Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe
-
Size
456KB
-
MD5
66f1d18cd128bc781cb8bde229c49a21
-
SHA1
cd576678b6b6519f3cde161b13ea09696b464b61
-
SHA256
36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070
-
SHA512
5f667dc56ce9722866a7fecbb7b8d80728d62a63cd8de721045468e6d60f33c487b728eabceaf321873013c423fc39041e9ab8200f8e843cf72abc8016f6d7d7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRz:q7Tc2NYHUrAwfMp3CDRz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2380-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-28-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-78-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-88-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2708-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-147-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2900-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-722-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2672-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-376-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2580-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-368-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2372-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-217-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1724-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-180-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1524-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1876-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-106-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-917-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-919-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-932-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2656-944-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1524-959-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-973-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/324-972-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-1022-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-1122-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2380 vvpdd.exe 2228 nhttnh.exe 2392 3htntb.exe 2216 jdvvv.exe 604 7thnht.exe 2824 httthh.exe 2540 lxlflfl.exe 2840 rxlfxrl.exe 2708 thtbnh.exe 2544 vjvpv.exe 3012 9lllrxf.exe 2036 nbtbhh.exe 1876 7tbtnn.exe 1324 9jvpv.exe 2364 5llffxr.exe 1676 3thhhb.exe 1524 jpvdv.exe 1932 7rrrffl.exe 2276 tthhbb.exe 2744 ddvdp.exe 1724 rfxfrxr.exe 2136 htntbb.exe 408 rxxxrfr.exe 568 xlffllx.exe 1788 jdvdv.exe 2764 3pddd.exe 332 rfrrxrf.exe 2108 dvvvd.exe 1000 dpddd.exe 1884 1xrrfxl.exe 2372 9thhhn.exe 2412 jddjj.exe 2332 lxlllll.exe 1856 1lxxfxx.exe 3032 thnnbb.exe 2856 thntbb.exe 2092 jvjjp.exe 2692 frfxlxf.exe 2828 1frxxxx.exe 2900 9btntb.exe 2668 thnntt.exe 2580 jvjdj.exe 2708 5vpvd.exe 2568 xlxxllx.exe 2584 tnhhhb.exe 3012 9hbbhh.exe 2036 1vpvp.exe 2368 lffrxfx.exe 3040 rlflllr.exe 2340 btbbnn.exe 2452 tnttbb.exe 1676 jdpvd.exe 2492 9vjjd.exe 860 frrrxrx.exe 1604 7frrxfl.exe 2736 nhbhhn.exe 2744 thnttt.exe 1012 pjvvv.exe 1740 3vjpj.exe 2908 lrrxlrl.exe 1268 5lxrxxl.exe 844 tnhnnn.exe 2428 3djjd.exe 2876 dpvdj.exe -
resource yara_rule behavioral1/memory/2380-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-917-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1524-959-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-972-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2248-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-1090-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2380 3044 36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe 30 PID 3044 wrote to memory of 2380 3044 36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe 30 PID 3044 wrote to memory of 2380 3044 36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe 30 PID 3044 wrote to memory of 2380 3044 36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe 30 PID 2380 wrote to memory of 2228 2380 vvpdd.exe 31 PID 2380 wrote to memory of 2228 2380 vvpdd.exe 31 PID 2380 wrote to memory of 2228 2380 vvpdd.exe 31 PID 2380 wrote to memory of 2228 2380 vvpdd.exe 31 PID 2228 wrote to memory of 2392 2228 nhttnh.exe 103 PID 2228 wrote to memory of 2392 2228 nhttnh.exe 103 PID 2228 wrote to memory of 2392 2228 nhttnh.exe 103 PID 2228 wrote to memory of 2392 2228 nhttnh.exe 103 PID 2392 wrote to memory of 2216 2392 3htntb.exe 105 PID 2392 wrote to memory of 2216 2392 3htntb.exe 105 PID 2392 wrote to memory of 2216 2392 3htntb.exe 105 PID 2392 wrote to memory of 2216 2392 3htntb.exe 105 PID 2216 wrote to memory of 604 2216 jdvvv.exe 34 PID 2216 wrote to memory of 604 2216 jdvvv.exe 34 PID 2216 wrote to memory of 604 2216 jdvvv.exe 34 PID 2216 wrote to memory of 604 2216 jdvvv.exe 34 PID 604 wrote to memory of 2824 604 7thnht.exe 35 PID 604 wrote to memory of 2824 604 7thnht.exe 35 PID 604 wrote to memory of 2824 604 7thnht.exe 35 PID 604 wrote to memory of 2824 604 7thnht.exe 35 PID 2824 wrote to memory of 2540 2824 httthh.exe 36 PID 2824 wrote to memory of 2540 2824 httthh.exe 36 PID 2824 wrote to memory of 2540 2824 httthh.exe 36 PID 2824 wrote to memory of 2540 2824 httthh.exe 36 PID 2540 wrote to memory of 2840 2540 lxlflfl.exe 37 PID 2540 wrote to memory of 2840 2540 lxlflfl.exe 37 PID 2540 wrote to memory of 2840 2540 lxlflfl.exe 37 PID 2540 wrote to memory of 2840 2540 lxlflfl.exe 37 PID 2840 wrote to memory of 2708 2840 rxlfxrl.exe 72 PID 2840 wrote to memory of 2708 2840 rxlfxrl.exe 72 PID 2840 wrote to memory of 2708 2840 rxlfxrl.exe 72 PID 2840 wrote to memory of 2708 2840 rxlfxrl.exe 72 PID 2708 wrote to memory of 2544 2708 thtbnh.exe 39 PID 2708 wrote to memory of 2544 2708 thtbnh.exe 39 PID 2708 wrote to memory of 2544 2708 thtbnh.exe 39 PID 2708 wrote to memory of 2544 2708 thtbnh.exe 39 PID 2544 wrote to memory of 3012 2544 vjvpv.exe 40 PID 2544 wrote to memory of 3012 2544 vjvpv.exe 40 PID 2544 wrote to memory of 3012 2544 vjvpv.exe 40 PID 2544 wrote to memory of 3012 2544 vjvpv.exe 40 PID 3012 wrote to memory of 2036 3012 9lllrxf.exe 76 PID 3012 wrote to memory of 2036 3012 9lllrxf.exe 76 PID 3012 wrote to memory of 2036 3012 9lllrxf.exe 76 PID 3012 wrote to memory of 2036 3012 9lllrxf.exe 76 PID 2036 wrote to memory of 1876 2036 nbtbhh.exe 42 PID 2036 wrote to memory of 1876 2036 nbtbhh.exe 42 PID 2036 wrote to memory of 1876 2036 nbtbhh.exe 42 PID 2036 wrote to memory of 1876 2036 nbtbhh.exe 42 PID 1876 wrote to memory of 1324 1876 7tbtnn.exe 43 PID 1876 wrote to memory of 1324 1876 7tbtnn.exe 43 PID 1876 wrote to memory of 1324 1876 7tbtnn.exe 43 PID 1876 wrote to memory of 1324 1876 7tbtnn.exe 43 PID 1324 wrote to memory of 2364 1324 9jvpv.exe 44 PID 1324 wrote to memory of 2364 1324 9jvpv.exe 44 PID 1324 wrote to memory of 2364 1324 9jvpv.exe 44 PID 1324 wrote to memory of 2364 1324 9jvpv.exe 44 PID 2364 wrote to memory of 1676 2364 5llffxr.exe 81 PID 2364 wrote to memory of 1676 2364 5llffxr.exe 81 PID 2364 wrote to memory of 1676 2364 5llffxr.exe 81 PID 2364 wrote to memory of 1676 2364 5llffxr.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe"C:\Users\Admin\AppData\Local\Temp\36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vvpdd.exec:\vvpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nhttnh.exec:\nhttnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\3htntb.exec:\3htntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\jdvvv.exec:\jdvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\7thnht.exec:\7thnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\httthh.exec:\httthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lxlflfl.exec:\lxlflfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\thtbnh.exec:\thtbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\vjvpv.exec:\vjvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\9lllrxf.exec:\9lllrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\nbtbhh.exec:\nbtbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\7tbtnn.exec:\7tbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\9jvpv.exec:\9jvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\5llffxr.exec:\5llffxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\3thhhb.exec:\3thhhb.exe17⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jpvdv.exec:\jpvdv.exe18⤵
- Executes dropped EXE
PID:1524 -
\??\c:\7rrrffl.exec:\7rrrffl.exe19⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tthhbb.exec:\tthhbb.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ddvdp.exec:\ddvdp.exe21⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rfxfrxr.exec:\rfxfrxr.exe22⤵
- Executes dropped EXE
PID:1724 -
\??\c:\htntbb.exec:\htntbb.exe23⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rxxxrfr.exec:\rxxxrfr.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\xlffllx.exec:\xlffllx.exe25⤵
- Executes dropped EXE
PID:568 -
\??\c:\jdvdv.exec:\jdvdv.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3pddd.exec:\3pddd.exe27⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe28⤵
- Executes dropped EXE
PID:332 -
\??\c:\dvvvd.exec:\dvvvd.exe29⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dpddd.exec:\dpddd.exe30⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1xrrfxl.exec:\1xrrfxl.exe31⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9thhhn.exec:\9thhhn.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jddjj.exec:\jddjj.exe33⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lxlllll.exec:\lxlllll.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1lxxfxx.exec:\1lxxfxx.exe35⤵
- Executes dropped EXE
PID:1856 -
\??\c:\thnnbb.exec:\thnnbb.exe36⤵
- Executes dropped EXE
PID:3032 -
\??\c:\thntbb.exec:\thntbb.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jvjjp.exec:\jvjjp.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\frfxlxf.exec:\frfxlxf.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1frxxxx.exec:\1frxxxx.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9btntb.exec:\9btntb.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\thnntt.exec:\thnntt.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jvjdj.exec:\jvjdj.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5vpvd.exec:\5vpvd.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xlxxllx.exec:\xlxxllx.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tnhhhb.exec:\tnhhhb.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9hbbhh.exec:\9hbbhh.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1vpvp.exec:\1vpvp.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lffrxfx.exec:\lffrxfx.exe49⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rlflllr.exec:\rlflllr.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\btbbnn.exec:\btbbnn.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tnttbb.exec:\tnttbb.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jdpvd.exec:\jdpvd.exe53⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9vjjd.exec:\9vjjd.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\frrrxrx.exec:\frrrxrx.exe55⤵
- Executes dropped EXE
PID:860 -
\??\c:\7frrxfl.exec:\7frrxfl.exe56⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nhbhhn.exec:\nhbhhn.exe57⤵
- Executes dropped EXE
PID:2736 -
\??\c:\thnttt.exec:\thnttt.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pjvvv.exec:\pjvvv.exe59⤵
- Executes dropped EXE
PID:1012 -
\??\c:\3vjpj.exec:\3vjpj.exe60⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lrrxlrl.exec:\lrrxlrl.exe61⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5lxrxxl.exec:\5lxrxxl.exe62⤵
- Executes dropped EXE
PID:1268 -
\??\c:\tnhnnn.exec:\tnhnnn.exe63⤵
- Executes dropped EXE
PID:844 -
\??\c:\3djjd.exec:\3djjd.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dpvdj.exec:\dpvdj.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7rffllx.exec:\7rffllx.exe66⤵PID:2140
-
\??\c:\frflrlr.exec:\frflrlr.exe67⤵PID:2896
-
\??\c:\hbhnnn.exec:\hbhnnn.exe68⤵PID:2964
-
\??\c:\5hthnt.exec:\5hthnt.exe69⤵PID:952
-
\??\c:\dvppp.exec:\dvppp.exe70⤵PID:1000
-
\??\c:\djvpp.exec:\djvpp.exe71⤵PID:3060
-
\??\c:\xlxxlfr.exec:\xlxxlfr.exe72⤵PID:1588
-
\??\c:\xlfrrxf.exec:\xlfrrxf.exe73⤵PID:2616
-
\??\c:\7bbhnt.exec:\7bbhnt.exe74⤵PID:2076
-
\??\c:\vjdjp.exec:\vjdjp.exe75⤵PID:2392
-
\??\c:\9pjdj.exec:\9pjdj.exe76⤵PID:1856
-
\??\c:\frfrxfl.exec:\frfrxfl.exe77⤵PID:2216
-
\??\c:\3flrxxx.exec:\3flrxxx.exe78⤵PID:2112
-
\??\c:\1nbbbb.exec:\1nbbbb.exe79⤵PID:2920
-
\??\c:\nnthhh.exec:\nnthhh.exe80⤵PID:2652
-
\??\c:\7pvdd.exec:\7pvdd.exe81⤵PID:2860
-
\??\c:\jvjpp.exec:\jvjpp.exe82⤵PID:2924
-
\??\c:\1flflff.exec:\1flflff.exe83⤵PID:2800
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe84⤵PID:2672
-
\??\c:\tbnbhn.exec:\tbnbhn.exe85⤵PID:2592
-
\??\c:\5dvvd.exec:\5dvvd.exe86⤵PID:2708
-
\??\c:\jdvpv.exec:\jdvpv.exe87⤵PID:2568
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe88⤵PID:2584
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe89⤵PID:1908
-
\??\c:\nhbhtt.exec:\nhbhtt.exe90⤵PID:1976
-
\??\c:\3tbttt.exec:\3tbttt.exe91⤵PID:1640
-
\??\c:\pdjdj.exec:\pdjdj.exe92⤵PID:2336
-
\??\c:\pjdjj.exec:\pjdjj.exe93⤵PID:1968
-
\??\c:\7xxlrxf.exec:\7xxlrxf.exe94⤵PID:1992
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe95⤵PID:2004
-
\??\c:\nhttbb.exec:\nhttbb.exe96⤵PID:344
-
\??\c:\tnthnh.exec:\tnthnh.exe97⤵PID:1616
-
\??\c:\jdppj.exec:\jdppj.exe98⤵PID:2884
-
\??\c:\rlxfllx.exec:\rlxfllx.exe99⤵PID:1236
-
\??\c:\rlxfllx.exec:\rlxfllx.exe100⤵PID:2740
-
\??\c:\hthhnn.exec:\hthhnn.exe101⤵PID:1892
-
\??\c:\hnhnhh.exec:\hnhnhh.exe102⤵PID:1468
-
\??\c:\7jppv.exec:\7jppv.exe103⤵PID:1264
-
\??\c:\1rrlrlx.exec:\1rrlrlx.exe104⤵PID:2748
-
\??\c:\1xrxrxf.exec:\1xrxrxf.exe105⤵PID:408
-
\??\c:\btbhbh.exec:\btbhbh.exe106⤵PID:2780
-
\??\c:\pjjdp.exec:\pjjdp.exe107⤵PID:276
-
\??\c:\xlxfflx.exec:\xlxfflx.exe108⤵PID:1692
-
\??\c:\hthbhb.exec:\hthbhb.exe109⤵PID:2468
-
\??\c:\jjppp.exec:\jjppp.exe110⤵PID:2248
-
\??\c:\rllrffx.exec:\rllrffx.exe111⤵PID:2448
-
\??\c:\tnbbhn.exec:\tnbbhn.exe112⤵PID:2008
-
\??\c:\jvddj.exec:\jvddj.exe113⤵PID:2252
-
\??\c:\vjppv.exec:\vjppv.exe114⤵PID:1884
-
\??\c:\7djjp.exec:\7djjp.exe115⤵PID:1540
-
\??\c:\1xlllfr.exec:\1xlllfr.exe116⤵PID:1304
-
\??\c:\hhbbnt.exec:\hhbbnt.exe117⤵PID:1912
-
\??\c:\jdvdj.exec:\jdvdj.exe118⤵PID:2472
-
\??\c:\rfffrlr.exec:\rfffrlr.exe119⤵PID:1984
-
\??\c:\bntnnn.exec:\bntnnn.exe120⤵PID:3032
-
\??\c:\vdjdd.exec:\vdjdd.exe121⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-