Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe
-
Size
454KB
-
MD5
76b3947c781fd3e3181d28d91f695ac4
-
SHA1
41932a1675bbce5927dc24ded2eebd8bb9df80cd
-
SHA256
b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937
-
SHA512
41da3b27e70202d02a45d367ba362e2a63bf16763b4eff10ecaa512d32fb89e6c549e286f3e511a80845aa9a3852deb791b64d98af7edb6a0e175c83251e0813
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-60-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-80-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2652-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-249-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/880-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-360-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-426-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-444-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-448-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2400-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-625-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2940-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-650-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2508-703-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2400-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-841-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3016-999-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-1006-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/648-1020-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/648-1019-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-1045-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1788 9bbnbn.exe 1708 pvpjd.exe 2780 rrlxlxr.exe 2940 fxxxllx.exe 2248 bhhtnb.exe 2456 tnnbnb.exe 3028 nnnbnb.exe 2652 hhntnh.exe 2648 ttthtb.exe 2696 rrlxrxx.exe 2828 pjdjv.exe 2560 rllrxff.exe 2556 1tbbhh.exe 564 rlflxlf.exe 1700 5ttbhh.exe 2016 9flrllr.exe 1224 ntthtn.exe 1364 5flxflf.exe 1704 nhntnh.exe 1964 hnthbh.exe 1772 hhnhbt.exe 2832 1xxrfrf.exe 2860 btnbnt.exe 536 ffxllxf.exe 940 hbbhhn.exe 1544 tbbtht.exe 1052 nnhtnn.exe 880 bbntnt.exe 320 ttnnbh.exe 2152 rrrxrxr.exe 2120 7hnhnt.exe 1508 xfxrfff.exe 2408 btbhtb.exe 388 pvpdv.exe 1612 fxfrflf.exe 2436 nhhtbh.exe 2100 hbhtbh.exe 2576 ddpdd.exe 2964 3xxfflx.exe 2944 rrlxflf.exe 2108 nhtbth.exe 2688 dddvd.exe 1760 jdjvp.exe 2624 xxrxxlx.exe 2712 3bhbbh.exe 2752 vvvjv.exe 2736 vvppd.exe 1656 xxxfrff.exe 2632 nhbnbh.exe 2828 5hhbbn.exe 2528 vvpdv.exe 2512 xfrrflf.exe 2988 3lxflxl.exe 1804 nhthnt.exe 2324 7xffrll.exe 1732 bbthth.exe 2232 hbbnbh.exe 2400 3pvjj.exe 1784 lllfrfl.exe 1968 tttbtb.exe 2548 hbbnbn.exe 1964 vdvjd.exe 2824 lfxlrxf.exe 2856 tnnbtt.exe -
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-80-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2652-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-136-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/564-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-360-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2624-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-448-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2232-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-799-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1152-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-979-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3016-999-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-1101-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1788 2244 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 28 PID 2244 wrote to memory of 1788 2244 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 28 PID 2244 wrote to memory of 1788 2244 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 28 PID 2244 wrote to memory of 1788 2244 b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe 28 PID 1788 wrote to memory of 1708 1788 9bbnbn.exe 29 PID 1788 wrote to memory of 1708 1788 9bbnbn.exe 29 PID 1788 wrote to memory of 1708 1788 9bbnbn.exe 29 PID 1788 wrote to memory of 1708 1788 9bbnbn.exe 29 PID 1708 wrote to memory of 2780 1708 pvpjd.exe 30 PID 1708 wrote to memory of 2780 1708 pvpjd.exe 30 PID 1708 wrote to memory of 2780 1708 pvpjd.exe 30 PID 1708 wrote to memory of 2780 1708 pvpjd.exe 30 PID 2780 wrote to memory of 2940 2780 rrlxlxr.exe 31 PID 2780 wrote to memory of 2940 2780 rrlxlxr.exe 31 PID 2780 wrote to memory of 2940 2780 rrlxlxr.exe 31 PID 2780 wrote to memory of 2940 2780 rrlxlxr.exe 31 PID 2940 wrote to memory of 2248 2940 fxxxllx.exe 32 PID 2940 wrote to memory of 2248 2940 fxxxllx.exe 32 PID 2940 wrote to memory of 2248 2940 fxxxllx.exe 32 PID 2940 wrote to memory of 2248 2940 fxxxllx.exe 32 PID 2248 wrote to memory of 2456 2248 bhhtnb.exe 33 PID 2248 wrote to memory of 2456 2248 bhhtnb.exe 33 PID 2248 wrote to memory of 2456 2248 bhhtnb.exe 33 PID 2248 wrote to memory of 2456 2248 bhhtnb.exe 33 PID 2456 wrote to memory of 3028 2456 tnnbnb.exe 34 PID 2456 wrote to memory of 3028 2456 tnnbnb.exe 34 PID 2456 wrote to memory of 3028 2456 tnnbnb.exe 34 PID 2456 wrote to memory of 3028 2456 tnnbnb.exe 34 PID 3028 wrote to memory of 2652 3028 nnnbnb.exe 35 PID 3028 wrote to memory of 2652 3028 nnnbnb.exe 35 PID 3028 wrote to memory of 2652 3028 nnnbnb.exe 35 PID 3028 wrote to memory of 2652 3028 nnnbnb.exe 35 PID 2652 wrote to memory of 2648 2652 hhntnh.exe 36 PID 2652 wrote to memory of 2648 2652 hhntnh.exe 36 PID 2652 wrote to memory of 2648 2652 hhntnh.exe 36 PID 2652 wrote to memory of 2648 2652 hhntnh.exe 36 PID 2648 wrote to memory of 2696 2648 ttthtb.exe 37 PID 2648 wrote to memory of 2696 2648 ttthtb.exe 37 PID 2648 wrote to memory of 2696 2648 ttthtb.exe 37 PID 2648 wrote to memory of 2696 2648 ttthtb.exe 37 PID 2696 wrote to memory of 2828 2696 rrlxrxx.exe 38 PID 2696 wrote to memory of 2828 2696 rrlxrxx.exe 38 PID 2696 wrote to memory of 2828 2696 rrlxrxx.exe 38 PID 2696 wrote to memory of 2828 2696 rrlxrxx.exe 38 PID 2828 wrote to memory of 2560 2828 pjdjv.exe 39 PID 2828 wrote to memory of 2560 2828 pjdjv.exe 39 PID 2828 wrote to memory of 2560 2828 pjdjv.exe 39 PID 2828 wrote to memory of 2560 2828 pjdjv.exe 39 PID 2560 wrote to memory of 2556 2560 rllrxff.exe 40 PID 2560 wrote to memory of 2556 2560 rllrxff.exe 40 PID 2560 wrote to memory of 2556 2560 rllrxff.exe 40 PID 2560 wrote to memory of 2556 2560 rllrxff.exe 40 PID 2556 wrote to memory of 564 2556 1tbbhh.exe 41 PID 2556 wrote to memory of 564 2556 1tbbhh.exe 41 PID 2556 wrote to memory of 564 2556 1tbbhh.exe 41 PID 2556 wrote to memory of 564 2556 1tbbhh.exe 41 PID 564 wrote to memory of 1700 564 rlflxlf.exe 42 PID 564 wrote to memory of 1700 564 rlflxlf.exe 42 PID 564 wrote to memory of 1700 564 rlflxlf.exe 42 PID 564 wrote to memory of 1700 564 rlflxlf.exe 42 PID 1700 wrote to memory of 2016 1700 5ttbhh.exe 43 PID 1700 wrote to memory of 2016 1700 5ttbhh.exe 43 PID 1700 wrote to memory of 2016 1700 5ttbhh.exe 43 PID 1700 wrote to memory of 2016 1700 5ttbhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe"C:\Users\Admin\AppData\Local\Temp\b733597448e76221d528822d03274a483985ee17b09965a0f8a6dc1a981ad937.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\9bbnbn.exec:\9bbnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pvpjd.exec:\pvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\rrlxlxr.exec:\rrlxlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\fxxxllx.exec:\fxxxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\bhhtnb.exec:\bhhtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\tnnbnb.exec:\tnnbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\nnnbnb.exec:\nnnbnb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\hhntnh.exec:\hhntnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ttthtb.exec:\ttthtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rrlxrxx.exec:\rrlxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjdjv.exec:\pjdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rllrxff.exec:\rllrxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1tbbhh.exec:\1tbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rlflxlf.exec:\rlflxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\5ttbhh.exec:\5ttbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\9flrllr.exec:\9flrllr.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ntthtn.exec:\ntthtn.exe18⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5flxflf.exec:\5flxflf.exe19⤵
- Executes dropped EXE
PID:1364 -
\??\c:\nhntnh.exec:\nhntnh.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hnthbh.exec:\hnthbh.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hhnhbt.exec:\hhnhbt.exe22⤵
- Executes dropped EXE
PID:1772 -
\??\c:\1xxrfrf.exec:\1xxrfrf.exe23⤵
- Executes dropped EXE
PID:2832 -
\??\c:\btnbnt.exec:\btnbnt.exe24⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ffxllxf.exec:\ffxllxf.exe25⤵
- Executes dropped EXE
PID:536 -
\??\c:\hbbhhn.exec:\hbbhhn.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\tbbtht.exec:\tbbtht.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nnhtnn.exec:\nnhtnn.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bbntnt.exec:\bbntnt.exe29⤵
- Executes dropped EXE
PID:880 -
\??\c:\ttnnbh.exec:\ttnnbh.exe30⤵
- Executes dropped EXE
PID:320 -
\??\c:\rrrxrxr.exec:\rrrxrxr.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7hnhnt.exec:\7hnhnt.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xfxrfff.exec:\xfxrfff.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\btbhtb.exec:\btbhtb.exe34⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pvpdv.exec:\pvpdv.exe35⤵
- Executes dropped EXE
PID:388 -
\??\c:\fxfrflf.exec:\fxfrflf.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nhhtbh.exec:\nhhtbh.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbhtbh.exec:\hbhtbh.exe38⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ddpdd.exec:\ddpdd.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3xxfflx.exec:\3xxfflx.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rrlxflf.exec:\rrlxflf.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhtbth.exec:\nhtbth.exe42⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dddvd.exec:\dddvd.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdjvp.exec:\jdjvp.exe44⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xxrxxlx.exec:\xxrxxlx.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3bhbbh.exec:\3bhbbh.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vvvjv.exec:\vvvjv.exe47⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vvppd.exec:\vvppd.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xxxfrff.exec:\xxxfrff.exe49⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhbnbh.exec:\nhbnbh.exe50⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5hhbbn.exec:\5hhbbn.exe51⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vvpdv.exec:\vvpdv.exe52⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xfrrflf.exec:\xfrrflf.exe53⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3lxflxl.exec:\3lxflxl.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nhthnt.exec:\nhthnt.exe55⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7xffrll.exec:\7xffrll.exe56⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bbthth.exec:\bbthth.exe57⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbbnbh.exec:\hbbnbh.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\3pvjj.exec:\3pvjj.exe59⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lllfrfl.exec:\lllfrfl.exe60⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tttbtb.exec:\tttbtb.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hbbnbn.exec:\hbbnbn.exe62⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vdvjd.exec:\vdvjd.exe63⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lfxlrxf.exec:\lfxlrxf.exe64⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tnnbtt.exec:\tnnbtt.exe65⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jpvdv.exec:\jpvdv.exe66⤵PID:1740
-
\??\c:\lxxrflf.exec:\lxxrflf.exe67⤵PID:2808
-
\??\c:\5lxflrx.exec:\5lxflrx.exe68⤵PID:1872
-
\??\c:\nhbhnt.exec:\nhbhnt.exe69⤵PID:816
-
\??\c:\jpppp.exec:\jpppp.exe70⤵PID:1516
-
\??\c:\pppvp.exec:\pppvp.exe71⤵PID:1152
-
\??\c:\xxxlrlr.exec:\xxxlrlr.exe72⤵PID:1288
-
\??\c:\nhbbbb.exec:\nhbbbb.exe73⤵PID:2168
-
\??\c:\ppjvp.exec:\ppjvp.exe74⤵PID:2348
-
\??\c:\1rrfxfx.exec:\1rrfxfx.exe75⤵PID:568
-
\??\c:\fxxxrfr.exec:\fxxxrfr.exe76⤵PID:1640
-
\??\c:\btntbb.exec:\btntbb.exe77⤵PID:1752
-
\??\c:\5jddj.exec:\5jddj.exe78⤵PID:2204
-
\??\c:\vjjjp.exec:\vjjjp.exe79⤵PID:2412
-
\??\c:\9lflxfr.exec:\9lflxfr.exe80⤵PID:2408
-
\??\c:\hbntbt.exec:\hbntbt.exe81⤵PID:2076
-
\??\c:\bhbntb.exec:\bhbntb.exe82⤵PID:2128
-
\??\c:\vpvjd.exec:\vpvjd.exe83⤵PID:2296
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe84⤵PID:2948
-
\??\c:\9bbttt.exec:\9bbttt.exe85⤵PID:3032
-
\??\c:\pvvvj.exec:\pvvvj.exe86⤵PID:2940
-
\??\c:\rrrfrff.exec:\rrrfrff.exe87⤵PID:2880
-
\??\c:\tntbtb.exec:\tntbtb.exe88⤵PID:2688
-
\??\c:\7pddd.exec:\7pddd.exe89⤵PID:1760
-
\??\c:\dvdjp.exec:\dvdjp.exe90⤵PID:2644
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe91⤵PID:2600
-
\??\c:\9nhnbn.exec:\9nhnbn.exe92⤵PID:2764
-
\??\c:\7ttbnt.exec:\7ttbnt.exe93⤵PID:2696
-
\??\c:\vpddp.exec:\vpddp.exe94⤵PID:2896
-
\??\c:\rrrflrx.exec:\rrrflrx.exe95⤵PID:2508
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe96⤵PID:2560
-
\??\c:\btbbnn.exec:\btbbnn.exe97⤵PID:2608
-
\??\c:\pvjpp.exec:\pvjpp.exe98⤵PID:1820
-
\??\c:\rllxlrf.exec:\rllxlrf.exe99⤵PID:648
-
\??\c:\lfxflrl.exec:\lfxflrl.exe100⤵PID:2020
-
\??\c:\nntbbn.exec:\nntbbn.exe101⤵PID:1276
-
\??\c:\3pjpp.exec:\3pjpp.exe102⤵PID:2016
-
\??\c:\5pjjp.exec:\5pjjp.exe103⤵PID:1528
-
\??\c:\fflrlrr.exec:\fflrlrr.exe104⤵PID:1632
-
\??\c:\nnhtbn.exec:\nnhtbn.exe105⤵PID:2400
-
\??\c:\ppddp.exec:\ppddp.exe106⤵PID:684
-
\??\c:\pvdjp.exec:\pvdjp.exe107⤵PID:1968
-
\??\c:\9lflrfr.exec:\9lflrfr.exe108⤵PID:1948
-
\??\c:\hhtbht.exec:\hhtbht.exe109⤵PID:1964
-
\??\c:\bhnbhn.exec:\bhnbhn.exe110⤵PID:1292
-
\??\c:\vpjjp.exec:\vpjjp.exe111⤵PID:2856
-
\??\c:\rfflrxl.exec:\rfflrxl.exe112⤵PID:2876
-
\??\c:\hntnht.exec:\hntnht.exe113⤵PID:1664
-
\??\c:\dpjvj.exec:\dpjvj.exe114⤵PID:1872
-
\??\c:\9lllrxl.exec:\9lllrxl.exe115⤵PID:1556
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe116⤵PID:1516
-
\??\c:\tttnhn.exec:\tttnhn.exe117⤵PID:1152
-
\??\c:\9bttbn.exec:\9bttbn.exe118⤵PID:1288
-
\??\c:\vvjvd.exec:\vvjvd.exe119⤵PID:2168
-
\??\c:\rrlxfrf.exec:\rrlxfrf.exe120⤵PID:1648
-
\??\c:\hnnbtn.exec:\hnnbtn.exe121⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-