Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe
-
Size
454KB
-
MD5
6abd8c063831dcdc79203d5e12de4221
-
SHA1
23b9c356decc9114bec5118f93eca4f8cbb4dee5
-
SHA256
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f
-
SHA512
7c95bc995ee3b3ef80f6e01bc629b37325e7a6ad610cd0864dc10eb8b53055fd71ff3d601f840e56c041cbc6e1a2aa50d679863bbc2d8e6c195aff489e29d3b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2720-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-234-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1880-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-341-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2692-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-383-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-406-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1092-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1140-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-472-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-535-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-570-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2720-577-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-596-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-650-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2800 3xffrfx.exe 3032 3hhbbh.exe 2756 xlrrrfx.exe 1548 btnbnt.exe 2572 ppjvj.exe 2692 7bhtnb.exe 2268 vddpj.exe 3008 jpvpj.exe 2252 9lfrflx.exe 1976 dvpvv.exe 2556 3xfxffl.exe 2828 9flfxlx.exe 2924 hhhhbn.exe 2964 jdvdv.exe 604 xfrrlxf.exe 1076 pdppv.exe 2232 pdppp.exe 1996 bnttbn.exe 1932 thnntb.exe 976 lxfrlfl.exe 1516 tttnbn.exe 2144 tnntnt.exe 1372 9djjj.exe 1928 vvvjd.exe 1152 ddjdp.exe 2452 vdddv.exe 1496 rfrfffx.exe 2332 vddpd.exe 892 llrllxx.exe 1880 ntthbh.exe 2840 1vvpd.exe 1600 ppvpd.exe 2696 rrrrfxl.exe 3028 3ppdj.exe 2608 jvdvp.exe 2568 fffrfxr.exe 2588 5hnnbt.exe 2564 vjdvj.exe 2692 frxxrlf.exe 1384 bbhbnb.exe 2244 dpvpj.exe 2072 5lxrrfl.exe 2264 ttbhbt.exe 1216 1vpdp.exe 2896 xflxlrf.exe 2952 tbnbth.exe 1092 dpdjv.exe 3000 rxrfxfr.exe 2368 tbtttn.exe 1140 ddvpj.exe 2372 rxrrxlf.exe 2212 nhtbnb.exe 1076 jvpvd.exe 2040 5lrfrxl.exe 396 fxfxrfx.exe 1968 bbhtnb.exe 1052 pvjdj.exe 108 ttbhtb.exe 2940 nnhnbt.exe 2080 rfrfrrl.exe 1784 9lxxrrl.exe 1372 jpppj.exe 1992 vvvpp.exe 568 9rxlxrl.exe -
resource yara_rule behavioral1/memory/2720-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-348-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2564-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-535-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/568-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-577-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1608-596-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3004-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-650-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2800 2720 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 31 PID 2720 wrote to memory of 2800 2720 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 31 PID 2720 wrote to memory of 2800 2720 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 31 PID 2720 wrote to memory of 2800 2720 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 31 PID 2800 wrote to memory of 3032 2800 3xffrfx.exe 32 PID 2800 wrote to memory of 3032 2800 3xffrfx.exe 32 PID 2800 wrote to memory of 3032 2800 3xffrfx.exe 32 PID 2800 wrote to memory of 3032 2800 3xffrfx.exe 32 PID 3032 wrote to memory of 2756 3032 3hhbbh.exe 33 PID 3032 wrote to memory of 2756 3032 3hhbbh.exe 33 PID 3032 wrote to memory of 2756 3032 3hhbbh.exe 33 PID 3032 wrote to memory of 2756 3032 3hhbbh.exe 33 PID 2756 wrote to memory of 1548 2756 xlrrrfx.exe 34 PID 2756 wrote to memory of 1548 2756 xlrrrfx.exe 34 PID 2756 wrote to memory of 1548 2756 xlrrrfx.exe 34 PID 2756 wrote to memory of 1548 2756 xlrrrfx.exe 34 PID 1548 wrote to memory of 2572 1548 btnbnt.exe 35 PID 1548 wrote to memory of 2572 1548 btnbnt.exe 35 PID 1548 wrote to memory of 2572 1548 btnbnt.exe 35 PID 1548 wrote to memory of 2572 1548 btnbnt.exe 35 PID 2572 wrote to memory of 2692 2572 ppjvj.exe 36 PID 2572 wrote to memory of 2692 2572 ppjvj.exe 36 PID 2572 wrote to memory of 2692 2572 ppjvj.exe 36 PID 2572 wrote to memory of 2692 2572 ppjvj.exe 36 PID 2692 wrote to memory of 2268 2692 7bhtnb.exe 37 PID 2692 wrote to memory of 2268 2692 7bhtnb.exe 37 PID 2692 wrote to memory of 2268 2692 7bhtnb.exe 37 PID 2692 wrote to memory of 2268 2692 7bhtnb.exe 37 PID 2268 wrote to memory of 3008 2268 vddpj.exe 38 PID 2268 wrote to memory of 3008 2268 vddpj.exe 38 PID 2268 wrote to memory of 3008 2268 vddpj.exe 38 PID 2268 wrote to memory of 3008 2268 vddpj.exe 38 PID 3008 wrote to memory of 2252 3008 jpvpj.exe 39 PID 3008 wrote to memory of 2252 3008 jpvpj.exe 39 PID 3008 wrote to memory of 2252 3008 jpvpj.exe 39 PID 3008 wrote to memory of 2252 3008 jpvpj.exe 39 PID 2252 wrote to memory of 1976 2252 9lfrflx.exe 40 PID 2252 wrote to memory of 1976 2252 9lfrflx.exe 40 PID 2252 wrote to memory of 1976 2252 9lfrflx.exe 40 PID 2252 wrote to memory of 1976 2252 9lfrflx.exe 40 PID 1976 wrote to memory of 2556 1976 dvpvv.exe 41 PID 1976 wrote to memory of 2556 1976 dvpvv.exe 41 PID 1976 wrote to memory of 2556 1976 dvpvv.exe 41 PID 1976 wrote to memory of 2556 1976 dvpvv.exe 41 PID 2556 wrote to memory of 2828 2556 3xfxffl.exe 42 PID 2556 wrote to memory of 2828 2556 3xfxffl.exe 42 PID 2556 wrote to memory of 2828 2556 3xfxffl.exe 42 PID 2556 wrote to memory of 2828 2556 3xfxffl.exe 42 PID 2828 wrote to memory of 2924 2828 9flfxlx.exe 43 PID 2828 wrote to memory of 2924 2828 9flfxlx.exe 43 PID 2828 wrote to memory of 2924 2828 9flfxlx.exe 43 PID 2828 wrote to memory of 2924 2828 9flfxlx.exe 43 PID 2924 wrote to memory of 2964 2924 hhhhbn.exe 44 PID 2924 wrote to memory of 2964 2924 hhhhbn.exe 44 PID 2924 wrote to memory of 2964 2924 hhhhbn.exe 44 PID 2924 wrote to memory of 2964 2924 hhhhbn.exe 44 PID 2964 wrote to memory of 604 2964 jdvdv.exe 45 PID 2964 wrote to memory of 604 2964 jdvdv.exe 45 PID 2964 wrote to memory of 604 2964 jdvdv.exe 45 PID 2964 wrote to memory of 604 2964 jdvdv.exe 45 PID 604 wrote to memory of 1076 604 xfrrlxf.exe 46 PID 604 wrote to memory of 1076 604 xfrrlxf.exe 46 PID 604 wrote to memory of 1076 604 xfrrlxf.exe 46 PID 604 wrote to memory of 1076 604 xfrrlxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe"C:\Users\Admin\AppData\Local\Temp\cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3xffrfx.exec:\3xffrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3hhbbh.exec:\3hhbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xlrrrfx.exec:\xlrrrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\btnbnt.exec:\btnbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\ppjvj.exec:\ppjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\7bhtnb.exec:\7bhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vddpj.exec:\vddpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\jpvpj.exec:\jpvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9lfrflx.exec:\9lfrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\dvpvv.exec:\dvpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\3xfxffl.exec:\3xfxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9flfxlx.exec:\9flfxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hhhhbn.exec:\hhhhbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\jdvdv.exec:\jdvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xfrrlxf.exec:\xfrrlxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\pdppv.exec:\pdppv.exe17⤵
- Executes dropped EXE
PID:1076 -
\??\c:\pdppp.exec:\pdppp.exe18⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bnttbn.exec:\bnttbn.exe19⤵
- Executes dropped EXE
PID:1996 -
\??\c:\thnntb.exec:\thnntb.exe20⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxfrlfl.exec:\lxfrlfl.exe21⤵
- Executes dropped EXE
PID:976 -
\??\c:\tttnbn.exec:\tttnbn.exe22⤵
- Executes dropped EXE
PID:1516 -
\??\c:\tnntnt.exec:\tnntnt.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9djjj.exec:\9djjj.exe24⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vvvjd.exec:\vvvjd.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ddjdp.exec:\ddjdp.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vdddv.exec:\vdddv.exe27⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rfrfffx.exec:\rfrfffx.exe28⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vddpd.exec:\vddpd.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\llrllxx.exec:\llrllxx.exe30⤵
- Executes dropped EXE
PID:892 -
\??\c:\ntthbh.exec:\ntthbh.exe31⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1vvpd.exec:\1vvpd.exe32⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ppvpd.exec:\ppvpd.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rrrrfxl.exec:\rrrrfxl.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\3ppdj.exec:\3ppdj.exe35⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jvdvp.exec:\jvdvp.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\fffrfxr.exec:\fffrfxr.exe37⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5hnnbt.exec:\5hnnbt.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vjdvj.exec:\vjdvj.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\frxxrlf.exec:\frxxrlf.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bbhbnb.exec:\bbhbnb.exe41⤵
- Executes dropped EXE
PID:1384 -
\??\c:\dpvpj.exec:\dpvpj.exe42⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5lxrrfl.exec:\5lxrrfl.exe43⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ttbhbt.exec:\ttbhbt.exe44⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1vpdp.exec:\1vpdp.exe45⤵
- Executes dropped EXE
PID:1216 -
\??\c:\xflxlrf.exec:\xflxlrf.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tbnbth.exec:\tbnbth.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dpdjv.exec:\dpdjv.exe48⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rxrfxfr.exec:\rxrfxfr.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\tbtttn.exec:\tbtttn.exe50⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddvpj.exec:\ddvpj.exe51⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rxrrxlf.exec:\rxrrxlf.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhtbnb.exec:\nhtbnb.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jvpvd.exec:\jvpvd.exe54⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5lrfrxl.exec:\5lrfrxl.exe55⤵
- Executes dropped EXE
PID:2040 -
\??\c:\fxfxrfx.exec:\fxfxrfx.exe56⤵
- Executes dropped EXE
PID:396 -
\??\c:\bbhtnb.exec:\bbhtnb.exe57⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pvjdj.exec:\pvjdj.exe58⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ttbhtb.exec:\ttbhtb.exe59⤵
- Executes dropped EXE
PID:108 -
\??\c:\nnhnbt.exec:\nnhnbt.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rfrfrrl.exec:\rfrfrrl.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9lxxrrl.exec:\9lxxrrl.exe62⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jpppj.exec:\jpppj.exe63⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vvvpp.exec:\vvvpp.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9rxlxrl.exec:\9rxlxrl.exe65⤵
- Executes dropped EXE
PID:568 -
\??\c:\tbnnht.exec:\tbnnht.exe66⤵PID:2056
-
\??\c:\xlxxrff.exec:\xlxxrff.exe67⤵PID:1688
-
\??\c:\hnhnht.exec:\hnhnht.exe68⤵PID:2180
-
\??\c:\bnnbth.exec:\bnnbth.exe69⤵PID:1060
-
\??\c:\vjpjj.exec:\vjpjj.exe70⤵PID:1764
-
\??\c:\xfllfrf.exec:\xfllfrf.exe71⤵PID:2720
-
\??\c:\1lllrrr.exec:\1lllrrr.exe72⤵PID:2832
-
\??\c:\7pdjj.exec:\7pdjj.exe73⤵PID:2840
-
\??\c:\ddpdd.exec:\ddpdd.exe74⤵PID:1608
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe75⤵PID:2748
-
\??\c:\bnnhht.exec:\bnnhht.exe76⤵PID:2688
-
\??\c:\pvdjd.exec:\pvdjd.exe77⤵PID:2848
-
\??\c:\xxrxflx.exec:\xxrxflx.exe78⤵PID:2600
-
\??\c:\nnnhhb.exec:\nnnhhb.exe79⤵PID:2416
-
\??\c:\bnnbhb.exec:\bnnbhb.exe80⤵PID:776
-
\??\c:\1vvdj.exec:\1vvdj.exe81⤵PID:2864
-
\??\c:\5rflrxl.exec:\5rflrxl.exe82⤵PID:3004
-
\??\c:\9hnbbn.exec:\9hnbbn.exe83⤵PID:3008
-
\??\c:\1jjvj.exec:\1jjvj.exe84⤵PID:2816
-
\??\c:\ffxfrrr.exec:\ffxfrrr.exe85⤵PID:780
-
\??\c:\1bhtnt.exec:\1bhtnt.exe86⤵PID:2888
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe87⤵PID:2444
-
\??\c:\hhbhhb.exec:\hhbhhb.exe88⤵PID:864
-
\??\c:\vvvjd.exec:\vvvjd.exe89⤵PID:2968
-
\??\c:\rflxxlx.exec:\rflxxlx.exe90⤵PID:1620
-
\??\c:\7bnntn.exec:\7bnntn.exe91⤵PID:2368
-
\??\c:\3jjvp.exec:\3jjvp.exe92⤵PID:3048
-
\??\c:\vpvpd.exec:\vpvpd.exe93⤵PID:2204
-
\??\c:\fxffrfx.exec:\fxffrfx.exe94⤵PID:2388
-
\??\c:\nnnhbn.exec:\nnnhbn.exe95⤵PID:1956
-
\??\c:\dddjv.exec:\dddjv.exe96⤵
- System Location Discovery: System Language Discovery
PID:824 -
\??\c:\fffrrxr.exec:\fffrrxr.exe97⤵PID:408
-
\??\c:\tnntnb.exec:\tnntnb.exe98⤵PID:1768
-
\??\c:\9jpjp.exec:\9jpjp.exe99⤵PID:1344
-
\??\c:\1fxfrxr.exec:\1fxfrxr.exe100⤵PID:960
-
\??\c:\tttbtb.exec:\tttbtb.exe101⤵PID:1516
-
\??\c:\vvvvp.exec:\vvvvp.exe102⤵PID:1964
-
\??\c:\xlrxflx.exec:\xlrxflx.exe103⤵PID:1560
-
\??\c:\nnhnnb.exec:\nnhnnb.exe104⤵PID:316
-
\??\c:\jjjdp.exec:\jjjdp.exe105⤵PID:1752
-
\??\c:\1vvdj.exec:\1vvdj.exe106⤵PID:1692
-
\??\c:\rffxrfx.exec:\rffxrfx.exe107⤵PID:1636
-
\??\c:\5hnbht.exec:\5hnbht.exe108⤵PID:2484
-
\??\c:\vvvjj.exec:\vvvjj.exe109⤵PID:904
-
\??\c:\3xfxrfr.exec:\3xfxrfr.exe110⤵PID:876
-
\??\c:\hhtnnh.exec:\hhtnnh.exe111⤵PID:2356
-
\??\c:\1jddv.exec:\1jddv.exe112⤵PID:2348
-
\??\c:\frffrrr.exec:\frffrrr.exe113⤵PID:2844
-
\??\c:\3ntbbn.exec:\3ntbbn.exe114⤵PID:540
-
\??\c:\ddjdp.exec:\ddjdp.exe115⤵PID:3032
-
\??\c:\flrffxx.exec:\flrffxx.exe116⤵PID:2760
-
\??\c:\ntntnh.exec:\ntntnh.exe117⤵PID:2744
-
\??\c:\9ttnht.exec:\9ttnht.exe118⤵PID:2584
-
\??\c:\pvdpd.exec:\pvdpd.exe119⤵PID:1948
-
\??\c:\htbtnn.exec:\htbtnn.exe120⤵PID:2016
-
\??\c:\7ntbth.exec:\7ntbth.exe121⤵PID:1040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-