Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 04:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe
-
Size
453KB
-
MD5
c4ce211cf37b230eba75e7539bea68e2
-
SHA1
0baaba630401b4146f538d7337bd5b2857dbc9f0
-
SHA256
ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75
-
SHA512
f02d9ee537d8dfbd3eaaf6dd74536ff19a83ffc33f73067f7347a53f3513c34225c7f2cc6688225d03769adc454b831cbf8580e0fbd1aa89456928c092bdb5cb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2896-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-38-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2416-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-56-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2160-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-240-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1572-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-320-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2412-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1268-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-574-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1488-591-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-636-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1088-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-778-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/576-791-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-811-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/988-818-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1896-878-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2400-922-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-965-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3012 flxxrrf.exe 2840 frxrllr.exe 2272 lxfflrx.exe 2388 tnbthh.exe 2416 fxlxlxl.exe 2288 7thbnt.exe 2160 3fxrffr.exe 2588 vvvdp.exe 2756 xxflfrx.exe 2612 hhbhbh.exe 2596 3pjpv.exe 2120 1bbbht.exe 2480 djdvp.exe 2600 tbtnht.exe 2528 1pddd.exe 1512 1ttbht.exe 1796 bththn.exe 1704 pjjjv.exe 1812 hhhnhn.exe 1844 llllrxf.exe 264 hhtbnn.exe 576 9pppp.exe 2696 7xrrxxf.exe 2936 1vjjp.exe 2748 1fxxlrl.exe 2992 nbtthh.exe 1572 tthnbt.exe 1628 nnhhtt.exe 692 xfxfrxx.exe 2184 vpvvj.exe 572 7frlrxx.exe 1500 jvdjp.exe 2900 lfxxrfr.exe 3032 3bnntt.exe 3008 vpdjp.exe 2412 1xrrxxf.exe 1708 nhbbnn.exe 2156 7hbhtb.exe 2392 ppjvp.exe 2004 xrxxflr.exe 2244 1tntbh.exe 2292 hhbhnt.exe 2152 dvjjd.exe 1052 lxffxff.exe 2736 hhtntt.exe 2732 jvppv.exe 1268 jpjvd.exe 2504 frlrxxr.exe 2640 hbnthh.exe 2648 nhtntn.exe 2532 pjddd.exe 2480 xrlfffl.exe 2336 hbtbth.exe 1776 nnhtbn.exe 1676 pdddp.exe 1792 fxxxflx.exe 1916 xfxfflr.exe 276 hhtbhn.exe 1784 pjdpd.exe 2300 1xrxllx.exe 1420 7bnhtt.exe 836 3bttbh.exe 980 ppjpj.exe 776 lrfxfff.exe -
resource yara_rule behavioral1/memory/3012-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-36-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2416-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-380-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1268-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-881-0x0000000000280000-0x00000000002AA000-memory.dmp upx behavioral1/memory/1248-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-972-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 3012 2896 ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe 28 PID 2896 wrote to memory of 3012 2896 ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe 28 PID 2896 wrote to memory of 3012 2896 ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe 28 PID 2896 wrote to memory of 3012 2896 ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe 28 PID 3012 wrote to memory of 2840 3012 flxxrrf.exe 29 PID 3012 wrote to memory of 2840 3012 flxxrrf.exe 29 PID 3012 wrote to memory of 2840 3012 flxxrrf.exe 29 PID 3012 wrote to memory of 2840 3012 flxxrrf.exe 29 PID 2840 wrote to memory of 2272 2840 frxrllr.exe 30 PID 2840 wrote to memory of 2272 2840 frxrllr.exe 30 PID 2840 wrote to memory of 2272 2840 frxrllr.exe 30 PID 2840 wrote to memory of 2272 2840 frxrllr.exe 30 PID 2272 wrote to memory of 2388 2272 lxfflrx.exe 31 PID 2272 wrote to memory of 2388 2272 lxfflrx.exe 31 PID 2272 wrote to memory of 2388 2272 lxfflrx.exe 31 PID 2272 wrote to memory of 2388 2272 lxfflrx.exe 31 PID 2388 wrote to memory of 2416 2388 tnbthh.exe 32 PID 2388 wrote to memory of 2416 2388 tnbthh.exe 32 PID 2388 wrote to memory of 2416 2388 tnbthh.exe 32 PID 2388 wrote to memory of 2416 2388 tnbthh.exe 32 PID 2416 wrote to memory of 2288 2416 fxlxlxl.exe 33 PID 2416 wrote to memory of 2288 2416 fxlxlxl.exe 33 PID 2416 wrote to memory of 2288 2416 fxlxlxl.exe 33 PID 2416 wrote to memory of 2288 2416 fxlxlxl.exe 33 PID 2288 wrote to memory of 2160 2288 7thbnt.exe 34 PID 2288 wrote to memory of 2160 2288 7thbnt.exe 34 PID 2288 wrote to memory of 2160 2288 7thbnt.exe 34 PID 2288 wrote to memory of 2160 2288 7thbnt.exe 34 PID 2160 wrote to memory of 2588 2160 3fxrffr.exe 35 PID 2160 wrote to memory of 2588 2160 3fxrffr.exe 35 PID 2160 wrote to memory of 2588 2160 3fxrffr.exe 35 PID 2160 wrote to memory of 2588 2160 3fxrffr.exe 35 PID 2588 wrote to memory of 2756 2588 vvvdp.exe 36 PID 2588 wrote to memory of 2756 2588 vvvdp.exe 36 PID 2588 wrote to memory of 2756 2588 vvvdp.exe 36 PID 2588 wrote to memory of 2756 2588 vvvdp.exe 36 PID 2756 wrote to memory of 2612 2756 xxflfrx.exe 37 PID 2756 wrote to memory of 2612 2756 xxflfrx.exe 37 PID 2756 wrote to memory of 2612 2756 xxflfrx.exe 37 PID 2756 wrote to memory of 2612 2756 xxflfrx.exe 37 PID 2612 wrote to memory of 2596 2612 hhbhbh.exe 38 PID 2612 wrote to memory of 2596 2612 hhbhbh.exe 38 PID 2612 wrote to memory of 2596 2612 hhbhbh.exe 38 PID 2612 wrote to memory of 2596 2612 hhbhbh.exe 38 PID 2596 wrote to memory of 2120 2596 3pjpv.exe 39 PID 2596 wrote to memory of 2120 2596 3pjpv.exe 39 PID 2596 wrote to memory of 2120 2596 3pjpv.exe 39 PID 2596 wrote to memory of 2120 2596 3pjpv.exe 39 PID 2120 wrote to memory of 2480 2120 1bbbht.exe 40 PID 2120 wrote to memory of 2480 2120 1bbbht.exe 40 PID 2120 wrote to memory of 2480 2120 1bbbht.exe 40 PID 2120 wrote to memory of 2480 2120 1bbbht.exe 40 PID 2480 wrote to memory of 2600 2480 djdvp.exe 41 PID 2480 wrote to memory of 2600 2480 djdvp.exe 41 PID 2480 wrote to memory of 2600 2480 djdvp.exe 41 PID 2480 wrote to memory of 2600 2480 djdvp.exe 41 PID 2600 wrote to memory of 2528 2600 tbtnht.exe 42 PID 2600 wrote to memory of 2528 2600 tbtnht.exe 42 PID 2600 wrote to memory of 2528 2600 tbtnht.exe 42 PID 2600 wrote to memory of 2528 2600 tbtnht.exe 42 PID 2528 wrote to memory of 1512 2528 1pddd.exe 43 PID 2528 wrote to memory of 1512 2528 1pddd.exe 43 PID 2528 wrote to memory of 1512 2528 1pddd.exe 43 PID 2528 wrote to memory of 1512 2528 1pddd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe"C:\Users\Admin\AppData\Local\Temp\ed6575c0152857dd168c9cc39ca89f94396b46c5ddb6ba26d5e8c2ca9d053b75.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\flxxrrf.exec:\flxxrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\frxrllr.exec:\frxrllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\lxfflrx.exec:\lxfflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\tnbthh.exec:\tnbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fxlxlxl.exec:\fxlxlxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\7thbnt.exec:\7thbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\3fxrffr.exec:\3fxrffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\vvvdp.exec:\vvvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xxflfrx.exec:\xxflfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hhbhbh.exec:\hhbhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\3pjpv.exec:\3pjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1bbbht.exec:\1bbbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\djdvp.exec:\djdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\tbtnht.exec:\tbtnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\1pddd.exec:\1pddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1ttbht.exec:\1ttbht.exe17⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bththn.exec:\bththn.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pjjjv.exec:\pjjjv.exe19⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hhhnhn.exec:\hhhnhn.exe20⤵
- Executes dropped EXE
PID:1812 -
\??\c:\llllrxf.exec:\llllrxf.exe21⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hhtbnn.exec:\hhtbnn.exe22⤵
- Executes dropped EXE
PID:264 -
\??\c:\9pppp.exec:\9pppp.exe23⤵
- Executes dropped EXE
PID:576 -
\??\c:\7xrrxxf.exec:\7xrrxxf.exe24⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1vjjp.exec:\1vjjp.exe25⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1fxxlrl.exec:\1fxxlrl.exe26⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nbtthh.exec:\nbtthh.exe27⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tthnbt.exec:\tthnbt.exe28⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nnhhtt.exec:\nnhhtt.exe29⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xfxfrxx.exec:\xfxfrxx.exe30⤵
- Executes dropped EXE
PID:692 -
\??\c:\vpvvj.exec:\vpvvj.exe31⤵
- Executes dropped EXE
PID:2184 -
\??\c:\7frlrxx.exec:\7frlrxx.exe32⤵
- Executes dropped EXE
PID:572 -
\??\c:\jvdjp.exec:\jvdjp.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lfxxrfr.exec:\lfxxrfr.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3bnntt.exec:\3bnntt.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\1xrrxxf.exec:\1xrrxxf.exe37⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nhbbnn.exec:\nhbbnn.exe38⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7hbhtb.exec:\7hbhtb.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ppjvp.exec:\ppjvp.exe40⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xrxxflr.exec:\xrxxflr.exe41⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1tntbh.exec:\1tntbh.exe42⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hhbhnt.exec:\hhbhnt.exe43⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvjjd.exec:\dvjjd.exe44⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lxffxff.exec:\lxffxff.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1052 -
\??\c:\hhtntt.exec:\hhtntt.exe46⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jvppv.exec:\jvppv.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jpjvd.exec:\jpjvd.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268 -
\??\c:\frlrxxr.exec:\frlrxxr.exe49⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hbnthh.exec:\hbnthh.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nhtntn.exec:\nhtntn.exe51⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjddd.exec:\pjddd.exe52⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xrlfffl.exec:\xrlfffl.exe53⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hbtbth.exec:\hbtbth.exe54⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nnhtbn.exec:\nnhtbn.exe55⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pdddp.exec:\pdddp.exe56⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxxxflx.exec:\fxxxflx.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xfxfflr.exec:\xfxfflr.exe58⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hhtbhn.exec:\hhtbhn.exe59⤵
- Executes dropped EXE
PID:276 -
\??\c:\pjdpd.exec:\pjdpd.exe60⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1xrxllx.exec:\1xrxllx.exe61⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7bnhtt.exec:\7bnhtt.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\3bttbh.exec:\3bttbh.exe63⤵
- Executes dropped EXE
PID:836 -
\??\c:\ppjpj.exec:\ppjpj.exe64⤵
- Executes dropped EXE
PID:980 -
\??\c:\lrfxfff.exec:\lrfxfff.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\hnthhn.exec:\hnthhn.exe66⤵PID:2780
-
\??\c:\1bbntb.exec:\1bbntb.exe67⤵PID:2936
-
\??\c:\5vjjp.exec:\5vjjp.exe68⤵PID:2984
-
\??\c:\flfflrl.exec:\flfflrl.exe69⤵PID:1528
-
\??\c:\xxrrlll.exec:\xxrrlll.exe70⤵PID:2992
-
\??\c:\btbhbt.exec:\btbhbt.exe71⤵PID:840
-
\??\c:\7pjdj.exec:\7pjdj.exe72⤵PID:1380
-
\??\c:\5lxffrf.exec:\5lxffrf.exe73⤵PID:2656
-
\??\c:\1lxflrx.exec:\1lxflrx.exe74⤵PID:692
-
\??\c:\bbbntb.exec:\bbbntb.exe75⤵PID:1488
-
\??\c:\3jjpp.exec:\3jjpp.exe76⤵PID:2864
-
\??\c:\5frxxxl.exec:\5frxxxl.exe77⤵PID:1720
-
\??\c:\lfrlxrr.exec:\lfrlxrr.exe78⤵PID:1880
-
\??\c:\hbtnth.exec:\hbtnth.exe79⤵PID:2900
-
\??\c:\vpdjd.exec:\vpdjd.exe80⤵PID:3032
-
\??\c:\xxlxflf.exec:\xxlxflf.exe81⤵PID:3028
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe82⤵PID:2412
-
\??\c:\hthhtn.exec:\hthhtn.exe83⤵PID:1996
-
\??\c:\vvpvj.exec:\vvpvj.exe84⤵PID:1932
-
\??\c:\djjdv.exec:\djjdv.exe85⤵PID:2408
-
\??\c:\frlllll.exec:\frlllll.exe86⤵PID:2396
-
\??\c:\ddvdp.exec:\ddvdp.exe87⤵PID:3056
-
\??\c:\5jddd.exec:\5jddd.exe88⤵PID:3052
-
\??\c:\lfflrxl.exec:\lfflrxl.exe89⤵PID:2064
-
\??\c:\5nbttn.exec:\5nbttn.exe90⤵PID:2624
-
\??\c:\dvdvd.exec:\dvdvd.exe91⤵PID:2684
-
\??\c:\9jvvd.exec:\9jvvd.exe92⤵PID:2720
-
\??\c:\flfxlrl.exec:\flfxlrl.exe93⤵PID:2512
-
\??\c:\ntthht.exec:\ntthht.exe94⤵PID:3016
-
\??\c:\vjjvd.exec:\vjjvd.exe95⤵PID:2580
-
\??\c:\dpjdp.exec:\dpjdp.exe96⤵PID:2496
-
\??\c:\flxlrfl.exec:\flxlrfl.exe97⤵PID:2952
-
\??\c:\9tnhnt.exec:\9tnhnt.exe98⤵PID:2236
-
\??\c:\7dppp.exec:\7dppp.exe99⤵PID:2480
-
\??\c:\ppjpj.exec:\ppjpj.exe100⤵PID:2336
-
\??\c:\1fllllr.exec:\1fllllr.exe101⤵PID:1776
-
\??\c:\hbttbn.exec:\hbttbn.exe102⤵PID:1620
-
\??\c:\jjdjv.exec:\jjdjv.exe103⤵PID:1900
-
\??\c:\xrxflrx.exec:\xrxflrx.exe104⤵PID:1680
-
\??\c:\xxrflxl.exec:\xxrflxl.exe105⤵PID:1088
-
\??\c:\hhhthn.exec:\hhhthn.exe106⤵PID:480
-
\??\c:\dddjv.exec:\dddjv.exe107⤵PID:1316
-
\??\c:\xrfxffl.exec:\xrfxffl.exe108⤵PID:1748
-
\??\c:\hhtbbh.exec:\hhtbbh.exe109⤵PID:576
-
\??\c:\hbntnn.exec:\hbntnn.exe110⤵PID:2744
-
\??\c:\dpvpp.exec:\dpvpp.exe111⤵PID:2904
-
\??\c:\9xxxlxl.exec:\9xxxlxl.exe112⤵PID:2924
-
\??\c:\hbbhnt.exec:\hbbhnt.exe113⤵PID:988
-
\??\c:\9htbhn.exec:\9htbhn.exe114⤵PID:2988
-
\??\c:\7jppp.exec:\7jppp.exe115⤵PID:1624
-
\??\c:\rllfxfl.exec:\rllfxfl.exe116⤵PID:584
-
\??\c:\9thttb.exec:\9thttb.exe117⤵PID:1628
-
\??\c:\ddvdp.exec:\ddvdp.exe118⤵PID:2308
-
\??\c:\rrrxxfx.exec:\rrrxxfx.exe119⤵PID:2352
-
\??\c:\bthhth.exec:\bthhth.exe120⤵PID:2168
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe121⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-