Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe
-
Size
453KB
-
MD5
5790ef9b1f4c0efd0647dea58b516a69
-
SHA1
10e81b9544b2506fc018a958447b3c67e7ec1d34
-
SHA256
63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43
-
SHA512
af68257b5a99dbf6528390bf8d1caeb98ee1eb3a1b015136288f2e37d70a17f063c5f502931b591848a8c8d13c2a0c23450847a84fe1e25ce1d4d8eb4d80131e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN3:q7Tc2NYHUrAwfMp3CDN3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/1444-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-188-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1044-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-243-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/640-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-614-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2572-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 352 3frxflx.exe 2184 bbbhtb.exe 2848 3jdjv.exe 2696 9ttthn.exe 2076 9jvpv.exe 2700 fxxxfxf.exe 2584 vvpvd.exe 2616 7lrrxxf.exe 2552 5vjpd.exe 2128 ffrrxfr.exe 2484 bbnnbh.exe 2780 9pvdv.exe 2784 nhttbt.exe 1168 rlrflrf.exe 1248 tttbtt.exe 2912 1rllxxr.exe 376 hbntbt.exe 1764 rllrffx.exe 2120 llxfrxl.exe 3020 ttbbhn.exe 2068 rlllrxl.exe 2768 vdpdj.exe 1960 rlffxxf.exe 1044 9httbb.exe 568 jdvvj.exe 2428 3xlxlfx.exe 344 tthhhn.exe 640 tbtbhh.exe 2136 jdppd.exe 392 hbtbnn.exe 1532 vvppj.exe 2140 flfrrrf.exe 1664 nhbhbb.exe 2216 3dvdp.exe 2716 lffrlrf.exe 2808 tnbthn.exe 2872 5dvjp.exe 2600 rfrfxll.exe 1788 ffxlflx.exe 2636 nnbhtb.exe 2280 ddpvj.exe 2416 lfrxxxf.exe 2100 bnbhnn.exe 2028 3ppjp.exe 1624 jvjjv.exe 1676 xrrrffr.exe 2484 1bthtb.exe 2780 jddpv.exe 2904 dvjjj.exe 1348 lfrrxrx.exe 2924 nhttbb.exe 1248 jvppp.exe 2652 xrrxxfl.exe 604 tnhtbh.exe 2212 dvppj.exe 2256 7dvjv.exe 2120 7lrrxlr.exe 1316 nhtbnn.exe 1100 jdvvj.exe 1716 vpjpd.exe 852 xlxrxxf.exe 672 bthtbb.exe 1644 dpvvv.exe 1728 xrlrrxl.exe -
resource yara_rule behavioral1/memory/1444-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-113-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1168-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-186-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2768-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-614-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2572-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-763-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 352 1444 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 1444 wrote to memory of 352 1444 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 1444 wrote to memory of 352 1444 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 1444 wrote to memory of 352 1444 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 352 wrote to memory of 2184 352 3frxflx.exe 31 PID 352 wrote to memory of 2184 352 3frxflx.exe 31 PID 352 wrote to memory of 2184 352 3frxflx.exe 31 PID 352 wrote to memory of 2184 352 3frxflx.exe 31 PID 2184 wrote to memory of 2848 2184 bbbhtb.exe 32 PID 2184 wrote to memory of 2848 2184 bbbhtb.exe 32 PID 2184 wrote to memory of 2848 2184 bbbhtb.exe 32 PID 2184 wrote to memory of 2848 2184 bbbhtb.exe 32 PID 2848 wrote to memory of 2696 2848 3jdjv.exe 33 PID 2848 wrote to memory of 2696 2848 3jdjv.exe 33 PID 2848 wrote to memory of 2696 2848 3jdjv.exe 33 PID 2848 wrote to memory of 2696 2848 3jdjv.exe 33 PID 2696 wrote to memory of 2076 2696 9ttthn.exe 34 PID 2696 wrote to memory of 2076 2696 9ttthn.exe 34 PID 2696 wrote to memory of 2076 2696 9ttthn.exe 34 PID 2696 wrote to memory of 2076 2696 9ttthn.exe 34 PID 2076 wrote to memory of 2700 2076 9jvpv.exe 35 PID 2076 wrote to memory of 2700 2076 9jvpv.exe 35 PID 2076 wrote to memory of 2700 2076 9jvpv.exe 35 PID 2076 wrote to memory of 2700 2076 9jvpv.exe 35 PID 2700 wrote to memory of 2584 2700 fxxxfxf.exe 36 PID 2700 wrote to memory of 2584 2700 fxxxfxf.exe 36 PID 2700 wrote to memory of 2584 2700 fxxxfxf.exe 36 PID 2700 wrote to memory of 2584 2700 fxxxfxf.exe 36 PID 2584 wrote to memory of 2616 2584 vvpvd.exe 37 PID 2584 wrote to memory of 2616 2584 vvpvd.exe 37 PID 2584 wrote to memory of 2616 2584 vvpvd.exe 37 PID 2584 wrote to memory of 2616 2584 vvpvd.exe 37 PID 2616 wrote to memory of 2552 2616 7lrrxxf.exe 38 PID 2616 wrote to memory of 2552 2616 7lrrxxf.exe 38 PID 2616 wrote to memory of 2552 2616 7lrrxxf.exe 38 PID 2616 wrote to memory of 2552 2616 7lrrxxf.exe 38 PID 2552 wrote to memory of 2128 2552 5vjpd.exe 39 PID 2552 wrote to memory of 2128 2552 5vjpd.exe 39 PID 2552 wrote to memory of 2128 2552 5vjpd.exe 39 PID 2552 wrote to memory of 2128 2552 5vjpd.exe 39 PID 2128 wrote to memory of 2484 2128 ffrrxfr.exe 40 PID 2128 wrote to memory of 2484 2128 ffrrxfr.exe 40 PID 2128 wrote to memory of 2484 2128 ffrrxfr.exe 40 PID 2128 wrote to memory of 2484 2128 ffrrxfr.exe 40 PID 2484 wrote to memory of 2780 2484 bbnnbh.exe 41 PID 2484 wrote to memory of 2780 2484 bbnnbh.exe 41 PID 2484 wrote to memory of 2780 2484 bbnnbh.exe 41 PID 2484 wrote to memory of 2780 2484 bbnnbh.exe 41 PID 2780 wrote to memory of 2784 2780 9pvdv.exe 42 PID 2780 wrote to memory of 2784 2780 9pvdv.exe 42 PID 2780 wrote to memory of 2784 2780 9pvdv.exe 42 PID 2780 wrote to memory of 2784 2780 9pvdv.exe 42 PID 2784 wrote to memory of 1168 2784 nhttbt.exe 43 PID 2784 wrote to memory of 1168 2784 nhttbt.exe 43 PID 2784 wrote to memory of 1168 2784 nhttbt.exe 43 PID 2784 wrote to memory of 1168 2784 nhttbt.exe 43 PID 1168 wrote to memory of 1248 1168 rlrflrf.exe 44 PID 1168 wrote to memory of 1248 1168 rlrflrf.exe 44 PID 1168 wrote to memory of 1248 1168 rlrflrf.exe 44 PID 1168 wrote to memory of 1248 1168 rlrflrf.exe 44 PID 1248 wrote to memory of 2912 1248 tttbtt.exe 45 PID 1248 wrote to memory of 2912 1248 tttbtt.exe 45 PID 1248 wrote to memory of 2912 1248 tttbtt.exe 45 PID 1248 wrote to memory of 2912 1248 tttbtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe"C:\Users\Admin\AppData\Local\Temp\63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\3frxflx.exec:\3frxflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\bbbhtb.exec:\bbbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\3jdjv.exec:\3jdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9ttthn.exec:\9ttthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9jvpv.exec:\9jvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\fxxxfxf.exec:\fxxxfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vvpvd.exec:\vvpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\7lrrxxf.exec:\7lrrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5vjpd.exec:\5vjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ffrrxfr.exec:\ffrrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\bbnnbh.exec:\bbnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9pvdv.exec:\9pvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhttbt.exec:\nhttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rlrflrf.exec:\rlrflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\tttbtt.exec:\tttbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\1rllxxr.exec:\1rllxxr.exe17⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hbntbt.exec:\hbntbt.exe18⤵
- Executes dropped EXE
PID:376 -
\??\c:\rllrffx.exec:\rllrffx.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\llxfrxl.exec:\llxfrxl.exe20⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ttbbhn.exec:\ttbbhn.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rlllrxl.exec:\rlllrxl.exe22⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vdpdj.exec:\vdpdj.exe23⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rlffxxf.exec:\rlffxxf.exe24⤵
- Executes dropped EXE
PID:1960 -
\??\c:\9httbb.exec:\9httbb.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdvvj.exec:\jdvvj.exe26⤵
- Executes dropped EXE
PID:568 -
\??\c:\3xlxlfx.exec:\3xlxlfx.exe27⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tthhhn.exec:\tthhhn.exe28⤵
- Executes dropped EXE
PID:344 -
\??\c:\tbtbhh.exec:\tbtbhh.exe29⤵
- Executes dropped EXE
PID:640 -
\??\c:\jdppd.exec:\jdppd.exe30⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbtbnn.exec:\hbtbnn.exe31⤵
- Executes dropped EXE
PID:392 -
\??\c:\vvppj.exec:\vvppj.exe32⤵
- Executes dropped EXE
PID:1532 -
\??\c:\flfrrrf.exec:\flfrrrf.exe33⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhbhbb.exec:\nhbhbb.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3dvdp.exec:\3dvdp.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lffrlrf.exec:\lffrlrf.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnbthn.exec:\tnbthn.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5dvjp.exec:\5dvjp.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rfrfxll.exec:\rfrfxll.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ffxlflx.exec:\ffxlflx.exe40⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nnbhtb.exec:\nnbhtb.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ddpvj.exec:\ddpvj.exe42⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bnbhnn.exec:\bnbhnn.exe44⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3ppjp.exec:\3ppjp.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jvjjv.exec:\jvjjv.exe46⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrrrffr.exec:\xrrrffr.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\1bthtb.exec:\1bthtb.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jddpv.exec:\jddpv.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dvjjj.exec:\dvjjj.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe51⤵
- Executes dropped EXE
PID:1348 -
\??\c:\nhttbb.exec:\nhttbb.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvppp.exec:\jvppp.exe53⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xrrxxfl.exec:\xrrxxfl.exe54⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnhtbh.exec:\tnhtbh.exe55⤵
- Executes dropped EXE
PID:604 -
\??\c:\dvppj.exec:\dvppj.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7dvjv.exec:\7dvjv.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7lrrxlr.exec:\7lrrxlr.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nhtbnn.exec:\nhtbnn.exe59⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jdvvj.exec:\jdvvj.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vpjpd.exec:\vpjpd.exe61⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe62⤵
- Executes dropped EXE
PID:852 -
\??\c:\bthtbb.exec:\bthtbb.exe63⤵
- Executes dropped EXE
PID:672 -
\??\c:\dpvvv.exec:\dpvvv.exe64⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xrlrrxl.exec:\xrlrrxl.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\bbntbt.exec:\bbntbt.exe66⤵PID:1404
-
\??\c:\ddppd.exec:\ddppd.exe67⤵PID:2516
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe68⤵PID:2328
-
\??\c:\hbntbt.exec:\hbntbt.exe69⤵PID:1968
-
\??\c:\3hnttn.exec:\3hnttn.exe70⤵PID:1284
-
\??\c:\vpdjp.exec:\vpdjp.exe71⤵PID:1304
-
\??\c:\3xxlrxf.exec:\3xxlrxf.exe72⤵PID:392
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe73⤵PID:2276
-
\??\c:\thtbbh.exec:\thtbbh.exe74⤵PID:1596
-
\??\c:\ppjpd.exec:\ppjpd.exe75⤵PID:2668
-
\??\c:\9xxxrrl.exec:\9xxxrrl.exe76⤵PID:2672
-
\??\c:\fxrxllr.exec:\fxrxllr.exe77⤵PID:2836
-
\??\c:\hbttbb.exec:\hbttbb.exe78⤵PID:2988
-
\??\c:\vjddp.exec:\vjddp.exe79⤵PID:2572
-
\??\c:\vdpjj.exec:\vdpjj.exe80⤵PID:1784
-
\??\c:\nntbhh.exec:\nntbhh.exe81⤵PID:2736
-
\??\c:\bnbhnt.exec:\bnbhnt.exe82⤵PID:2676
-
\??\c:\jdpvd.exec:\jdpvd.exe83⤵PID:2636
-
\??\c:\frlxffl.exec:\frlxffl.exe84⤵PID:2280
-
\??\c:\hbtnhh.exec:\hbtnhh.exe85⤵PID:2940
-
\??\c:\pdppv.exec:\pdppv.exe86⤵PID:2132
-
\??\c:\jjppv.exec:\jjppv.exe87⤵PID:2552
-
\??\c:\5rrlrxf.exec:\5rrlrxf.exe88⤵PID:2740
-
\??\c:\tttbnt.exec:\tttbnt.exe89⤵PID:1668
-
\??\c:\pjjdp.exec:\pjjdp.exe90⤵PID:2368
-
\??\c:\5jddd.exec:\5jddd.exe91⤵PID:2776
-
\??\c:\rlxrfff.exec:\rlxrfff.exe92⤵PID:1860
-
\??\c:\3nbhtt.exec:\3nbhtt.exe93⤵PID:1564
-
\??\c:\jvjpv.exec:\jvjpv.exe94⤵PID:2944
-
\??\c:\vjvvd.exec:\vjvvd.exe95⤵PID:552
-
\??\c:\rlxxxll.exec:\rlxxxll.exe96⤵PID:536
-
\??\c:\btnbnb.exec:\btnbnb.exe97⤵PID:1028
-
\??\c:\7vjjj.exec:\7vjjj.exe98⤵PID:2208
-
\??\c:\vvpvj.exec:\vvpvj.exe99⤵PID:1804
-
\??\c:\3rfxlll.exec:\3rfxlll.exe100⤵PID:3016
-
\??\c:\bthnbh.exec:\bthnbh.exe101⤵PID:908
-
\??\c:\vpvdp.exec:\vpvdp.exe102⤵PID:1360
-
\??\c:\rlfxllr.exec:\rlfxllr.exe103⤵PID:1056
-
\??\c:\thntbb.exec:\thntbb.exe104⤵PID:3044
-
\??\c:\hbtbhh.exec:\hbtbhh.exe105⤵PID:1104
-
\??\c:\1djvd.exec:\1djvd.exe106⤵PID:956
-
\??\c:\xxffrfr.exec:\xxffrfr.exe107⤵PID:1644
-
\??\c:\5bnnbt.exec:\5bnnbt.exe108⤵PID:1728
-
\??\c:\7btbhb.exec:\7btbhb.exe109⤵PID:1748
-
\??\c:\jjvdp.exec:\jjvdp.exe110⤵PID:2264
-
\??\c:\9rlfllr.exec:\9rlfllr.exe111⤵PID:344
-
\??\c:\rlrlrxf.exec:\rlrlrxf.exe112⤵PID:372
-
\??\c:\hnbhbh.exec:\hnbhbh.exe113⤵PID:556
-
\??\c:\dpvdd.exec:\dpvdd.exe114⤵PID:2504
-
\??\c:\3dpvj.exec:\3dpvj.exe115⤵PID:2420
-
\??\c:\9rrxlfl.exec:\9rrxlfl.exe116⤵PID:2648
-
\??\c:\nhtbhh.exec:\nhtbhh.exe117⤵PID:1600
-
\??\c:\vvjvd.exec:\vvjvd.exe118⤵PID:1708
-
\??\c:\lllxllf.exec:\lllxllf.exe119⤵PID:2704
-
\??\c:\9hhhnt.exec:\9hhhnt.exe120⤵PID:2844
-
\??\c:\vpddj.exec:\vpddj.exe121⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-