Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe
-
Size
453KB
-
MD5
1bf92ff7b02652b69c83bd1aa97d6702
-
SHA1
43eea7f9d7bd8428fc70ede188a67c00b9a72a50
-
SHA256
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a
-
SHA512
c8d04dde236e814ac501058f6331a4f875204368e7833a706e8b04d1d2a9eb4ec32a3485e6dbed5dbe537f7e729fdc500f893210d1448884dbcf63248f588b81
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2152-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-45-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2708-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-90-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1512-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1512-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-148-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1760-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-170-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2796-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-206-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1528-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-308-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2132-306-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2528-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-394-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1108-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-566-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2956-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-690-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1212-752-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2400-759-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2344-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-779-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1728-805-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-929-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-998-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-1178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-1277-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1664-1296-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2152 vpjvd.exe 2228 pjvpv.exe 2536 xxrrxxf.exe 2708 1nnbtn.exe 2820 3rfflfl.exe 2624 pdpvd.exe 2704 nnbbhh.exe 2808 5lflxxf.exe 2668 fxfflrx.exe 2660 hbntnn.exe 1512 pdppd.exe 1752 9lffrxf.exe 1352 rlrxxxl.exe 2032 thnhhh.exe 1760 lfrrxrx.exe 1740 hbhttb.exe 2792 vjddp.exe 2796 rlfxflr.exe 448 rlxxfff.exe 600 dvvpj.exe 1548 rrrxlrl.exe 2052 1dppp.exe 1816 xxrrfff.exe 1528 tnbbhn.exe 2252 ddppd.exe 2256 llxlrrx.exe 688 7dvjv.exe 336 thbbnn.exe 1724 rlxxllr.exe 2372 xxrflrl.exe 2356 tbtbbb.exe 2228 1lflrrl.exe 2132 5nnthh.exe 2528 1ddjp.exe 1916 jjdjp.exe 2824 5frllrx.exe 2892 tnbbnb.exe 2732 5dppd.exe 3028 rrfrlrf.exe 2544 llxxlfr.exe 2728 bnbbbh.exe 2688 nbhntt.exe 1496 1vvpd.exe 536 fxxfxlr.exe 1576 fllxlrf.exe 1108 nhbnbn.exe 1636 vvpdp.exe 1712 lxffllx.exe 2428 hnhtbb.exe 1224 bbttbb.exe 1760 jddjv.exe 1736 llffrxl.exe 1920 bbtnbh.exe 1612 hbttbb.exe 1620 dddpv.exe 2600 rlfrffr.exe 1056 xrffxfr.exe 600 tthhnn.exe 1604 jdvjj.exe 2020 xfrxffx.exe 2400 xxxxffl.exe 1632 nbtbnt.exe 1528 vpvvp.exe 2524 9dpdj.exe -
resource yara_rule behavioral1/memory/2152-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-204-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2052-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-566-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2956-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-752-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2344-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-998-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2040-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-1179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-1281-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2152 2216 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 30 PID 2216 wrote to memory of 2152 2216 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 30 PID 2216 wrote to memory of 2152 2216 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 30 PID 2216 wrote to memory of 2152 2216 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 30 PID 2152 wrote to memory of 2228 2152 vpjvd.exe 31 PID 2152 wrote to memory of 2228 2152 vpjvd.exe 31 PID 2152 wrote to memory of 2228 2152 vpjvd.exe 31 PID 2152 wrote to memory of 2228 2152 vpjvd.exe 31 PID 2228 wrote to memory of 2536 2228 pjvpv.exe 32 PID 2228 wrote to memory of 2536 2228 pjvpv.exe 32 PID 2228 wrote to memory of 2536 2228 pjvpv.exe 32 PID 2228 wrote to memory of 2536 2228 pjvpv.exe 32 PID 2536 wrote to memory of 2708 2536 xxrrxxf.exe 33 PID 2536 wrote to memory of 2708 2536 xxrrxxf.exe 33 PID 2536 wrote to memory of 2708 2536 xxrrxxf.exe 33 PID 2536 wrote to memory of 2708 2536 xxrrxxf.exe 33 PID 2708 wrote to memory of 2820 2708 1nnbtn.exe 35 PID 2708 wrote to memory of 2820 2708 1nnbtn.exe 35 PID 2708 wrote to memory of 2820 2708 1nnbtn.exe 35 PID 2708 wrote to memory of 2820 2708 1nnbtn.exe 35 PID 2820 wrote to memory of 2624 2820 3rfflfl.exe 36 PID 2820 wrote to memory of 2624 2820 3rfflfl.exe 36 PID 2820 wrote to memory of 2624 2820 3rfflfl.exe 36 PID 2820 wrote to memory of 2624 2820 3rfflfl.exe 36 PID 2624 wrote to memory of 2704 2624 pdpvd.exe 37 PID 2624 wrote to memory of 2704 2624 pdpvd.exe 37 PID 2624 wrote to memory of 2704 2624 pdpvd.exe 37 PID 2624 wrote to memory of 2704 2624 pdpvd.exe 37 PID 2704 wrote to memory of 2808 2704 nnbbhh.exe 38 PID 2704 wrote to memory of 2808 2704 nnbbhh.exe 38 PID 2704 wrote to memory of 2808 2704 nnbbhh.exe 38 PID 2704 wrote to memory of 2808 2704 nnbbhh.exe 38 PID 2808 wrote to memory of 2668 2808 5lflxxf.exe 39 PID 2808 wrote to memory of 2668 2808 5lflxxf.exe 39 PID 2808 wrote to memory of 2668 2808 5lflxxf.exe 39 PID 2808 wrote to memory of 2668 2808 5lflxxf.exe 39 PID 2668 wrote to memory of 2660 2668 fxfflrx.exe 40 PID 2668 wrote to memory of 2660 2668 fxfflrx.exe 40 PID 2668 wrote to memory of 2660 2668 fxfflrx.exe 40 PID 2668 wrote to memory of 2660 2668 fxfflrx.exe 40 PID 2660 wrote to memory of 1512 2660 hbntnn.exe 41 PID 2660 wrote to memory of 1512 2660 hbntnn.exe 41 PID 2660 wrote to memory of 1512 2660 hbntnn.exe 41 PID 2660 wrote to memory of 1512 2660 hbntnn.exe 41 PID 1512 wrote to memory of 1752 1512 pdppd.exe 42 PID 1512 wrote to memory of 1752 1512 pdppd.exe 42 PID 1512 wrote to memory of 1752 1512 pdppd.exe 42 PID 1512 wrote to memory of 1752 1512 pdppd.exe 42 PID 1752 wrote to memory of 1352 1752 9lffrxf.exe 43 PID 1752 wrote to memory of 1352 1752 9lffrxf.exe 43 PID 1752 wrote to memory of 1352 1752 9lffrxf.exe 43 PID 1752 wrote to memory of 1352 1752 9lffrxf.exe 43 PID 1352 wrote to memory of 2032 1352 rlrxxxl.exe 44 PID 1352 wrote to memory of 2032 1352 rlrxxxl.exe 44 PID 1352 wrote to memory of 2032 1352 rlrxxxl.exe 44 PID 1352 wrote to memory of 2032 1352 rlrxxxl.exe 44 PID 2032 wrote to memory of 1760 2032 thnhhh.exe 45 PID 2032 wrote to memory of 1760 2032 thnhhh.exe 45 PID 2032 wrote to memory of 1760 2032 thnhhh.exe 45 PID 2032 wrote to memory of 1760 2032 thnhhh.exe 45 PID 1760 wrote to memory of 1740 1760 lfrrxrx.exe 46 PID 1760 wrote to memory of 1740 1760 lfrrxrx.exe 46 PID 1760 wrote to memory of 1740 1760 lfrrxrx.exe 46 PID 1760 wrote to memory of 1740 1760 lfrrxrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe"C:\Users\Admin\AppData\Local\Temp\37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\vpjvd.exec:\vpjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\pjvpv.exec:\pjvpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1nnbtn.exec:\1nnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3rfflfl.exec:\3rfflfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pdpvd.exec:\pdpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nnbbhh.exec:\nnbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5lflxxf.exec:\5lflxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\fxfflrx.exec:\fxfflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hbntnn.exec:\hbntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pdppd.exec:\pdppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\9lffrxf.exec:\9lffrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\thnhhh.exec:\thnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\hbhttb.exec:\hbhttb.exe17⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vjddp.exec:\vjddp.exe18⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rlfxflr.exec:\rlfxflr.exe19⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rlxxfff.exec:\rlxxfff.exe20⤵
- Executes dropped EXE
PID:448 -
\??\c:\dvvpj.exec:\dvvpj.exe21⤵
- Executes dropped EXE
PID:600 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe22⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1dppp.exec:\1dppp.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xxrrfff.exec:\xxrrfff.exe24⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tnbbhn.exec:\tnbbhn.exe25⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ddppd.exec:\ddppd.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\llxlrrx.exec:\llxlrrx.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7dvjv.exec:\7dvjv.exe28⤵
- Executes dropped EXE
PID:688 -
\??\c:\thbbnn.exec:\thbbnn.exe29⤵
- Executes dropped EXE
PID:336 -
\??\c:\rlxxllr.exec:\rlxxllr.exe30⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xxrflrl.exec:\xxrflrl.exe31⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tbtbbb.exec:\tbtbbb.exe32⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1lflrrl.exec:\1lflrrl.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5nnthh.exec:\5nnthh.exe34⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1ddjp.exec:\1ddjp.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jjdjp.exec:\jjdjp.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5frllrx.exec:\5frllrx.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tnbbnb.exec:\tnbbnb.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\5dppd.exec:\5dppd.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe40⤵
- Executes dropped EXE
PID:3028 -
\??\c:\llxxlfr.exec:\llxxlfr.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bnbbbh.exec:\bnbbbh.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nbhntt.exec:\nbhntt.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1vvpd.exec:\1vvpd.exe44⤵
- Executes dropped EXE
PID:1496 -
\??\c:\fxxfxlr.exec:\fxxfxlr.exe45⤵
- Executes dropped EXE
PID:536 -
\??\c:\fllxlrf.exec:\fllxlrf.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nhbnbn.exec:\nhbnbn.exe47⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vvpdp.exec:\vvpdp.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lxffllx.exec:\lxffllx.exe49⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hnhtbb.exec:\hnhtbb.exe50⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bbttbb.exec:\bbttbb.exe51⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jddjv.exec:\jddjv.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\llffrxl.exec:\llffrxl.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bbtnbh.exec:\bbtnbh.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\hbttbb.exec:\hbttbb.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dddpv.exec:\dddpv.exe56⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rlfrffr.exec:\rlfrffr.exe57⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xrffxfr.exec:\xrffxfr.exe58⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tthhnn.exec:\tthhnn.exe59⤵
- Executes dropped EXE
PID:600 -
\??\c:\jdvjj.exec:\jdvjj.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xfrxffx.exec:\xfrxffx.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xxxxffl.exec:\xxxxffl.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nbtbnt.exec:\nbtbnt.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vpvvp.exec:\vpvvp.exe64⤵
- Executes dropped EXE
PID:1528 -
\??\c:\9dpdj.exec:\9dpdj.exe65⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xxxxlrl.exec:\xxxxlrl.exe66⤵PID:2252
-
\??\c:\thttbh.exec:\thttbh.exe67⤵PID:1716
-
\??\c:\7bttbn.exec:\7bttbn.exe68⤵
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\vvjpd.exec:\vvjpd.exe69⤵PID:1200
-
\??\c:\fxrrffx.exec:\fxrrffx.exe70⤵PID:872
-
\??\c:\hnhhtb.exec:\hnhhtb.exe71⤵PID:768
-
\??\c:\bbnthn.exec:\bbnthn.exe72⤵PID:2352
-
\??\c:\jpjpd.exec:\jpjpd.exe73⤵PID:2216
-
\??\c:\rlrxxfr.exec:\rlrxxfr.exe74⤵PID:2072
-
\??\c:\5lrllxx.exec:\5lrllxx.exe75⤵PID:2800
-
\??\c:\nbthnt.exec:\nbthnt.exe76⤵PID:2360
-
\??\c:\djpdp.exec:\djpdp.exe77⤵PID:2560
-
\??\c:\jvvvp.exec:\jvvvp.exe78⤵PID:2760
-
\??\c:\xxxrlxl.exec:\xxxrlxl.exe79⤵PID:2868
-
\??\c:\thnnnt.exec:\thnnnt.exe80⤵PID:2956
-
\??\c:\jdppv.exec:\jdppv.exe81⤵PID:2888
-
\??\c:\dvddj.exec:\dvddj.exe82⤵PID:2876
-
\??\c:\llxlrfl.exec:\llxlrfl.exe83⤵PID:2880
-
\??\c:\bnbbbn.exec:\bnbbbn.exe84⤵PID:2104
-
\??\c:\dvpvd.exec:\dvpvd.exe85⤵PID:2736
-
\??\c:\ddvpv.exec:\ddvpv.exe86⤵PID:1496
-
\??\c:\rrfrffl.exec:\rrfrffl.exe87⤵PID:3044
-
\??\c:\1nbbnn.exec:\1nbbnn.exe88⤵PID:1512
-
\??\c:\hbnnbb.exec:\hbnnbb.exe89⤵PID:352
-
\??\c:\vvpjj.exec:\vvpjj.exe90⤵PID:2120
-
\??\c:\1fxrxfl.exec:\1fxrxfl.exe91⤵PID:1688
-
\??\c:\1flffll.exec:\1flffll.exe92⤵PID:1420
-
\??\c:\bhtthn.exec:\bhtthn.exe93⤵PID:2044
-
\??\c:\jdppd.exec:\jdppd.exe94⤵PID:1976
-
\??\c:\rrlxffl.exec:\rrlxffl.exe95⤵PID:2060
-
\??\c:\lfrrflr.exec:\lfrrflr.exe96⤵PID:1700
-
\??\c:\nbtttn.exec:\nbtttn.exe97⤵PID:2500
-
\??\c:\jdpjp.exec:\jdpjp.exe98⤵PID:684
-
\??\c:\djvpv.exec:\djvpv.exe99⤵PID:2604
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe100⤵PID:2328
-
\??\c:\hbnnbb.exec:\hbnnbb.exe101⤵PID:1212
-
\??\c:\9nhtbb.exec:\9nhtbb.exe102⤵PID:672
-
\??\c:\vjvdv.exec:\vjvdv.exe103⤵
- System Location Discovery: System Language Discovery
PID:1604 -
\??\c:\3xxxxxr.exec:\3xxxxxr.exe104⤵PID:2020
-
\??\c:\fxxrffl.exec:\fxxrffl.exe105⤵PID:2400
-
\??\c:\9nttbt.exec:\9nttbt.exe106⤵PID:1632
-
\??\c:\vjdjv.exec:\vjdjv.exe107⤵PID:2140
-
\??\c:\frfflrx.exec:\frfflrx.exe108⤵PID:2344
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe109⤵PID:2996
-
\??\c:\tnhthn.exec:\tnhthn.exe110⤵PID:688
-
\??\c:\jpdjp.exec:\jpdjp.exe111⤵PID:764
-
\??\c:\rlxrffl.exec:\rlxrffl.exe112⤵PID:1728
-
\??\c:\xllxrxf.exec:\xllxrxf.exe113⤵PID:2584
-
\??\c:\jdjjp.exec:\jdjjp.exe114⤵PID:2432
-
\??\c:\vpdvd.exec:\vpdvd.exe115⤵PID:2232
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe116⤵PID:1584
-
\??\c:\1thntt.exec:\1thntt.exe117⤵PID:1696
-
\??\c:\nhnnbh.exec:\nhnnbh.exe118⤵PID:2376
-
\??\c:\5vpdd.exec:\5vpdd.exe119⤵PID:2720
-
\??\c:\rrxllfx.exec:\rrxllfx.exe120⤵PID:2864
-
\??\c:\rxllllr.exec:\rxllllr.exe121⤵PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-