Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe
-
Size
454KB
-
MD5
2ee18af53d3d1a78dd64d155ee6be0b4
-
SHA1
cc9a3fb76a74c17830048a3125e6aaf2a1acfd04
-
SHA256
c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49
-
SHA512
0c236db0e50a520347efd95aad45f22f5ad7bcda817f14c1aea431e222de992f057949e655819d5c8ee8dc3ebc47b378287bdf1273a251dea49eee59e548f4d0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/772-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-45-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-71-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2664-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-149-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2780-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-168-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2800-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-188-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2972-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-197-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2056-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-244-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2616-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-386-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2908-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-520-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1692-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-529-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1628-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-723-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2296-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 772 lrfflrx.exe 2288 rrrxlrf.exe 2308 1vjdp.exe 2712 fffrxff.exe 2732 hhthnt.exe 2660 vvjvj.exe 2664 9tntbb.exe 2852 ttbhtb.exe 2580 5lfffll.exe 2596 hbttht.exe 2152 rfrrrrx.exe 1072 hnhhnn.exe 2916 hhhnhn.exe 2780 ddvjv.exe 848 lflxffr.exe 2800 bbbhnn.exe 2896 xfxxrrf.exe 2972 9bttbh.exe 2272 jpjpd.exe 2628 nnhhtt.exe 2056 dvpvd.exe 1332 3hbtbh.exe 2400 ddddj.exe 1600 xrllrrx.exe 1500 pjdjv.exe 1700 3xffflr.exe 1628 pjddp.exe 2216 vvjpd.exe 1432 hbtbnt.exe 2616 ddpdd.exe 2348 1lfrrxf.exe 1944 tbthtt.exe 1956 dvjpd.exe 2428 rlrfxfx.exe 2024 hhhntb.exe 2724 tnbhnt.exe 2820 7pjpv.exe 2680 flxflrf.exe 2636 btnttt.exe 820 thbhhb.exe 2280 pvjjv.exe 2852 rlfrflf.exe 2564 rrlxfrx.exe 2832 btnthn.exe 2596 5pvjj.exe 1240 9frfrxf.exe 2760 fxlrffr.exe 2908 3htnbh.exe 1472 ppddj.exe 824 pppvv.exe 2792 1xllrxf.exe 888 hbtbnn.exe 2756 bnhhnn.exe 1736 vpdpj.exe 1704 1fflrxf.exe 2968 bnbnhh.exe 2572 bnhtth.exe 1860 vpjdv.exe 2248 xrlrxfl.exe 1504 rlffrrx.exe 1120 hbtnnt.exe 1332 ttthtb.exe 1692 dvvvv.exe 2008 5lffllf.exe -
resource yara_rule behavioral1/memory/772-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-71-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2664-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-197-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2056-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-520-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1692-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-769-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 772 2348 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 2348 wrote to memory of 772 2348 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 2348 wrote to memory of 772 2348 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 2348 wrote to memory of 772 2348 c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe 30 PID 772 wrote to memory of 2288 772 lrfflrx.exe 31 PID 772 wrote to memory of 2288 772 lrfflrx.exe 31 PID 772 wrote to memory of 2288 772 lrfflrx.exe 31 PID 772 wrote to memory of 2288 772 lrfflrx.exe 31 PID 2288 wrote to memory of 2308 2288 rrrxlrf.exe 32 PID 2288 wrote to memory of 2308 2288 rrrxlrf.exe 32 PID 2288 wrote to memory of 2308 2288 rrrxlrf.exe 32 PID 2288 wrote to memory of 2308 2288 rrrxlrf.exe 32 PID 2308 wrote to memory of 2712 2308 1vjdp.exe 33 PID 2308 wrote to memory of 2712 2308 1vjdp.exe 33 PID 2308 wrote to memory of 2712 2308 1vjdp.exe 33 PID 2308 wrote to memory of 2712 2308 1vjdp.exe 33 PID 2712 wrote to memory of 2732 2712 fffrxff.exe 34 PID 2712 wrote to memory of 2732 2712 fffrxff.exe 34 PID 2712 wrote to memory of 2732 2712 fffrxff.exe 34 PID 2712 wrote to memory of 2732 2712 fffrxff.exe 34 PID 2732 wrote to memory of 2660 2732 hhthnt.exe 35 PID 2732 wrote to memory of 2660 2732 hhthnt.exe 35 PID 2732 wrote to memory of 2660 2732 hhthnt.exe 35 PID 2732 wrote to memory of 2660 2732 hhthnt.exe 35 PID 2660 wrote to memory of 2664 2660 vvjvj.exe 36 PID 2660 wrote to memory of 2664 2660 vvjvj.exe 36 PID 2660 wrote to memory of 2664 2660 vvjvj.exe 36 PID 2660 wrote to memory of 2664 2660 vvjvj.exe 36 PID 2664 wrote to memory of 2852 2664 9tntbb.exe 37 PID 2664 wrote to memory of 2852 2664 9tntbb.exe 37 PID 2664 wrote to memory of 2852 2664 9tntbb.exe 37 PID 2664 wrote to memory of 2852 2664 9tntbb.exe 37 PID 2852 wrote to memory of 2580 2852 ttbhtb.exe 38 PID 2852 wrote to memory of 2580 2852 ttbhtb.exe 38 PID 2852 wrote to memory of 2580 2852 ttbhtb.exe 38 PID 2852 wrote to memory of 2580 2852 ttbhtb.exe 38 PID 2580 wrote to memory of 2596 2580 5lfffll.exe 39 PID 2580 wrote to memory of 2596 2580 5lfffll.exe 39 PID 2580 wrote to memory of 2596 2580 5lfffll.exe 39 PID 2580 wrote to memory of 2596 2580 5lfffll.exe 39 PID 2596 wrote to memory of 2152 2596 hbttht.exe 40 PID 2596 wrote to memory of 2152 2596 hbttht.exe 40 PID 2596 wrote to memory of 2152 2596 hbttht.exe 40 PID 2596 wrote to memory of 2152 2596 hbttht.exe 40 PID 2152 wrote to memory of 1072 2152 rfrrrrx.exe 41 PID 2152 wrote to memory of 1072 2152 rfrrrrx.exe 41 PID 2152 wrote to memory of 1072 2152 rfrrrrx.exe 41 PID 2152 wrote to memory of 1072 2152 rfrrrrx.exe 41 PID 1072 wrote to memory of 2916 1072 hnhhnn.exe 42 PID 1072 wrote to memory of 2916 1072 hnhhnn.exe 42 PID 1072 wrote to memory of 2916 1072 hnhhnn.exe 42 PID 1072 wrote to memory of 2916 1072 hnhhnn.exe 42 PID 2916 wrote to memory of 2780 2916 hhhnhn.exe 43 PID 2916 wrote to memory of 2780 2916 hhhnhn.exe 43 PID 2916 wrote to memory of 2780 2916 hhhnhn.exe 43 PID 2916 wrote to memory of 2780 2916 hhhnhn.exe 43 PID 2780 wrote to memory of 848 2780 ddvjv.exe 44 PID 2780 wrote to memory of 848 2780 ddvjv.exe 44 PID 2780 wrote to memory of 848 2780 ddvjv.exe 44 PID 2780 wrote to memory of 848 2780 ddvjv.exe 44 PID 848 wrote to memory of 2800 848 lflxffr.exe 45 PID 848 wrote to memory of 2800 848 lflxffr.exe 45 PID 848 wrote to memory of 2800 848 lflxffr.exe 45 PID 848 wrote to memory of 2800 848 lflxffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe"C:\Users\Admin\AppData\Local\Temp\c514b26cee9fef658a35da2bc84542444a890601d8fbaf5bdb4186e78ec7cc49.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\lrfflrx.exec:\lrfflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\1vjdp.exec:\1vjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\fffrxff.exec:\fffrxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hhthnt.exec:\hhthnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vvjvj.exec:\vvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\9tntbb.exec:\9tntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ttbhtb.exec:\ttbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5lfffll.exec:\5lfffll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\hbttht.exec:\hbttht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hnhhnn.exec:\hnhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\hhhnhn.exec:\hhhnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ddvjv.exec:\ddvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lflxffr.exec:\lflxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\bbbhnn.exec:\bbbhnn.exe17⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xfxxrrf.exec:\xfxxrrf.exe18⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9bttbh.exec:\9bttbh.exe19⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jpjpd.exec:\jpjpd.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nnhhtt.exec:\nnhhtt.exe21⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dvpvd.exec:\dvpvd.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\3hbtbh.exec:\3hbtbh.exe23⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ddddj.exec:\ddddj.exe24⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xrllrrx.exec:\xrllrrx.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pjdjv.exec:\pjdjv.exe26⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3xffflr.exec:\3xffflr.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pjddp.exec:\pjddp.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvjpd.exec:\vvjpd.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbtbnt.exec:\hbtbnt.exe30⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ddpdd.exec:\ddpdd.exe31⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1lfrrxf.exec:\1lfrrxf.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tbthtt.exec:\tbthtt.exe33⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvjpd.exec:\dvjpd.exe34⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rlrfxfx.exec:\rlrfxfx.exe35⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hhhntb.exec:\hhhntb.exe36⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnbhnt.exec:\tnbhnt.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7pjpv.exec:\7pjpv.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\flxflrf.exec:\flxflrf.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\btnttt.exec:\btnttt.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\thbhhb.exec:\thbhhb.exe41⤵
- Executes dropped EXE
PID:820 -
\??\c:\pvjjv.exec:\pvjjv.exe42⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rlfrflf.exec:\rlfrflf.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrlxfrx.exec:\rrlxfrx.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\btnthn.exec:\btnthn.exe45⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5pvjj.exec:\5pvjj.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9frfrxf.exec:\9frfrxf.exe47⤵
- Executes dropped EXE
PID:1240 -
\??\c:\fxlrffr.exec:\fxlrffr.exe48⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3htnbh.exec:\3htnbh.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ppddj.exec:\ppddj.exe50⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pppvv.exec:\pppvv.exe51⤵
- Executes dropped EXE
PID:824 -
\??\c:\1xllrxf.exec:\1xllrxf.exe52⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hbtbnn.exec:\hbtbnn.exe53⤵
- Executes dropped EXE
PID:888 -
\??\c:\bnhhnn.exec:\bnhhnn.exe54⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vpdpj.exec:\vpdpj.exe55⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1fflrxf.exec:\1fflrxf.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bnbnhh.exec:\bnbnhh.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bnhtth.exec:\bnhtth.exe58⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vpjdv.exec:\vpjdv.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlffrrx.exec:\rlffrrx.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hbtnnt.exec:\hbtnnt.exe62⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ttthtb.exec:\ttthtb.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dvvvv.exec:\dvvvv.exe64⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5lffllf.exec:\5lffllf.exe65⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hbnthn.exec:\hbnthn.exe66⤵PID:1276
-
\??\c:\jdvvd.exec:\jdvvd.exe67⤵PID:580
-
\??\c:\1pjdp.exec:\1pjdp.exe68⤵PID:1700
-
\??\c:\rfrxrxl.exec:\rfrxrxl.exe69⤵PID:1628
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe70⤵PID:2232
-
\??\c:\nhtbhn.exec:\nhtbhn.exe71⤵PID:884
-
\??\c:\pvjjp.exec:\pvjjp.exe72⤵PID:1448
-
\??\c:\flfxfll.exec:\flfxfll.exe73⤵PID:1552
-
\??\c:\lllxlxr.exec:\lllxlxr.exe74⤵PID:1268
-
\??\c:\nhbnhn.exec:\nhbnhn.exe75⤵PID:2472
-
\??\c:\5bthnn.exec:\5bthnn.exe76⤵PID:1992
-
\??\c:\1jjpp.exec:\1jjpp.exe77⤵PID:1660
-
\??\c:\rllxrxf.exec:\rllxrxf.exe78⤵PID:700
-
\??\c:\3lrxfrx.exec:\3lrxfrx.exe79⤵PID:2712
-
\??\c:\nhbhnt.exec:\nhbhnt.exe80⤵PID:2088
-
\??\c:\5pddj.exec:\5pddj.exe81⤵PID:2812
-
\??\c:\5pvdj.exec:\5pvdj.exe82⤵PID:2988
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe83⤵PID:2872
-
\??\c:\fxxxfll.exec:\fxxxfll.exe84⤵PID:2568
-
\??\c:\bthhtb.exec:\bthhtb.exe85⤵PID:2352
-
\??\c:\jjvvj.exec:\jjvvj.exe86⤵PID:2644
-
\??\c:\3ppjp.exec:\3ppjp.exe87⤵PID:2564
-
\??\c:\frlrflx.exec:\frlrflx.exe88⤵PID:2528
-
\??\c:\7bthnt.exec:\7bthnt.exe89⤵PID:2584
-
\??\c:\7btttt.exec:\7btttt.exe90⤵PID:1028
-
\??\c:\1jddj.exec:\1jddj.exe91⤵PID:2760
-
\??\c:\fxlrllr.exec:\fxlrllr.exe92⤵PID:2788
-
\??\c:\rlxflrr.exec:\rlxflrr.exe93⤵PID:2036
-
\??\c:\tnbtbh.exec:\tnbtbh.exe94⤵PID:1152
-
\??\c:\1vvdd.exec:\1vvdd.exe95⤵PID:2900
-
\??\c:\jdppd.exec:\jdppd.exe96⤵PID:2836
-
\??\c:\9frxxxf.exec:\9frxxxf.exe97⤵PID:2772
-
\??\c:\7ntttb.exec:\7ntttb.exe98⤵PID:1224
-
\??\c:\dpdvd.exec:\dpdvd.exe99⤵PID:2936
-
\??\c:\xlffllf.exec:\xlffllf.exe100⤵PID:2260
-
\??\c:\llrxlrl.exec:\llrxlrl.exe101⤵PID:2256
-
\??\c:\btnnht.exec:\btnnht.exe102⤵PID:1896
-
\??\c:\1dvvd.exec:\1dvvd.exe103⤵PID:2296
-
\??\c:\9rllrlf.exec:\9rllrlf.exe104⤵PID:1932
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe105⤵PID:780
-
\??\c:\3ntnnb.exec:\3ntnnb.exe106⤵PID:1848
-
\??\c:\dvpjv.exec:\dvpjv.exe107⤵PID:1608
-
\??\c:\dvdvj.exec:\dvdvj.exe108⤵PID:1600
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe109⤵PID:268
-
\??\c:\bnthnh.exec:\bnthnh.exe110⤵PID:1800
-
\??\c:\hbnntt.exec:\hbnntt.exe111⤵PID:2300
-
\??\c:\9dvvd.exec:\9dvvd.exe112⤵PID:2444
-
\??\c:\5lflxrr.exec:\5lflxrr.exe113⤵PID:2128
-
\??\c:\frlflfl.exec:\frlflfl.exe114⤵PID:800
-
\??\c:\bntthh.exec:\bntthh.exe115⤵PID:2360
-
\??\c:\jdpjj.exec:\jdpjj.exe116⤵PID:1904
-
\??\c:\vjvvj.exec:\vjvvj.exe117⤵PID:1872
-
\??\c:\fxxfrfl.exec:\fxxfrfl.exe118⤵PID:1156
-
\??\c:\xxrfllx.exec:\xxrfllx.exe119⤵PID:1672
-
\??\c:\hbttbh.exec:\hbttbh.exe120⤵PID:3036
-
\??\c:\3vjjp.exec:\3vjjp.exe121⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-