Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe
-
Size
454KB
-
MD5
af41d2810e4461d38765855431903103
-
SHA1
0a84f87ec2226669582c7256f5d93f7ac3c1ce56
-
SHA256
ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244
-
SHA512
5072fc7b6d56073b18ce084c2e582c37025abd65f7b2b4fd9c2b0e26b55dc752db4f3ae450f68b4dd9da9dda129877b59ef06c0464a52548efb39ba138ad5e0a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2440-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-997-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-1032-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1472-1060-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-1196-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2844-1228-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/560-1280-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2096-1279-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-1288-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 xfxfrxl.exe 2320 btnhth.exe 1740 ntthbn.exe 2808 jpjvj.exe 2728 fflrxfr.exe 2920 bbtbtt.exe 2880 djpjp.exe 2888 xffxrfl.exe 2760 hbntnb.exe 2616 3ntnnb.exe 2052 vppjj.exe 2404 lllrrrx.exe 980 tnhntn.exe 1332 nthbtn.exe 2992 pjdjv.exe 2840 fflrlxr.exe 2952 7xxrlxr.exe 1664 ntthhh.exe 1860 jvvjd.exe 1328 llxrrrr.exe 2520 hbtbnt.exe 2368 7pjvp.exe 2360 vpvdp.exe 2496 5rxflxx.exe 3064 ntntbh.exe 1660 7ddjj.exe 1376 jpjdd.exe 3048 hnbhnt.exe 1704 dvpdd.exe 780 xrrlxlx.exe 1724 tnhnbn.exe 1692 tbtbhn.exe 2236 ppjvp.exe 2280 xxrxlrr.exe 2120 ntnbnb.exe 2560 dddvd.exe 1044 7vppp.exe 2164 lrxxlff.exe 2400 nnnhbh.exe 2768 bbbtht.exe 2920 djvjj.exe 3000 7lflrlf.exe 2876 hbhntn.exe 2612 ntntnn.exe 2788 9ppvp.exe 2052 tbntbh.exe 2324 7bhttn.exe 2744 fflxfrr.exe 1668 nthbbh.exe 2472 bhhnth.exe 2848 rrlflxr.exe 1992 bnbnnh.exe 2908 jjvvj.exe 2516 lrlxrfx.exe 2980 frlffxl.exe 2264 pjpvd.exe 2488 9djvj.exe 1152 fxfrlrl.exe 2676 9nhnbh.exe 996 bthnbh.exe 1916 hnnnhn.exe 276 vvvpp.exe 904 1lfflrf.exe 3068 ntbbbn.exe -
resource yara_rule behavioral1/memory/2440-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-1068-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-1137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-1144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-1164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-1215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-1253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-1307-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2192 2440 ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe 30 PID 2440 wrote to memory of 2192 2440 ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe 30 PID 2440 wrote to memory of 2192 2440 ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe 30 PID 2440 wrote to memory of 2192 2440 ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe 30 PID 2192 wrote to memory of 2320 2192 xfxfrxl.exe 31 PID 2192 wrote to memory of 2320 2192 xfxfrxl.exe 31 PID 2192 wrote to memory of 2320 2192 xfxfrxl.exe 31 PID 2192 wrote to memory of 2320 2192 xfxfrxl.exe 31 PID 2320 wrote to memory of 1740 2320 btnhth.exe 32 PID 2320 wrote to memory of 1740 2320 btnhth.exe 32 PID 2320 wrote to memory of 1740 2320 btnhth.exe 32 PID 2320 wrote to memory of 1740 2320 btnhth.exe 32 PID 1740 wrote to memory of 2808 1740 ntthbn.exe 33 PID 1740 wrote to memory of 2808 1740 ntthbn.exe 33 PID 1740 wrote to memory of 2808 1740 ntthbn.exe 33 PID 1740 wrote to memory of 2808 1740 ntthbn.exe 33 PID 2808 wrote to memory of 2728 2808 jpjvj.exe 34 PID 2808 wrote to memory of 2728 2808 jpjvj.exe 34 PID 2808 wrote to memory of 2728 2808 jpjvj.exe 34 PID 2808 wrote to memory of 2728 2808 jpjvj.exe 34 PID 2728 wrote to memory of 2920 2728 fflrxfr.exe 35 PID 2728 wrote to memory of 2920 2728 fflrxfr.exe 35 PID 2728 wrote to memory of 2920 2728 fflrxfr.exe 35 PID 2728 wrote to memory of 2920 2728 fflrxfr.exe 35 PID 2920 wrote to memory of 2880 2920 bbtbtt.exe 36 PID 2920 wrote to memory of 2880 2920 bbtbtt.exe 36 PID 2920 wrote to memory of 2880 2920 bbtbtt.exe 36 PID 2920 wrote to memory of 2880 2920 bbtbtt.exe 36 PID 2880 wrote to memory of 2888 2880 djpjp.exe 37 PID 2880 wrote to memory of 2888 2880 djpjp.exe 37 PID 2880 wrote to memory of 2888 2880 djpjp.exe 37 PID 2880 wrote to memory of 2888 2880 djpjp.exe 37 PID 2888 wrote to memory of 2760 2888 xffxrfl.exe 38 PID 2888 wrote to memory of 2760 2888 xffxrfl.exe 38 PID 2888 wrote to memory of 2760 2888 xffxrfl.exe 38 PID 2888 wrote to memory of 2760 2888 xffxrfl.exe 38 PID 2760 wrote to memory of 2616 2760 hbntnb.exe 39 PID 2760 wrote to memory of 2616 2760 hbntnb.exe 39 PID 2760 wrote to memory of 2616 2760 hbntnb.exe 39 PID 2760 wrote to memory of 2616 2760 hbntnb.exe 39 PID 2616 wrote to memory of 2052 2616 3ntnnb.exe 75 PID 2616 wrote to memory of 2052 2616 3ntnnb.exe 75 PID 2616 wrote to memory of 2052 2616 3ntnnb.exe 75 PID 2616 wrote to memory of 2052 2616 3ntnnb.exe 75 PID 2052 wrote to memory of 2404 2052 vppjj.exe 41 PID 2052 wrote to memory of 2404 2052 vppjj.exe 41 PID 2052 wrote to memory of 2404 2052 vppjj.exe 41 PID 2052 wrote to memory of 2404 2052 vppjj.exe 41 PID 2404 wrote to memory of 980 2404 lllrrrx.exe 42 PID 2404 wrote to memory of 980 2404 lllrrrx.exe 42 PID 2404 wrote to memory of 980 2404 lllrrrx.exe 42 PID 2404 wrote to memory of 980 2404 lllrrrx.exe 42 PID 980 wrote to memory of 1332 980 tnhntn.exe 43 PID 980 wrote to memory of 1332 980 tnhntn.exe 43 PID 980 wrote to memory of 1332 980 tnhntn.exe 43 PID 980 wrote to memory of 1332 980 tnhntn.exe 43 PID 1332 wrote to memory of 2992 1332 nthbtn.exe 44 PID 1332 wrote to memory of 2992 1332 nthbtn.exe 44 PID 1332 wrote to memory of 2992 1332 nthbtn.exe 44 PID 1332 wrote to memory of 2992 1332 nthbtn.exe 44 PID 2992 wrote to memory of 2840 2992 pjdjv.exe 45 PID 2992 wrote to memory of 2840 2992 pjdjv.exe 45 PID 2992 wrote to memory of 2840 2992 pjdjv.exe 45 PID 2992 wrote to memory of 2840 2992 pjdjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe"C:\Users\Admin\AppData\Local\Temp\ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xfxfrxl.exec:\xfxfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\btnhth.exec:\btnhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\ntthbn.exec:\ntthbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jpjvj.exec:\jpjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\fflrxfr.exec:\fflrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bbtbtt.exec:\bbtbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\djpjp.exec:\djpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xffxrfl.exec:\xffxrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hbntnb.exec:\hbntnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\3ntnnb.exec:\3ntnnb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vppjj.exec:\vppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\lllrrrx.exec:\lllrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\tnhntn.exec:\tnhntn.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nthbtn.exec:\nthbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\pjdjv.exec:\pjdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\fflrlxr.exec:\fflrlxr.exe17⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7xxrlxr.exec:\7xxrlxr.exe18⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ntthhh.exec:\ntthhh.exe19⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jvvjd.exec:\jvvjd.exe20⤵
- Executes dropped EXE
PID:1860 -
\??\c:\llxrrrr.exec:\llxrrrr.exe21⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hbtbnt.exec:\hbtbnt.exe22⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7pjvp.exec:\7pjvp.exe23⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vpvdp.exec:\vpvdp.exe24⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5rxflxx.exec:\5rxflxx.exe25⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ntntbh.exec:\ntntbh.exe26⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7ddjj.exec:\7ddjj.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jpjdd.exec:\jpjdd.exe28⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hnbhnt.exec:\hnbhnt.exe29⤵
- Executes dropped EXE
PID:3048 -
\??\c:\dvpdd.exec:\dvpdd.exe30⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrrlxlx.exec:\xrrlxlx.exe31⤵
- Executes dropped EXE
PID:780 -
\??\c:\tnhnbn.exec:\tnhnbn.exe32⤵
- Executes dropped EXE
PID:1724 -
\??\c:\tbtbhn.exec:\tbtbhn.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ppjvp.exec:\ppjvp.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xxrxlrr.exec:\xxrxlrr.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\ntnbnb.exec:\ntnbnb.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dddvd.exec:\dddvd.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7vppp.exec:\7vppp.exe38⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrxxlff.exec:\lrxxlff.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\nnnhbh.exec:\nnnhbh.exe40⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bbbtht.exec:\bbbtht.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\djvjj.exec:\djvjj.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7lflrlf.exec:\7lflrlf.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbhntn.exec:\hbhntn.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ntntnn.exec:\ntntnn.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\9ppvp.exec:\9ppvp.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tbntbh.exec:\tbntbh.exe47⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7bhttn.exec:\7bhttn.exe48⤵
- Executes dropped EXE
PID:2324 -
\??\c:\fflxfrr.exec:\fflxfrr.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nthbbh.exec:\nthbbh.exe50⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bhhnth.exec:\bhhnth.exe51⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rrlflxr.exec:\rrlflxr.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bnbnnh.exec:\bnbnnh.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jjvvj.exec:\jjvvj.exe54⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lrlxrfx.exec:\lrlxrfx.exe55⤵
- Executes dropped EXE
PID:2516 -
\??\c:\frlffxl.exec:\frlffxl.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980 -
\??\c:\pjpvd.exec:\pjpvd.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9djvj.exec:\9djvj.exe58⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe59⤵
- Executes dropped EXE
PID:1152 -
\??\c:\9nhnbh.exec:\9nhnbh.exe60⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bthnbh.exec:\bthnbh.exe61⤵
- Executes dropped EXE
PID:996 -
\??\c:\hnnnhn.exec:\hnnnhn.exe62⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vvvpp.exec:\vvvpp.exe63⤵
- Executes dropped EXE
PID:276 -
\??\c:\1lfflrf.exec:\1lfflrf.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\ntbbbn.exec:\ntbbbn.exe65⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jpjjv.exec:\jpjjv.exe66⤵PID:1468
-
\??\c:\frrffrf.exec:\frrffrf.exe67⤵PID:1032
-
\??\c:\nhbnbt.exec:\nhbnbt.exe68⤵PID:1644
-
\??\c:\dddvv.exec:\dddvv.exe69⤵PID:564
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe70⤵PID:556
-
\??\c:\rlfxlrf.exec:\rlfxlrf.exe71⤵PID:1508
-
\??\c:\bbbnth.exec:\bbbnth.exe72⤵PID:880
-
\??\c:\jjdjd.exec:\jjdjd.exe73⤵PID:2408
-
\??\c:\rlflffr.exec:\rlflffr.exe74⤵PID:3024
-
\??\c:\3tbnhn.exec:\3tbnhn.exe75⤵
- System Location Discovery: System Language Discovery
PID:2336 -
\??\c:\vdpdp.exec:\vdpdp.exe76⤵PID:2560
-
\??\c:\rxxrrxf.exec:\rxxrrxf.exe77⤵PID:2204
-
\??\c:\lffxxrr.exec:\lffxxrr.exe78⤵PID:2340
-
\??\c:\bbhtbn.exec:\bbhtbn.exe79⤵PID:2996
-
\??\c:\vppvp.exec:\vppvp.exe80⤵PID:912
-
\??\c:\7rrflxl.exec:\7rrflxl.exe81⤵PID:340
-
\??\c:\5rxlrxl.exec:\5rxlrxl.exe82⤵PID:2892
-
\??\c:\tttnht.exec:\tttnht.exe83⤵PID:2776
-
\??\c:\1dvdj.exec:\1dvdj.exe84⤵PID:2884
-
\??\c:\llffrxr.exec:\llffrxr.exe85⤵PID:2880
-
\??\c:\3bnbbh.exec:\3bnbbh.exe86⤵PID:2528
-
\??\c:\pjdpj.exec:\pjdpj.exe87⤵PID:2640
-
\??\c:\1vddj.exec:\1vddj.exe88⤵PID:2616
-
\??\c:\xxrrflf.exec:\xxrrflf.exe89⤵PID:2900
-
\??\c:\thhnbt.exec:\thhnbt.exe90⤵PID:2788
-
\??\c:\jjdpd.exec:\jjdpd.exe91⤵PID:2772
-
\??\c:\jddjp.exec:\jddjp.exe92⤵PID:2304
-
\??\c:\xllrfrl.exec:\xllrfrl.exe93⤵PID:2744
-
\??\c:\5bnhnb.exec:\5bnhnb.exe94⤵PID:1464
-
\??\c:\djdvj.exec:\djdvj.exe95⤵PID:2992
-
\??\c:\xrrflxl.exec:\xrrflxl.exe96⤵PID:2720
-
\??\c:\llrfffx.exec:\llrfffx.exe97⤵PID:1776
-
\??\c:\nhhhtb.exec:\nhhhtb.exe98⤵PID:1808
-
\??\c:\dddjv.exec:\dddjv.exe99⤵PID:2684
-
\??\c:\xxlrrlr.exec:\xxlrrlr.exe100⤵PID:2132
-
\??\c:\rxxffrr.exec:\rxxffrr.exe101⤵PID:1968
-
\??\c:\tbbnbn.exec:\tbbnbn.exe102⤵PID:2184
-
\??\c:\3jpdj.exec:\3jpdj.exe103⤵PID:2268
-
\??\c:\llrrlxx.exec:\llrrlxx.exe104⤵PID:1092
-
\??\c:\nnhtbh.exec:\nnhtbh.exe105⤵PID:1136
-
\??\c:\bhbtnb.exec:\bhbtnb.exe106⤵PID:292
-
\??\c:\pdvjp.exec:\pdvjp.exe107⤵PID:2096
-
\??\c:\3rxlrfr.exec:\3rxlrfr.exe108⤵PID:2476
-
\??\c:\tthbnb.exec:\tthbnb.exe109⤵PID:2428
-
\??\c:\7dpvj.exec:\7dpvj.exe110⤵PID:2076
-
\??\c:\ffrxrrf.exec:\ffrxrrf.exe111⤵PID:1564
-
\??\c:\tthnhn.exec:\tthnhn.exe112⤵PID:1108
-
\??\c:\thhhhn.exec:\thhhhn.exe113⤵PID:1904
-
\??\c:\ppjpp.exec:\ppjpp.exe114⤵PID:1692
-
\??\c:\flfrxxx.exec:\flfrxxx.exe115⤵PID:2056
-
\??\c:\bhhhtb.exec:\bhhhtb.exe116⤵PID:2540
-
\??\c:\dvppv.exec:\dvppv.exe117⤵PID:2280
-
\??\c:\rrrxllf.exec:\rrrxllf.exe118⤵PID:2196
-
\??\c:\ntnbhb.exec:\ntnbhb.exe119⤵PID:2120
-
\??\c:\bnhbth.exec:\bnhbth.exe120⤵PID:1044
-
\??\c:\dvvdp.exec:\dvvdp.exe121⤵PID:1812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-