Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe
-
Size
453KB
-
MD5
76a1081903e7be113b71fcb56bd62d89
-
SHA1
80b8f2811c9becbda5fb6a196dbebe830b3d79f0
-
SHA256
625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69
-
SHA512
b83ef7ebd1e46a3ac9bc3a26c38ffea4fe74c76b8ee9b855f5a2232aca26c8566b865513a974b4d43adfaba4b3d6db347a456594330b543e8d9ecc926e37d272
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-93-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2664-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/676-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-132-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1412-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/328-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-266-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-356-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2788-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/476-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-411-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2608-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-425-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1432-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-465-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1520-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-625-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-636-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2912-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-653-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/552-668-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1648-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-771-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-1157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-1194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1956 jvddj.exe 2568 rfrxxxf.exe 2708 nbhbbt.exe 2272 nbnhbb.exe 2864 1bbhht.exe 2780 nbbtbt.exe 2812 7lrfxxx.exe 2912 fxfrrlr.exe 2668 1bbbtt.exe 2664 1xlllff.exe 2672 3lfxxlf.exe 676 dvpjp.exe 1584 lrfllxl.exe 1412 nhbhhn.exe 2816 vpjjv.exe 328 hbntbt.exe 1088 nhtnnn.exe 1852 lxlrffx.exe 1120 tbbtnb.exe 2344 ttnnbh.exe 2148 vpjpp.exe 2388 lxfrrll.exe 2236 thnhhb.exe 3036 xflxfxl.exe 1312 bthbhb.exe 920 hbnbtn.exe 1488 pdvjj.exe 904 bntthn.exe 2436 dpdvv.exe 1440 7nttbh.exe 2180 9vdjj.exe 2516 rlrxxxf.exe 1652 btbhhh.exe 3004 pjppd.exe 2552 ddpvd.exe 2500 rlffffr.exe 1724 nhtbhh.exe 2244 vpjdj.exe 3024 5rfxxxf.exe 2768 xrflrrf.exe 2956 7bnhhb.exe 2756 7pdvv.exe 2372 dpvpd.exe 2788 lfxfrxl.exe 2088 7tbttt.exe 2624 jdppv.exe 812 jjddd.exe 476 1fxxllr.exe 1416 bntttn.exe 2608 7bnnnb.exe 1432 5vjjj.exe 588 xrffrrx.exe 796 3lxxffl.exe 996 9bhbbb.exe 2036 hbnhhh.exe 1860 1dppd.exe 2144 3llfxrr.exe 2288 tnbhbb.exe 2424 hnbtnh.exe 2416 dvjpv.exe 2588 5lrfxxx.exe 2572 rfrrxxl.exe 2236 btbttn.exe 1296 pdvvd.exe -
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-113-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/676-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-222-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/920-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-356-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2788-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-612-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2908-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-1008-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-1137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-1157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-1201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-1233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-1348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-1367-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1956 2364 625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe 30 PID 2364 wrote to memory of 1956 2364 625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe 30 PID 2364 wrote to memory of 1956 2364 625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe 30 PID 2364 wrote to memory of 1956 2364 625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe 30 PID 1956 wrote to memory of 2568 1956 jvddj.exe 31 PID 1956 wrote to memory of 2568 1956 jvddj.exe 31 PID 1956 wrote to memory of 2568 1956 jvddj.exe 31 PID 1956 wrote to memory of 2568 1956 jvddj.exe 31 PID 2568 wrote to memory of 2708 2568 rfrxxxf.exe 32 PID 2568 wrote to memory of 2708 2568 rfrxxxf.exe 32 PID 2568 wrote to memory of 2708 2568 rfrxxxf.exe 32 PID 2568 wrote to memory of 2708 2568 rfrxxxf.exe 32 PID 2708 wrote to memory of 2272 2708 nbhbbt.exe 33 PID 2708 wrote to memory of 2272 2708 nbhbbt.exe 33 PID 2708 wrote to memory of 2272 2708 nbhbbt.exe 33 PID 2708 wrote to memory of 2272 2708 nbhbbt.exe 33 PID 2272 wrote to memory of 2864 2272 nbnhbb.exe 34 PID 2272 wrote to memory of 2864 2272 nbnhbb.exe 34 PID 2272 wrote to memory of 2864 2272 nbnhbb.exe 34 PID 2272 wrote to memory of 2864 2272 nbnhbb.exe 34 PID 2864 wrote to memory of 2780 2864 1bbhht.exe 35 PID 2864 wrote to memory of 2780 2864 1bbhht.exe 35 PID 2864 wrote to memory of 2780 2864 1bbhht.exe 35 PID 2864 wrote to memory of 2780 2864 1bbhht.exe 35 PID 2780 wrote to memory of 2812 2780 nbbtbt.exe 36 PID 2780 wrote to memory of 2812 2780 nbbtbt.exe 36 PID 2780 wrote to memory of 2812 2780 nbbtbt.exe 36 PID 2780 wrote to memory of 2812 2780 nbbtbt.exe 36 PID 2812 wrote to memory of 2912 2812 7lrfxxx.exe 37 PID 2812 wrote to memory of 2912 2812 7lrfxxx.exe 37 PID 2812 wrote to memory of 2912 2812 7lrfxxx.exe 37 PID 2812 wrote to memory of 2912 2812 7lrfxxx.exe 37 PID 2912 wrote to memory of 2668 2912 fxfrrlr.exe 38 PID 2912 wrote to memory of 2668 2912 fxfrrlr.exe 38 PID 2912 wrote to memory of 2668 2912 fxfrrlr.exe 38 PID 2912 wrote to memory of 2668 2912 fxfrrlr.exe 38 PID 2668 wrote to memory of 2664 2668 1bbbtt.exe 39 PID 2668 wrote to memory of 2664 2668 1bbbtt.exe 39 PID 2668 wrote to memory of 2664 2668 1bbbtt.exe 39 PID 2668 wrote to memory of 2664 2668 1bbbtt.exe 39 PID 2664 wrote to memory of 2672 2664 1xlllff.exe 40 PID 2664 wrote to memory of 2672 2664 1xlllff.exe 40 PID 2664 wrote to memory of 2672 2664 1xlllff.exe 40 PID 2664 wrote to memory of 2672 2664 1xlllff.exe 40 PID 2672 wrote to memory of 676 2672 3lfxxlf.exe 41 PID 2672 wrote to memory of 676 2672 3lfxxlf.exe 41 PID 2672 wrote to memory of 676 2672 3lfxxlf.exe 41 PID 2672 wrote to memory of 676 2672 3lfxxlf.exe 41 PID 676 wrote to memory of 1584 676 dvpjp.exe 42 PID 676 wrote to memory of 1584 676 dvpjp.exe 42 PID 676 wrote to memory of 1584 676 dvpjp.exe 42 PID 676 wrote to memory of 1584 676 dvpjp.exe 42 PID 1584 wrote to memory of 1412 1584 lrfllxl.exe 43 PID 1584 wrote to memory of 1412 1584 lrfllxl.exe 43 PID 1584 wrote to memory of 1412 1584 lrfllxl.exe 43 PID 1584 wrote to memory of 1412 1584 lrfllxl.exe 43 PID 1412 wrote to memory of 2816 1412 nhbhhn.exe 44 PID 1412 wrote to memory of 2816 1412 nhbhhn.exe 44 PID 1412 wrote to memory of 2816 1412 nhbhhn.exe 44 PID 1412 wrote to memory of 2816 1412 nhbhhn.exe 44 PID 2816 wrote to memory of 328 2816 vpjjv.exe 45 PID 2816 wrote to memory of 328 2816 vpjjv.exe 45 PID 2816 wrote to memory of 328 2816 vpjjv.exe 45 PID 2816 wrote to memory of 328 2816 vpjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe"C:\Users\Admin\AppData\Local\Temp\625c1d314045f7e1e0e10dba57fb419f43d375e9d37d4104dbffba987e4fdc69.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jvddj.exec:\jvddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nbhbbt.exec:\nbhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\nbnhbb.exec:\nbnhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\1bbhht.exec:\1bbhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nbbtbt.exec:\nbbtbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7lrfxxx.exec:\7lrfxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\fxfrrlr.exec:\fxfrrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\1bbbtt.exec:\1bbbtt.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1xlllff.exec:\1xlllff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3lfxxlf.exec:\3lfxxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\dvpjp.exec:\dvpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\lrfllxl.exec:\lrfllxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\nhbhhn.exec:\nhbhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\vpjjv.exec:\vpjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hbntbt.exec:\hbntbt.exe17⤵
- Executes dropped EXE
PID:328 -
\??\c:\nhtnnn.exec:\nhtnnn.exe18⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lxlrffx.exec:\lxlrffx.exe19⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tbbtnb.exec:\tbbtnb.exe20⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ttnnbh.exec:\ttnnbh.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vpjpp.exec:\vpjpp.exe22⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lxfrrll.exec:\lxfrrll.exe23⤵
- Executes dropped EXE
PID:2388 -
\??\c:\thnhhb.exec:\thnhhb.exe24⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xflxfxl.exec:\xflxfxl.exe25⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bthbhb.exec:\bthbhb.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hbnbtn.exec:\hbnbtn.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\pdvjj.exec:\pdvjj.exe28⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bntthn.exec:\bntthn.exe29⤵
- Executes dropped EXE
PID:904 -
\??\c:\dpdvv.exec:\dpdvv.exe30⤵
- Executes dropped EXE
PID:2436 -
\??\c:\7nttbh.exec:\7nttbh.exe31⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9vdjj.exec:\9vdjj.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rlrxxxf.exec:\rlrxxxf.exe33⤵
- Executes dropped EXE
PID:2516 -
\??\c:\btbhhh.exec:\btbhhh.exe34⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjppd.exec:\pjppd.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\ddpvd.exec:\ddpvd.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rlffffr.exec:\rlffffr.exe37⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhtbhh.exec:\nhtbhh.exe38⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpjdj.exec:\vpjdj.exe39⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5rfxxxf.exec:\5rfxxxf.exe40⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xrflrrf.exec:\xrflrrf.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7bnhhb.exec:\7bnhhb.exe42⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7pdvv.exec:\7pdvv.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dpvpd.exec:\dpvpd.exe44⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\7tbttt.exec:\7tbttt.exe46⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jdppv.exec:\jdppv.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jjddd.exec:\jjddd.exe48⤵
- Executes dropped EXE
PID:812 -
\??\c:\1fxxllr.exec:\1fxxllr.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:476 -
\??\c:\bntttn.exec:\bntttn.exe50⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7bnnnb.exec:\7bnnnb.exe51⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5vjjj.exec:\5vjjj.exe52⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xrffrrx.exec:\xrffrrx.exe53⤵
- Executes dropped EXE
PID:588 -
\??\c:\3lxxffl.exec:\3lxxffl.exe54⤵
- Executes dropped EXE
PID:796 -
\??\c:\9bhbbb.exec:\9bhbbb.exe55⤵
- Executes dropped EXE
PID:996 -
\??\c:\hbnhhh.exec:\hbnhhh.exe56⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1dppd.exec:\1dppd.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\3llfxrr.exec:\3llfxrr.exe58⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tnbhbb.exec:\tnbhbb.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hnbtnh.exec:\hnbtnh.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dvjpv.exec:\dvjpv.exe61⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5lrfxxx.exec:\5lrfxxx.exe62⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe63⤵
- Executes dropped EXE
PID:2572 -
\??\c:\btbttn.exec:\btbttn.exe64⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pdvvd.exec:\pdvvd.exe65⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pjjdp.exec:\pjjdp.exe66⤵PID:744
-
\??\c:\xrffllr.exec:\xrffllr.exe67⤵PID:2328
-
\??\c:\ntbntn.exec:\ntbntn.exe68⤵PID:1516
-
\??\c:\1nnhbt.exec:\1nnhbt.exe69⤵PID:2452
-
\??\c:\pjvvd.exec:\pjvvd.exe70⤵PID:2052
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe71⤵PID:892
-
\??\c:\rflrrlr.exec:\rflrrlr.exe72⤵PID:1736
-
\??\c:\btnntt.exec:\btnntt.exe73⤵PID:1520
-
\??\c:\jvddv.exec:\jvddv.exe74⤵PID:2704
-
\??\c:\pjddp.exec:\pjddp.exe75⤵PID:1688
-
\??\c:\xlfxrrr.exec:\xlfxrrr.exe76⤵PID:1212
-
\??\c:\3hbhnt.exec:\3hbhnt.exe77⤵PID:1532
-
\??\c:\jpdvv.exec:\jpdvv.exe78⤵PID:2104
-
\??\c:\pjddj.exec:\pjddj.exe79⤵PID:1496
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe80⤵PID:2316
-
\??\c:\rrfflxr.exec:\rrfflxr.exe81⤵PID:1724
-
\??\c:\bnhntn.exec:\bnhntn.exe82⤵PID:2772
-
\??\c:\jdvdj.exec:\jdvdj.exe83⤵PID:2908
-
\??\c:\pjvpv.exec:\pjvpv.exe84⤵PID:2760
-
\??\c:\lxfffxr.exec:\lxfffxr.exe85⤵PID:2912
-
\??\c:\xrffffl.exec:\xrffffl.exe86⤵PID:2800
-
\??\c:\bbttbh.exec:\bbttbh.exe87⤵PID:2700
-
\??\c:\jpvvv.exec:\jpvvv.exe88⤵PID:2664
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe89⤵PID:1624
-
\??\c:\9frrrrx.exec:\9frrrrx.exe90⤵PID:552
-
\??\c:\tnhhtn.exec:\tnhhtn.exe91⤵PID:1648
-
\??\c:\vvvpv.exec:\vvvpv.exe92⤵PID:2808
-
\??\c:\7ppdd.exec:\7ppdd.exe93⤵PID:2924
-
\??\c:\lfxxflr.exec:\lfxxflr.exe94⤵PID:2828
-
\??\c:\9fxxllr.exec:\9fxxllr.exe95⤵PID:2944
-
\??\c:\bbnnnt.exec:\bbnnnt.exe96⤵PID:328
-
\??\c:\vjvpj.exec:\vjvpj.exe97⤵PID:1324
-
\??\c:\9pjdd.exec:\9pjdd.exe98⤵PID:532
-
\??\c:\frffxrx.exec:\frffxrx.exe99⤵PID:2200
-
\??\c:\bttntt.exec:\bttntt.exe100⤵PID:1704
-
\??\c:\7tntbh.exec:\7tntbh.exe101⤵PID:2996
-
\??\c:\7jvdd.exec:\7jvdd.exe102⤵PID:2320
-
\??\c:\lfrlxff.exec:\lfrlxff.exe103⤵PID:2480
-
\??\c:\7fllrlr.exec:\7fllrlr.exe104⤵PID:1188
-
\??\c:\bnhhnn.exec:\bnhhnn.exe105⤵PID:444
-
\??\c:\vpdvp.exec:\vpdvp.exe106⤵PID:1640
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe107⤵PID:1888
-
\??\c:\lxffxrl.exec:\lxffxrl.exe108⤵PID:1296
-
\??\c:\1thhhn.exec:\1thhhn.exe109⤵PID:3056
-
\??\c:\1tntnn.exec:\1tntnn.exe110⤵PID:956
-
\??\c:\vpjdd.exec:\vpjdd.exe111⤵PID:1516
-
\??\c:\1lxffff.exec:\1lxffff.exe112⤵PID:904
-
\??\c:\9fllxxx.exec:\9fllxxx.exe113⤵PID:2052
-
\??\c:\htbbhh.exec:\htbbhh.exe114⤵PID:892
-
\??\c:\vpvpp.exec:\vpvpp.exe115⤵PID:1736
-
\??\c:\7pdvd.exec:\7pdvd.exe116⤵PID:1728
-
\??\c:\rlrllfl.exec:\rlrllfl.exe117⤵PID:2704
-
\??\c:\1fflrxf.exec:\1fflrxf.exe118⤵PID:2008
-
\??\c:\1thntb.exec:\1thntb.exe119⤵PID:1508
-
\??\c:\htnnnh.exec:\htnnnh.exe120⤵PID:2584
-
\??\c:\9vvvd.exec:\9vvvd.exe121⤵PID:1252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-