Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe
-
Size
454KB
-
MD5
61a8293543a51a05efa89493181f5dcd
-
SHA1
27684c669666b7065ed8f179c331466c03eb2b69
-
SHA256
66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892
-
SHA512
c82fbc85ea70256926a5f14a2d73b6d2483c5341721c34a45a78e85b425f6db5ff350064b77703944e393e7c4df10010786361caa81314da5441dce0078683a7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1y:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-93-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2716-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-135-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1148-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-193-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1640-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-298-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2240-302-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2240-301-0x0000000076FD0000-0x00000000770CA000-memory.dmp family_blackmoon behavioral1/memory/2376-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-352-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2164-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-386-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-414-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1056-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-571-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1988-607-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2824-626-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2528-660-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2608-668-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-741-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/572-818-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2112 9flflfl.exe 1232 tntttn.exe 2932 9jvdd.exe 2128 fxllfff.exe 1956 hnbtbt.exe 3036 jdvvv.exe 2700 7bbbbt.exe 2636 jpvpp.exe 2652 lflflll.exe 2532 bnhttn.exe 2716 jpvvv.exe 2568 thhhhb.exe 2924 9hnhtn.exe 1148 3ffxrll.exe 2316 3nhbht.exe 296 5fllflr.exe 1632 nhttbt.exe 328 hnbbtb.exe 624 jvjdv.exe 1764 bnbhnn.exe 1692 3pddd.exe 1292 tntnbb.exe 1640 vjddp.exe 1848 rxrrflx.exe 1144 pjvdd.exe 872 jdjdv.exe 1772 rxfxffl.exe 1344 rrfxlfx.exe 2160 1thnhh.exe 2204 7rrrrlx.exe 2240 5xxxllr.exe 1576 vpjjd.exe 2948 tnnnhb.exe 1328 3hnttt.exe 2376 5dpjj.exe 2824 rlrrxxf.exe 1952 bthntn.exe 2692 5nbhhb.exe 2584 pdvjp.exe 2500 7lrffxx.exe 2164 hhnttn.exe 2768 5tbtbh.exe 2744 jvdvv.exe 2508 fxlllll.exe 2540 rlflrrx.exe 2912 htnntt.exe 2524 1dpdp.exe 2180 rfrrxxf.exe 856 xrflxxf.exe 2300 nbhhnh.exe 1056 ddppv.exe 1284 xrfflfl.exe 2280 ffxflrr.exe 1632 tnhhnn.exe 1436 vpvpp.exe 1500 vvjdd.exe 2720 xxrllll.exe 2816 thnttb.exe 2256 7htbbt.exe 3068 dvppp.exe 1124 7frxxxx.exe 2804 rfxxxxf.exe 1132 bthnnt.exe 804 1djdd.exe -
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-298-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2376-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-701-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1716-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-741-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2324-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-799-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2112 2868 66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe 28 PID 2868 wrote to memory of 2112 2868 66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe 28 PID 2868 wrote to memory of 2112 2868 66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe 28 PID 2868 wrote to memory of 2112 2868 66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe 28 PID 2112 wrote to memory of 1232 2112 9flflfl.exe 29 PID 2112 wrote to memory of 1232 2112 9flflfl.exe 29 PID 2112 wrote to memory of 1232 2112 9flflfl.exe 29 PID 2112 wrote to memory of 1232 2112 9flflfl.exe 29 PID 1232 wrote to memory of 2932 1232 tntttn.exe 30 PID 1232 wrote to memory of 2932 1232 tntttn.exe 30 PID 1232 wrote to memory of 2932 1232 tntttn.exe 30 PID 1232 wrote to memory of 2932 1232 tntttn.exe 30 PID 2932 wrote to memory of 2128 2932 9jvdd.exe 31 PID 2932 wrote to memory of 2128 2932 9jvdd.exe 31 PID 2932 wrote to memory of 2128 2932 9jvdd.exe 31 PID 2932 wrote to memory of 2128 2932 9jvdd.exe 31 PID 2128 wrote to memory of 1956 2128 fxllfff.exe 32 PID 2128 wrote to memory of 1956 2128 fxllfff.exe 32 PID 2128 wrote to memory of 1956 2128 fxllfff.exe 32 PID 2128 wrote to memory of 1956 2128 fxllfff.exe 32 PID 1956 wrote to memory of 3036 1956 hnbtbt.exe 33 PID 1956 wrote to memory of 3036 1956 hnbtbt.exe 33 PID 1956 wrote to memory of 3036 1956 hnbtbt.exe 33 PID 1956 wrote to memory of 3036 1956 hnbtbt.exe 33 PID 3036 wrote to memory of 2700 3036 jdvvv.exe 34 PID 3036 wrote to memory of 2700 3036 jdvvv.exe 34 PID 3036 wrote to memory of 2700 3036 jdvvv.exe 34 PID 3036 wrote to memory of 2700 3036 jdvvv.exe 34 PID 2700 wrote to memory of 2636 2700 7bbbbt.exe 35 PID 2700 wrote to memory of 2636 2700 7bbbbt.exe 35 PID 2700 wrote to memory of 2636 2700 7bbbbt.exe 35 PID 2700 wrote to memory of 2636 2700 7bbbbt.exe 35 PID 2636 wrote to memory of 2652 2636 jpvpp.exe 36 PID 2636 wrote to memory of 2652 2636 jpvpp.exe 36 PID 2636 wrote to memory of 2652 2636 jpvpp.exe 36 PID 2636 wrote to memory of 2652 2636 jpvpp.exe 36 PID 2652 wrote to memory of 2532 2652 lflflll.exe 37 PID 2652 wrote to memory of 2532 2652 lflflll.exe 37 PID 2652 wrote to memory of 2532 2652 lflflll.exe 37 PID 2652 wrote to memory of 2532 2652 lflflll.exe 37 PID 2532 wrote to memory of 2716 2532 bnhttn.exe 38 PID 2532 wrote to memory of 2716 2532 bnhttn.exe 38 PID 2532 wrote to memory of 2716 2532 bnhttn.exe 38 PID 2532 wrote to memory of 2716 2532 bnhttn.exe 38 PID 2716 wrote to memory of 2568 2716 jpvvv.exe 39 PID 2716 wrote to memory of 2568 2716 jpvvv.exe 39 PID 2716 wrote to memory of 2568 2716 jpvvv.exe 39 PID 2716 wrote to memory of 2568 2716 jpvvv.exe 39 PID 2568 wrote to memory of 2924 2568 thhhhb.exe 40 PID 2568 wrote to memory of 2924 2568 thhhhb.exe 40 PID 2568 wrote to memory of 2924 2568 thhhhb.exe 40 PID 2568 wrote to memory of 2924 2568 thhhhb.exe 40 PID 2924 wrote to memory of 1148 2924 9hnhtn.exe 41 PID 2924 wrote to memory of 1148 2924 9hnhtn.exe 41 PID 2924 wrote to memory of 1148 2924 9hnhtn.exe 41 PID 2924 wrote to memory of 1148 2924 9hnhtn.exe 41 PID 1148 wrote to memory of 2316 1148 3ffxrll.exe 42 PID 1148 wrote to memory of 2316 1148 3ffxrll.exe 42 PID 1148 wrote to memory of 2316 1148 3ffxrll.exe 42 PID 1148 wrote to memory of 2316 1148 3ffxrll.exe 42 PID 2316 wrote to memory of 296 2316 3nhbht.exe 43 PID 2316 wrote to memory of 296 2316 3nhbht.exe 43 PID 2316 wrote to memory of 296 2316 3nhbht.exe 43 PID 2316 wrote to memory of 296 2316 3nhbht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe"C:\Users\Admin\AppData\Local\Temp\66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\9flflfl.exec:\9flflfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tntttn.exec:\tntttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\9jvdd.exec:\9jvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fxllfff.exec:\fxllfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hnbtbt.exec:\hnbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\jdvvv.exec:\jdvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7bbbbt.exec:\7bbbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jpvpp.exec:\jpvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lflflll.exec:\lflflll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\bnhttn.exec:\bnhttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jpvvv.exec:\jpvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\thhhhb.exec:\thhhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9hnhtn.exec:\9hnhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\3ffxrll.exec:\3ffxrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\3nhbht.exec:\3nhbht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\5fllflr.exec:\5fllflr.exe17⤵
- Executes dropped EXE
PID:296 -
\??\c:\nhttbt.exec:\nhttbt.exe18⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hnbbtb.exec:\hnbbtb.exe19⤵
- Executes dropped EXE
PID:328 -
\??\c:\jvjdv.exec:\jvjdv.exe20⤵
- Executes dropped EXE
PID:624 -
\??\c:\bnbhnn.exec:\bnbhnn.exe21⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3pddd.exec:\3pddd.exe22⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tntnbb.exec:\tntnbb.exe23⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vjddp.exec:\vjddp.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rxrrflx.exec:\rxrrflx.exe25⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pjvdd.exec:\pjvdd.exe26⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jdjdv.exec:\jdjdv.exe27⤵
- Executes dropped EXE
PID:872 -
\??\c:\rxfxffl.exec:\rxfxffl.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rrfxlfx.exec:\rrfxlfx.exe29⤵
- Executes dropped EXE
PID:1344 -
\??\c:\1thnhh.exec:\1thnhh.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7rrrrlx.exec:\7rrrrlx.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\5xxxllr.exec:\5xxxllr.exe32⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btnnbb.exec:\btnnbb.exe33⤵PID:2368
-
\??\c:\vpjjd.exec:\vpjjd.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\tnnnhb.exec:\tnnnhb.exe35⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3hnttt.exec:\3hnttt.exe36⤵
- Executes dropped EXE
PID:1328 -
\??\c:\5dpjj.exec:\5dpjj.exe37⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bthntn.exec:\bthntn.exe39⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5nbhhb.exec:\5nbhhb.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pdvjp.exec:\pdvjp.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7lrffxx.exec:\7lrffxx.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hhnttn.exec:\hhnttn.exe43⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5tbtbh.exec:\5tbtbh.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvdvv.exec:\jvdvv.exe45⤵
- Executes dropped EXE
PID:2744 -
\??\c:\fxlllll.exec:\fxlllll.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rlflrrx.exec:\rlflrrx.exe47⤵
- Executes dropped EXE
PID:2540 -
\??\c:\htnntt.exec:\htnntt.exe48⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1dpdp.exec:\1dpdp.exe49⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xrflxxf.exec:\xrflxxf.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\nbhhnh.exec:\nbhhnh.exe52⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ddppv.exec:\ddppv.exe53⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xrfflfl.exec:\xrfflfl.exe54⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ffxflrr.exec:\ffxflrr.exe55⤵
- Executes dropped EXE
PID:2280 -
\??\c:\tnhhnn.exec:\tnhhnn.exe56⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vpvpp.exec:\vpvpp.exe57⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vvjdd.exec:\vvjdd.exe58⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xxrllll.exec:\xxrllll.exe59⤵
- Executes dropped EXE
PID:2720 -
\??\c:\thnttb.exec:\thnttb.exe60⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7htbbt.exec:\7htbbt.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dvppp.exec:\dvppp.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\7frxxxx.exec:\7frxxxx.exe63⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rfxxxxf.exec:\rfxxxxf.exe64⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bthnnt.exec:\bthnnt.exe65⤵
- Executes dropped EXE
PID:1132 -
\??\c:\1djdd.exec:\1djdd.exe66⤵
- Executes dropped EXE
PID:804 -
\??\c:\5rxxrfl.exec:\5rxxrfl.exe67⤵PID:340
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe68⤵PID:1896
-
\??\c:\1ntnhh.exec:\1ntnhh.exe69⤵PID:872
-
\??\c:\tnbttn.exec:\tnbttn.exe70⤵PID:2060
-
\??\c:\jvdvp.exec:\jvdvp.exe71⤵PID:2184
-
\??\c:\lfllrrr.exec:\lfllrrr.exe72⤵PID:2068
-
\??\c:\rfrrrlx.exec:\rfrrrlx.exe73⤵PID:2340
-
\??\c:\bhnbbt.exec:\bhnbbt.exe74⤵PID:2204
-
\??\c:\7djjj.exec:\7djjj.exe75⤵PID:2240
-
\??\c:\dpdvv.exec:\dpdvv.exe76⤵PID:1600
-
\??\c:\lxlffxx.exec:\lxlffxx.exe77⤵PID:2936
-
\??\c:\5rxlfxr.exec:\5rxlfxr.exe78⤵PID:1288
-
\??\c:\bhtnnn.exec:\bhtnnn.exe79⤵PID:1988
-
\??\c:\jpvjj.exec:\jpvjj.exe80⤵PID:2896
-
\??\c:\dvjdv.exec:\dvjdv.exe81⤵PID:1700
-
\??\c:\7rlffxx.exec:\7rlffxx.exe82⤵PID:2824
-
\??\c:\9hbbbt.exec:\9hbbbt.exe83⤵PID:2704
-
\??\c:\jdppv.exec:\jdppv.exe84⤵PID:2692
-
\??\c:\9vjjd.exec:\9vjjd.exe85⤵PID:3004
-
\??\c:\1lxrffx.exec:\1lxrffx.exe86⤵PID:2836
-
\??\c:\htbnhb.exec:\htbnhb.exe87⤵PID:2528
-
\??\c:\hthhnn.exec:\hthhnn.exe88⤵PID:2608
-
\??\c:\pjvdp.exec:\pjvdp.exe89⤵PID:2660
-
\??\c:\xlrlffx.exec:\xlrlffx.exe90⤵PID:2508
-
\??\c:\3rlxrlr.exec:\3rlxrlr.exe91⤵PID:2516
-
\??\c:\7htbbb.exec:\7htbbb.exe92⤵PID:2432
-
\??\c:\vpddj.exec:\vpddj.exe93⤵PID:2524
-
\??\c:\7ffrrlf.exec:\7ffrrlf.exe94⤵PID:1036
-
\??\c:\9ntnnh.exec:\9ntnnh.exe95⤵PID:2272
-
\??\c:\3jppd.exec:\3jppd.exe96⤵PID:2316
-
\??\c:\dvdvv.exec:\dvdvv.exe97⤵PID:1716
-
\??\c:\5lxxxrx.exec:\5lxxxrx.exe98⤵PID:1440
-
\??\c:\llxflff.exec:\llxflff.exe99⤵PID:2056
-
\??\c:\nbnnnb.exec:\nbnnnb.exe100⤵PID:2324
-
\??\c:\jjjdd.exec:\jjjdd.exe101⤵PID:328
-
\??\c:\7jjdv.exec:\7jjdv.exe102⤵PID:1500
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe103⤵PID:2720
-
\??\c:\ntbttn.exec:\ntbttn.exe104⤵PID:2816
-
\??\c:\nhnhhb.exec:\nhnhhb.exe105⤵PID:2256
-
\??\c:\pvdvp.exec:\pvdvp.exe106⤵PID:3068
-
\??\c:\5dddv.exec:\5dddv.exe107⤵PID:2552
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe108⤵PID:1532
-
\??\c:\btbbbt.exec:\btbbbt.exe109⤵PID:264
-
\??\c:\bnbttn.exec:\bnbttn.exe110⤵PID:1916
-
\??\c:\pdjjj.exec:\pdjjj.exe111⤵PID:572
-
\??\c:\5lllxxx.exec:\5lllxxx.exe112⤵PID:2992
-
\??\c:\tbhhnt.exec:\tbhhnt.exe113⤵PID:2076
-
\??\c:\btnhnh.exec:\btnhnh.exe114⤵PID:2172
-
\??\c:\pdvvd.exec:\pdvvd.exe115⤵PID:880
-
\??\c:\3pdvp.exec:\3pdvp.exe116⤵PID:2452
-
\??\c:\xfllfxx.exec:\xfllfxx.exe117⤵PID:2004
-
\??\c:\9tnnhb.exec:\9tnnhb.exe118⤵PID:2368
-
\??\c:\1nhnbb.exec:\1nhnbb.exe119⤵PID:2360
-
\??\c:\pdppd.exec:\pdppd.exe120⤵PID:1596
-
\??\c:\jvdpv.exec:\jvdpv.exe121⤵PID:1052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-