Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe
-
Size
454KB
-
MD5
28ffd168dc361117a5cc00a7ae7036b0
-
SHA1
f151211d4dd3daba03dda797da4e7b0d5c5bdff1
-
SHA256
aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6f
-
SHA512
7c8ef09479c85625468c6f784dfd1b7fb26087f9f1187b963c5886c069488ec492dee3ced5557fa4f3a72a399bd380e97e27b925ea5c2ed53ea4f3aa9ccc877d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT2:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2288-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-106-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2132-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1772-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-173-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1184-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-217-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-366-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2856-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-413-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/672-431-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/672-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-484-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-707-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-978-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-988-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2704-1300-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1152-1346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/780-1353-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/564-1361-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/564-1580-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 xxrxflx.exe 2124 5tbbth.exe 2076 vpjdv.exe 2112 nhnnhh.exe 1676 tbbhbh.exe 2196 jvddv.exe 2576 lrfrlxr.exe 2732 nnnbnt.exe 2640 dppjp.exe 2856 vpddp.exe 2508 flrrlfl.exe 2536 vddjv.exe 2548 3btbbb.exe 2132 ffxxrxr.exe 1672 nnhtnn.exe 1716 1nhnth.exe 1708 dvpvp.exe 1772 bbnnbb.exe 1184 dvjpp.exe 2024 nhtbhh.exe 1956 5pdjd.exe 2572 3tnntb.exe 2796 7hbtbt.exe 2360 fxrrflx.exe 3044 tnhnnt.exe 1556 dvpvj.exe 1900 nnbhbb.exe 564 llffxll.exe 1224 1ttbnt.exe 668 fxlrlrf.exe 1976 ffxfxfr.exe 2212 dvppd.exe 2900 fxrrffl.exe 1920 hbtbtb.exe 1544 1bbbnt.exe 316 vdpvj.exe 2064 xllxlxf.exe 2236 btnbbb.exe 1056 tnbhtn.exe 2428 vvpjp.exe 2592 rlffffl.exe 2956 nnhnnt.exe 2624 1tnnnt.exe 2616 ppjpj.exe 2612 rlffxfr.exe 2856 5nhhtt.exe 2980 9nhhbt.exe 2528 pjddd.exe 2596 7rlfrfx.exe 2540 nhhhbh.exe 2132 hthhhh.exe 1968 vpdpd.exe 672 rrllxfl.exe 1672 hhbbnt.exe 1400 bbnnbb.exe 2000 jddjp.exe 2028 1xflrxf.exe 1972 tnhnbh.exe 1748 3btbbh.exe 1924 jdppd.exe 1940 xxlrxxf.exe 2700 3rlxrfl.exe 2800 hhbhhh.exe 2824 pjvvd.exe -
resource yara_rule behavioral1/memory/2288-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-366-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2856-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-431-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/672-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-850-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3008-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-963-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-978-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1672-988-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/324-990-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-1054-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-1080-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-1301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-1309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-1354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-1362-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2396 2288 aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe 28 PID 2288 wrote to memory of 2396 2288 aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe 28 PID 2288 wrote to memory of 2396 2288 aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe 28 PID 2288 wrote to memory of 2396 2288 aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe 28 PID 2396 wrote to memory of 2124 2396 xxrxflx.exe 29 PID 2396 wrote to memory of 2124 2396 xxrxflx.exe 29 PID 2396 wrote to memory of 2124 2396 xxrxflx.exe 29 PID 2396 wrote to memory of 2124 2396 xxrxflx.exe 29 PID 2124 wrote to memory of 2076 2124 5tbbth.exe 30 PID 2124 wrote to memory of 2076 2124 5tbbth.exe 30 PID 2124 wrote to memory of 2076 2124 5tbbth.exe 30 PID 2124 wrote to memory of 2076 2124 5tbbth.exe 30 PID 2076 wrote to memory of 2112 2076 vpjdv.exe 31 PID 2076 wrote to memory of 2112 2076 vpjdv.exe 31 PID 2076 wrote to memory of 2112 2076 vpjdv.exe 31 PID 2076 wrote to memory of 2112 2076 vpjdv.exe 31 PID 2112 wrote to memory of 1676 2112 nhnnhh.exe 32 PID 2112 wrote to memory of 1676 2112 nhnnhh.exe 32 PID 2112 wrote to memory of 1676 2112 nhnnhh.exe 32 PID 2112 wrote to memory of 1676 2112 nhnnhh.exe 32 PID 1676 wrote to memory of 2196 1676 tbbhbh.exe 33 PID 1676 wrote to memory of 2196 1676 tbbhbh.exe 33 PID 1676 wrote to memory of 2196 1676 tbbhbh.exe 33 PID 1676 wrote to memory of 2196 1676 tbbhbh.exe 33 PID 2196 wrote to memory of 2576 2196 jvddv.exe 34 PID 2196 wrote to memory of 2576 2196 jvddv.exe 34 PID 2196 wrote to memory of 2576 2196 jvddv.exe 34 PID 2196 wrote to memory of 2576 2196 jvddv.exe 34 PID 2576 wrote to memory of 2732 2576 lrfrlxr.exe 35 PID 2576 wrote to memory of 2732 2576 lrfrlxr.exe 35 PID 2576 wrote to memory of 2732 2576 lrfrlxr.exe 35 PID 2576 wrote to memory of 2732 2576 lrfrlxr.exe 35 PID 2732 wrote to memory of 2640 2732 nnnbnt.exe 36 PID 2732 wrote to memory of 2640 2732 nnnbnt.exe 36 PID 2732 wrote to memory of 2640 2732 nnnbnt.exe 36 PID 2732 wrote to memory of 2640 2732 nnnbnt.exe 36 PID 2640 wrote to memory of 2856 2640 dppjp.exe 37 PID 2640 wrote to memory of 2856 2640 dppjp.exe 37 PID 2640 wrote to memory of 2856 2640 dppjp.exe 37 PID 2640 wrote to memory of 2856 2640 dppjp.exe 37 PID 2856 wrote to memory of 2508 2856 vpddp.exe 38 PID 2856 wrote to memory of 2508 2856 vpddp.exe 38 PID 2856 wrote to memory of 2508 2856 vpddp.exe 38 PID 2856 wrote to memory of 2508 2856 vpddp.exe 38 PID 2508 wrote to memory of 2536 2508 flrrlfl.exe 39 PID 2508 wrote to memory of 2536 2508 flrrlfl.exe 39 PID 2508 wrote to memory of 2536 2508 flrrlfl.exe 39 PID 2508 wrote to memory of 2536 2508 flrrlfl.exe 39 PID 2536 wrote to memory of 2548 2536 vddjv.exe 40 PID 2536 wrote to memory of 2548 2536 vddjv.exe 40 PID 2536 wrote to memory of 2548 2536 vddjv.exe 40 PID 2536 wrote to memory of 2548 2536 vddjv.exe 40 PID 2548 wrote to memory of 2132 2548 3btbbb.exe 41 PID 2548 wrote to memory of 2132 2548 3btbbb.exe 41 PID 2548 wrote to memory of 2132 2548 3btbbb.exe 41 PID 2548 wrote to memory of 2132 2548 3btbbb.exe 41 PID 2132 wrote to memory of 1672 2132 ffxxrxr.exe 42 PID 2132 wrote to memory of 1672 2132 ffxxrxr.exe 42 PID 2132 wrote to memory of 1672 2132 ffxxrxr.exe 42 PID 2132 wrote to memory of 1672 2132 ffxxrxr.exe 42 PID 1672 wrote to memory of 1716 1672 nnhtnn.exe 43 PID 1672 wrote to memory of 1716 1672 nnhtnn.exe 43 PID 1672 wrote to memory of 1716 1672 nnhtnn.exe 43 PID 1672 wrote to memory of 1716 1672 nnhtnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe"C:\Users\Admin\AppData\Local\Temp\aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\xxrxflx.exec:\xxrxflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\5tbbth.exec:\5tbbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vpjdv.exec:\vpjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\nhnnhh.exec:\nhnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tbbhbh.exec:\tbbhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\jvddv.exec:\jvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lrfrlxr.exec:\lrfrlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nnnbnt.exec:\nnnbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dppjp.exec:\dppjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vpddp.exec:\vpddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\flrrlfl.exec:\flrrlfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\vddjv.exec:\vddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3btbbb.exec:\3btbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\nnhtnn.exec:\nnhtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\1nhnth.exec:\1nhnth.exe17⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dvpvp.exec:\dvpvp.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bbnnbb.exec:\bbnnbb.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dvjpp.exec:\dvjpp.exe20⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nhtbhh.exec:\nhtbhh.exe21⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5pdjd.exec:\5pdjd.exe22⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3tnntb.exec:\3tnntb.exe23⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7hbtbt.exec:\7hbtbt.exe24⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fxrrflx.exec:\fxrrflx.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tnhnnt.exec:\tnhnnt.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvpvj.exec:\dvpvj.exe27⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nnbhbb.exec:\nnbhbb.exe28⤵
- Executes dropped EXE
PID:1900 -
\??\c:\llffxll.exec:\llffxll.exe29⤵
- Executes dropped EXE
PID:564 -
\??\c:\1ttbnt.exec:\1ttbnt.exe30⤵
- Executes dropped EXE
PID:1224 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe31⤵
- Executes dropped EXE
PID:668 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe32⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvppd.exec:\dvppd.exe33⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fxrrffl.exec:\fxrrffl.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbtbtb.exec:\hbtbtb.exe35⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1bbbnt.exec:\1bbbnt.exe36⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vdpvj.exec:\vdpvj.exe37⤵
- Executes dropped EXE
PID:316 -
\??\c:\xllxlxf.exec:\xllxlxf.exe38⤵
- Executes dropped EXE
PID:2064 -
\??\c:\btnbbb.exec:\btnbbb.exe39⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tnbhtn.exec:\tnbhtn.exe40⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vvpjp.exec:\vvpjp.exe41⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlffffl.exec:\rlffffl.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nnhnnt.exec:\nnhnnt.exe43⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1tnnnt.exec:\1tnnnt.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ppjpj.exec:\ppjpj.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rlffxfr.exec:\rlffxfr.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\5nhhtt.exec:\5nhhtt.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9nhhbt.exec:\9nhhbt.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pjddd.exec:\pjddd.exe49⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7rlfrfx.exec:\7rlfrfx.exe50⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nhhhbh.exec:\nhhhbh.exe51⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hthhhh.exec:\hthhhh.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpdpd.exec:\vpdpd.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\rrllxfl.exec:\rrllxfl.exe54⤵
- Executes dropped EXE
PID:672 -
\??\c:\hhbbnt.exec:\hhbbnt.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bbnnbb.exec:\bbnnbb.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\jddjp.exec:\jddjp.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\1xflrxf.exec:\1xflrxf.exe58⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tnhnbh.exec:\tnhnbh.exe59⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3btbbh.exec:\3btbbh.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jdppd.exec:\jdppd.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe62⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3rlxrfl.exec:\3rlxrfl.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hhbhhh.exec:\hhbhhh.exe64⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjvvd.exec:\pjvvd.exe65⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ppjvp.exec:\ppjvp.exe66⤵PID:2816
-
\??\c:\ffffffr.exec:\ffffffr.exe67⤵PID:2320
-
\??\c:\nnhhnt.exec:\nnhhnt.exe68⤵PID:1752
-
\??\c:\djdpd.exec:\djdpd.exe69⤵PID:2420
-
\??\c:\9ppjj.exec:\9ppjj.exe70⤵PID:1664
-
\??\c:\xrlrffl.exec:\xrlrffl.exe71⤵PID:2792
-
\??\c:\bhbhhh.exec:\bhbhhh.exe72⤵PID:328
-
\??\c:\bthbnb.exec:\bthbnb.exe73⤵PID:2276
-
\??\c:\pdvvv.exec:\pdvvv.exe74⤵PID:1736
-
\??\c:\3xlxlll.exec:\3xlxlll.exe75⤵PID:888
-
\??\c:\btnhbn.exec:\btnhbn.exe76⤵PID:2092
-
\??\c:\hnhthb.exec:\hnhthb.exe77⤵PID:2052
-
\??\c:\5jpvv.exec:\5jpvv.exe78⤵PID:2120
-
\??\c:\3fflrxf.exec:\3fflrxf.exe79⤵PID:1732
-
\??\c:\xlrxllx.exec:\xlrxllx.exe80⤵PID:1036
-
\??\c:\5bttht.exec:\5bttht.exe81⤵PID:1644
-
\??\c:\pjddp.exec:\pjddp.exe82⤵PID:2412
-
\??\c:\rrllxxr.exec:\rrllxxr.exe83⤵PID:2260
-
\??\c:\rrrflxr.exec:\rrrflxr.exe84⤵PID:1056
-
\??\c:\5tntbh.exec:\5tntbh.exe85⤵PID:2292
-
\??\c:\9dppv.exec:\9dppv.exe86⤵PID:2760
-
\??\c:\xrflrrf.exec:\xrflrrf.exe87⤵PID:384
-
\??\c:\xxrxxfr.exec:\xxrxxfr.exe88⤵PID:2728
-
\??\c:\nnnhbb.exec:\nnnhbb.exe89⤵PID:1776
-
\??\c:\pjjjv.exec:\pjjjv.exe90⤵PID:2252
-
\??\c:\jvvdv.exec:\jvvdv.exe91⤵PID:2768
-
\??\c:\3xrrxxl.exec:\3xrrxxl.exe92⤵PID:2648
-
\??\c:\hhtbhh.exec:\hhtbhh.exe93⤵PID:2476
-
\??\c:\vvpdp.exec:\vvpdp.exe94⤵PID:2984
-
\??\c:\ddpvd.exec:\ddpvd.exe95⤵PID:2532
-
\??\c:\flllflr.exec:\flllflr.exe96⤵PID:2940
-
\??\c:\ttntbh.exec:\ttntbh.exe97⤵PID:2132
-
\??\c:\3nhbth.exec:\3nhbth.exe98⤵PID:2444
-
\??\c:\pjjjp.exec:\pjjjp.exe99⤵PID:672
-
\??\c:\ddvdd.exec:\ddvdd.exe100⤵
- System Location Discovery: System Language Discovery
PID:1200 -
\??\c:\3ffrrfl.exec:\3ffrrfl.exe101⤵PID:1400
-
\??\c:\bbhnbb.exec:\bbhnbb.exe102⤵PID:1992
-
\??\c:\1dpvd.exec:\1dpvd.exe103⤵PID:2284
-
\??\c:\pdjjd.exec:\pdjjd.exe104⤵PID:1944
-
\??\c:\lfllxxf.exec:\lfllxxf.exe105⤵PID:1848
-
\??\c:\1nhntb.exec:\1nhntb.exe106⤵PID:2584
-
\??\c:\5pjpv.exec:\5pjpv.exe107⤵PID:1756
-
\??\c:\jjdjd.exec:\jjdjd.exe108⤵PID:2700
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe109⤵PID:2152
-
\??\c:\9htthh.exec:\9htthh.exe110⤵PID:2804
-
\??\c:\3nbhnb.exec:\3nbhnb.exe111⤵PID:2820
-
\??\c:\7dvjv.exec:\7dvjv.exe112⤵PID:2780
-
\??\c:\rlxxflr.exec:\rlxxflr.exe113⤵PID:848
-
\??\c:\9fflffl.exec:\9fflffl.exe114⤵PID:2420
-
\??\c:\tnhnhh.exec:\tnhnhh.exe115⤵PID:1040
-
\??\c:\pjddd.exec:\pjddd.exe116⤵PID:544
-
\??\c:\3xxflfl.exec:\3xxflfl.exe117⤵PID:328
-
\??\c:\fxrrlll.exec:\fxrrlll.exe118⤵PID:1740
-
\??\c:\9tnntb.exec:\9tnntb.exe119⤵PID:1976
-
\??\c:\ddvdp.exec:\ddvdp.exe120⤵PID:760
-
\??\c:\pjvdv.exec:\pjvdv.exe121⤵PID:2100
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe122⤵PID:1576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-