Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe
-
Size
454KB
-
MD5
76b3947c781fd3e3181d28d91f695ac4
-
SHA1
41932a1675bbce5927dc24ded2eebd8bb9df80cd
-
SHA256
b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937
-
SHA512
41da3b27e70202d02a45d367ba362e2a63bf16763b4eff10ecaa512d32fb89e6c549e286f3e511a80845aa9a3852deb791b64d98af7edb6a0e175c83251e0813
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/3040-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-38-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1632-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-132-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2820-130-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2512-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-169-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/544-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-523-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1752-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-567-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-616-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-692-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3056-711-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3056-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-719-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2144-732-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2076-1006-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-1037-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1732-1079-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1648-1104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2432-1285-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1532-1354-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 nbhntb.exe 2540 tnhnbb.exe 2172 btnthh.exe 2752 vvjjp.exe 2860 bhbbhn.exe 2840 vvjvj.exe 1700 fxrxffr.exe 2772 5tnthh.exe 2616 xlxflrr.exe 2316 9nhhht.exe 2672 ffrxllr.exe 1632 dpjpv.exe 2820 fxlrllx.exe 784 tntbbh.exe 1796 pjvdj.exe 2512 dvjjp.exe 2000 rlxfrxl.exe 2932 frlxxlr.exe 2696 pjpvd.exe 2064 vpvvd.exe 2256 vdppv.exe 3064 lxlxffx.exe 2584 xxrflrf.exe 544 7thhnh.exe 2184 vpjjd.exe 2492 jvvvj.exe 2988 9hbbhn.exe 2204 tnbbhh.exe 1752 lflrxfl.exe 1680 btnhtb.exe 1412 lfxxfxf.exe 2408 tnnbnt.exe 2520 xxrxlxx.exe 1288 vjjdj.exe 2092 5flllfx.exe 2748 fxllrll.exe 2876 3nbbbb.exe 2868 1jjvp.exe 2732 pjvvj.exe 2740 frrrxxl.exe 2832 bththh.exe 2776 7htbbn.exe 2772 pjppd.exe 2720 rflrfxf.exe 2316 7fxxlrx.exe 988 btbhhn.exe 1756 hbhhhh.exe 796 vpvpv.exe 264 5frrrxl.exe 1908 lfrxxrx.exe 2016 thntbb.exe 1716 7vddp.exe 1796 dpddv.exe 1628 1rxrxrr.exe 1724 thtbtb.exe 2708 thtnbt.exe 2948 pjpjp.exe 2696 fxxfrrf.exe 2220 xlrxffl.exe 1520 thtttt.exe 2456 vpdvv.exe 644 jvjjp.exe 1812 1ffflrr.exe 1332 nhnnhh.exe -
resource yara_rule behavioral1/memory/3040-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-93-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2672-108-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1632-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-168-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2064-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-616-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2768-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-732-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2616-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-1254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-1285-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1136-1304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-1341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-1354-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2168 3040 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 30 PID 3040 wrote to memory of 2168 3040 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 30 PID 3040 wrote to memory of 2168 3040 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 30 PID 3040 wrote to memory of 2168 3040 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 30 PID 2168 wrote to memory of 2540 2168 nbhntb.exe 31 PID 2168 wrote to memory of 2540 2168 nbhntb.exe 31 PID 2168 wrote to memory of 2540 2168 nbhntb.exe 31 PID 2168 wrote to memory of 2540 2168 nbhntb.exe 31 PID 2540 wrote to memory of 2172 2540 tnhnbb.exe 32 PID 2540 wrote to memory of 2172 2540 tnhnbb.exe 32 PID 2540 wrote to memory of 2172 2540 tnhnbb.exe 32 PID 2540 wrote to memory of 2172 2540 tnhnbb.exe 32 PID 2172 wrote to memory of 2752 2172 btnthh.exe 33 PID 2172 wrote to memory of 2752 2172 btnthh.exe 33 PID 2172 wrote to memory of 2752 2172 btnthh.exe 33 PID 2172 wrote to memory of 2752 2172 btnthh.exe 33 PID 2752 wrote to memory of 2860 2752 vvjjp.exe 34 PID 2752 wrote to memory of 2860 2752 vvjjp.exe 34 PID 2752 wrote to memory of 2860 2752 vvjjp.exe 34 PID 2752 wrote to memory of 2860 2752 vvjjp.exe 34 PID 2860 wrote to memory of 2840 2860 bhbbhn.exe 35 PID 2860 wrote to memory of 2840 2860 bhbbhn.exe 35 PID 2860 wrote to memory of 2840 2860 bhbbhn.exe 35 PID 2860 wrote to memory of 2840 2860 bhbbhn.exe 35 PID 2840 wrote to memory of 1700 2840 vvjvj.exe 36 PID 2840 wrote to memory of 1700 2840 vvjvj.exe 36 PID 2840 wrote to memory of 1700 2840 vvjvj.exe 36 PID 2840 wrote to memory of 1700 2840 vvjvj.exe 36 PID 1700 wrote to memory of 2772 1700 fxrxffr.exe 37 PID 1700 wrote to memory of 2772 1700 fxrxffr.exe 37 PID 1700 wrote to memory of 2772 1700 fxrxffr.exe 37 PID 1700 wrote to memory of 2772 1700 fxrxffr.exe 37 PID 2772 wrote to memory of 2616 2772 5tnthh.exe 38 PID 2772 wrote to memory of 2616 2772 5tnthh.exe 38 PID 2772 wrote to memory of 2616 2772 5tnthh.exe 38 PID 2772 wrote to memory of 2616 2772 5tnthh.exe 38 PID 2616 wrote to memory of 2316 2616 xlxflrr.exe 39 PID 2616 wrote to memory of 2316 2616 xlxflrr.exe 39 PID 2616 wrote to memory of 2316 2616 xlxflrr.exe 39 PID 2616 wrote to memory of 2316 2616 xlxflrr.exe 39 PID 2316 wrote to memory of 2672 2316 9nhhht.exe 40 PID 2316 wrote to memory of 2672 2316 9nhhht.exe 40 PID 2316 wrote to memory of 2672 2316 9nhhht.exe 40 PID 2316 wrote to memory of 2672 2316 9nhhht.exe 40 PID 2672 wrote to memory of 1632 2672 ffrxllr.exe 41 PID 2672 wrote to memory of 1632 2672 ffrxllr.exe 41 PID 2672 wrote to memory of 1632 2672 ffrxllr.exe 41 PID 2672 wrote to memory of 1632 2672 ffrxllr.exe 41 PID 1632 wrote to memory of 2820 1632 dpjpv.exe 42 PID 1632 wrote to memory of 2820 1632 dpjpv.exe 42 PID 1632 wrote to memory of 2820 1632 dpjpv.exe 42 PID 1632 wrote to memory of 2820 1632 dpjpv.exe 42 PID 2820 wrote to memory of 784 2820 fxlrllx.exe 43 PID 2820 wrote to memory of 784 2820 fxlrllx.exe 43 PID 2820 wrote to memory of 784 2820 fxlrllx.exe 43 PID 2820 wrote to memory of 784 2820 fxlrllx.exe 43 PID 784 wrote to memory of 1796 784 tntbbh.exe 44 PID 784 wrote to memory of 1796 784 tntbbh.exe 44 PID 784 wrote to memory of 1796 784 tntbbh.exe 44 PID 784 wrote to memory of 1796 784 tntbbh.exe 44 PID 1796 wrote to memory of 2512 1796 pjvdj.exe 45 PID 1796 wrote to memory of 2512 1796 pjvdj.exe 45 PID 1796 wrote to memory of 2512 1796 pjvdj.exe 45 PID 1796 wrote to memory of 2512 1796 pjvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe"C:\Users\Admin\AppData\Local\Temp\b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nbhntb.exec:\nbhntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\tnhnbb.exec:\tnhnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\btnthh.exec:\btnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\vvjjp.exec:\vvjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bhbbhn.exec:\bhbbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\vvjvj.exec:\vvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\fxrxffr.exec:\fxrxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\5tnthh.exec:\5tnthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xlxflrr.exec:\xlxflrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\9nhhht.exec:\9nhhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ffrxllr.exec:\ffrxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\dpjpv.exec:\dpjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\fxlrllx.exec:\fxlrllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tntbbh.exec:\tntbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\pjvdj.exec:\pjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\dvjjp.exec:\dvjjp.exe17⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe18⤵
- Executes dropped EXE
PID:2000 -
\??\c:\frlxxlr.exec:\frlxxlr.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjpvd.exec:\pjpvd.exe20⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpvvd.exec:\vpvvd.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vdppv.exec:\vdppv.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lxlxffx.exec:\lxlxffx.exe23⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xxrflrf.exec:\xxrflrf.exe24⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7thhnh.exec:\7thhnh.exe25⤵
- Executes dropped EXE
PID:544 -
\??\c:\vpjjd.exec:\vpjjd.exe26⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jvvvj.exec:\jvvvj.exe27⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9hbbhn.exec:\9hbbhn.exe28⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tnbbhh.exec:\tnbbhh.exe29⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lflrxfl.exec:\lflrxfl.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\btnhtb.exec:\btnhtb.exe31⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe32⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tnnbnt.exec:\tnnbnt.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xxrxlxx.exec:\xxrxlxx.exe34⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vjjdj.exec:\vjjdj.exe35⤵
- Executes dropped EXE
PID:1288 -
\??\c:\5flllfx.exec:\5flllfx.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxllrll.exec:\fxllrll.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3nbbbb.exec:\3nbbbb.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1jjvp.exec:\1jjvp.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pjvvj.exec:\pjvvj.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\frrrxxl.exec:\frrrxxl.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bththh.exec:\bththh.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7htbbn.exec:\7htbbn.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjppd.exec:\pjppd.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rflrfxf.exec:\rflrfxf.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7fxxlrx.exec:\7fxxlrx.exe46⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btbhhn.exec:\btbhhn.exe47⤵
- Executes dropped EXE
PID:988 -
\??\c:\hbhhhh.exec:\hbhhhh.exe48⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vpvpv.exec:\vpvpv.exe49⤵
- Executes dropped EXE
PID:796 -
\??\c:\5frrrxl.exec:\5frrrxl.exe50⤵
- Executes dropped EXE
PID:264 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe51⤵
- Executes dropped EXE
PID:1908 -
\??\c:\thntbb.exec:\thntbb.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7vddp.exec:\7vddp.exe53⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dpddv.exec:\dpddv.exe54⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1rxrxrr.exec:\1rxrxrr.exe55⤵
- Executes dropped EXE
PID:1628 -
\??\c:\thtbtb.exec:\thtbtb.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thtnbt.exec:\thtnbt.exe57⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjpjp.exec:\pjpjp.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fxxfrrf.exec:\fxxfrrf.exe59⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xlrxffl.exec:\xlrxffl.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\thtttt.exec:\thtttt.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vpdvv.exec:\vpdvv.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jvjjp.exec:\jvjjp.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:644 -
\??\c:\1ffflrr.exec:\1ffflrr.exe64⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhnnhh.exec:\nhnnhh.exe65⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vvdjd.exec:\vvdjd.exe66⤵PID:2844
-
\??\c:\vpvpj.exec:\vpvpj.exe67⤵PID:708
-
\??\c:\7fxlxxx.exec:\7fxlxxx.exe68⤵PID:564
-
\??\c:\7hnntt.exec:\7hnntt.exe69⤵PID:2224
-
\??\c:\tnbbhb.exec:\tnbbhb.exe70⤵PID:3028
-
\??\c:\dvjvd.exec:\dvjvd.exe71⤵PID:2140
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe72⤵PID:1752
-
\??\c:\7rxflrr.exec:\7rxflrr.exe73⤵PID:2336
-
\??\c:\btbntn.exec:\btbntn.exe74⤵PID:2060
-
\??\c:\ddpjp.exec:\ddpjp.exe75⤵PID:1580
-
\??\c:\pjvdd.exec:\pjvdd.exe76⤵PID:2312
-
\??\c:\9lrllll.exec:\9lrllll.exe77⤵PID:1280
-
\??\c:\3tnhnn.exec:\3tnhnn.exe78⤵PID:1624
-
\??\c:\hbnnnn.exec:\hbnnnn.exe79⤵PID:2756
-
\??\c:\3jddj.exec:\3jddj.exe80⤵PID:2864
-
\??\c:\jdvjv.exec:\jdvjv.exe81⤵PID:3004
-
\??\c:\llxxfxf.exec:\llxxfxf.exe82⤵PID:2836
-
\??\c:\hbbbnn.exec:\hbbbnn.exe83⤵PID:2640
-
\??\c:\htbnth.exec:\htbnth.exe84⤵PID:2768
-
\??\c:\dvjjv.exec:\dvjjv.exe85⤵PID:1700
-
\??\c:\fxfffff.exec:\fxfffff.exe86⤵PID:2992
-
\??\c:\3xfllrr.exec:\3xfllrr.exe87⤵PID:2600
-
\??\c:\hthhhh.exec:\hthhhh.exe88⤵PID:2604
-
\??\c:\jdvvj.exec:\jdvvj.exe89⤵PID:1800
-
\??\c:\ppjvj.exec:\ppjvj.exe90⤵PID:680
-
\??\c:\lflfrrl.exec:\lflfrrl.exe91⤵PID:1108
-
\??\c:\9hbtbh.exec:\9hbtbh.exe92⤵PID:2020
-
\??\c:\vjjdj.exec:\vjjdj.exe93⤵PID:2812
-
\??\c:\jvddp.exec:\jvddp.exe94⤵PID:1496
-
\??\c:\rrrrflr.exec:\rrrrflr.exe95⤵PID:2804
-
\??\c:\lfxrlrx.exec:\lfxrlrx.exe96⤵PID:3056
-
\??\c:\bthntt.exec:\bthntt.exe97⤵PID:2512
-
\??\c:\vpddj.exec:\vpddj.exe98⤵PID:1664
-
\??\c:\pdvvd.exec:\pdvvd.exe99⤵PID:2144
-
\??\c:\rrrlrxr.exec:\rrrlrxr.exe100⤵PID:2176
-
\??\c:\hhttbn.exec:\hhttbn.exe101⤵PID:2444
-
\??\c:\nhtnhh.exec:\nhtnhh.exe102⤵PID:1808
-
\??\c:\jdvdd.exec:\jdvdd.exe103⤵PID:1788
-
\??\c:\lxfflfl.exec:\lxfflfl.exe104⤵
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\3rxxffl.exec:\3rxxffl.exe105⤵PID:2292
-
\??\c:\thbttn.exec:\thbttn.exe106⤵PID:2044
-
\??\c:\hthhnn.exec:\hthhnn.exe107⤵PID:1996
-
\??\c:\9jvpv.exec:\9jvpv.exe108⤵PID:1812
-
\??\c:\xlrllfx.exec:\xlrllfx.exe109⤵PID:1312
-
\??\c:\fxlrlfr.exec:\fxlrlfr.exe110⤵PID:2268
-
\??\c:\hbhhnt.exec:\hbhhnt.exe111⤵PID:1780
-
\??\c:\jjppv.exec:\jjppv.exe112⤵PID:2688
-
\??\c:\jdvjj.exec:\jdvjj.exe113⤵PID:2988
-
\??\c:\fxffffl.exec:\fxffffl.exe114⤵PID:2692
-
\??\c:\frxxfff.exec:\frxxfff.exe115⤵PID:1500
-
\??\c:\3nnttt.exec:\3nnttt.exe116⤵PID:1680
-
\??\c:\jjpvd.exec:\jjpvd.exe117⤵PID:2372
-
\??\c:\3frlxrf.exec:\3frlxrf.exe118⤵PID:1412
-
\??\c:\xrxxllf.exec:\xrxxllf.exe119⤵PID:2524
-
\??\c:\htbthh.exec:\htbthh.exe120⤵PID:776
-
\??\c:\nhbhhb.exec:\nhbhhb.exe121⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-