Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 22:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe
-
Size
454KB
-
MD5
a4f63d04489d1502617b22253d4f3ff3
-
SHA1
7e624b63777ae58fa4171bd542efa08b6b25a72b
-
SHA256
552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20
-
SHA512
3ccc67ab3a619954ef5ceac199a0dc66139d9e0aa5926db786280734c42db39632c3560bb5643d29c496ec48d730c644b8b99a9159f8cc001a3db78177a145c5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed9:q7Tc2NYHUrAwfMp3CDd9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2404-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-73-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2952-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-234-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1036-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-280-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2164-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-291-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/476-308-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/476-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-352-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2736-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-413-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2716-422-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1904-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-690-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-767-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/408-777-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1280-816-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2824-927-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1308-996-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2196-1051-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2908 rrffrfx.exe 2216 5hthhb.exe 2536 9dppd.exe 3068 frrrflx.exe 2720 3bnbnb.exe 2844 bbbbhh.exe 2976 dvpdp.exe 2952 bbttbb.exe 2784 pjpjv.exe 2628 nhtbhb.exe 3052 jvpvj.exe 2160 bnbbhb.exe 1764 9jppp.exe 2452 nhbthh.exe 2524 ffrlrxl.exe 556 dvpdj.exe 1768 9fllrxf.exe 2932 jjdjp.exe 2304 lfxlffr.exe 2504 bnbbhh.exe 2492 ppdjd.exe 1128 7rrfffr.exe 1776 hbnntn.exe 2324 ffrrflf.exe 2032 hbnnbt.exe 1668 dvvpv.exe 1548 xrfxfxl.exe 1036 pdvpv.exe 2500 lfflllx.exe 2164 9pjdj.exe 3016 fxlrllr.exe 2104 lflrxfr.exe 476 vjppv.exe 1608 thbhnn.exe 1752 vjvvd.exe 2216 vpppp.exe 2228 rrllrrx.exe 2964 3hbnbt.exe 2756 jjvvd.exe 1052 pdjdd.exe 2980 rlxfrxl.exe 2760 btbhtb.exe 2872 bthbtt.exe 2640 jdppp.exe 2780 llxrflx.exe 2752 frffllx.exe 2736 thbbtt.exe 984 jdvvd.exe 1536 dvpvj.exe 1872 lxrrxxf.exe 2716 hhbbnn.exe 1844 9dpvd.exe 1804 jjpvd.exe 1904 llffrlr.exe 1948 thbhbb.exe 2916 vpjjv.exe 1768 9dvdj.exe 2212 lfrlrrx.exe 2052 bbbhtb.exe 2496 vjppp.exe 904 3pvvv.exe 652 1flxfxx.exe 1080 tthntn.exe 1692 jvpjv.exe -
resource yara_rule behavioral1/memory/2404-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-352-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2760-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-504-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2320-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-949-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-1086-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2908 2404 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 2404 wrote to memory of 2908 2404 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 2404 wrote to memory of 2908 2404 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 2404 wrote to memory of 2908 2404 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 2908 wrote to memory of 2216 2908 rrffrfx.exe 31 PID 2908 wrote to memory of 2216 2908 rrffrfx.exe 31 PID 2908 wrote to memory of 2216 2908 rrffrfx.exe 31 PID 2908 wrote to memory of 2216 2908 rrffrfx.exe 31 PID 2216 wrote to memory of 2536 2216 5hthhb.exe 32 PID 2216 wrote to memory of 2536 2216 5hthhb.exe 32 PID 2216 wrote to memory of 2536 2216 5hthhb.exe 32 PID 2216 wrote to memory of 2536 2216 5hthhb.exe 32 PID 2536 wrote to memory of 3068 2536 9dppd.exe 33 PID 2536 wrote to memory of 3068 2536 9dppd.exe 33 PID 2536 wrote to memory of 3068 2536 9dppd.exe 33 PID 2536 wrote to memory of 3068 2536 9dppd.exe 33 PID 3068 wrote to memory of 2720 3068 frrrflx.exe 34 PID 3068 wrote to memory of 2720 3068 frrrflx.exe 34 PID 3068 wrote to memory of 2720 3068 frrrflx.exe 34 PID 3068 wrote to memory of 2720 3068 frrrflx.exe 34 PID 2720 wrote to memory of 2844 2720 3bnbnb.exe 35 PID 2720 wrote to memory of 2844 2720 3bnbnb.exe 35 PID 2720 wrote to memory of 2844 2720 3bnbnb.exe 35 PID 2720 wrote to memory of 2844 2720 3bnbnb.exe 35 PID 2844 wrote to memory of 2976 2844 bbbbhh.exe 36 PID 2844 wrote to memory of 2976 2844 bbbbhh.exe 36 PID 2844 wrote to memory of 2976 2844 bbbbhh.exe 36 PID 2844 wrote to memory of 2976 2844 bbbbhh.exe 36 PID 2976 wrote to memory of 2952 2976 dvpdp.exe 37 PID 2976 wrote to memory of 2952 2976 dvpdp.exe 37 PID 2976 wrote to memory of 2952 2976 dvpdp.exe 37 PID 2976 wrote to memory of 2952 2976 dvpdp.exe 37 PID 2952 wrote to memory of 2784 2952 bbttbb.exe 38 PID 2952 wrote to memory of 2784 2952 bbttbb.exe 38 PID 2952 wrote to memory of 2784 2952 bbttbb.exe 38 PID 2952 wrote to memory of 2784 2952 bbttbb.exe 38 PID 2784 wrote to memory of 2628 2784 pjpjv.exe 39 PID 2784 wrote to memory of 2628 2784 pjpjv.exe 39 PID 2784 wrote to memory of 2628 2784 pjpjv.exe 39 PID 2784 wrote to memory of 2628 2784 pjpjv.exe 39 PID 2628 wrote to memory of 3052 2628 nhtbhb.exe 40 PID 2628 wrote to memory of 3052 2628 nhtbhb.exe 40 PID 2628 wrote to memory of 3052 2628 nhtbhb.exe 40 PID 2628 wrote to memory of 3052 2628 nhtbhb.exe 40 PID 3052 wrote to memory of 2160 3052 jvpvj.exe 41 PID 3052 wrote to memory of 2160 3052 jvpvj.exe 41 PID 3052 wrote to memory of 2160 3052 jvpvj.exe 41 PID 3052 wrote to memory of 2160 3052 jvpvj.exe 41 PID 2160 wrote to memory of 1764 2160 bnbbhb.exe 42 PID 2160 wrote to memory of 1764 2160 bnbbhb.exe 42 PID 2160 wrote to memory of 1764 2160 bnbbhb.exe 42 PID 2160 wrote to memory of 1764 2160 bnbbhb.exe 42 PID 1764 wrote to memory of 2452 1764 9jppp.exe 43 PID 1764 wrote to memory of 2452 1764 9jppp.exe 43 PID 1764 wrote to memory of 2452 1764 9jppp.exe 43 PID 1764 wrote to memory of 2452 1764 9jppp.exe 43 PID 2452 wrote to memory of 2524 2452 nhbthh.exe 44 PID 2452 wrote to memory of 2524 2452 nhbthh.exe 44 PID 2452 wrote to memory of 2524 2452 nhbthh.exe 44 PID 2452 wrote to memory of 2524 2452 nhbthh.exe 44 PID 2524 wrote to memory of 556 2524 ffrlrxl.exe 45 PID 2524 wrote to memory of 556 2524 ffrlrxl.exe 45 PID 2524 wrote to memory of 556 2524 ffrlrxl.exe 45 PID 2524 wrote to memory of 556 2524 ffrlrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe"C:\Users\Admin\AppData\Local\Temp\552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rrffrfx.exec:\rrffrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\5hthhb.exec:\5hthhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\9dppd.exec:\9dppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\frrrflx.exec:\frrrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\3bnbnb.exec:\3bnbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bbbbhh.exec:\bbbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dvpdp.exec:\dvpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bbttbb.exec:\bbttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pjpjv.exec:\pjpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nhtbhb.exec:\nhtbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jvpvj.exec:\jvpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\bnbbhb.exec:\bnbbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\9jppp.exec:\9jppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\nhbthh.exec:\nhbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ffrlrxl.exec:\ffrlrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\dvpdj.exec:\dvpdj.exe17⤵
- Executes dropped EXE
PID:556 -
\??\c:\9fllrxf.exec:\9fllrxf.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jjdjp.exec:\jjdjp.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lfxlffr.exec:\lfxlffr.exe20⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnbbhh.exec:\bnbbhh.exe21⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ppdjd.exec:\ppdjd.exe22⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7rrfffr.exec:\7rrfffr.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\hbnntn.exec:\hbnntn.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ffrrflf.exec:\ffrrflf.exe25⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hbnnbt.exec:\hbnnbt.exe26⤵
- Executes dropped EXE
PID:2032 -
\??\c:\dvvpv.exec:\dvvpv.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xrfxfxl.exec:\xrfxfxl.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pdvpv.exec:\pdvpv.exe29⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lfflllx.exec:\lfflllx.exe30⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9pjdj.exec:\9pjdj.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fxlrllr.exec:\fxlrllr.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lflrxfr.exec:\lflrxfr.exe33⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vjppv.exec:\vjppv.exe34⤵
- Executes dropped EXE
PID:476 -
\??\c:\thbhnn.exec:\thbhnn.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\vjvvd.exec:\vjvvd.exe36⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vpppp.exec:\vpppp.exe37⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rrllrrx.exec:\rrllrrx.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3hbnbt.exec:\3hbnbt.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jjvvd.exec:\jjvvd.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pdjdd.exec:\pdjdd.exe41⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\btbhtb.exec:\btbhtb.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bthbtt.exec:\bthbtt.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jdppp.exec:\jdppp.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\llxrflx.exec:\llxrflx.exe46⤵
- Executes dropped EXE
PID:2780 -
\??\c:\frffllx.exec:\frffllx.exe47⤵
- Executes dropped EXE
PID:2752 -
\??\c:\thbbtt.exec:\thbbtt.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jdvvd.exec:\jdvvd.exe49⤵
- Executes dropped EXE
PID:984 -
\??\c:\dvpvj.exec:\dvpvj.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hhbbnn.exec:\hhbbnn.exe52⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9dpvd.exec:\9dpvd.exe53⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjpvd.exec:\jjpvd.exe54⤵
- Executes dropped EXE
PID:1804 -
\??\c:\llffrlr.exec:\llffrlr.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\thbhbb.exec:\thbhbb.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpjjv.exec:\vpjjv.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9dvdj.exec:\9dvdj.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe59⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbbhtb.exec:\bbbhtb.exe60⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vjppp.exec:\vjppp.exe61⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3pvvv.exec:\3pvvv.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\1flxfxx.exec:\1flxfxx.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:652 -
\??\c:\tthntn.exec:\tthntn.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jvpjv.exec:\jvpjv.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jjdjd.exec:\jjdjd.exe66⤵PID:2324
-
\??\c:\3xlxrxr.exec:\3xlxrxr.exe67⤵PID:2300
-
\??\c:\hbttht.exec:\hbttht.exe68⤵PID:876
-
\??\c:\thtnnt.exec:\thtnnt.exe69⤵PID:1560
-
\??\c:\pdppj.exec:\pdppj.exe70⤵PID:2520
-
\??\c:\9fxxfff.exec:\9fxxfff.exe71⤵
- System Location Discovery: System Language Discovery
PID:2044 -
\??\c:\xfllrrx.exec:\xfllrrx.exe72⤵PID:2532
-
\??\c:\tbbtnb.exec:\tbbtnb.exe73⤵PID:2208
-
\??\c:\dvjjd.exec:\dvjjd.exe74⤵PID:672
-
\??\c:\rrflxrx.exec:\rrflxrx.exe75⤵PID:324
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe76⤵PID:1512
-
\??\c:\tnbthn.exec:\tnbthn.exe77⤵PID:688
-
\??\c:\pjjjv.exec:\pjjjv.exe78⤵PID:3036
-
\??\c:\7djjv.exec:\7djjv.exe79⤵PID:1664
-
\??\c:\lllxrxx.exec:\lllxrxx.exe80⤵PID:1608
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe81⤵PID:2320
-
\??\c:\thbthh.exec:\thbthh.exe82⤵PID:2436
-
\??\c:\3jvpv.exec:\3jvpv.exe83⤵PID:2248
-
\??\c:\vpdjp.exec:\vpdjp.exe84⤵PID:2724
-
\??\c:\xxrxllx.exec:\xxrxllx.exe85⤵PID:2088
-
\??\c:\9hbhnn.exec:\9hbhnn.exe86⤵PID:2868
-
\??\c:\hbttbb.exec:\hbttbb.exe87⤵PID:2844
-
\??\c:\3vvdd.exec:\3vvdd.exe88⤵PID:2064
-
\??\c:\rrflrrx.exec:\rrflrrx.exe89⤵PID:2748
-
\??\c:\tnnbhh.exec:\tnnbhh.exe90⤵PID:2640
-
\??\c:\3tbbtt.exec:\3tbbtt.exe91⤵PID:2668
-
\??\c:\dddpj.exec:\dddpj.exe92⤵PID:2752
-
\??\c:\llxfxxx.exec:\llxfxxx.exe93⤵PID:2632
-
\??\c:\fxrxllx.exec:\fxrxllx.exe94⤵PID:2688
-
\??\c:\7hhthn.exec:\7hhthn.exe95⤵PID:1124
-
\??\c:\7ppdv.exec:\7ppdv.exe96⤵PID:576
-
\??\c:\dvvvd.exec:\dvvvd.exe97⤵PID:2144
-
\??\c:\9fxfrxf.exec:\9fxfrxf.exe98⤵PID:1844
-
\??\c:\ntnntb.exec:\ntnntb.exe99⤵PID:1136
-
\??\c:\ttnbtt.exec:\ttnbtt.exe100⤵PID:2912
-
\??\c:\ppdjv.exec:\ppdjv.exe101⤵PID:2128
-
\??\c:\lxrrffr.exec:\lxrrffr.exe102⤵PID:2940
-
\??\c:\hhhtbt.exec:\hhhtbt.exe103⤵PID:2200
-
\??\c:\bbbhnt.exec:\bbbhnt.exe104⤵PID:2508
-
\??\c:\jpjpv.exec:\jpjpv.exe105⤵PID:2516
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe106⤵PID:2020
-
\??\c:\xfrrfxf.exec:\xfrrfxf.exe107⤵PID:408
-
\??\c:\1tthtb.exec:\1tthtb.exe108⤵PID:772
-
\??\c:\ddvdp.exec:\ddvdp.exe109⤵PID:1812
-
\??\c:\lfflxlf.exec:\lfflxlf.exe110⤵PID:1280
-
\??\c:\ffxrlfr.exec:\ffxrlfr.exe111⤵PID:1332
-
\??\c:\1hntbb.exec:\1hntbb.exe112⤵PID:2032
-
\??\c:\ppddd.exec:\ppddd.exe113⤵PID:888
-
\??\c:\3lfllrf.exec:\3lfllrf.exe114⤵PID:1012
-
\??\c:\ntnbhn.exec:\ntnbhn.exe115⤵PID:2292
-
\??\c:\3ththn.exec:\3ththn.exe116⤵PID:2044
-
\??\c:\5dvjp.exec:\5dvjp.exe117⤵PID:2376
-
\??\c:\rlflxfr.exec:\rlflxfr.exe118⤵PID:2164
-
\??\c:\xxfffxr.exec:\xxfffxr.exe119⤵PID:672
-
\??\c:\1thnhn.exec:\1thnhn.exe120⤵PID:3016
-
\??\c:\pppvj.exec:\pppvj.exe121⤵PID:1512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-