Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe
-
Size
456KB
-
MD5
7ec19c0612051d0ca8c087d205c1ac32
-
SHA1
710a22d0906be18a8a562a482862729e1e30c96f
-
SHA256
1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef
-
SHA512
0a84f4e043d71db4ea18038a1db1554f0b0d843499971780b815f2fe1f237687ea8e0ac30c8e29962e407181dfc59d1ce2ed66c8d39c783f4efadb73aea3de43
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbexu:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2400-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-26-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2772-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-68-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2604-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-88-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/472-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1104-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-136-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1984-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-183-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1848-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-241-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1356-240-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/336-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-297-0x0000000077310000-0x000000007742F000-memory.dmp family_blackmoon behavioral1/memory/2780-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/392-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-651-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/696-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-876-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2400 lfxfrxl.exe 1732 hbtthn.exe 2772 ffrrxxr.exe 2704 dpjvd.exe 2908 5frrlrf.exe 2820 pjdpd.exe 2604 lllxflf.exe 2992 9httnh.exe 3016 vpjvj.exe 472 thnnnt.exe 1480 vvvjj.exe 2824 rlrflrf.exe 2884 bbthnt.exe 1104 jvjjj.exe 1812 3thbtt.exe 1984 vjddj.exe 1952 5frfllr.exe 2580 1hbhnt.exe 1848 1pppd.exe 1032 frlxrxr.exe 2108 vvpdj.exe 2932 9rlrflx.exe 1420 tnbtth.exe 1356 vpdjv.exe 1648 rrlrflx.exe 1028 7pjjj.exe 1200 lrfxlff.exe 336 nbnhnh.exe 2272 jvppd.exe 2052 9lxrxrr.exe 1228 9ttbtt.exe 1576 rfrxffl.exe 2784 hbthnn.exe 2764 pdpvv.exe 2780 pdpvd.exe 2608 ttthtt.exe 2672 nttntt.exe 2664 dpddd.exe 2488 lxrxrlr.exe 2536 nhhhhh.exe 2556 nnnbbh.exe 2404 3vddj.exe 1052 rrlxlxr.exe 1496 nbnhhb.exe 392 nhbhnh.exe 988 pdppp.exe 3008 1xllllf.exe 2532 rfrxrll.exe 2872 7nttbh.exe 1796 5vjjj.exe 2552 pjvvv.exe 2000 1xffllr.exe 1856 nnbhnb.exe 632 1jdpv.exe 2744 3xllrrf.exe 2144 tbtttn.exe 1928 nhhhnh.exe 1660 rlflflf.exe 2164 1nbhnt.exe 2472 7jvpv.exe 1224 9fxxllx.exe 1916 thbtbb.exe 1136 9pdvv.exe 1684 xrrxllx.exe -
resource yara_rule behavioral1/memory/2400-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/472-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-917-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2400 1120 1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe 28 PID 1120 wrote to memory of 2400 1120 1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe 28 PID 1120 wrote to memory of 2400 1120 1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe 28 PID 1120 wrote to memory of 2400 1120 1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe 28 PID 2400 wrote to memory of 1732 2400 lfxfrxl.exe 29 PID 2400 wrote to memory of 1732 2400 lfxfrxl.exe 29 PID 2400 wrote to memory of 1732 2400 lfxfrxl.exe 29 PID 2400 wrote to memory of 1732 2400 lfxfrxl.exe 29 PID 1732 wrote to memory of 2772 1732 hbtthn.exe 30 PID 1732 wrote to memory of 2772 1732 hbtthn.exe 30 PID 1732 wrote to memory of 2772 1732 hbtthn.exe 30 PID 1732 wrote to memory of 2772 1732 hbtthn.exe 30 PID 2772 wrote to memory of 2704 2772 ffrrxxr.exe 31 PID 2772 wrote to memory of 2704 2772 ffrrxxr.exe 31 PID 2772 wrote to memory of 2704 2772 ffrrxxr.exe 31 PID 2772 wrote to memory of 2704 2772 ffrrxxr.exe 31 PID 2704 wrote to memory of 2908 2704 dpjvd.exe 32 PID 2704 wrote to memory of 2908 2704 dpjvd.exe 32 PID 2704 wrote to memory of 2908 2704 dpjvd.exe 32 PID 2704 wrote to memory of 2908 2704 dpjvd.exe 32 PID 2908 wrote to memory of 2820 2908 5frrlrf.exe 33 PID 2908 wrote to memory of 2820 2908 5frrlrf.exe 33 PID 2908 wrote to memory of 2820 2908 5frrlrf.exe 33 PID 2908 wrote to memory of 2820 2908 5frrlrf.exe 33 PID 2820 wrote to memory of 2604 2820 pjdpd.exe 34 PID 2820 wrote to memory of 2604 2820 pjdpd.exe 34 PID 2820 wrote to memory of 2604 2820 pjdpd.exe 34 PID 2820 wrote to memory of 2604 2820 pjdpd.exe 34 PID 2604 wrote to memory of 2992 2604 lllxflf.exe 35 PID 2604 wrote to memory of 2992 2604 lllxflf.exe 35 PID 2604 wrote to memory of 2992 2604 lllxflf.exe 35 PID 2604 wrote to memory of 2992 2604 lllxflf.exe 35 PID 2992 wrote to memory of 3016 2992 9httnh.exe 36 PID 2992 wrote to memory of 3016 2992 9httnh.exe 36 PID 2992 wrote to memory of 3016 2992 9httnh.exe 36 PID 2992 wrote to memory of 3016 2992 9httnh.exe 36 PID 3016 wrote to memory of 472 3016 vpjvj.exe 37 PID 3016 wrote to memory of 472 3016 vpjvj.exe 37 PID 3016 wrote to memory of 472 3016 vpjvj.exe 37 PID 3016 wrote to memory of 472 3016 vpjvj.exe 37 PID 472 wrote to memory of 1480 472 thnnnt.exe 38 PID 472 wrote to memory of 1480 472 thnnnt.exe 38 PID 472 wrote to memory of 1480 472 thnnnt.exe 38 PID 472 wrote to memory of 1480 472 thnnnt.exe 38 PID 1480 wrote to memory of 2824 1480 vvvjj.exe 39 PID 1480 wrote to memory of 2824 1480 vvvjj.exe 39 PID 1480 wrote to memory of 2824 1480 vvvjj.exe 39 PID 1480 wrote to memory of 2824 1480 vvvjj.exe 39 PID 2824 wrote to memory of 2884 2824 rlrflrf.exe 40 PID 2824 wrote to memory of 2884 2824 rlrflrf.exe 40 PID 2824 wrote to memory of 2884 2824 rlrflrf.exe 40 PID 2824 wrote to memory of 2884 2824 rlrflrf.exe 40 PID 2884 wrote to memory of 1104 2884 bbthnt.exe 41 PID 2884 wrote to memory of 1104 2884 bbthnt.exe 41 PID 2884 wrote to memory of 1104 2884 bbthnt.exe 41 PID 2884 wrote to memory of 1104 2884 bbthnt.exe 41 PID 1104 wrote to memory of 1812 1104 jvjjj.exe 42 PID 1104 wrote to memory of 1812 1104 jvjjj.exe 42 PID 1104 wrote to memory of 1812 1104 jvjjj.exe 42 PID 1104 wrote to memory of 1812 1104 jvjjj.exe 42 PID 1812 wrote to memory of 1984 1812 3thbtt.exe 43 PID 1812 wrote to memory of 1984 1812 3thbtt.exe 43 PID 1812 wrote to memory of 1984 1812 3thbtt.exe 43 PID 1812 wrote to memory of 1984 1812 3thbtt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe"C:\Users\Admin\AppData\Local\Temp\1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hbtthn.exec:\hbtthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\ffrrxxr.exec:\ffrrxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dpjvd.exec:\dpjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5frrlrf.exec:\5frrlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pjdpd.exec:\pjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lllxflf.exec:\lllxflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\9httnh.exec:\9httnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vpjvj.exec:\vpjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\thnnnt.exec:\thnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\vvvjj.exec:\vvvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rlrflrf.exec:\rlrflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bbthnt.exec:\bbthnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\jvjjj.exec:\jvjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\3thbtt.exec:\3thbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\vjddj.exec:\vjddj.exe17⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5frfllr.exec:\5frfllr.exe18⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1hbhnt.exec:\1hbhnt.exe19⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1pppd.exec:\1pppd.exe20⤵
- Executes dropped EXE
PID:1848 -
\??\c:\frlxrxr.exec:\frlxrxr.exe21⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vvpdj.exec:\vvpdj.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\9rlrflx.exec:\9rlrflx.exe23⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnbtth.exec:\tnbtth.exe24⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vpdjv.exec:\vpdjv.exe25⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rrlrflx.exec:\rrlrflx.exe26⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7pjjj.exec:\7pjjj.exe27⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lrfxlff.exec:\lrfxlff.exe28⤵
- Executes dropped EXE
PID:1200 -
\??\c:\nbnhnh.exec:\nbnhnh.exe29⤵
- Executes dropped EXE
PID:336 -
\??\c:\jvppd.exec:\jvppd.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9lxrxrr.exec:\9lxrxrr.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\9ttbtt.exec:\9ttbtt.exe32⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3dppv.exec:\3dppv.exe33⤵PID:1628
-
\??\c:\rfrxffl.exec:\rfrxffl.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hbthnn.exec:\hbthnn.exe35⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdpvv.exec:\pdpvv.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pdpvd.exec:\pdpvd.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ttthtt.exec:\ttthtt.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nttntt.exec:\nttntt.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dpddd.exec:\dpddd.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lxrxrlr.exec:\lxrxrlr.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nhhhhh.exec:\nhhhhh.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nnnbbh.exec:\nnnbbh.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3vddj.exec:\3vddj.exe44⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rrlxlxr.exec:\rrlxlxr.exe45⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nbnhhb.exec:\nbnhhb.exe46⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nhbhnh.exec:\nhbhnh.exe47⤵
- Executes dropped EXE
PID:392 -
\??\c:\pdppp.exec:\pdppp.exe48⤵
- Executes dropped EXE
PID:988 -
\??\c:\1xllllf.exec:\1xllllf.exe49⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rfrxrll.exec:\rfrxrll.exe50⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7nttbh.exec:\7nttbh.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5vjjj.exec:\5vjjj.exe52⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pjvvv.exec:\pjvvv.exe53⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1xffllr.exec:\1xffllr.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nnbhnb.exec:\nnbhnb.exe55⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1jdpv.exec:\1jdpv.exe56⤵
- Executes dropped EXE
PID:632 -
\??\c:\3xllrrf.exec:\3xllrrf.exe57⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbtttn.exec:\tbtttn.exe58⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nhhhnh.exec:\nhhhnh.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rlflflf.exec:\rlflflf.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1nbhnt.exec:\1nbhnt.exe61⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7jvpv.exec:\7jvpv.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9fxxllx.exec:\9fxxllx.exe63⤵
- Executes dropped EXE
PID:1224 -
\??\c:\thbtbb.exec:\thbtbb.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\9pdvv.exec:\9pdvv.exe65⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xrrxllx.exec:\xrrxllx.exe66⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hhtbnn.exec:\hhtbnn.exe67⤵PID:700
-
\??\c:\7hbntt.exec:\7hbntt.exe68⤵PID:788
-
\??\c:\dvdjp.exec:\dvdjp.exe69⤵PID:2032
-
\??\c:\3rlrrrl.exec:\3rlrrrl.exe70⤵PID:560
-
\??\c:\vjvvj.exec:\vjvvj.exe71⤵PID:1348
-
\??\c:\djddd.exec:\djddd.exe72⤵PID:2272
-
\??\c:\nbnnbt.exec:\nbnnbt.exe73⤵PID:1416
-
\??\c:\jdppp.exec:\jdppp.exe74⤵PID:1120
-
\??\c:\fxllrxl.exec:\fxllrxl.exe75⤵
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\bnbtth.exec:\bnbtth.exe76⤵PID:1608
-
\??\c:\bntntb.exec:\bntntb.exe77⤵PID:2760
-
\??\c:\vdjpd.exec:\vdjpd.exe78⤵PID:2692
-
\??\c:\xlxxllx.exec:\xlxxllx.exe79⤵PID:2596
-
\??\c:\tbbntn.exec:\tbbntn.exe80⤵PID:2104
-
\??\c:\3hhttb.exec:\3hhttb.exe81⤵PID:1044
-
\??\c:\vdvpv.exec:\vdvpv.exe82⤵PID:2716
-
\??\c:\rlffrrx.exec:\rlffrrx.exe83⤵PID:2696
-
\??\c:\hbbhtt.exec:\hbbhtt.exe84⤵PID:2508
-
\??\c:\bbnbnn.exec:\bbnbnn.exe85⤵PID:2128
-
\??\c:\ddpvj.exec:\ddpvj.exe86⤵PID:2024
-
\??\c:\jvjjp.exec:\jvjjp.exe87⤵PID:2564
-
\??\c:\lxrxfxl.exec:\lxrxfxl.exe88⤵PID:696
-
\??\c:\5nhhbn.exec:\5nhhbn.exe89⤵PID:472
-
\??\c:\dpdjp.exec:\dpdjp.exe90⤵PID:1480
-
\??\c:\7xxfllf.exec:\7xxfllf.exe91⤵PID:2888
-
\??\c:\lflllrr.exec:\lflllrr.exe92⤵PID:988
-
\??\c:\9bntbn.exec:\9bntbn.exe93⤵PID:2732
-
\??\c:\pvdjj.exec:\pvdjj.exe94⤵PID:2532
-
\??\c:\lxrxllf.exec:\lxrxllf.exe95⤵PID:1964
-
\??\c:\bbnntn.exec:\bbnntn.exe96⤵PID:2560
-
\??\c:\btbbhh.exec:\btbbhh.exe97⤵PID:1820
-
\??\c:\3dpvd.exec:\3dpvd.exe98⤵PID:1264
-
\??\c:\rlffxrf.exec:\rlffxrf.exe99⤵PID:1872
-
\??\c:\lxllrrx.exec:\lxllrrx.exe100⤵PID:632
-
\??\c:\1hbbht.exec:\1hbbht.exe101⤵PID:1848
-
\??\c:\djddd.exec:\djddd.exe102⤵PID:2748
-
\??\c:\rflffff.exec:\rflffff.exe103⤵PID:1928
-
\??\c:\lxllrll.exec:\lxllrll.exe104⤵PID:2108
-
\??\c:\1bnnhb.exec:\1bnnhb.exe105⤵PID:2180
-
\??\c:\jdjjv.exec:\jdjjv.exe106⤵PID:2376
-
\??\c:\jvjpp.exec:\jvjpp.exe107⤵PID:2156
-
\??\c:\frfrrlf.exec:\frfrrlf.exe108⤵PID:2924
-
\??\c:\9tnhhn.exec:\9tnhhn.exe109⤵PID:956
-
\??\c:\htttnn.exec:\htttnn.exe110⤵PID:2392
-
\??\c:\jvjjj.exec:\jvjjj.exe111⤵PID:2140
-
\??\c:\frfllfl.exec:\frfllfl.exe112⤵PID:788
-
\??\c:\tbhbtn.exec:\tbhbtn.exe113⤵PID:1832
-
\??\c:\nbnnnn.exec:\nbnnnn.exe114⤵PID:2100
-
\??\c:\7pvvd.exec:\7pvvd.exe115⤵PID:2260
-
\??\c:\rlrlfxf.exec:\rlrlfxf.exe116⤵PID:2240
-
\??\c:\nbnhbb.exec:\nbnhbb.exe117⤵PID:1416
-
\??\c:\bthtth.exec:\bthtth.exe118⤵PID:1716
-
\??\c:\vpjdj.exec:\vpjdj.exe119⤵PID:1612
-
\??\c:\5frrffl.exec:\5frrffl.exe120⤵PID:1608
-
\??\c:\1hhbth.exec:\1hhbth.exe121⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-