Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe
-
Size
453KB
-
MD5
51a96bedf6759a90bcc40ea80e72e9e4
-
SHA1
1366a83a0ba7213347a5925b45c4b307fe5aee70
-
SHA256
171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14
-
SHA512
e7d5867dd197433ce899f34dcbda6d62cc703d307a33ff6b1d1799479e89f82dcc0d9b38f490b76fbdfd34fc601eb331f37c9513baeae09cf773b19f0e12a2fe
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2520-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1560-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-179-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1756-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2296-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-592-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2148-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-706-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-766-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-915-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-974-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-1072-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-1098-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1548-1191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 pjvjp.exe 2084 5rlfrxr.exe 2296 5hnttn.exe 2660 rrflrrl.exe 2756 bbnhnt.exe 2724 vpdjd.exe 2576 xlrxffr.exe 2780 pjvvd.exe 2736 rlxfllx.exe 2612 bnbhnn.exe 2844 jjjdj.exe 1972 tthnbb.exe 1560 7dppp.exe 1900 5frrxrr.exe 1928 1vpvd.exe 536 7rxxxrx.exe 1348 3bnntt.exe 1756 ddjdj.exe 956 5frlfxx.exe 2876 7nbhnb.exe 2972 fffxxrl.exe 1592 7hnnhh.exe 1208 dvdjp.exe 900 lfrrlrl.exe 1336 tthtbh.exe 2820 ddpvd.exe 2180 ffxxllr.exe 3052 nhnntb.exe 1912 ppjjd.exe 2008 jdvdj.exe 2380 nbnnhb.exe 1616 lxxfrrf.exe 2348 tnbbhb.exe 2296 1vppv.exe 2772 xxlllfl.exe 2080 xrflrrl.exe 2904 btnnnh.exe 2848 1dpvv.exe 2604 7pvvp.exe 3020 1rlrrrx.exe 2840 hhtbhb.exe 2588 thnbtn.exe 2600 pjvvd.exe 2228 lxllllr.exe 2456 3bnnnn.exe 1972 httttt.exe 1096 vjddd.exe 1968 rlfflll.exe 1808 tnhhnh.exe 1928 htbntt.exe 2112 ppvdp.exe 584 5rffrrx.exe 2788 llllfff.exe 1780 1tntbt.exe 2012 dpdvd.exe 956 jdpjv.exe 2152 frflllr.exe 2140 thbtbb.exe 920 3ntnnn.exe 2440 dpjjj.exe 664 fxlffff.exe 900 rlxllrf.exe 264 7bnhnn.exe 1048 bnbhnn.exe -
resource yara_rule behavioral1/memory/2520-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-169-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1756-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-706-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1144-766-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2240-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-882-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2996-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-915-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2392-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-974-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1732-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-1072-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2108 2520 171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe 30 PID 2520 wrote to memory of 2108 2520 171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe 30 PID 2520 wrote to memory of 2108 2520 171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe 30 PID 2520 wrote to memory of 2108 2520 171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe 30 PID 2108 wrote to memory of 2084 2108 pjvjp.exe 31 PID 2108 wrote to memory of 2084 2108 pjvjp.exe 31 PID 2108 wrote to memory of 2084 2108 pjvjp.exe 31 PID 2108 wrote to memory of 2084 2108 pjvjp.exe 31 PID 2084 wrote to memory of 2296 2084 5rlfrxr.exe 32 PID 2084 wrote to memory of 2296 2084 5rlfrxr.exe 32 PID 2084 wrote to memory of 2296 2084 5rlfrxr.exe 32 PID 2084 wrote to memory of 2296 2084 5rlfrxr.exe 32 PID 2296 wrote to memory of 2660 2296 5hnttn.exe 33 PID 2296 wrote to memory of 2660 2296 5hnttn.exe 33 PID 2296 wrote to memory of 2660 2296 5hnttn.exe 33 PID 2296 wrote to memory of 2660 2296 5hnttn.exe 33 PID 2660 wrote to memory of 2756 2660 rrflrrl.exe 34 PID 2660 wrote to memory of 2756 2660 rrflrrl.exe 34 PID 2660 wrote to memory of 2756 2660 rrflrrl.exe 34 PID 2660 wrote to memory of 2756 2660 rrflrrl.exe 34 PID 2756 wrote to memory of 2724 2756 bbnhnt.exe 35 PID 2756 wrote to memory of 2724 2756 bbnhnt.exe 35 PID 2756 wrote to memory of 2724 2756 bbnhnt.exe 35 PID 2756 wrote to memory of 2724 2756 bbnhnt.exe 35 PID 2724 wrote to memory of 2576 2724 vpdjd.exe 36 PID 2724 wrote to memory of 2576 2724 vpdjd.exe 36 PID 2724 wrote to memory of 2576 2724 vpdjd.exe 36 PID 2724 wrote to memory of 2576 2724 vpdjd.exe 36 PID 2576 wrote to memory of 2780 2576 xlrxffr.exe 37 PID 2576 wrote to memory of 2780 2576 xlrxffr.exe 37 PID 2576 wrote to memory of 2780 2576 xlrxffr.exe 37 PID 2576 wrote to memory of 2780 2576 xlrxffr.exe 37 PID 2780 wrote to memory of 2736 2780 pjvvd.exe 38 PID 2780 wrote to memory of 2736 2780 pjvvd.exe 38 PID 2780 wrote to memory of 2736 2780 pjvvd.exe 38 PID 2780 wrote to memory of 2736 2780 pjvvd.exe 38 PID 2736 wrote to memory of 2612 2736 rlxfllx.exe 39 PID 2736 wrote to memory of 2612 2736 rlxfllx.exe 39 PID 2736 wrote to memory of 2612 2736 rlxfllx.exe 39 PID 2736 wrote to memory of 2612 2736 rlxfllx.exe 39 PID 2612 wrote to memory of 2844 2612 bnbhnn.exe 40 PID 2612 wrote to memory of 2844 2612 bnbhnn.exe 40 PID 2612 wrote to memory of 2844 2612 bnbhnn.exe 40 PID 2612 wrote to memory of 2844 2612 bnbhnn.exe 40 PID 2844 wrote to memory of 1972 2844 jjjdj.exe 41 PID 2844 wrote to memory of 1972 2844 jjjdj.exe 41 PID 2844 wrote to memory of 1972 2844 jjjdj.exe 41 PID 2844 wrote to memory of 1972 2844 jjjdj.exe 41 PID 1972 wrote to memory of 1560 1972 tthnbb.exe 42 PID 1972 wrote to memory of 1560 1972 tthnbb.exe 42 PID 1972 wrote to memory of 1560 1972 tthnbb.exe 42 PID 1972 wrote to memory of 1560 1972 tthnbb.exe 42 PID 1560 wrote to memory of 1900 1560 7dppp.exe 43 PID 1560 wrote to memory of 1900 1560 7dppp.exe 43 PID 1560 wrote to memory of 1900 1560 7dppp.exe 43 PID 1560 wrote to memory of 1900 1560 7dppp.exe 43 PID 1900 wrote to memory of 1928 1900 5frrxrr.exe 44 PID 1900 wrote to memory of 1928 1900 5frrxrr.exe 44 PID 1900 wrote to memory of 1928 1900 5frrxrr.exe 44 PID 1900 wrote to memory of 1928 1900 5frrxrr.exe 44 PID 1928 wrote to memory of 536 1928 1vpvd.exe 45 PID 1928 wrote to memory of 536 1928 1vpvd.exe 45 PID 1928 wrote to memory of 536 1928 1vpvd.exe 45 PID 1928 wrote to memory of 536 1928 1vpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe"C:\Users\Admin\AppData\Local\Temp\171ba2aeb5aefb87780ced85d4998d9c1af8009479e532d93ebbae0cf69b8c14.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pjvjp.exec:\pjvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\5rlfrxr.exec:\5rlfrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\5hnttn.exec:\5hnttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rrflrrl.exec:\rrflrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bbnhnt.exec:\bbnhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vpdjd.exec:\vpdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xlrxffr.exec:\xlrxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pjvvd.exec:\pjvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rlxfllx.exec:\rlxfllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bnbhnn.exec:\bnbhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jjjdj.exec:\jjjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tthnbb.exec:\tthnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\7dppp.exec:\7dppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\5frrxrr.exec:\5frrxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\1vpvd.exec:\1vpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\7rxxxrx.exec:\7rxxxrx.exe17⤵
- Executes dropped EXE
PID:536 -
\??\c:\3bnntt.exec:\3bnntt.exe18⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ddjdj.exec:\ddjdj.exe19⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5frlfxx.exec:\5frlfxx.exe20⤵
- Executes dropped EXE
PID:956 -
\??\c:\7nbhnb.exec:\7nbhnb.exe21⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fffxxrl.exec:\fffxxrl.exe22⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7hnnhh.exec:\7hnnhh.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dvdjp.exec:\dvdjp.exe24⤵
- Executes dropped EXE
PID:1208 -
\??\c:\lfrrlrl.exec:\lfrrlrl.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\tthtbh.exec:\tthtbh.exe26⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ddpvd.exec:\ddpvd.exe27⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ffxxllr.exec:\ffxxllr.exe28⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nhnntb.exec:\nhnntb.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ppjjd.exec:\ppjjd.exe30⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jdvdj.exec:\jdvdj.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nbnnhb.exec:\nbnnhb.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxxfrrf.exec:\lxxfrrf.exe33⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tnbbhb.exec:\tnbbhb.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1vppv.exec:\1vppv.exe35⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xxlllfl.exec:\xxlllfl.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xrflrrl.exec:\xrflrrl.exe37⤵
- Executes dropped EXE
PID:2080 -
\??\c:\btnnnh.exec:\btnnnh.exe38⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1dpvv.exec:\1dpvv.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7pvvp.exec:\7pvvp.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1rlrrrx.exec:\1rlrrrx.exe41⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhtbhb.exec:\hhtbhb.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\thnbtn.exec:\thnbtn.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pjvvd.exec:\pjvvd.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lxllllr.exec:\lxllllr.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3bnnnn.exec:\3bnnnn.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\httttt.exec:\httttt.exe47⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjddd.exec:\vjddd.exe48⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rlfflll.exec:\rlfflll.exe49⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tnhhnh.exec:\tnhhnh.exe50⤵
- Executes dropped EXE
PID:1808 -
\??\c:\htbntt.exec:\htbntt.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ppvdp.exec:\ppvdp.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5rffrrx.exec:\5rffrrx.exe53⤵
- Executes dropped EXE
PID:584 -
\??\c:\llllfff.exec:\llllfff.exe54⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1tntbt.exec:\1tntbt.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dpdvd.exec:\dpdvd.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jdpjv.exec:\jdpjv.exe57⤵
- Executes dropped EXE
PID:956 -
\??\c:\frflllr.exec:\frflllr.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\thbtbb.exec:\thbtbb.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3ntnnn.exec:\3ntnnn.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:920 -
\??\c:\dpjjj.exec:\dpjjj.exe61⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fxlffff.exec:\fxlffff.exe62⤵
- Executes dropped EXE
PID:664 -
\??\c:\rlxllrf.exec:\rlxllrf.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\7bnhnn.exec:\7bnhnn.exe64⤵
- Executes dropped EXE
PID:264 -
\??\c:\bnbhnn.exec:\bnbhnn.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jdpvd.exec:\jdpvd.exe66⤵PID:924
-
\??\c:\fxllrxf.exec:\fxllrxf.exe67⤵PID:2252
-
\??\c:\ttbbtt.exec:\ttbbtt.exe68⤵PID:1964
-
\??\c:\hthbbn.exec:\hthbbn.exe69⤵PID:1912
-
\??\c:\5vvdd.exec:\5vvdd.exe70⤵PID:1504
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe71⤵PID:2008
-
\??\c:\rrlrxxl.exec:\rrlrxxl.exe72⤵PID:1608
-
\??\c:\hnhbnn.exec:\hnhbnn.exe73⤵PID:1812
-
\??\c:\9vpdj.exec:\9vpdj.exe74⤵PID:1616
-
\??\c:\pdvvd.exec:\pdvvd.exe75⤵PID:2348
-
\??\c:\lfffxll.exec:\lfffxll.exe76⤵PID:2296
-
\??\c:\7hntnn.exec:\7hntnn.exe77⤵PID:2692
-
\??\c:\hhtbhh.exec:\hhtbhh.exe78⤵PID:2080
-
\??\c:\pjdjj.exec:\pjdjj.exe79⤵PID:2904
-
\??\c:\xlxxrlr.exec:\xlxxrlr.exe80⤵PID:2848
-
\??\c:\7xfllrf.exec:\7xfllrf.exe81⤵PID:2148
-
\??\c:\5hthnh.exec:\5hthnh.exe82⤵PID:2804
-
\??\c:\vjvpd.exec:\vjvpd.exe83⤵PID:2640
-
\??\c:\xrflfxx.exec:\xrflfxx.exe84⤵PID:2644
-
\??\c:\xxxxllr.exec:\xxxxllr.exe85⤵PID:3024
-
\??\c:\7tbbhh.exec:\7tbbhh.exe86⤵PID:2996
-
\??\c:\1jdjj.exec:\1jdjj.exe87⤵PID:1748
-
\??\c:\9pvpj.exec:\9pvpj.exe88⤵PID:396
-
\??\c:\frxrxxf.exec:\frxrxxf.exe89⤵PID:1560
-
\??\c:\bttbhh.exec:\bttbhh.exe90⤵PID:1980
-
\??\c:\bntttb.exec:\bntttb.exe91⤵PID:1808
-
\??\c:\jpjpv.exec:\jpjpv.exe92⤵PID:1928
-
\??\c:\frfflfr.exec:\frfflfr.exe93⤵PID:2112
-
\??\c:\lfrxfll.exec:\lfrxfll.exe94⤵PID:584
-
\??\c:\nnbbnh.exec:\nnbbnh.exe95⤵PID:2788
-
\??\c:\vvpvd.exec:\vvpvd.exe96⤵PID:1480
-
\??\c:\dpvvd.exec:\dpvvd.exe97⤵
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\9llfllr.exec:\9llfllr.exe98⤵PID:2176
-
\??\c:\bnbbbb.exec:\bnbbbb.exe99⤵PID:2960
-
\??\c:\btbbnh.exec:\btbbnh.exe100⤵PID:2864
-
\??\c:\vpdjp.exec:\vpdjp.exe101⤵PID:1132
-
\??\c:\rfxxffr.exec:\rfxxffr.exe102⤵PID:1144
-
\??\c:\7bnhhh.exec:\7bnhhh.exe103⤵PID:1080
-
\??\c:\pdjjp.exec:\pdjjp.exe104⤵PID:1336
-
\??\c:\9vpjj.exec:\9vpjj.exe105⤵PID:1356
-
\??\c:\xxlxflx.exec:\xxlxflx.exe106⤵PID:552
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe107⤵PID:924
-
\??\c:\7bnntn.exec:\7bnntn.exe108⤵PID:1500
-
\??\c:\vpdjd.exec:\vpdjd.exe109⤵PID:1964
-
\??\c:\rxffxxf.exec:\rxffxxf.exe110⤵PID:548
-
\??\c:\rfxflfr.exec:\rfxflfr.exe111⤵PID:2068
-
\??\c:\ttttbb.exec:\ttttbb.exe112⤵PID:2240
-
\??\c:\thbbhb.exec:\thbbhb.exe113⤵PID:2380
-
\??\c:\1jdjj.exec:\1jdjj.exe114⤵PID:2276
-
\??\c:\5xrrrrf.exec:\5xrrrrf.exe115⤵PID:2852
-
\??\c:\lfrrrll.exec:\lfrrrll.exe116⤵PID:2092
-
\??\c:\htnntt.exec:\htnntt.exe117⤵PID:2888
-
\??\c:\thbbbh.exec:\thbbbh.exe118⤵PID:2800
-
\??\c:\jvjjp.exec:\jvjjp.exe119⤵PID:2724
-
\??\c:\xrfrffl.exec:\xrfrffl.exe120⤵PID:2860
-
\??\c:\1rffrrx.exec:\1rffrrx.exe121⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-