Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe
-
Size
347KB
-
MD5
3279973f1dd1c020ebe9d87c9d3cb470
-
SHA1
579024560e61caad6d37b23e428ac9bfa52473f3
-
SHA256
e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157b
-
SHA512
5921788ab8b8ae4a336519cb8a92789ac7e33de0aa7f1b3a3454dcc919e25a953903cf8747a52857095429cc49bb639a5e0b32cedb71501225efcc7d5fc1c450
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAN:l7TcbWXZshJX2VGdN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1568-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2172-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2496-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2680-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2824-50-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2712-59-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1860-94-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2792-90-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1688-110-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2116-120-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2000-135-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1436-171-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2912-180-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2460-191-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2968-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/668-226-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1896-235-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1064-245-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1064-248-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1064-246-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3040-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3040-264-0x00000000002A0000-0x00000000002C8000-memory.dmp family_blackmoon behavioral1/memory/2428-277-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2428-285-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/1576-302-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2880-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2660-366-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2224-370-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2924-380-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1248-432-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2920-444-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2156-470-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3032-477-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/628-485-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/628-483-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/828-504-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/304-529-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2528-543-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2332-547-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/1508-557-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2808-592-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1908-654-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2860-663-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1532-744-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2172-831-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1244-983-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1740-1098-0x00000000002A0000-0x00000000002C8000-memory.dmp family_blackmoon behavioral1/memory/2744-1119-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1568 tntbnt.exe 2172 9jvvj.exe 2496 3hhbhb.exe 2680 lfxrxxf.exe 2824 xrffrrr.exe 2712 3ntnnh.exe 2888 pjjvj.exe 2908 xlxxllr.exe 2792 pppvp.exe 1860 vpddj.exe 2100 lxrrrxl.exe 1688 hbbbnt.exe 2116 pjvpd.exe 2000 hbtnbn.exe 1708 lfxlxxl.exe 1384 bbnbbh.exe 1616 1lflxxx.exe 1436 bbthnn.exe 2912 vjpjj.exe 2460 rrxxxxl.exe 2156 dppjj.exe 444 fxfxxff.exe 2968 bthtbh.exe 668 jdvvv.exe 1896 bnhnbt.exe 1064 vdvjv.exe 1452 hhbhbh.exe 3040 dvjpv.exe 1020 1jvvp.exe 2428 tnhnhn.exe 1508 9dvdv.exe 1576 5xrxlrf.exe 2172 dvjpv.exe 2896 lfrlrrx.exe 2320 lfxfrxf.exe 2880 nnbnbh.exe 2868 vvvjv.exe 2692 7vjjp.exe 2748 lfxxlrr.exe 2888 bthhbb.exe 2640 tnbhnh.exe 2660 jvjdd.exe 2224 frflrrx.exe 1692 frffllx.exe 2924 hbnntt.exe 2020 dvdjd.exe 2116 jvddd.exe 1864 rlxlxfl.exe 1812 1bthbn.exe 2656 3dvpv.exe 1920 ppjdj.exe 1248 1fxfrfr.exe 2960 tnbbtt.exe 2920 tnttht.exe 2944 7dppp.exe 2176 lfxxllr.exe 2396 rflllff.exe 2156 bbnhtt.exe 3032 bnbbhh.exe 628 jjpdj.exe 1528 xlrxxff.exe 668 thnnbt.exe 828 7nttbn.exe 1756 dvppv.exe -
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2172-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1568-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2172-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2496-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2680-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2824-50-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2712-59-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2792-82-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1860-94-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2792-90-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1688-110-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2116-120-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1708-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2000-135-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1616-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1436-171-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2912-172-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2912-180-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2156-192-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2460-191-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2968-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-227-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/668-226-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1896-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1064-248-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3040-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2428-277-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2880-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2692-335-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2660-366-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2224-370-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2924-380-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1920-418-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2156-470-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3032-477-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/628-483-0x00000000003A0000-0x00000000003C8000-memory.dmp upx behavioral1/memory/828-504-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/304-529-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2528-536-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2528-543-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2808-592-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2860-663-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2164-670-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1456-684-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2172-831-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2208-881-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2212-894-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2728-1099-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2744-1119-0x0000000000250000-0x0000000000278000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1568 2528 e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe 30 PID 2528 wrote to memory of 1568 2528 e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe 30 PID 2528 wrote to memory of 1568 2528 e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe 30 PID 2528 wrote to memory of 1568 2528 e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe 30 PID 1568 wrote to memory of 2172 1568 tntbnt.exe 31 PID 1568 wrote to memory of 2172 1568 tntbnt.exe 31 PID 1568 wrote to memory of 2172 1568 tntbnt.exe 31 PID 1568 wrote to memory of 2172 1568 tntbnt.exe 31 PID 2172 wrote to memory of 2496 2172 9jvvj.exe 32 PID 2172 wrote to memory of 2496 2172 9jvvj.exe 32 PID 2172 wrote to memory of 2496 2172 9jvvj.exe 32 PID 2172 wrote to memory of 2496 2172 9jvvj.exe 32 PID 2496 wrote to memory of 2680 2496 3hhbhb.exe 33 PID 2496 wrote to memory of 2680 2496 3hhbhb.exe 33 PID 2496 wrote to memory of 2680 2496 3hhbhb.exe 33 PID 2496 wrote to memory of 2680 2496 3hhbhb.exe 33 PID 2680 wrote to memory of 2824 2680 lfxrxxf.exe 34 PID 2680 wrote to memory of 2824 2680 lfxrxxf.exe 34 PID 2680 wrote to memory of 2824 2680 lfxrxxf.exe 34 PID 2680 wrote to memory of 2824 2680 lfxrxxf.exe 34 PID 2824 wrote to memory of 2712 2824 xrffrrr.exe 35 PID 2824 wrote to memory of 2712 2824 xrffrrr.exe 35 PID 2824 wrote to memory of 2712 2824 xrffrrr.exe 35 PID 2824 wrote to memory of 2712 2824 xrffrrr.exe 35 PID 2712 wrote to memory of 2888 2712 3ntnnh.exe 36 PID 2712 wrote to memory of 2888 2712 3ntnnh.exe 36 PID 2712 wrote to memory of 2888 2712 3ntnnh.exe 36 PID 2712 wrote to memory of 2888 2712 3ntnnh.exe 36 PID 2888 wrote to memory of 2908 2888 pjjvj.exe 37 PID 2888 wrote to memory of 2908 2888 pjjvj.exe 37 PID 2888 wrote to memory of 2908 2888 pjjvj.exe 37 PID 2888 wrote to memory of 2908 2888 pjjvj.exe 37 PID 2908 wrote to memory of 2792 2908 xlxxllr.exe 39 PID 2908 wrote to memory of 2792 2908 xlxxllr.exe 39 PID 2908 wrote to memory of 2792 2908 xlxxllr.exe 39 PID 2908 wrote to memory of 2792 2908 xlxxllr.exe 39 PID 2792 wrote to memory of 1860 2792 pppvp.exe 40 PID 2792 wrote to memory of 1860 2792 pppvp.exe 40 PID 2792 wrote to memory of 1860 2792 pppvp.exe 40 PID 2792 wrote to memory of 1860 2792 pppvp.exe 40 PID 1860 wrote to memory of 2100 1860 vpddj.exe 41 PID 1860 wrote to memory of 2100 1860 vpddj.exe 41 PID 1860 wrote to memory of 2100 1860 vpddj.exe 41 PID 1860 wrote to memory of 2100 1860 vpddj.exe 41 PID 2100 wrote to memory of 1688 2100 lxrrrxl.exe 42 PID 2100 wrote to memory of 1688 2100 lxrrrxl.exe 42 PID 2100 wrote to memory of 1688 2100 lxrrrxl.exe 42 PID 2100 wrote to memory of 1688 2100 lxrrrxl.exe 42 PID 1688 wrote to memory of 2116 1688 hbbbnt.exe 43 PID 1688 wrote to memory of 2116 1688 hbbbnt.exe 43 PID 1688 wrote to memory of 2116 1688 hbbbnt.exe 43 PID 1688 wrote to memory of 2116 1688 hbbbnt.exe 43 PID 2116 wrote to memory of 2000 2116 pjvpd.exe 44 PID 2116 wrote to memory of 2000 2116 pjvpd.exe 44 PID 2116 wrote to memory of 2000 2116 pjvpd.exe 44 PID 2116 wrote to memory of 2000 2116 pjvpd.exe 44 PID 2000 wrote to memory of 1708 2000 hbtnbn.exe 45 PID 2000 wrote to memory of 1708 2000 hbtnbn.exe 45 PID 2000 wrote to memory of 1708 2000 hbtnbn.exe 45 PID 2000 wrote to memory of 1708 2000 hbtnbn.exe 45 PID 1708 wrote to memory of 1384 1708 lfxlxxl.exe 46 PID 1708 wrote to memory of 1384 1708 lfxlxxl.exe 46 PID 1708 wrote to memory of 1384 1708 lfxlxxl.exe 46 PID 1708 wrote to memory of 1384 1708 lfxlxxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe"C:\Users\Admin\AppData\Local\Temp\e3a26a4f7271a31bb4e81d70fdf19057a5ad2b9be94a2335d094d8bbabc1157bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\tntbnt.exec:\tntbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\9jvvj.exec:\9jvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\3hhbhb.exec:\3hhbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xrffrrr.exec:\xrffrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\3ntnnh.exec:\3ntnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pjjvj.exec:\pjjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\xlxxllr.exec:\xlxxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pppvp.exec:\pppvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vpddj.exec:\vpddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\lxrrrxl.exec:\lxrrrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hbbbnt.exec:\hbbbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\pjvpd.exec:\pjvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hbtnbn.exec:\hbtnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\bbnbbh.exec:\bbnbbh.exe17⤵
- Executes dropped EXE
PID:1384 -
\??\c:\1lflxxx.exec:\1lflxxx.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\bbthnn.exec:\bbthnn.exe19⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vjpjj.exec:\vjpjj.exe20⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrxxxxl.exec:\rrxxxxl.exe21⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dppjj.exec:\dppjj.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxfxxff.exec:\fxfxxff.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\bthtbh.exec:\bthtbh.exe24⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jdvvv.exec:\jdvvv.exe25⤵
- Executes dropped EXE
PID:668 -
\??\c:\bnhnbt.exec:\bnhnbt.exe26⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vdvjv.exec:\vdvjv.exe27⤵
- Executes dropped EXE
PID:1064 -
\??\c:\hhbhbh.exec:\hhbhbh.exe28⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1jvvp.exec:\1jvvp.exe30⤵
- Executes dropped EXE
PID:1020 -
\??\c:\tnhnhn.exec:\tnhnhn.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9dvdv.exec:\9dvdv.exe32⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5xrxlrf.exec:\5xrxlrf.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dvjpv.exec:\dvjpv.exe34⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nnbnbh.exec:\nnbnbh.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vvvjv.exec:\vvvjv.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7vjjp.exec:\7vjjp.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfxxlrr.exec:\lfxxlrr.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bthhbb.exec:\bthhbb.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnbhnh.exec:\tnbhnh.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jvjdd.exec:\jvjdd.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\frflrrx.exec:\frflrrx.exe44⤵
- Executes dropped EXE
PID:2224 -
\??\c:\frffllx.exec:\frffllx.exe45⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbnntt.exec:\hbnntt.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvdjd.exec:\dvdjd.exe47⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jvddd.exec:\jvddd.exe48⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rlxlxfl.exec:\rlxlxfl.exe49⤵
- Executes dropped EXE
PID:1864 -
\??\c:\1bthbn.exec:\1bthbn.exe50⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3dvpv.exec:\3dvpv.exe51⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ppjdj.exec:\ppjdj.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1fxfrfr.exec:\1fxfrfr.exe53⤵
- Executes dropped EXE
PID:1248 -
\??\c:\tnbbtt.exec:\tnbbtt.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tnttht.exec:\tnttht.exe55⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7dppp.exec:\7dppp.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lfxxllr.exec:\lfxxllr.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rflllff.exec:\rflllff.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bbnhtt.exec:\bbnhtt.exe59⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bnbbhh.exec:\bnbbhh.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjpdj.exec:\jjpdj.exe61⤵
- Executes dropped EXE
PID:628 -
\??\c:\xlrxxff.exec:\xlrxxff.exe62⤵
- Executes dropped EXE
PID:1528 -
\??\c:\thnnbt.exec:\thnnbt.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\7nttbn.exec:\7nttbn.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\dvppv.exec:\dvppv.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7fxxffl.exec:\7fxxffl.exe66⤵PID:2248
-
\??\c:\5xllxxf.exec:\5xllxxf.exe67⤵PID:924
-
\??\c:\tnhbnt.exec:\tnhbnt.exe68⤵PID:304
-
\??\c:\7dpvd.exec:\7dpvd.exe69⤵PID:876
-
\??\c:\ddjdj.exec:\ddjdj.exe70⤵PID:2528
-
\??\c:\rlxfllf.exec:\rlxfllf.exe71⤵PID:2332
-
\??\c:\thntbt.exec:\thntbt.exe72⤵PID:1508
-
\??\c:\thbbnh.exec:\thbbnh.exe73⤵PID:1568
-
\??\c:\5dpvp.exec:\5dpvp.exe74⤵PID:2076
-
\??\c:\frlrrrl.exec:\frlrrrl.exe75⤵PID:2496
-
\??\c:\nnhnbh.exec:\nnhnbh.exe76⤵PID:2728
-
\??\c:\tnhhhn.exec:\tnhhhn.exe77⤵PID:2808
-
\??\c:\9dvjd.exec:\9dvjd.exe78⤵PID:2720
-
\??\c:\dvvjv.exec:\dvvjv.exe79⤵PID:2620
-
\??\c:\xffrxxr.exec:\xffrxxr.exe80⤵PID:2096
-
\??\c:\1htttt.exec:\1htttt.exe81⤵PID:2908
-
\??\c:\ppdpv.exec:\ppdpv.exe82⤵PID:1564
-
\??\c:\vvvjd.exec:\vvvjd.exe83⤵PID:2756
-
\??\c:\5lxfflr.exec:\5lxfflr.exe84⤵PID:1200
-
\??\c:\frxfrrx.exec:\frxfrrx.exe85⤵PID:2100
-
\??\c:\tbthtb.exec:\tbthtb.exe86⤵PID:2844
-
\??\c:\5vppd.exec:\5vppd.exe87⤵PID:1908
-
\??\c:\9jdvv.exec:\9jdvv.exe88⤵PID:2860
-
\??\c:\rrlflrf.exec:\rrlflrf.exe89⤵PID:2408
-
\??\c:\hhbthn.exec:\hhbthn.exe90⤵PID:2164
-
\??\c:\7pjjv.exec:\7pjjv.exe91⤵PID:2856
-
\??\c:\5pjjp.exec:\5pjjp.exe92⤵PID:1456
-
\??\c:\rrxflrf.exec:\rrxflrf.exe93⤵PID:2984
-
\??\c:\5htbbh.exec:\5htbbh.exe94⤵PID:1436
-
\??\c:\nhtbhh.exec:\nhtbhh.exe95⤵PID:2204
-
\??\c:\dvpdv.exec:\dvpdv.exe96⤵PID:2152
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe97⤵PID:2416
-
\??\c:\rrrlxfl.exec:\rrrlxfl.exe98⤵PID:1968
-
\??\c:\bnhhhh.exec:\bnhhhh.exe99⤵PID:1432
-
\??\c:\bbtthn.exec:\bbtthn.exe100⤵PID:1084
-
\??\c:\jdvpv.exec:\jdvpv.exe101⤵PID:1532
-
\??\c:\vpvvd.exec:\vpvvd.exe102⤵PID:1888
-
\??\c:\7flrxxf.exec:\7flrxxf.exe103⤵PID:1652
-
\??\c:\tthbnb.exec:\tthbnb.exe104⤵PID:1896
-
\??\c:\1btbhn.exec:\1btbhn.exe105⤵PID:2140
-
\??\c:\pdjjd.exec:\pdjjd.exe106⤵PID:1756
-
\??\c:\jjdpv.exec:\jjdpv.exe107⤵PID:2260
-
\??\c:\xxlrflf.exec:\xxlrflf.exe108⤵PID:2308
-
\??\c:\hthhtt.exec:\hthhtt.exe109⤵PID:304
-
\??\c:\bntttt.exec:\bntttt.exe110⤵PID:1040
-
\??\c:\ddvdp.exec:\ddvdp.exe111⤵PID:2544
-
\??\c:\ddpdp.exec:\ddpdp.exe112⤵PID:1484
-
\??\c:\9rfflrf.exec:\9rfflrf.exe113⤵PID:1352
-
\??\c:\1hbbht.exec:\1hbbht.exe114⤵PID:1576
-
\??\c:\nhnnbh.exec:\nhnnbh.exe115⤵PID:2172
-
\??\c:\5pvvd.exec:\5pvvd.exe116⤵PID:1392
-
\??\c:\7jvvv.exec:\7jvvv.exe117⤵PID:2320
-
\??\c:\lrffffr.exec:\lrffffr.exe118⤵PID:2880
-
\??\c:\tnhntt.exec:\tnhntt.exe119⤵PID:2824
-
\??\c:\9ntbhh.exec:\9ntbhh.exe120⤵PID:2776
-
\??\c:\jjddj.exec:\jjddj.exe121⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-