Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 19:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe
-
Size
453KB
-
MD5
2fcc12773775af39b95951f70bda48b0
-
SHA1
4f64c007dfbe23a7618a881685d928771be33056
-
SHA256
2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3ad
-
SHA512
8e0e185ba18d3045c19012ef23cc516fb4b77863d4bb49ca6928754c3457592803f6c532c64bc737f952a32358b12618aacc6bf406069999ca019d32433add39
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeu:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2368-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-163-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2008-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-181-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2416-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-371-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1976-422-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2012-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-442-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2912-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-468-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/988-521-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/484-534-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2148-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-657-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1744-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-696-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2264-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-849-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-917-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-968-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1916 7bnthn.exe 1060 rrfxxxf.exe 2276 hhnnbb.exe 1656 lxrrrrf.exe 2720 hnttnh.exe 2728 ddppp.exe 2824 hbnbbn.exe 2604 3pvdp.exe 1592 hthhnn.exe 2592 ppdjp.exe 3060 9flflfl.exe 1792 pdppp.exe 2876 3fxfrrx.exe 1564 xrflrrx.exe 1948 5dpdd.exe 2888 rlxflxr.exe 2008 bhttbt.exe 3048 9djvj.exe 2436 xlfrflx.exe 2372 dpdpv.exe 1864 rrfflrl.exe 1480 btbbbt.exe 2556 vvjvd.exe 776 vjvvv.exe 956 5tttbb.exe 2416 vdjdv.exe 2220 1xrxffl.exe 2452 5thhnn.exe 2984 rflfrxf.exe 2368 fxlfxxx.exe 1524 3bhhtt.exe 2992 vpjvd.exe 2196 rfrlfff.exe 2148 pjvpv.exe 2152 lxrrlff.exe 2712 xfxxllf.exe 2696 5nhhnn.exe 2764 pdpdv.exe 2704 5lfllfl.exe 2732 3vdvv.exe 2624 7pdvp.exe 2628 rlrrrxx.exe 2592 hthbnt.exe 1440 bnbbtt.exe 1068 jvvpp.exe 1976 lrxxrll.exe 2896 lffxxrx.exe 2812 nbnnhh.exe 2472 1tthbb.exe 1948 dpdvv.exe 2012 rxffxrf.exe 1784 5lrlfff.exe 2912 5tbnnn.exe 3016 thntbt.exe 2188 3djdv.exe 2392 3xffxxx.exe 1408 9flffxf.exe 1108 1bbbbn.exe 2972 vjpjp.exe 1996 3vvpp.exe 1324 1lxlrlr.exe 776 hnhhtn.exe 1780 jvjpj.exe 988 jvjdv.exe -
resource yara_rule behavioral1/memory/2368-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-219-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/776-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-422-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2012-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-442-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2912-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-495-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/988-521-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/484-534-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2108-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-955-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1760-999-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-1104-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1916 2368 2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe 30 PID 2368 wrote to memory of 1916 2368 2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe 30 PID 2368 wrote to memory of 1916 2368 2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe 30 PID 2368 wrote to memory of 1916 2368 2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe 30 PID 1916 wrote to memory of 1060 1916 7bnthn.exe 31 PID 1916 wrote to memory of 1060 1916 7bnthn.exe 31 PID 1916 wrote to memory of 1060 1916 7bnthn.exe 31 PID 1916 wrote to memory of 1060 1916 7bnthn.exe 31 PID 1060 wrote to memory of 2276 1060 rrfxxxf.exe 32 PID 1060 wrote to memory of 2276 1060 rrfxxxf.exe 32 PID 1060 wrote to memory of 2276 1060 rrfxxxf.exe 32 PID 1060 wrote to memory of 2276 1060 rrfxxxf.exe 32 PID 2276 wrote to memory of 1656 2276 hhnnbb.exe 33 PID 2276 wrote to memory of 1656 2276 hhnnbb.exe 33 PID 2276 wrote to memory of 1656 2276 hhnnbb.exe 33 PID 2276 wrote to memory of 1656 2276 hhnnbb.exe 33 PID 1656 wrote to memory of 2720 1656 lxrrrrf.exe 34 PID 1656 wrote to memory of 2720 1656 lxrrrrf.exe 34 PID 1656 wrote to memory of 2720 1656 lxrrrrf.exe 34 PID 1656 wrote to memory of 2720 1656 lxrrrrf.exe 34 PID 2720 wrote to memory of 2728 2720 hnttnh.exe 35 PID 2720 wrote to memory of 2728 2720 hnttnh.exe 35 PID 2720 wrote to memory of 2728 2720 hnttnh.exe 35 PID 2720 wrote to memory of 2728 2720 hnttnh.exe 35 PID 2728 wrote to memory of 2824 2728 ddppp.exe 36 PID 2728 wrote to memory of 2824 2728 ddppp.exe 36 PID 2728 wrote to memory of 2824 2728 ddppp.exe 36 PID 2728 wrote to memory of 2824 2728 ddppp.exe 36 PID 2824 wrote to memory of 2604 2824 hbnbbn.exe 37 PID 2824 wrote to memory of 2604 2824 hbnbbn.exe 37 PID 2824 wrote to memory of 2604 2824 hbnbbn.exe 37 PID 2824 wrote to memory of 2604 2824 hbnbbn.exe 37 PID 2604 wrote to memory of 1592 2604 3pvdp.exe 38 PID 2604 wrote to memory of 1592 2604 3pvdp.exe 38 PID 2604 wrote to memory of 1592 2604 3pvdp.exe 38 PID 2604 wrote to memory of 1592 2604 3pvdp.exe 38 PID 1592 wrote to memory of 2592 1592 hthhnn.exe 39 PID 1592 wrote to memory of 2592 1592 hthhnn.exe 39 PID 1592 wrote to memory of 2592 1592 hthhnn.exe 39 PID 1592 wrote to memory of 2592 1592 hthhnn.exe 39 PID 2592 wrote to memory of 3060 2592 ppdjp.exe 40 PID 2592 wrote to memory of 3060 2592 ppdjp.exe 40 PID 2592 wrote to memory of 3060 2592 ppdjp.exe 40 PID 2592 wrote to memory of 3060 2592 ppdjp.exe 40 PID 3060 wrote to memory of 1792 3060 9flflfl.exe 41 PID 3060 wrote to memory of 1792 3060 9flflfl.exe 41 PID 3060 wrote to memory of 1792 3060 9flflfl.exe 41 PID 3060 wrote to memory of 1792 3060 9flflfl.exe 41 PID 1792 wrote to memory of 2876 1792 pdppp.exe 42 PID 1792 wrote to memory of 2876 1792 pdppp.exe 42 PID 1792 wrote to memory of 2876 1792 pdppp.exe 42 PID 1792 wrote to memory of 2876 1792 pdppp.exe 42 PID 2876 wrote to memory of 1564 2876 3fxfrrx.exe 43 PID 2876 wrote to memory of 1564 2876 3fxfrrx.exe 43 PID 2876 wrote to memory of 1564 2876 3fxfrrx.exe 43 PID 2876 wrote to memory of 1564 2876 3fxfrrx.exe 43 PID 1564 wrote to memory of 1948 1564 xrflrrx.exe 44 PID 1564 wrote to memory of 1948 1564 xrflrrx.exe 44 PID 1564 wrote to memory of 1948 1564 xrflrrx.exe 44 PID 1564 wrote to memory of 1948 1564 xrflrrx.exe 44 PID 1948 wrote to memory of 2888 1948 5dpdd.exe 45 PID 1948 wrote to memory of 2888 1948 5dpdd.exe 45 PID 1948 wrote to memory of 2888 1948 5dpdd.exe 45 PID 1948 wrote to memory of 2888 1948 5dpdd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe"C:\Users\Admin\AppData\Local\Temp\2c3a254f4d9850b531961e72eb1dcbe573fde1e2b0727ac445a6be1df9ecb3adN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\7bnthn.exec:\7bnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rrfxxxf.exec:\rrfxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\hhnnbb.exec:\hhnnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\lxrrrrf.exec:\lxrrrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\hnttnh.exec:\hnttnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\ddppp.exec:\ddppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\hbnbbn.exec:\hbnbbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\3pvdp.exec:\3pvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hthhnn.exec:\hthhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\ppdjp.exec:\ppdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\9flflfl.exec:\9flflfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pdppp.exec:\pdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\3fxfrrx.exec:\3fxfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xrflrrx.exec:\xrflrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\5dpdd.exec:\5dpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\rlxflxr.exec:\rlxflxr.exe17⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bhttbt.exec:\bhttbt.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9djvj.exec:\9djvj.exe19⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xlfrflx.exec:\xlfrflx.exe20⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dpdpv.exec:\dpdpv.exe21⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rrfflrl.exec:\rrfflrl.exe22⤵
- Executes dropped EXE
PID:1864 -
\??\c:\btbbbt.exec:\btbbbt.exe23⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vvjvd.exec:\vvjvd.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\vjvvv.exec:\vjvvv.exe25⤵
- Executes dropped EXE
PID:776 -
\??\c:\5tttbb.exec:\5tttbb.exe26⤵
- Executes dropped EXE
PID:956 -
\??\c:\vdjdv.exec:\vdjdv.exe27⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1xrxffl.exec:\1xrxffl.exe28⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5thhnn.exec:\5thhnn.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rflfrxf.exec:\rflfrxf.exe30⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3bhhtt.exec:\3bhhtt.exe32⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vpjvd.exec:\vpjvd.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rfrlfff.exec:\rfrlfff.exe34⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pjvpv.exec:\pjvpv.exe35⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lxrrlff.exec:\lxrrlff.exe36⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xfxxllf.exec:\xfxxllf.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5nhhnn.exec:\5nhhnn.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pdpdv.exec:\pdpdv.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5lfllfl.exec:\5lfllfl.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3vdvv.exec:\3vdvv.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7pdvp.exec:\7pdvp.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hthbnt.exec:\hthbnt.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bnbbtt.exec:\bnbbtt.exe45⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jvvpp.exec:\jvvpp.exe46⤵
- Executes dropped EXE
PID:1068 -
\??\c:\lrxxrll.exec:\lrxxrll.exe47⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lffxxrx.exec:\lffxxrx.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nbnnhh.exec:\nbnnhh.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1tthbb.exec:\1tthbb.exe50⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dpdvv.exec:\dpdvv.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rxffxrf.exec:\rxffxrf.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5lrlfff.exec:\5lrlfff.exe53⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5tbnnn.exec:\5tbnnn.exe54⤵
- Executes dropped EXE
PID:2912 -
\??\c:\thntbt.exec:\thntbt.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3djdv.exec:\3djdv.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3xffxxx.exec:\3xffxxx.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9flffxf.exec:\9flffxf.exe58⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1bbbbn.exec:\1bbbbn.exe59⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vjpjp.exec:\vjpjp.exe60⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3vvpp.exec:\3vvpp.exe61⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1lxlrlr.exec:\1lxlrlr.exe62⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hnhhtn.exec:\hnhhtn.exe63⤵
- Executes dropped EXE
PID:776 -
\??\c:\jvjpj.exec:\jvjpj.exe64⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jvjdv.exec:\jvjdv.exe65⤵
- Executes dropped EXE
PID:988 -
\??\c:\lxfrllr.exec:\lxfrllr.exe66⤵PID:2248
-
\??\c:\tthhnb.exec:\tthhnb.exe67⤵PID:484
-
\??\c:\1ttttn.exec:\1ttttn.exe68⤵PID:2428
-
\??\c:\3djdv.exec:\3djdv.exe69⤵PID:2108
-
\??\c:\7jvjj.exec:\7jvjj.exe70⤵PID:1616
-
\??\c:\fxfrrll.exec:\fxfrrll.exe71⤵PID:2016
-
\??\c:\tnnhhh.exec:\tnnhhh.exe72⤵PID:1580
-
\??\c:\thhbbb.exec:\thhbbb.exe73⤵PID:1984
-
\??\c:\dppvj.exec:\dppvj.exe74⤵PID:2992
-
\??\c:\5lxrrll.exec:\5lxrrll.exe75⤵PID:2276
-
\??\c:\xrfflll.exec:\xrfflll.exe76⤵PID:2148
-
\??\c:\hthhhb.exec:\hthhhb.exe77⤵PID:824
-
\??\c:\hthhnn.exec:\hthhnn.exe78⤵PID:2676
-
\??\c:\vjjjd.exec:\vjjjd.exe79⤵PID:2728
-
\??\c:\flrllff.exec:\flrllff.exe80⤵PID:2764
-
\??\c:\1lflrrl.exec:\1lflrrl.exe81⤵PID:2840
-
\??\c:\btbttn.exec:\btbttn.exe82⤵PID:2604
-
\??\c:\pdjdd.exec:\pdjdd.exe83⤵PID:2748
-
\??\c:\rllxflf.exec:\rllxflf.exe84⤵PID:3032
-
\??\c:\7xlxxrx.exec:\7xlxxrx.exe85⤵PID:2580
-
\??\c:\bnttnn.exec:\bnttnn.exe86⤵PID:2816
-
\??\c:\pdpjj.exec:\pdpjj.exe87⤵PID:1816
-
\??\c:\vpdvv.exec:\vpdvv.exe88⤵PID:1644
-
\??\c:\fxlllfl.exec:\fxlllfl.exe89⤵PID:1744
-
\??\c:\xlxfxxx.exec:\xlxfxxx.exe90⤵PID:1936
-
\??\c:\thtbbb.exec:\thtbbb.exe91⤵PID:2636
-
\??\c:\jvdpv.exec:\jvdpv.exe92⤵PID:756
-
\??\c:\xrxlfrr.exec:\xrxlfrr.exe93⤵PID:1248
-
\??\c:\llffrlr.exec:\llffrlr.exe94⤵PID:2528
-
\??\c:\bnnhhn.exec:\bnnhhn.exe95⤵PID:2200
-
\??\c:\tbnnnh.exec:\tbnnnh.exe96⤵PID:2228
-
\??\c:\jdjvp.exec:\jdjvp.exe97⤵PID:2264
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe98⤵PID:2868
-
\??\c:\xlffrrr.exec:\xlffrrr.exe99⤵PID:2208
-
\??\c:\ntbbbh.exec:\ntbbbh.exe100⤵PID:2088
-
\??\c:\jdjpv.exec:\jdjpv.exe101⤵PID:680
-
\??\c:\5vddv.exec:\5vddv.exe102⤵PID:612
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe103⤵PID:2976
-
\??\c:\3bttbh.exec:\3bttbh.exe104⤵PID:1364
-
\??\c:\9btttt.exec:\9btttt.exe105⤵PID:2968
-
\??\c:\jvddd.exec:\jvddd.exe106⤵PID:2416
-
\??\c:\rlxrllr.exec:\rlxrllr.exe107⤵
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\7llxffr.exec:\7llxffr.exe108⤵PID:2220
-
\??\c:\3bbnhb.exec:\3bbnhb.exe109⤵PID:764
-
\??\c:\7tnntt.exec:\7tnntt.exe110⤵PID:2428
-
\??\c:\9dvvd.exec:\9dvvd.exe111⤵PID:552
-
\??\c:\7vjdv.exec:\7vjdv.exe112⤵PID:2984
-
\??\c:\llxffxx.exec:\llxffxx.exe113⤵PID:3008
-
\??\c:\tbbhhn.exec:\tbbhhn.exe114⤵PID:2860
-
\??\c:\5jvvp.exec:\5jvvp.exe115⤵PID:1916
-
\??\c:\rffxxll.exec:\rffxxll.exe116⤵PID:3064
-
\??\c:\5xlrlfl.exec:\5xlrlfl.exe117⤵PID:2864
-
\??\c:\bbtbtt.exec:\bbtbtt.exe118⤵PID:2668
-
\??\c:\vjjdp.exec:\vjjdp.exe119⤵PID:2788
-
\??\c:\vjpjd.exec:\vjpjd.exe120⤵
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\xflfxrr.exec:\xflfxrr.exe121⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-