe120⤵PID:2156
-
\??\c:\3fllxff.exec:\3fllxff.exe121⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-