Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe
-
Size
456KB
-
MD5
81936129e6ecf3314932aae32c0ab213
-
SHA1
09c5a861b63ea28a421a478040eb5f01805d066d
-
SHA256
e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7
-
SHA512
f8d9814f1e5ca8bbf61cc6f5973497af3045caedbeb3fbf831b85a5087f1da9bc353ce2f9e6c07708586144bdc9c9a5b0526126365c265d11151ff87eb0ab890
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/1748-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-73-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2804-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/484-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3032-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-261-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-354-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-373-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1628-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-455-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1100-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-489-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/572-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-566-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2152-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-764-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1036-777-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-790-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2084-809-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-862-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-875-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/356-900-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2980-937-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/812-944-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-987-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-1014-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1800-1033-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1604-1042-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2432-1119-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2988-1184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-1204-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1748 lxxlfll.exe 2320 7nnbbh.exe 2696 5tnthn.exe 3044 pvpjd.exe 2764 9nnbhn.exe 2636 nhhhnb.exe 2804 3fxffrf.exe 2884 jdvpd.exe 2516 1bthnn.exe 484 vvvpd.exe 3032 hbthnn.exe 1772 nnhnbt.exe 2500 nhhhht.exe 1816 pjjvp.exe 1908 5hhntb.exe 1156 rlfrfrl.exe 2600 nhhhtt.exe 2152 hnnhtt.exe 2120 3hbhnt.exe 1012 bhbhbn.exe 676 xrlrfll.exe 1332 btnbhh.exe 1708 1flxxfx.exe 1660 7nbbnt.exe 988 1fxxflf.exe 1384 tbtbhn.exe 876 3rffrlr.exe 2440 1lxlxfl.exe 1032 vvpvj.exe 2920 flxrfrl.exe 1680 vpjpj.exe 2004 5rlxlxr.exe 1748 vvvpd.exe 2320 jjdjv.exe 1720 llfxlll.exe 1668 hnhbhn.exe 2652 bnbnhh.exe 2752 djdvp.exe 2748 xrllllr.exe 2764 rlxfxrf.exe 2628 thnntt.exe 2536 vvpjv.exe 2680 7rxxfxf.exe 2884 xrlrffx.exe 2976 1thnhn.exe 2980 jdjpv.exe 324 3vppp.exe 3032 5rxfxrr.exe 1628 9bbtbh.exe 2028 5nnthn.exe 2708 jjdpv.exe 1756 lllrxrr.exe 1584 hbhhtt.exe 2964 pjjdj.exe 2860 pdppp.exe 2108 lfxfrrl.exe 1800 3nbttt.exe 1940 5jdjp.exe 1100 vpvvv.exe 2304 rffrxxx.exe 956 tnttbh.exe 1332 5dddv.exe 1708 vvvjp.exe 1048 5ffrlrr.exe -
resource yara_rule behavioral1/memory/1748-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-155-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2152-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-377-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/324-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-566-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2624-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-764-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1036-777-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2200-790-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2084-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-862-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2980-937-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/812-944-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/952-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-1027-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1048-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-1119-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2760-1150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-1164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-1171-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/2576-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-1217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-1242-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 268 wrote to memory of 1748 268 e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe 31 PID 268 wrote to memory of 1748 268 e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe 31 PID 268 wrote to memory of 1748 268 e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe 31 PID 268 wrote to memory of 1748 268 e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe 31 PID 1748 wrote to memory of 2320 1748 lxxlfll.exe 32 PID 1748 wrote to memory of 2320 1748 lxxlfll.exe 32 PID 1748 wrote to memory of 2320 1748 lxxlfll.exe 32 PID 1748 wrote to memory of 2320 1748 lxxlfll.exe 32 PID 2320 wrote to memory of 2696 2320 7nnbbh.exe 33 PID 2320 wrote to memory of 2696 2320 7nnbbh.exe 33 PID 2320 wrote to memory of 2696 2320 7nnbbh.exe 33 PID 2320 wrote to memory of 2696 2320 7nnbbh.exe 33 PID 2696 wrote to memory of 3044 2696 5tnthn.exe 34 PID 2696 wrote to memory of 3044 2696 5tnthn.exe 34 PID 2696 wrote to memory of 3044 2696 5tnthn.exe 34 PID 2696 wrote to memory of 3044 2696 5tnthn.exe 34 PID 3044 wrote to memory of 2764 3044 pvpjd.exe 35 PID 3044 wrote to memory of 2764 3044 pvpjd.exe 35 PID 3044 wrote to memory of 2764 3044 pvpjd.exe 35 PID 3044 wrote to memory of 2764 3044 pvpjd.exe 35 PID 2764 wrote to memory of 2636 2764 9nnbhn.exe 36 PID 2764 wrote to memory of 2636 2764 9nnbhn.exe 36 PID 2764 wrote to memory of 2636 2764 9nnbhn.exe 36 PID 2764 wrote to memory of 2636 2764 9nnbhn.exe 36 PID 2636 wrote to memory of 2804 2636 nhhhnb.exe 37 PID 2636 wrote to memory of 2804 2636 nhhhnb.exe 37 PID 2636 wrote to memory of 2804 2636 nhhhnb.exe 37 PID 2636 wrote to memory of 2804 2636 nhhhnb.exe 37 PID 2804 wrote to memory of 2884 2804 3fxffrf.exe 38 PID 2804 wrote to memory of 2884 2804 3fxffrf.exe 38 PID 2804 wrote to memory of 2884 2804 3fxffrf.exe 38 PID 2804 wrote to memory of 2884 2804 3fxffrf.exe 38 PID 2884 wrote to memory of 2516 2884 jdvpd.exe 39 PID 2884 wrote to memory of 2516 2884 jdvpd.exe 39 PID 2884 wrote to memory of 2516 2884 jdvpd.exe 39 PID 2884 wrote to memory of 2516 2884 jdvpd.exe 39 PID 2516 wrote to memory of 484 2516 1bthnn.exe 40 PID 2516 wrote to memory of 484 2516 1bthnn.exe 40 PID 2516 wrote to memory of 484 2516 1bthnn.exe 40 PID 2516 wrote to memory of 484 2516 1bthnn.exe 40 PID 484 wrote to memory of 3032 484 vvvpd.exe 41 PID 484 wrote to memory of 3032 484 vvvpd.exe 41 PID 484 wrote to memory of 3032 484 vvvpd.exe 41 PID 484 wrote to memory of 3032 484 vvvpd.exe 41 PID 3032 wrote to memory of 1772 3032 hbthnn.exe 42 PID 3032 wrote to memory of 1772 3032 hbthnn.exe 42 PID 3032 wrote to memory of 1772 3032 hbthnn.exe 42 PID 3032 wrote to memory of 1772 3032 hbthnn.exe 42 PID 1772 wrote to memory of 2500 1772 nnhnbt.exe 43 PID 1772 wrote to memory of 2500 1772 nnhnbt.exe 43 PID 1772 wrote to memory of 2500 1772 nnhnbt.exe 43 PID 1772 wrote to memory of 2500 1772 nnhnbt.exe 43 PID 2500 wrote to memory of 1816 2500 nhhhht.exe 44 PID 2500 wrote to memory of 1816 2500 nhhhht.exe 44 PID 2500 wrote to memory of 1816 2500 nhhhht.exe 44 PID 2500 wrote to memory of 1816 2500 nhhhht.exe 44 PID 1816 wrote to memory of 1908 1816 pjjvp.exe 45 PID 1816 wrote to memory of 1908 1816 pjjvp.exe 45 PID 1816 wrote to memory of 1908 1816 pjjvp.exe 45 PID 1816 wrote to memory of 1908 1816 pjjvp.exe 45 PID 1908 wrote to memory of 1156 1908 5hhntb.exe 46 PID 1908 wrote to memory of 1156 1908 5hhntb.exe 46 PID 1908 wrote to memory of 1156 1908 5hhntb.exe 46 PID 1908 wrote to memory of 1156 1908 5hhntb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe"C:\Users\Admin\AppData\Local\Temp\e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\lxxlfll.exec:\lxxlfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\7nnbbh.exec:\7nnbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\5tnthn.exec:\5tnthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pvpjd.exec:\pvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\9nnbhn.exec:\9nnbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nhhhnb.exec:\nhhhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3fxffrf.exec:\3fxffrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jdvpd.exec:\jdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\1bthnn.exec:\1bthnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\vvvpd.exec:\vvvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\hbthnn.exec:\hbthnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\nnhnbt.exec:\nnhnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nhhhht.exec:\nhhhht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\pjjvp.exec:\pjjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\5hhntb.exec:\5hhntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\rlfrfrl.exec:\rlfrfrl.exe17⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nhhhtt.exec:\nhhhtt.exe18⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hnnhtt.exec:\hnnhtt.exe19⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3hbhnt.exec:\3hbhnt.exe20⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bhbhbn.exec:\bhbhbn.exe21⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xrlrfll.exec:\xrlrfll.exe22⤵
- Executes dropped EXE
PID:676 -
\??\c:\btnbhh.exec:\btnbhh.exe23⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1flxxfx.exec:\1flxxfx.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7nbbnt.exec:\7nbbnt.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1fxxflf.exec:\1fxxflf.exe26⤵
- Executes dropped EXE
PID:988 -
\??\c:\tbtbhn.exec:\tbtbhn.exe27⤵
- Executes dropped EXE
PID:1384 -
\??\c:\3rffrlr.exec:\3rffrlr.exe28⤵
- Executes dropped EXE
PID:876 -
\??\c:\1lxlxfl.exec:\1lxlxfl.exe29⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvpvj.exec:\vvpvj.exe30⤵
- Executes dropped EXE
PID:1032 -
\??\c:\flxrfrl.exec:\flxrfrl.exe31⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vpjpj.exec:\vpjpj.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5rlxlxr.exec:\5rlxlxr.exe33⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvvpd.exec:\vvvpd.exe34⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jjdjv.exec:\jjdjv.exe35⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llfxlll.exec:\llfxlll.exe36⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hnhbhn.exec:\hnhbhn.exe37⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnbnhh.exec:\bnbnhh.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\djdvp.exec:\djdvp.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrllllr.exec:\xrllllr.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\thnntt.exec:\thnntt.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vvpjv.exec:\vvpjv.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7rxxfxf.exec:\7rxxfxf.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrlrffx.exec:\xrlrffx.exe45⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1thnhn.exec:\1thnhn.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jdjpv.exec:\jdjpv.exe47⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3vppp.exec:\3vppp.exe48⤵
- Executes dropped EXE
PID:324 -
\??\c:\5rxfxrr.exec:\5rxfxrr.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9bbtbh.exec:\9bbtbh.exe50⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5nnthn.exec:\5nnthn.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjdpv.exec:\jjdpv.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lllrxrr.exec:\lllrxrr.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hbhhtt.exec:\hbhhtt.exe54⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pjjdj.exec:\pjjdj.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pdppp.exec:\pdppp.exe56⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3nbttt.exec:\3nbttt.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5jdjp.exec:\5jdjp.exe59⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vpvvv.exec:\vpvvv.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rffrxxx.exec:\rffrxxx.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tnttbh.exec:\tnttbh.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\5dddv.exec:\5dddv.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vvvjp.exec:\vvvjp.exe64⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5ffrlrr.exec:\5ffrlrr.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\btnthn.exec:\btnthn.exe66⤵PID:572
-
\??\c:\tnbnnb.exec:\tnbnnb.exe67⤵PID:1548
-
\??\c:\vvvdd.exec:\vvvdd.exe68⤵PID:1384
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe69⤵PID:2052
-
\??\c:\ntthbn.exec:\ntthbn.exe70⤵PID:2236
-
\??\c:\tnbntb.exec:\tnbntb.exe71⤵PID:2180
-
\??\c:\pvvjv.exec:\pvvjv.exe72⤵PID:1032
-
\??\c:\1llrlrr.exec:\1llrlrr.exe73⤵PID:3016
-
\??\c:\xlfxffl.exec:\xlfxffl.exe74⤵PID:3036
-
\??\c:\5nbhbh.exec:\5nbhbh.exe75⤵PID:3008
-
\??\c:\1jppp.exec:\1jppp.exe76⤵PID:2332
-
\??\c:\ppjpv.exec:\ppjpv.exe77⤵PID:1592
-
\??\c:\fxllrrf.exec:\fxllrrf.exe78⤵PID:1828
-
\??\c:\7nhnbb.exec:\7nhnbb.exe79⤵PID:896
-
\??\c:\7vjjp.exec:\7vjjp.exe80⤵PID:1668
-
\??\c:\9dpvv.exec:\9dpvv.exe81⤵PID:2620
-
\??\c:\xrflllx.exec:\xrflllx.exe82⤵PID:2752
-
\??\c:\tbbtbb.exec:\tbbtbb.exe83⤵PID:2748
-
\??\c:\7nhhnn.exec:\7nhhnn.exe84⤵PID:2764
-
\??\c:\5jddd.exec:\5jddd.exe85⤵PID:2672
-
\??\c:\xlfxxfl.exec:\xlfxxfl.exe86⤵PID:2624
-
\??\c:\rrlxlxx.exec:\rrlxlxx.exe87⤵PID:2560
-
\??\c:\bhbnnn.exec:\bhbnnn.exe88⤵PID:2972
-
\??\c:\jdvvj.exec:\jdvvj.exe89⤵PID:2992
-
\??\c:\vpdvd.exec:\vpdvd.exe90⤵PID:2984
-
\??\c:\xrrflrl.exec:\xrrflrl.exe91⤵PID:1328
-
\??\c:\nhhhbh.exec:\nhhhbh.exe92⤵PID:2732
-
\??\c:\tbhhnt.exec:\tbhhnt.exe93⤵PID:2036
-
\??\c:\vvvdj.exec:\vvvdj.exe94⤵PID:1776
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe95⤵PID:2872
-
\??\c:\ffrrflr.exec:\ffrrflr.exe96⤵PID:2708
-
\??\c:\btntnt.exec:\btntnt.exe97⤵PID:1760
-
\??\c:\vvpdv.exec:\vvpdv.exe98⤵PID:2844
-
\??\c:\rlxxfll.exec:\rlxxfll.exe99⤵PID:2140
-
\??\c:\bnbbhh.exec:\bnbbhh.exe100⤵PID:2860
-
\??\c:\tnhhbn.exec:\tnhhbn.exe101⤵PID:2100
-
\??\c:\jvvpd.exec:\jvvpd.exe102⤵PID:2152
-
\??\c:\xxxflrf.exec:\xxxflrf.exe103⤵PID:2712
-
\??\c:\ffxffff.exec:\ffxffff.exe104⤵PID:748
-
\??\c:\bbbnnt.exec:\bbbnnt.exe105⤵PID:1860
-
\??\c:\3dppp.exec:\3dppp.exe106⤵PID:1604
-
\??\c:\ppjpd.exec:\ppjpd.exe107⤵PID:1876
-
\??\c:\xlffllr.exec:\xlffllr.exe108⤵PID:1036
-
\??\c:\5thntb.exec:\5thntb.exe109⤵PID:936
-
\??\c:\tnbbhh.exec:\tnbbhh.exe110⤵PID:2200
-
\??\c:\djvdp.exec:\djvdp.exe111⤵PID:2400
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe112⤵PID:3056
-
\??\c:\lfllxfl.exec:\lfllxfl.exe113⤵
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\5ntnhn.exec:\5ntnhn.exe114⤵PID:2440
-
\??\c:\vppvd.exec:\vppvd.exe115⤵PID:2376
-
\??\c:\rlxrllr.exec:\rlxrllr.exe116⤵PID:2928
-
\??\c:\llrlrfl.exec:\llrlrfl.exe117⤵PID:2168
-
\??\c:\7hbhnn.exec:\7hbhnn.exe118⤵PID:2592
-
\??\c:\vjvjp.exec:\vjvjp.exe119⤵PID:1172
-
\??\c:\lxfflfx.exec:\lxfflfx.exe120⤵PID:1588
-
\??\c:\bbnntt.exec:\bbnntt.exe121⤵PID:1248
-
\??\c:\dpvvp.exec:\dpvvp.exe122⤵PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-