Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe
-
Size
456KB
-
MD5
044668876e12d7f363d79c7140dfefb9
-
SHA1
0c097638e6ab05e6eec80e4a1459a2d077cb705e
-
SHA256
946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b
-
SHA512
6951a635a483bfc9b5fd25febcd3a1301797f78bee219fa90cdafa0b09f3d58ddbc6279ddf320d161834095430d85ad3ac8b53ed7df146cbc80ae8299887c091
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-72-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2608-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-146-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1720-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-328-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2236-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-367-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1524-511-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1788-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-595-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1260-627-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-634-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2752-641-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2244-709-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-766-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2992-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-894-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1744-1110-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2444-1254-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1448-1280-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/756-1286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-1307-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 1hhtbh.exe 308 dvpvj.exe 1624 hnbhbh.exe 1080 tnhntn.exe 2412 bnhhnn.exe 1260 9pvvp.exe 2116 ffflxlx.exe 2736 1hhthn.exe 2608 pjjjp.exe 2252 7jjdj.exe 2980 9xlxffl.exe 2480 3vjpv.exe 2984 7vddv.exe 2948 rrlrlxx.exe 2032 bbtbbb.exe 2380 1dvjv.exe 1720 ttthnt.exe 2040 bbhhtb.exe 2272 5tnbnt.exe 2424 rxxxxrx.exe 1848 nnbhbh.exe 1952 hbtnbh.exe 2800 5pjpj.exe 2336 xrflxfx.exe 1788 tnbhtb.exe 1368 nhtbnt.exe 2420 5jdjp.exe 2888 ffllffr.exe 544 frlflxr.exe 352 9pddp.exe 1740 lxllllr.exe 2092 hhtbtb.exe 2052 9vjjd.exe 1732 1xfxxxr.exe 1580 hbnhnh.exe 2408 vvjvj.exe 1240 vpjdj.exe 2236 9xffffl.exe 2084 5ttbnn.exe 2260 hbnntt.exe 2592 jjdpd.exe 2612 fxflxrx.exe 2748 1lrxlrf.exe 2488 nbhhtt.exe 2644 7pdjv.exe 2784 rlfflfr.exe 2536 rrlrxfl.exe 2296 1btbbh.exe 2480 7vppp.exe 2216 7dpvd.exe 2656 rrxxlfr.exe 1968 flxxfxx.exe 648 hnbhbh.exe 1668 vvppd.exe 2240 xrlrflx.exe 832 1rfflfl.exe 1796 hbtbhh.exe 1632 dvdjj.exe 1932 jpjjd.exe 1848 fxllrrl.exe 2796 1nntbb.exe 2468 ththnn.exe 2404 ddpjv.exe 2316 vjpdd.exe -
resource yara_rule behavioral1/memory/2868-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-183-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1848-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-367-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2488-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-450-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1632-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-1095-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-1350-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2192 2868 946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe 28 PID 2868 wrote to memory of 2192 2868 946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe 28 PID 2868 wrote to memory of 2192 2868 946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe 28 PID 2868 wrote to memory of 2192 2868 946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe 28 PID 2192 wrote to memory of 308 2192 1hhtbh.exe 29 PID 2192 wrote to memory of 308 2192 1hhtbh.exe 29 PID 2192 wrote to memory of 308 2192 1hhtbh.exe 29 PID 2192 wrote to memory of 308 2192 1hhtbh.exe 29 PID 308 wrote to memory of 1624 308 dvpvj.exe 30 PID 308 wrote to memory of 1624 308 dvpvj.exe 30 PID 308 wrote to memory of 1624 308 dvpvj.exe 30 PID 308 wrote to memory of 1624 308 dvpvj.exe 30 PID 1624 wrote to memory of 1080 1624 hnbhbh.exe 31 PID 1624 wrote to memory of 1080 1624 hnbhbh.exe 31 PID 1624 wrote to memory of 1080 1624 hnbhbh.exe 31 PID 1624 wrote to memory of 1080 1624 hnbhbh.exe 31 PID 1080 wrote to memory of 2412 1080 tnhntn.exe 32 PID 1080 wrote to memory of 2412 1080 tnhntn.exe 32 PID 1080 wrote to memory of 2412 1080 tnhntn.exe 32 PID 1080 wrote to memory of 2412 1080 tnhntn.exe 32 PID 2412 wrote to memory of 1260 2412 bnhhnn.exe 33 PID 2412 wrote to memory of 1260 2412 bnhhnn.exe 33 PID 2412 wrote to memory of 1260 2412 bnhhnn.exe 33 PID 2412 wrote to memory of 1260 2412 bnhhnn.exe 33 PID 1260 wrote to memory of 2116 1260 9pvvp.exe 34 PID 1260 wrote to memory of 2116 1260 9pvvp.exe 34 PID 1260 wrote to memory of 2116 1260 9pvvp.exe 34 PID 1260 wrote to memory of 2116 1260 9pvvp.exe 34 PID 2116 wrote to memory of 2736 2116 ffflxlx.exe 35 PID 2116 wrote to memory of 2736 2116 ffflxlx.exe 35 PID 2116 wrote to memory of 2736 2116 ffflxlx.exe 35 PID 2116 wrote to memory of 2736 2116 ffflxlx.exe 35 PID 2736 wrote to memory of 2608 2736 1hhthn.exe 36 PID 2736 wrote to memory of 2608 2736 1hhthn.exe 36 PID 2736 wrote to memory of 2608 2736 1hhthn.exe 36 PID 2736 wrote to memory of 2608 2736 1hhthn.exe 36 PID 2608 wrote to memory of 2252 2608 pjjjp.exe 37 PID 2608 wrote to memory of 2252 2608 pjjjp.exe 37 PID 2608 wrote to memory of 2252 2608 pjjjp.exe 37 PID 2608 wrote to memory of 2252 2608 pjjjp.exe 37 PID 2252 wrote to memory of 2980 2252 7jjdj.exe 38 PID 2252 wrote to memory of 2980 2252 7jjdj.exe 38 PID 2252 wrote to memory of 2980 2252 7jjdj.exe 38 PID 2252 wrote to memory of 2980 2252 7jjdj.exe 38 PID 2980 wrote to memory of 2480 2980 9xlxffl.exe 39 PID 2980 wrote to memory of 2480 2980 9xlxffl.exe 39 PID 2980 wrote to memory of 2480 2980 9xlxffl.exe 39 PID 2980 wrote to memory of 2480 2980 9xlxffl.exe 39 PID 2480 wrote to memory of 2984 2480 3vjpv.exe 40 PID 2480 wrote to memory of 2984 2480 3vjpv.exe 40 PID 2480 wrote to memory of 2984 2480 3vjpv.exe 40 PID 2480 wrote to memory of 2984 2480 3vjpv.exe 40 PID 2984 wrote to memory of 2948 2984 7vddv.exe 41 PID 2984 wrote to memory of 2948 2984 7vddv.exe 41 PID 2984 wrote to memory of 2948 2984 7vddv.exe 41 PID 2984 wrote to memory of 2948 2984 7vddv.exe 41 PID 2948 wrote to memory of 2032 2948 rrlrlxx.exe 42 PID 2948 wrote to memory of 2032 2948 rrlrlxx.exe 42 PID 2948 wrote to memory of 2032 2948 rrlrlxx.exe 42 PID 2948 wrote to memory of 2032 2948 rrlrlxx.exe 42 PID 2032 wrote to memory of 2380 2032 bbtbbb.exe 43 PID 2032 wrote to memory of 2380 2032 bbtbbb.exe 43 PID 2032 wrote to memory of 2380 2032 bbtbbb.exe 43 PID 2032 wrote to memory of 2380 2032 bbtbbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe"C:\Users\Admin\AppData\Local\Temp\946746ddfedd9d72bbc7f32577611fb39f62f27fd0d95a4fcaf22683e69baf7b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\1hhtbh.exec:\1hhtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\dvpvj.exec:\dvpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\hnbhbh.exec:\hnbhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\tnhntn.exec:\tnhntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\bnhhnn.exec:\bnhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\9pvvp.exec:\9pvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\ffflxlx.exec:\ffflxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\1hhthn.exec:\1hhthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pjjjp.exec:\pjjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\7jjdj.exec:\7jjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\9xlxffl.exec:\9xlxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3vjpv.exec:\3vjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\7vddv.exec:\7vddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rrlrlxx.exec:\rrlrlxx.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bbtbbb.exec:\bbtbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\1dvjv.exec:\1dvjv.exe17⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ttthnt.exec:\ttthnt.exe18⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bbhhtb.exec:\bbhhtb.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5tnbnt.exec:\5tnbnt.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rxxxxrx.exec:\rxxxxrx.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nnbhbh.exec:\nnbhbh.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1848 -
\??\c:\hbtnbh.exec:\hbtnbh.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5pjpj.exec:\5pjpj.exe24⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xrflxfx.exec:\xrflxfx.exe25⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tnbhtb.exec:\tnbhtb.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nhtbnt.exec:\nhtbnt.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5jdjp.exec:\5jdjp.exe28⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ffllffr.exec:\ffllffr.exe29⤵
- Executes dropped EXE
PID:2888 -
\??\c:\frlflxr.exec:\frlflxr.exe30⤵
- Executes dropped EXE
PID:544 -
\??\c:\9pddp.exec:\9pddp.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:352 -
\??\c:\lxllllr.exec:\lxllllr.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hhtbtb.exec:\hhtbtb.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9vjjd.exec:\9vjjd.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1xfxxxr.exec:\1xfxxxr.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbnhnh.exec:\hbnhnh.exe36⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vvjvj.exec:\vvjvj.exe37⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vpjdj.exec:\vpjdj.exe38⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9xffffl.exec:\9xffffl.exe39⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5ttbnn.exec:\5ttbnn.exe40⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbnntt.exec:\hbnntt.exe41⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjdpd.exec:\jjdpd.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxflxrx.exec:\fxflxrx.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1lrxlrf.exec:\1lrxlrf.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nbhhtt.exec:\nbhhtt.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7pdjv.exec:\7pdjv.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rlfflfr.exec:\rlfflfr.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe48⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1btbbh.exec:\1btbbh.exe49⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7vppp.exec:\7vppp.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7dpvd.exec:\7dpvd.exe51⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rrxxlfr.exec:\rrxxlfr.exe52⤵
- Executes dropped EXE
PID:2656 -
\??\c:\flxxfxx.exec:\flxxfxx.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hnbhbh.exec:\hnbhbh.exe54⤵
- Executes dropped EXE
PID:648 -
\??\c:\vvppd.exec:\vvppd.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xrlrflx.exec:\xrlrflx.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1rfflfl.exec:\1rfflfl.exe57⤵
- Executes dropped EXE
PID:832 -
\??\c:\hbtbhh.exec:\hbtbhh.exe58⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dvdjj.exec:\dvdjj.exe59⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jpjjd.exec:\jpjjd.exe60⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fxllrrl.exec:\fxllrrl.exe61⤵
- Executes dropped EXE
PID:1848 -
\??\c:\1nntbb.exec:\1nntbb.exe62⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ththnn.exec:\ththnn.exe63⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ddpjv.exec:\ddpjv.exe64⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vjpdd.exec:\vjpdd.exe65⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfffrxl.exec:\rfffrxl.exe66⤵PID:2812
-
\??\c:\thttnn.exec:\thttnn.exe67⤵PID:1524
-
\??\c:\jddjp.exec:\jddjp.exe68⤵PID:1788
-
\??\c:\1dppj.exec:\1dppj.exe69⤵PID:784
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe70⤵PID:1548
-
\??\c:\tnhhnn.exec:\tnhhnn.exe71⤵PID:3028
-
\??\c:\7bnnnn.exec:\7bnnnn.exe72⤵PID:3040
-
\??\c:\vpddd.exec:\vpddd.exe73⤵PID:2144
-
\??\c:\rlflffl.exec:\rlflffl.exe74⤵PID:2096
-
\??\c:\xrfrxxl.exec:\xrfrxxl.exe75⤵PID:2992
-
\??\c:\7hbhhh.exec:\7hbhhh.exe76⤵PID:3056
-
\??\c:\5dppp.exec:\5dppp.exe77⤵PID:2400
-
\??\c:\pvpvj.exec:\pvpvj.exe78⤵PID:1636
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe79⤵PID:1732
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe80⤵PID:2776
-
\??\c:\9thbhh.exec:\9thbhh.exe81⤵PID:2408
-
\??\c:\ppddv.exec:\ppddv.exe82⤵PID:1056
-
\??\c:\9llfllr.exec:\9llfllr.exe83⤵PID:2236
-
\??\c:\7rxfllr.exec:\7rxfllr.exe84⤵PID:2248
-
\??\c:\3tbbbb.exec:\3tbbbb.exe85⤵PID:1260
-
\??\c:\5bbbnt.exec:\5bbbnt.exe86⤵PID:2628
-
\??\c:\pjvvd.exec:\pjvvd.exe87⤵PID:2752
-
\??\c:\5xlxlxf.exec:\5xlxlxf.exe88⤵PID:3020
-
\??\c:\7bttbt.exec:\7bttbt.exe89⤵PID:2600
-
\??\c:\5tbbbb.exec:\5tbbbb.exe90⤵PID:2684
-
\??\c:\3dpvj.exec:\3dpvj.exe91⤵PID:2528
-
\??\c:\9frrrrx.exec:\9frrrrx.exe92⤵PID:2680
-
\??\c:\xxrxllr.exec:\xxrxllr.exe93⤵PID:2492
-
\??\c:\9nhbnt.exec:\9nhbnt.exe94⤵PID:2532
-
\??\c:\jdppv.exec:\jdppv.exe95⤵PID:2940
-
\??\c:\3djdj.exec:\3djdj.exe96⤵PID:1840
-
\??\c:\9fxxlrf.exec:\9fxxlrf.exe97⤵PID:1592
-
\??\c:\9tnthn.exec:\9tnthn.exe98⤵PID:2244
-
\??\c:\5bhnht.exec:\5bhnht.exe99⤵PID:1344
-
\??\c:\vppvj.exec:\vppvj.exe100⤵PID:1992
-
\??\c:\rfrxllr.exec:\rfrxllr.exe101⤵PID:2040
-
\??\c:\7tbntt.exec:\7tbntt.exe102⤵PID:756
-
\??\c:\bbbbnt.exec:\bbbbnt.exe103⤵PID:1060
-
\??\c:\3vdvv.exec:\3vdvv.exe104⤵PID:1904
-
\??\c:\lfxxxfr.exec:\lfxxxfr.exe105⤵PID:1936
-
\??\c:\llxxllx.exec:\llxxllx.exe106⤵PID:2572
-
\??\c:\3ntbbh.exec:\3ntbbh.exe107⤵PID:1912
-
\??\c:\jdvdp.exec:\jdvdp.exe108⤵PID:2580
-
\??\c:\dddjj.exec:\dddjj.exe109⤵PID:1132
-
\??\c:\rrllffx.exec:\rrllffx.exe110⤵PID:2828
-
\??\c:\hbbnbb.exec:\hbbnbb.exe111⤵PID:3044
-
\??\c:\9tbbhn.exec:\9tbbhn.exe112⤵PID:3068
-
\??\c:\pdvvd.exec:\pdvvd.exe113⤵PID:880
-
\??\c:\rllrlrf.exec:\rllrlrf.exe114⤵PID:564
-
\??\c:\9nnhnh.exec:\9nnhnh.exe115⤵PID:344
-
\??\c:\hhbbtt.exec:\hhbbtt.exe116⤵PID:2128
-
\??\c:\dpjjp.exec:\dpjjp.exe117⤵PID:352
-
\??\c:\3rrxxxl.exec:\3rrxxxl.exe118⤵PID:2096
-
\??\c:\lffrxfl.exec:\lffrxfl.exe119⤵PID:2992
-
\??\c:\1htthh.exec:\1htthh.exe120⤵PID:1640
-
\??\c:\tnbbbh.exec:\tnbbbh.exe121⤵PID:2400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-