Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe
-
Size
454KB
-
MD5
a4f63d04489d1502617b22253d4f3ff3
-
SHA1
7e624b63777ae58fa4171bd542efa08b6b25a72b
-
SHA256
552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20
-
SHA512
3ccc67ab3a619954ef5ceac199a0dc66139d9e0aa5926db786280734c42db39632c3560bb5643d29c496ec48d730c644b8b99a9159f8cc001a3db78177a145c5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed9:q7Tc2NYHUrAwfMp3CDd9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1976-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-65-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2904-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-105-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2684-115-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-144-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1284-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-226-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/448-225-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1788-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-430-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1156-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-554-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2072-573-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2660-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-606-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2808-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-846-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-865-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-891-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2000-956-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-963-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 ttbbhh.exe 2348 vvjvj.exe 1864 1rlrffx.exe 2748 1tttbb.exe 3056 ddpvd.exe 2808 5xrrxxf.exe 2904 ntnthh.exe 2684 fxlxlfl.exe 2804 hthhtt.exe 2568 fxfxlfl.exe 2688 hbnthh.exe 1532 dpjpd.exe 1488 rrlrflx.exe 1296 nhbhhn.exe 1980 jdvvj.exe 1284 rlflllx.exe 1952 fxrrrrr.exe 1388 lfrlffx.exe 2012 vddjd.exe 2424 llflxxx.exe 2448 1hbntb.exe 860 rlxrxfl.exe 448 nhttbb.exe 1948 jdvdj.exe 960 7rrrxxr.exe 1788 5thtbb.exe 2940 xlxxfll.exe 2400 nbntbb.exe 3036 1jdvp.exe 3032 ffrlffr.exe 2368 nbbhnt.exe 2516 dvjjv.exe 1616 nnbhnn.exe 2480 vpjjv.exe 2120 vpdjp.exe 3060 9xlfllr.exe 2856 3nnhhn.exe 2712 nbhhhb.exe 2812 pjppp.exe 2708 xlxrxxr.exe 2148 lfffrxf.exe 2668 nhbhnt.exe 2564 jpvjd.exe 2584 xrllrxx.exe 2620 nhntbh.exe 2688 btbbnn.exe 2980 dvddv.exe 1672 xrrxlrx.exe 1180 nnntbh.exe 600 bnbhhh.exe 1308 jdpvp.exe 1248 rlxxllr.exe 2476 5xllrxx.exe 1156 bttbhb.exe 1760 dvjvp.exe 1424 rlfxrxf.exe 2164 llflxxf.exe 2432 hbtbhn.exe 2960 vpjvj.exe 1588 5xxrrrr.exe 2784 9fflrxl.exe 1032 3thbnh.exe 848 jjjjj.exe 912 ffxxfxl.exe -
resource yara_rule behavioral1/memory/1976-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-142-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1284-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-161-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1952-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-970-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-995-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2520 1976 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 1976 wrote to memory of 2520 1976 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 1976 wrote to memory of 2520 1976 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 1976 wrote to memory of 2520 1976 552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe 30 PID 2520 wrote to memory of 2348 2520 ttbbhh.exe 31 PID 2520 wrote to memory of 2348 2520 ttbbhh.exe 31 PID 2520 wrote to memory of 2348 2520 ttbbhh.exe 31 PID 2520 wrote to memory of 2348 2520 ttbbhh.exe 31 PID 2348 wrote to memory of 1864 2348 vvjvj.exe 32 PID 2348 wrote to memory of 1864 2348 vvjvj.exe 32 PID 2348 wrote to memory of 1864 2348 vvjvj.exe 32 PID 2348 wrote to memory of 1864 2348 vvjvj.exe 32 PID 1864 wrote to memory of 2748 1864 1rlrffx.exe 33 PID 1864 wrote to memory of 2748 1864 1rlrffx.exe 33 PID 1864 wrote to memory of 2748 1864 1rlrffx.exe 33 PID 1864 wrote to memory of 2748 1864 1rlrffx.exe 33 PID 2748 wrote to memory of 3056 2748 1tttbb.exe 34 PID 2748 wrote to memory of 3056 2748 1tttbb.exe 34 PID 2748 wrote to memory of 3056 2748 1tttbb.exe 34 PID 2748 wrote to memory of 3056 2748 1tttbb.exe 34 PID 3056 wrote to memory of 2808 3056 ddpvd.exe 35 PID 3056 wrote to memory of 2808 3056 ddpvd.exe 35 PID 3056 wrote to memory of 2808 3056 ddpvd.exe 35 PID 3056 wrote to memory of 2808 3056 ddpvd.exe 35 PID 2808 wrote to memory of 2904 2808 5xrrxxf.exe 36 PID 2808 wrote to memory of 2904 2808 5xrrxxf.exe 36 PID 2808 wrote to memory of 2904 2808 5xrrxxf.exe 36 PID 2808 wrote to memory of 2904 2808 5xrrxxf.exe 36 PID 2904 wrote to memory of 2684 2904 ntnthh.exe 37 PID 2904 wrote to memory of 2684 2904 ntnthh.exe 37 PID 2904 wrote to memory of 2684 2904 ntnthh.exe 37 PID 2904 wrote to memory of 2684 2904 ntnthh.exe 37 PID 2684 wrote to memory of 2804 2684 fxlxlfl.exe 38 PID 2684 wrote to memory of 2804 2684 fxlxlfl.exe 38 PID 2684 wrote to memory of 2804 2684 fxlxlfl.exe 38 PID 2684 wrote to memory of 2804 2684 fxlxlfl.exe 38 PID 2804 wrote to memory of 2568 2804 hthhtt.exe 39 PID 2804 wrote to memory of 2568 2804 hthhtt.exe 39 PID 2804 wrote to memory of 2568 2804 hthhtt.exe 39 PID 2804 wrote to memory of 2568 2804 hthhtt.exe 39 PID 2568 wrote to memory of 2688 2568 fxfxlfl.exe 40 PID 2568 wrote to memory of 2688 2568 fxfxlfl.exe 40 PID 2568 wrote to memory of 2688 2568 fxfxlfl.exe 40 PID 2568 wrote to memory of 2688 2568 fxfxlfl.exe 40 PID 2688 wrote to memory of 1532 2688 hbnthh.exe 41 PID 2688 wrote to memory of 1532 2688 hbnthh.exe 41 PID 2688 wrote to memory of 1532 2688 hbnthh.exe 41 PID 2688 wrote to memory of 1532 2688 hbnthh.exe 41 PID 1532 wrote to memory of 1488 1532 dpjpd.exe 42 PID 1532 wrote to memory of 1488 1532 dpjpd.exe 42 PID 1532 wrote to memory of 1488 1532 dpjpd.exe 42 PID 1532 wrote to memory of 1488 1532 dpjpd.exe 42 PID 1488 wrote to memory of 1296 1488 rrlrflx.exe 43 PID 1488 wrote to memory of 1296 1488 rrlrflx.exe 43 PID 1488 wrote to memory of 1296 1488 rrlrflx.exe 43 PID 1488 wrote to memory of 1296 1488 rrlrflx.exe 43 PID 1296 wrote to memory of 1980 1296 nhbhhn.exe 44 PID 1296 wrote to memory of 1980 1296 nhbhhn.exe 44 PID 1296 wrote to memory of 1980 1296 nhbhhn.exe 44 PID 1296 wrote to memory of 1980 1296 nhbhhn.exe 44 PID 1980 wrote to memory of 1284 1980 jdvvj.exe 45 PID 1980 wrote to memory of 1284 1980 jdvvj.exe 45 PID 1980 wrote to memory of 1284 1980 jdvvj.exe 45 PID 1980 wrote to memory of 1284 1980 jdvvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe"C:\Users\Admin\AppData\Local\Temp\552c9469ae99250ea1fe79be8b161f8831fa814bcec8f8d20fb17175b1b28c20.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\ttbbhh.exec:\ttbbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vvjvj.exec:\vvjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\1rlrffx.exec:\1rlrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\1tttbb.exec:\1tttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\ddpvd.exec:\ddpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\5xrrxxf.exec:\5xrrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\ntnthh.exec:\ntnthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fxlxlfl.exec:\fxlxlfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hthhtt.exec:\hthhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\fxfxlfl.exec:\fxfxlfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hbnthh.exec:\hbnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dpjpd.exec:\dpjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\rrlrflx.exec:\rrlrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\nhbhhn.exec:\nhbhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\jdvvj.exec:\jdvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\rlflllx.exec:\rlflllx.exe17⤵
- Executes dropped EXE
PID:1284 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe18⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lfrlffx.exec:\lfrlffx.exe19⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vddjd.exec:\vddjd.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\llflxxx.exec:\llflxxx.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1hbntb.exec:\1hbntb.exe22⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rlxrxfl.exec:\rlxrxfl.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\nhttbb.exec:\nhttbb.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\jdvdj.exec:\jdvdj.exe25⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7rrrxxr.exec:\7rrrxxr.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\5thtbb.exec:\5thtbb.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xlxxfll.exec:\xlxxfll.exe28⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nbntbb.exec:\nbntbb.exe29⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1jdvp.exec:\1jdvp.exe30⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ffrlffr.exec:\ffrlffr.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nbbhnt.exec:\nbbhnt.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dvjjv.exec:\dvjjv.exe33⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nnbhnn.exec:\nnbhnn.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vpjjv.exec:\vpjjv.exe35⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9xlfllr.exec:\9xlfllr.exe37⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3nnhhn.exec:\3nnhhn.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nbhhhb.exec:\nbhhhb.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pjppp.exec:\pjppp.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xlxrxxr.exec:\xlxrxxr.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfffrxf.exec:\lfffrxf.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nhbhnt.exec:\nhbhnt.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jpvjd.exec:\jpvjd.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xrllrxx.exec:\xrllrxx.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhntbh.exec:\nhntbh.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\btbbnn.exec:\btbbnn.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvddv.exec:\dvddv.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrrxlrx.exec:\xrrxlrx.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nnntbh.exec:\nnntbh.exe50⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bnbhhh.exec:\bnbhhh.exe51⤵
- Executes dropped EXE
PID:600 -
\??\c:\jdpvp.exec:\jdpvp.exe52⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rlxxllr.exec:\rlxxllr.exe53⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5xllrxx.exec:\5xllrxx.exe54⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bttbhb.exec:\bttbhb.exe55⤵
- Executes dropped EXE
PID:1156 -
\??\c:\dvjvp.exec:\dvjvp.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rlfxrxf.exec:\rlfxrxf.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\llflxxf.exec:\llflxxf.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbtbhn.exec:\hbtbhn.exe59⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpjvj.exec:\vpjvj.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5xxrrrr.exec:\5xxrrrr.exe61⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9fflrxl.exec:\9fflrxl.exe62⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3thbnh.exec:\3thbnh.exe63⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jjjjj.exec:\jjjjj.exe64⤵
- Executes dropped EXE
PID:848 -
\??\c:\ffxxfxl.exec:\ffxxfxl.exe65⤵
- Executes dropped EXE
PID:912 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe66⤵PID:2300
-
\??\c:\hbnntb.exec:\hbnntb.exe67⤵PID:264
-
\??\c:\vppjp.exec:\vppjp.exe68⤵PID:1804
-
\??\c:\rxllrlx.exec:\rxllrlx.exe69⤵PID:2940
-
\??\c:\xrxfxfr.exec:\xrxfxfr.exe70⤵PID:3028
-
\??\c:\bnhhnt.exec:\bnhhnt.exe71⤵PID:552
-
\??\c:\vjvvd.exec:\vjvvd.exe72⤵PID:2508
-
\??\c:\pjvdd.exec:\pjvdd.exe73⤵PID:1608
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe74⤵PID:2316
-
\??\c:\nhbbhn.exec:\nhbbhn.exe75⤵PID:2072
-
\??\c:\vvpdd.exec:\vvpdd.exe76⤵PID:2108
-
\??\c:\5rffxxl.exec:\5rffxxl.exe77⤵PID:2660
-
\??\c:\fxrflrf.exec:\fxrflrf.exe78⤵PID:2696
-
\??\c:\5bnhnb.exec:\5bnhnb.exe79⤵PID:1920
-
\??\c:\vpppd.exec:\vpppd.exe80⤵PID:2760
-
\??\c:\ppjpv.exec:\ppjpv.exe81⤵PID:2808
-
\??\c:\frrxffx.exec:\frrxffx.exe82⤵PID:2728
-
\??\c:\bbnbnh.exec:\bbnbnh.exe83⤵PID:2708
-
\??\c:\3jjdp.exec:\3jjdp.exe84⤵PID:2740
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe85⤵PID:2668
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe86⤵PID:2680
-
\??\c:\bthhnt.exec:\bthhnt.exe87⤵PID:2584
-
\??\c:\vvjpv.exec:\vvjpv.exe88⤵PID:2844
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe89⤵PID:1956
-
\??\c:\tthhnn.exec:\tthhnn.exe90⤵PID:2312
-
\??\c:\htnntt.exec:\htnntt.exe91⤵PID:1672
-
\??\c:\dpvdd.exec:\dpvdd.exe92⤵PID:2000
-
\??\c:\7frllll.exec:\7frllll.exe93⤵PID:1740
-
\??\c:\hhthtn.exec:\hhthtn.exe94⤵PID:1308
-
\??\c:\thbtbb.exec:\thbtbb.exe95⤵PID:536
-
\??\c:\vdjpv.exec:\vdjpv.exe96⤵PID:2476
-
\??\c:\rrlllrx.exec:\rrlllrx.exe97⤵PID:1944
-
\??\c:\xfxxrxx.exec:\xfxxrxx.exe98⤵PID:2824
-
\??\c:\1nbbnn.exec:\1nbbnn.exe99⤵PID:2556
-
\??\c:\bthhhb.exec:\bthhhb.exe100⤵PID:2184
-
\??\c:\dvjdj.exec:\dvjdj.exe101⤵PID:2140
-
\??\c:\llrrlxl.exec:\llrrlxl.exe102⤵PID:2864
-
\??\c:\nnhttb.exec:\nnhttb.exe103⤵PID:2376
-
\??\c:\nnbhnn.exec:\nnbhnn.exe104⤵PID:1772
-
\??\c:\3pdpd.exec:\3pdpd.exe105⤵PID:844
-
\??\c:\rxllxxl.exec:\rxllxxl.exe106⤵PID:800
-
\??\c:\9lxxflx.exec:\9lxxflx.exe107⤵PID:1640
-
\??\c:\htnnnn.exec:\htnnnn.exe108⤵PID:2468
-
\??\c:\ddvjv.exec:\ddvjv.exe109⤵PID:2932
-
\??\c:\1jddd.exec:\1jddd.exe110⤵PID:2820
-
\??\c:\3xrrrxf.exec:\3xrrrxf.exe111⤵PID:996
-
\??\c:\nntttb.exec:\nntttb.exe112⤵PID:2400
-
\??\c:\dvpvd.exec:\dvpvd.exe113⤵PID:836
-
\??\c:\jjppv.exec:\jjppv.exe114⤵PID:1600
-
\??\c:\fxrxllf.exec:\fxrxllf.exe115⤵PID:1612
-
\??\c:\9thhbn.exec:\9thhbn.exe116⤵PID:1580
-
\??\c:\jjvvj.exec:\jjvvj.exe117⤵PID:2516
-
\??\c:\pdjjp.exec:\pdjjp.exe118⤵PID:1616
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe119⤵PID:2092
-
\??\c:\nnhhnn.exec:\nnhhnn.exe120⤵PID:2080
-
\??\c:\hbttbb.exec:\hbttbb.exe121⤵PID:2276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-