Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 18:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe
-
Size
453KB
-
MD5
b06b391c830140e6fc2a6bf3127a4a40
-
SHA1
cbf3694d39f15f0034d258fc91a2e77dc4286aeb
-
SHA256
4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314cca
-
SHA512
f0543f67d5e59f1b1c78019658fbd04c27e1fa0ccf836006cd58dd920254069c8b01cb9482ad5214c70866b6ba66965286f429e884f33ee1f5a13d48f476a620
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-32-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-75-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-96-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2612-94-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1896-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/268-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-198-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2344-188-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2376-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-298-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2264-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/324-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-681-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-685-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-718-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1136-757-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/772-782-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2096-821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-877-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-897-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-896-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2468-1017-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-1174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/868-1189-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1748 9rllrrx.exe 1260 tnhnbh.exe 3000 1rllxxl.exe 2708 hbnbhn.exe 2868 flffrxf.exe 2732 1hntht.exe 2632 7tnbhb.exe 2884 3vpdp.exe 2612 9htbnt.exe 2212 vpppd.exe 1896 hhbbnt.exe 668 llflrxl.exe 2356 1btbnb.exe 2828 pjvpj.exe 1040 1fxfflx.exe 2984 xxrlxfx.exe 268 5lxfffl.exe 2000 jvpvd.exe 2344 lrffllr.exe 1208 xrlflll.exe 2376 vvppd.exe 1524 ttntnt.exe 324 pjdjd.exe 1776 1lrlxxl.exe 688 dpjpd.exe 2412 lfrrxxr.exe 1496 pjdpd.exe 2036 7lflrrf.exe 468 7htbnn.exe 2388 rrlrflx.exe 2556 hbthnn.exe 1748 7jvvv.exe 1824 flffrxl.exe 2264 tnhbbn.exe 2008 dvjvd.exe 2124 lfrxlrx.exe 2916 9xllxfl.exe 2876 tntbbb.exe 2732 nthhnt.exe 2848 dvpvd.exe 2736 rllrflx.exe 2608 tnhnbb.exe 2596 tnnbnn.exe 1444 1vpjp.exe 1940 1pddd.exe 2156 3xlllrf.exe 1744 nnbbnt.exe 2796 7htthn.exe 2688 ddvvd.exe 2800 flxrxfr.exe 1308 lxrfffr.exe 1080 bthhnn.exe 1596 dppjj.exe 2120 frllllx.exe 268 5fxfllr.exe 1120 hbnnbb.exe 2060 pvvvd.exe 332 pjvjv.exe 2172 lfrxlxl.exe 2528 rlrfrrx.exe 1136 bbthnt.exe 1528 3dvvd.exe 324 vpjjp.exe 1756 xlxrxxx.exe -
resource yara_rule behavioral1/memory/2536-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-236-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/688-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-875-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2660-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-935-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1500-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1027-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/300-1062-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-1155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-1174-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2796-1204-0x00000000003B0000-0x00000000003DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1748 2536 4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe 30 PID 2536 wrote to memory of 1748 2536 4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe 30 PID 2536 wrote to memory of 1748 2536 4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe 30 PID 2536 wrote to memory of 1748 2536 4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe 30 PID 1748 wrote to memory of 1260 1748 9rllrrx.exe 31 PID 1748 wrote to memory of 1260 1748 9rllrrx.exe 31 PID 1748 wrote to memory of 1260 1748 9rllrrx.exe 31 PID 1748 wrote to memory of 1260 1748 9rllrrx.exe 31 PID 1260 wrote to memory of 3000 1260 tnhnbh.exe 32 PID 1260 wrote to memory of 3000 1260 tnhnbh.exe 32 PID 1260 wrote to memory of 3000 1260 tnhnbh.exe 32 PID 1260 wrote to memory of 3000 1260 tnhnbh.exe 32 PID 3000 wrote to memory of 2708 3000 1rllxxl.exe 33 PID 3000 wrote to memory of 2708 3000 1rllxxl.exe 33 PID 3000 wrote to memory of 2708 3000 1rllxxl.exe 33 PID 3000 wrote to memory of 2708 3000 1rllxxl.exe 33 PID 2708 wrote to memory of 2868 2708 hbnbhn.exe 34 PID 2708 wrote to memory of 2868 2708 hbnbhn.exe 34 PID 2708 wrote to memory of 2868 2708 hbnbhn.exe 34 PID 2708 wrote to memory of 2868 2708 hbnbhn.exe 34 PID 2868 wrote to memory of 2732 2868 flffrxf.exe 35 PID 2868 wrote to memory of 2732 2868 flffrxf.exe 35 PID 2868 wrote to memory of 2732 2868 flffrxf.exe 35 PID 2868 wrote to memory of 2732 2868 flffrxf.exe 35 PID 2732 wrote to memory of 2632 2732 1hntht.exe 36 PID 2732 wrote to memory of 2632 2732 1hntht.exe 36 PID 2732 wrote to memory of 2632 2732 1hntht.exe 36 PID 2732 wrote to memory of 2632 2732 1hntht.exe 36 PID 2632 wrote to memory of 2884 2632 7tnbhb.exe 37 PID 2632 wrote to memory of 2884 2632 7tnbhb.exe 37 PID 2632 wrote to memory of 2884 2632 7tnbhb.exe 37 PID 2632 wrote to memory of 2884 2632 7tnbhb.exe 37 PID 2884 wrote to memory of 2612 2884 3vpdp.exe 38 PID 2884 wrote to memory of 2612 2884 3vpdp.exe 38 PID 2884 wrote to memory of 2612 2884 3vpdp.exe 38 PID 2884 wrote to memory of 2612 2884 3vpdp.exe 38 PID 2612 wrote to memory of 2212 2612 9htbnt.exe 39 PID 2612 wrote to memory of 2212 2612 9htbnt.exe 39 PID 2612 wrote to memory of 2212 2612 9htbnt.exe 39 PID 2612 wrote to memory of 2212 2612 9htbnt.exe 39 PID 2212 wrote to memory of 1896 2212 vpppd.exe 40 PID 2212 wrote to memory of 1896 2212 vpppd.exe 40 PID 2212 wrote to memory of 1896 2212 vpppd.exe 40 PID 2212 wrote to memory of 1896 2212 vpppd.exe 40 PID 1896 wrote to memory of 668 1896 hhbbnt.exe 41 PID 1896 wrote to memory of 668 1896 hhbbnt.exe 41 PID 1896 wrote to memory of 668 1896 hhbbnt.exe 41 PID 1896 wrote to memory of 668 1896 hhbbnt.exe 41 PID 668 wrote to memory of 2356 668 llflrxl.exe 42 PID 668 wrote to memory of 2356 668 llflrxl.exe 42 PID 668 wrote to memory of 2356 668 llflrxl.exe 42 PID 668 wrote to memory of 2356 668 llflrxl.exe 42 PID 2356 wrote to memory of 2828 2356 1btbnb.exe 43 PID 2356 wrote to memory of 2828 2356 1btbnb.exe 43 PID 2356 wrote to memory of 2828 2356 1btbnb.exe 43 PID 2356 wrote to memory of 2828 2356 1btbnb.exe 43 PID 2828 wrote to memory of 1040 2828 pjvpj.exe 44 PID 2828 wrote to memory of 1040 2828 pjvpj.exe 44 PID 2828 wrote to memory of 1040 2828 pjvpj.exe 44 PID 2828 wrote to memory of 1040 2828 pjvpj.exe 44 PID 1040 wrote to memory of 2984 1040 1fxfflx.exe 45 PID 1040 wrote to memory of 2984 1040 1fxfflx.exe 45 PID 1040 wrote to memory of 2984 1040 1fxfflx.exe 45 PID 1040 wrote to memory of 2984 1040 1fxfflx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe"C:\Users\Admin\AppData\Local\Temp\4a9c5abf3fdca23d0851e9b357306cececf832ad64459c0cc4f25a4797314ccaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\9rllrrx.exec:\9rllrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\tnhnbh.exec:\tnhnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\1rllxxl.exec:\1rllxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hbnbhn.exec:\hbnbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\flffrxf.exec:\flffrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\1hntht.exec:\1hntht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7tnbhb.exec:\7tnbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\3vpdp.exec:\3vpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\9htbnt.exec:\9htbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vpppd.exec:\vpppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\hhbbnt.exec:\hhbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\llflrxl.exec:\llflrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\1btbnb.exec:\1btbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pjvpj.exec:\pjvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1fxfflx.exec:\1fxfflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\5lxfffl.exec:\5lxfffl.exe18⤵
- Executes dropped EXE
PID:268 -
\??\c:\jvpvd.exec:\jvpvd.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lrffllr.exec:\lrffllr.exe20⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xrlflll.exec:\xrlflll.exe21⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vvppd.exec:\vvppd.exe22⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ttntnt.exec:\ttntnt.exe23⤵
- Executes dropped EXE
PID:1524 -
\??\c:\pjdjd.exec:\pjdjd.exe24⤵
- Executes dropped EXE
PID:324 -
\??\c:\1lrlxxl.exec:\1lrlxxl.exe25⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dpjpd.exec:\dpjpd.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe27⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pjdpd.exec:\pjdpd.exe28⤵
- Executes dropped EXE
PID:1496 -
\??\c:\7lflrrf.exec:\7lflrrf.exe29⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7htbnn.exec:\7htbnn.exe30⤵
- Executes dropped EXE
PID:468 -
\??\c:\rrlrflx.exec:\rrlrflx.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\hbthnn.exec:\hbthnn.exe32⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7jvvv.exec:\7jvvv.exe33⤵
- Executes dropped EXE
PID:1748 -
\??\c:\flffrxl.exec:\flffrxl.exe34⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tnhbbn.exec:\tnhbbn.exe35⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dvjvd.exec:\dvjvd.exe36⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe37⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9xllxfl.exec:\9xllxfl.exe38⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tntbbb.exec:\tntbbb.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nthhnt.exec:\nthhnt.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dvpvd.exec:\dvpvd.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rllrflx.exec:\rllrflx.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tnhnbb.exec:\tnhnbb.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tnnbnn.exec:\tnnbnn.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1vpjp.exec:\1vpjp.exe45⤵
- Executes dropped EXE
PID:1444 -
\??\c:\1pddd.exec:\1pddd.exe46⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3xlllrf.exec:\3xlllrf.exe47⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nnbbnt.exec:\nnbbnt.exe48⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7htthn.exec:\7htthn.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ddvvd.exec:\ddvvd.exe50⤵
- Executes dropped EXE
PID:2688 -
\??\c:\flxrxfr.exec:\flxrxfr.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lxrfffr.exec:\lxrfffr.exe52⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bthhnn.exec:\bthhnn.exe53⤵
- Executes dropped EXE
PID:1080 -
\??\c:\dppjj.exec:\dppjj.exe54⤵
- Executes dropped EXE
PID:1596 -
\??\c:\frllllx.exec:\frllllx.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5fxfllr.exec:\5fxfllr.exe56⤵
- Executes dropped EXE
PID:268 -
\??\c:\hbnnbb.exec:\hbnnbb.exe57⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pvvvd.exec:\pvvvd.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pjvjv.exec:\pjvjv.exe59⤵
- Executes dropped EXE
PID:332 -
\??\c:\lfrxlxl.exec:\lfrxlxl.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rlrfrrx.exec:\rlrfrrx.exe61⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bbthnt.exec:\bbthnt.exe62⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3dvvd.exec:\3dvvd.exe63⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vpjjp.exec:\vpjjp.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\xlxrxxx.exec:\xlxrxxx.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bnntbt.exec:\bnntbt.exe66⤵PID:772
-
\??\c:\7bhttn.exec:\7bhttn.exe67⤵PID:3068
-
\??\c:\ppjdp.exec:\ppjdp.exe68⤵PID:2152
-
\??\c:\lxfffff.exec:\lxfffff.exe69⤵PID:3048
-
\??\c:\5fxxlrf.exec:\5fxxlrf.exe70⤵PID:2316
-
\??\c:\9bttbb.exec:\9bttbb.exe71⤵PID:880
-
\??\c:\jvdpj.exec:\jvdpj.exe72⤵PID:1624
-
\??\c:\jdjjp.exec:\jdjjp.exe73⤵PID:2388
-
\??\c:\rrxxrlr.exec:\rrxxrlr.exe74⤵PID:2384
-
\??\c:\nbnhhh.exec:\nbnhhh.exe75⤵PID:1592
-
\??\c:\5bnhtn.exec:\5bnhtn.exe76⤵PID:1144
-
\??\c:\vjvdp.exec:\vjvdp.exe77⤵PID:1728
-
\??\c:\9xllrxl.exec:\9xllrxl.exe78⤵PID:2264
-
\??\c:\xrllllr.exec:\xrllllr.exe79⤵PID:2880
-
\??\c:\bthbhh.exec:\bthbhh.exe80⤵PID:2124
-
\??\c:\5dppj.exec:\5dppj.exe81⤵PID:2916
-
\??\c:\frxxxff.exec:\frxxxff.exe82⤵PID:2868
-
\??\c:\3xllxfl.exec:\3xllxfl.exe83⤵PID:2760
-
\??\c:\nnthhb.exec:\nnthhb.exe84⤵PID:2900
-
\??\c:\dpvpp.exec:\dpvpp.exe85⤵PID:2600
-
\??\c:\9pvdj.exec:\9pvdj.exe86⤵PID:2608
-
\??\c:\rfrllll.exec:\rfrllll.exe87⤵
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\bntnbb.exec:\bntnbb.exe88⤵PID:1444
-
\??\c:\tnbtth.exec:\tnbtth.exe89⤵PID:1940
-
\??\c:\3pvdj.exec:\3pvdj.exe90⤵PID:2648
-
\??\c:\pjvvv.exec:\pjvvv.exe91⤵PID:2300
-
\??\c:\xxflrrr.exec:\xxflrrr.exe92⤵PID:2808
-
\??\c:\9nbhnn.exec:\9nbhnn.exe93⤵PID:2828
-
\??\c:\nhbnbh.exec:\nhbnbh.exe94⤵PID:1304
-
\??\c:\7jjpj.exec:\7jjpj.exe95⤵PID:844
-
\??\c:\rlflflr.exec:\rlflflr.exe96⤵
- System Location Discovery: System Language Discovery
PID:1080 -
\??\c:\lxlrxrf.exec:\lxlrxrf.exe97⤵PID:1996
-
\??\c:\7hnnnn.exec:\7hnnnn.exe98⤵PID:1320
-
\??\c:\pdjjj.exec:\pdjjj.exe99⤵PID:2560
-
\??\c:\7vjvv.exec:\7vjvv.exe100⤵PID:2064
-
\??\c:\lfxxlrr.exec:\lfxxlrr.exe101⤵PID:2060
-
\??\c:\3hnntt.exec:\3hnntt.exe102⤵PID:2980
-
\??\c:\nhthnn.exec:\nhthnn.exe103⤵PID:2172
-
\??\c:\jjvvd.exec:\jjvvd.exe104⤵PID:1284
-
\??\c:\rlxlfrr.exec:\rlxlfrr.exe105⤵PID:1136
-
\??\c:\rflrxrf.exec:\rflrxrf.exe106⤵PID:1528
-
\??\c:\hhtbhh.exec:\hhtbhh.exe107⤵PID:2080
-
\??\c:\dpddd.exec:\dpddd.exe108⤵PID:2260
-
\??\c:\pjpjp.exec:\pjpjp.exe109⤵PID:772
-
\??\c:\rllffxx.exec:\rllffxx.exe110⤵PID:3068
-
\??\c:\xrlllll.exec:\xrlllll.exe111⤵PID:2248
-
\??\c:\bntnhb.exec:\bntnhb.exe112⤵PID:2144
-
\??\c:\pvjdd.exec:\pvjdd.exe113⤵PID:2316
-
\??\c:\1vdvv.exec:\1vdvv.exe114⤵PID:880
-
\??\c:\xxlfllr.exec:\xxlfllr.exe115⤵PID:2096
-
\??\c:\btnthh.exec:\btnthh.exe116⤵PID:2388
-
\??\c:\nhhhhn.exec:\nhhhhn.exe117⤵PID:1588
-
\??\c:\9jppp.exec:\9jppp.exe118⤵PID:1732
-
\??\c:\lxrlffl.exec:\lxrlffl.exe119⤵PID:2324
-
\??\c:\ttbhnt.exec:\ttbhnt.exe120⤵PID:3000
-
\??\c:\nnhtnn.exec:\nnhtnn.exe121⤵PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-