Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe
-
Size
453KB
-
MD5
a06d0b209997c77d96bb03c09588f2c2
-
SHA1
bbce60392a0d95e96663e58a68ca0898894e7f92
-
SHA256
ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a
-
SHA512
436c5485ef5b777d91a585d5b678c5026198cedad8e12ad21bb8a289dbd6cdc0731402695205b9edefe544cbae136ea59080a0608f130019755c21551fb616fd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1872-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1604-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-183-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2368-164-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1800-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-98-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-303-0x00000000774D0000-0x00000000775EF000-memory.dmp family_blackmoon behavioral1/memory/2860-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-320-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1520-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-410-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2148-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-555-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2840-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-693-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/112-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-755-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2024-772-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2012-779-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2612-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-854-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-879-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-965-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2228-1004-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 nhttbb.exe 1908 9jddv.exe 1916 5xrlrxl.exe 2520 3bnntt.exe 1680 bntbbb.exe 2308 nbhntn.exe 2956 jdjjv.exe 2640 lfrflrx.exe 2568 thntbh.exe 2596 bbtbhn.exe 2464 7lffxxf.exe 2696 jjvvj.exe 2512 jvpjp.exe 2880 rrfxxxf.exe 1800 5ntbhh.exe 1608 jvdvd.exe 2368 frffrlr.exe 812 dpjjp.exe 2220 7xfffff.exe 2000 bbtnbh.exe 1216 lxllrrf.exe 2744 lfrrrrx.exe 1604 3djdj.exe 1144 7lxrrrr.exe 764 nnhhnn.exe 1696 vpjpp.exe 912 3lxxffl.exe 2816 7xrrflx.exe 1552 7xxxlrx.exe 1672 nnbhbb.exe 2976 jvppp.exe 1432 1tnhnt.exe 1836 bthnbh.exe 1520 lfxxlrx.exe 2316 pvpvv.exe 1812 lfrrxfl.exe 2888 htnntt.exe 1684 1pjpp.exe 2784 1lrrxfr.exe 2644 xfxrffr.exe 2684 thbhhh.exe 2552 9vjjj.exe 2296 bnbthb.exe 2472 7ttttt.exe 2596 rlxxflx.exe 2136 bnbbnn.exe 2440 jvvdv.exe 2696 xrlrrxl.exe 2148 fxlxrrr.exe 2508 nnthhh.exe 2484 jvvdp.exe 1800 1fxxxfr.exe 1736 rlflrrf.exe 308 nthttb.exe 2352 1jvdp.exe 812 5pdvv.exe 1888 lxfflll.exe 1988 hnbbhb.exe 2000 3pdvd.exe 2424 dpddd.exe 1324 xlrrlff.exe 1716 bnbbnn.exe 2676 7tnnbh.exe 284 djpdv.exe -
resource yara_rule behavioral1/memory/1872-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-154-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2368-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-303-0x00000000774D0000-0x00000000775EF000-memory.dmp upx behavioral1/memory/2860-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-467-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2000-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-918-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-1004-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2344-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2864 1872 ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe 28 PID 1872 wrote to memory of 2864 1872 ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe 28 PID 1872 wrote to memory of 2864 1872 ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe 28 PID 1872 wrote to memory of 2864 1872 ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe 28 PID 2864 wrote to memory of 1908 2864 nhttbb.exe 29 PID 2864 wrote to memory of 1908 2864 nhttbb.exe 29 PID 2864 wrote to memory of 1908 2864 nhttbb.exe 29 PID 2864 wrote to memory of 1908 2864 nhttbb.exe 29 PID 1908 wrote to memory of 1916 1908 9jddv.exe 30 PID 1908 wrote to memory of 1916 1908 9jddv.exe 30 PID 1908 wrote to memory of 1916 1908 9jddv.exe 30 PID 1908 wrote to memory of 1916 1908 9jddv.exe 30 PID 1916 wrote to memory of 2520 1916 5xrlrxl.exe 31 PID 1916 wrote to memory of 2520 1916 5xrlrxl.exe 31 PID 1916 wrote to memory of 2520 1916 5xrlrxl.exe 31 PID 1916 wrote to memory of 2520 1916 5xrlrxl.exe 31 PID 2520 wrote to memory of 1680 2520 3bnntt.exe 32 PID 2520 wrote to memory of 1680 2520 3bnntt.exe 32 PID 2520 wrote to memory of 1680 2520 3bnntt.exe 32 PID 2520 wrote to memory of 1680 2520 3bnntt.exe 32 PID 1680 wrote to memory of 2308 1680 bntbbb.exe 33 PID 1680 wrote to memory of 2308 1680 bntbbb.exe 33 PID 1680 wrote to memory of 2308 1680 bntbbb.exe 33 PID 1680 wrote to memory of 2308 1680 bntbbb.exe 33 PID 2308 wrote to memory of 2956 2308 nbhntn.exe 34 PID 2308 wrote to memory of 2956 2308 nbhntn.exe 34 PID 2308 wrote to memory of 2956 2308 nbhntn.exe 34 PID 2308 wrote to memory of 2956 2308 nbhntn.exe 34 PID 2956 wrote to memory of 2640 2956 jdjjv.exe 35 PID 2956 wrote to memory of 2640 2956 jdjjv.exe 35 PID 2956 wrote to memory of 2640 2956 jdjjv.exe 35 PID 2956 wrote to memory of 2640 2956 jdjjv.exe 35 PID 2640 wrote to memory of 2568 2640 lfrflrx.exe 36 PID 2640 wrote to memory of 2568 2640 lfrflrx.exe 36 PID 2640 wrote to memory of 2568 2640 lfrflrx.exe 36 PID 2640 wrote to memory of 2568 2640 lfrflrx.exe 36 PID 2568 wrote to memory of 2596 2568 thntbh.exe 37 PID 2568 wrote to memory of 2596 2568 thntbh.exe 37 PID 2568 wrote to memory of 2596 2568 thntbh.exe 37 PID 2568 wrote to memory of 2596 2568 thntbh.exe 37 PID 2596 wrote to memory of 2464 2596 bbtbhn.exe 38 PID 2596 wrote to memory of 2464 2596 bbtbhn.exe 38 PID 2596 wrote to memory of 2464 2596 bbtbhn.exe 38 PID 2596 wrote to memory of 2464 2596 bbtbhn.exe 38 PID 2464 wrote to memory of 2696 2464 7lffxxf.exe 39 PID 2464 wrote to memory of 2696 2464 7lffxxf.exe 39 PID 2464 wrote to memory of 2696 2464 7lffxxf.exe 39 PID 2464 wrote to memory of 2696 2464 7lffxxf.exe 39 PID 2696 wrote to memory of 2512 2696 jjvvj.exe 40 PID 2696 wrote to memory of 2512 2696 jjvvj.exe 40 PID 2696 wrote to memory of 2512 2696 jjvvj.exe 40 PID 2696 wrote to memory of 2512 2696 jjvvj.exe 40 PID 2512 wrote to memory of 2880 2512 jvpjp.exe 41 PID 2512 wrote to memory of 2880 2512 jvpjp.exe 41 PID 2512 wrote to memory of 2880 2512 jvpjp.exe 41 PID 2512 wrote to memory of 2880 2512 jvpjp.exe 41 PID 2880 wrote to memory of 1800 2880 rrfxxxf.exe 42 PID 2880 wrote to memory of 1800 2880 rrfxxxf.exe 42 PID 2880 wrote to memory of 1800 2880 rrfxxxf.exe 42 PID 2880 wrote to memory of 1800 2880 rrfxxxf.exe 42 PID 1800 wrote to memory of 1608 1800 5ntbhh.exe 43 PID 1800 wrote to memory of 1608 1800 5ntbhh.exe 43 PID 1800 wrote to memory of 1608 1800 5ntbhh.exe 43 PID 1800 wrote to memory of 1608 1800 5ntbhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe"C:\Users\Admin\AppData\Local\Temp\ff7ba13f223d6d9318c588f9c01773be7190e8cb4e48a037033fdecaaee3842a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\nhttbb.exec:\nhttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\9jddv.exec:\9jddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\5xrlrxl.exec:\5xrlrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\3bnntt.exec:\3bnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bntbbb.exec:\bntbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\nbhntn.exec:\nbhntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jdjjv.exec:\jdjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lfrflrx.exec:\lfrflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\thntbh.exec:\thntbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\bbtbhn.exec:\bbtbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\7lffxxf.exec:\7lffxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\jjvvj.exec:\jjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jvpjp.exec:\jvpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rrfxxxf.exec:\rrfxxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\5ntbhh.exec:\5ntbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\jvdvd.exec:\jvdvd.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\frffrlr.exec:\frffrlr.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dpjjp.exec:\dpjjp.exe19⤵
- Executes dropped EXE
PID:812 -
\??\c:\7xfffff.exec:\7xfffff.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bbtnbh.exec:\bbtnbh.exe21⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lxllrrf.exec:\lxllrrf.exe22⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe23⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3djdj.exec:\3djdj.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7lxrrrr.exec:\7lxrrrr.exe25⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nnhhnn.exec:\nnhhnn.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\vpjpp.exec:\vpjpp.exe27⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3lxxffl.exec:\3lxxffl.exe28⤵
- Executes dropped EXE
PID:912 -
\??\c:\7xrrflx.exec:\7xrrflx.exe29⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7xxxlrx.exec:\7xxxlrx.exe30⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nnbhbb.exec:\nnbhbb.exe31⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jvppp.exec:\jvppp.exe32⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1tnhnt.exec:\1tnhnt.exe33⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bthnbh.exec:\bthnbh.exe34⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dpddd.exec:\dpddd.exe35⤵PID:2860
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pvpvv.exec:\pvpvv.exe37⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe38⤵
- Executes dropped EXE
PID:1812 -
\??\c:\htnntt.exec:\htnntt.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1pjpp.exec:\1pjpp.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1lrrxfr.exec:\1lrrxfr.exe41⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xfxrffr.exec:\xfxrffr.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\thbhhh.exec:\thbhhh.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9vjjj.exec:\9vjjj.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bnbthb.exec:\bnbthb.exe45⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7ttttt.exec:\7ttttt.exe46⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rlxxflx.exec:\rlxxflx.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bnbbnn.exec:\bnbbnn.exe48⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jvvdv.exec:\jvvdv.exe49⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrlrrxl.exec:\xrlrrxl.exe50⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxlxrrr.exec:\fxlxrrr.exe51⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nnthhh.exec:\nnthhh.exe52⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvvdp.exec:\jvvdp.exe53⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1fxxxfr.exec:\1fxxxfr.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rlflrrf.exec:\rlflrrf.exe55⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nthttb.exec:\nthttb.exe56⤵
- Executes dropped EXE
PID:308 -
\??\c:\1jvdp.exec:\1jvdp.exe57⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5pdvv.exec:\5pdvv.exe58⤵
- Executes dropped EXE
PID:812 -
\??\c:\lxfflll.exec:\lxfflll.exe59⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hnbbhb.exec:\hnbbhb.exe60⤵
- Executes dropped EXE
PID:1988 -
\??\c:\3pdvd.exec:\3pdvd.exe61⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dpddd.exec:\dpddd.exe62⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xlrrlff.exec:\xlrrlff.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bnbbnn.exec:\bnbbnn.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7tnnbh.exec:\7tnnbh.exe65⤵
- Executes dropped EXE
PID:2676 -
\??\c:\djpdv.exec:\djpdv.exe66⤵
- Executes dropped EXE
PID:284 -
\??\c:\xrfffrx.exec:\xrfffrx.exe67⤵PID:572
-
\??\c:\3frrxfl.exec:\3frrxfl.exe68⤵PID:1864
-
\??\c:\nhnnbb.exec:\nhnnbb.exe69⤵PID:1212
-
\??\c:\pjvvv.exec:\pjvvv.exe70⤵PID:588
-
\??\c:\7dvpj.exec:\7dvpj.exe71⤵PID:1464
-
\??\c:\rlllrrf.exec:\rlllrrf.exe72⤵PID:1356
-
\??\c:\htbbnh.exec:\htbbnh.exe73⤵PID:1184
-
\??\c:\9nhntt.exec:\9nhntt.exe74⤵PID:3048
-
\??\c:\dvjdp.exec:\dvjdp.exe75⤵PID:1240
-
\??\c:\3lfxxxf.exec:\3lfxxxf.exe76⤵PID:3032
-
\??\c:\hbtbhh.exec:\hbtbhh.exe77⤵PID:1872
-
\??\c:\bntbhn.exec:\bntbhn.exe78⤵PID:1904
-
\??\c:\dpvvv.exec:\dpvvv.exe79⤵PID:2840
-
\??\c:\vjpjp.exec:\vjpjp.exe80⤵PID:1524
-
\??\c:\xlxxfff.exec:\xlxxfff.exe81⤵PID:2316
-
\??\c:\thtnnn.exec:\thtnnn.exe82⤵PID:1648
-
\??\c:\vjpjd.exec:\vjpjd.exe83⤵PID:1680
-
\??\c:\1vddj.exec:\1vddj.exe84⤵PID:2160
-
\??\c:\rflffff.exec:\rflffff.exe85⤵PID:3036
-
\??\c:\rxrxflx.exec:\rxrxflx.exe86⤵PID:1896
-
\??\c:\bnbtbb.exec:\bnbtbb.exe87⤵PID:2644
-
\??\c:\ppvpp.exec:\ppvpp.exe88⤵PID:2244
-
\??\c:\jjjjj.exec:\jjjjj.exe89⤵PID:2560
-
\??\c:\xrflrrf.exec:\xrflrrf.exe90⤵PID:2584
-
\??\c:\nhtbbh.exec:\nhtbbh.exe91⤵PID:2660
-
\??\c:\1hbbhn.exec:\1hbbhn.exe92⤵PID:2580
-
\??\c:\pdppv.exec:\pdppv.exe93⤵PID:2628
-
\??\c:\5dpjp.exec:\5dpjp.exe94⤵PID:2896
-
\??\c:\xrrrflr.exec:\xrrrflr.exe95⤵PID:2604
-
\??\c:\5bnbnn.exec:\5bnbnn.exe96⤵PID:112
-
\??\c:\bnhhtn.exec:\bnhhtn.exe97⤵PID:2872
-
\??\c:\vjddd.exec:\vjddd.exe98⤵PID:2480
-
\??\c:\frlflll.exec:\frlflll.exe99⤵PID:2456
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe100⤵PID:1556
-
\??\c:\thtttt.exec:\thtttt.exe101⤵PID:2368
-
\??\c:\nhbbnn.exec:\nhbbnn.exe102⤵PID:2212
-
\??\c:\pppdv.exec:\pppdv.exe103⤵PID:2700
-
\??\c:\rrlxflx.exec:\rrlxflx.exe104⤵PID:2220
-
\??\c:\ttthnn.exec:\ttthnn.exe105⤵PID:1992
-
\??\c:\tttbbn.exec:\tttbbn.exe106⤵PID:2024
-
\??\c:\vpjjp.exec:\vpjjp.exe107⤵PID:2012
-
\??\c:\vjpdd.exec:\vjpdd.exe108⤵PID:2036
-
\??\c:\frfllfx.exec:\frfllfx.exe109⤵PID:2728
-
\??\c:\5nbbbh.exec:\5nbbbh.exe110⤵PID:1808
-
\??\c:\9thhnn.exec:\9thhnn.exe111⤵PID:2612
-
\??\c:\dpvvd.exec:\dpvvd.exe112⤵PID:1724
-
\??\c:\xllfffl.exec:\xllfffl.exe113⤵PID:1188
-
\??\c:\frlrffr.exec:\frlrffr.exe114⤵PID:1212
-
\??\c:\hhbthb.exec:\hhbthb.exe115⤵PID:2972
-
\??\c:\jvppj.exec:\jvppj.exe116⤵PID:2816
-
\??\c:\dpvvv.exec:\dpvvv.exe117⤵PID:2968
-
\??\c:\fxrrrlx.exec:\fxrrrlx.exe118⤵PID:1780
-
\??\c:\hbhntt.exec:\hbhntt.exe119⤵PID:1596
-
\??\c:\3hbbhn.exec:\3hbbhn.exe120⤵PID:3048
-
\??\c:\vvppv.exec:\vvppv.exe121⤵PID:1804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-