Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 20:20
Behavioral task
behavioral1
Sample
1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe
-
Size
335KB
-
MD5
14b86b9fc5f491f969665534c2b67103
-
SHA1
7c6d184d1bba120766ba381109974bdd9d7b1303
-
SHA256
1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f
-
SHA512
350bab38b87e9e9d66723ba19cddbbe7eb97ac12832eecf9026c03044f165dfed164486690ef41580b0b0bf084f199e810fd6ee580fd40f4e200c17f4ebd90cb
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRr:R4wFHoSHYHUrAwfMp3CDRr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2096-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-52-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2572-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1088-77-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1088-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-79-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-102-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1524-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-140-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1852-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-148-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-183-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2576-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1068-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-348-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/448-410-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/608-569-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2784-602-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2876-674-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2944-723-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1048-744-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1536-747-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1504-822-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2456 nthttn.exe 2452 xxrlrrf.exe 2168 5jvdj.exe 2672 rxxlfrr.exe 2808 ppppp.exe 2544 rrxxlrx.exe 2572 jdppj.exe 1088 1xlrfxl.exe 2536 ntbbnh.exe 2444 1rxllfr.exe 3012 ttbbhh.exe 1524 ddppd.exe 2872 5thtbh.exe 1076 dvvvd.exe 1852 xrlrxlr.exe 2856 1tnbnb.exe 2300 rxlxlrf.exe 264 7bbnnn.exe 1484 ffrllrr.exe 2576 3tbtbb.exe 2632 frfflff.exe 1820 vpdvd.exe 1624 bbnbnh.exe 1068 3nbtbb.exe 1460 lrfxflx.exe 2036 nhtnnn.exe 2232 xrxfffl.exe 3036 rrfxrrx.exe 2496 jjppd.exe 1240 rrfllrx.exe 864 dvdvd.exe 2084 5lrxllr.exe 2112 1nbthb.exe 1568 jjvdj.exe 2124 1lrxxrx.exe 2724 1frrxxf.exe 1504 7hnnnn.exe 2680 pvvdj.exe 2752 xrxxfxl.exe 2636 lxfrflr.exe 2056 nnhnnt.exe 2764 jjvdp.exe 2784 3dpjj.exe 2572 fxrxrxr.exe 2592 bhtnhn.exe 2552 pppdv.exe 2540 jjvpd.exe 2060 9xflflr.exe 1676 bnnntn.exe 2768 nnthnn.exe 2292 jpvdj.exe 1728 llrrfll.exe 1800 llrfrxf.exe 1708 nttnbn.exe 2380 jpvvp.exe 448 1jvdp.exe 2032 fllrxxl.exe 1512 nthhtt.exe 2300 vvdjv.exe 2896 jppdj.exe 2900 fllfllr.exe 2160 hhthnt.exe 2428 5jvvd.exe 2720 dddjv.exe -
resource yara_rule behavioral1/memory/2096-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e00000001418b-7.dat upx behavioral1/memory/2096-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d0e-16.dat upx behavioral1/memory/2456-15-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000015d2f-23.dat upx behavioral1/memory/2168-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e05-34.dat upx behavioral1/files/0x0007000000015e16-44.dat upx behavioral1/memory/2672-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2808-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e5b-50.dat upx behavioral1/files/0x0009000000015eff-61.dat upx behavioral1/files/0x0005000000018710-70.dat upx behavioral1/memory/2572-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1088-77-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000018718-78.dat upx behavioral1/memory/1088-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018766-89.dat upx behavioral1/files/0x0005000000018780-96.dat upx behavioral1/memory/2444-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b62-106.dat upx behavioral1/memory/1524-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b68-114.dat upx behavioral1/files/0x0006000000018bf3-123.dat upx behavioral1/files/0x0005000000019223-133.dat upx behavioral1/memory/1076-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019230-141.dat upx behavioral1/memory/1852-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015ce8-149.dat upx behavioral1/memory/2300-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019240-158.dat upx behavioral1/files/0x0005000000019246-166.dat upx behavioral1/memory/264-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926b-176.dat upx behavioral1/memory/1484-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001930d-185.dat upx behavioral1/files/0x000500000001932d-194.dat upx behavioral1/memory/2632-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933b-201.dat upx behavioral1/memory/1820-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019374-211.dat upx behavioral1/memory/1068-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939b-218.dat upx behavioral1/files/0x00050000000193b3-225.dat upx behavioral1/memory/2036-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b5-233.dat upx behavioral1/memory/2036-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e8-242.dat upx behavioral1/files/0x00050000000193f7-249.dat upx behavioral1/memory/3036-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2496-258-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001949e-259.dat upx behavioral1/files/0x00050000000194c4-266.dat upx behavioral1/files/0x00050000000194cd-274.dat upx behavioral1/memory/2112-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1568-293-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2456 2096 1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe 31 PID 2096 wrote to memory of 2456 2096 1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe 31 PID 2096 wrote to memory of 2456 2096 1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe 31 PID 2096 wrote to memory of 2456 2096 1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe 31 PID 2456 wrote to memory of 2452 2456 nthttn.exe 32 PID 2456 wrote to memory of 2452 2456 nthttn.exe 32 PID 2456 wrote to memory of 2452 2456 nthttn.exe 32 PID 2456 wrote to memory of 2452 2456 nthttn.exe 32 PID 2452 wrote to memory of 2168 2452 xxrlrrf.exe 33 PID 2452 wrote to memory of 2168 2452 xxrlrrf.exe 33 PID 2452 wrote to memory of 2168 2452 xxrlrrf.exe 33 PID 2452 wrote to memory of 2168 2452 xxrlrrf.exe 33 PID 2168 wrote to memory of 2672 2168 5jvdj.exe 34 PID 2168 wrote to memory of 2672 2168 5jvdj.exe 34 PID 2168 wrote to memory of 2672 2168 5jvdj.exe 34 PID 2168 wrote to memory of 2672 2168 5jvdj.exe 34 PID 2672 wrote to memory of 2808 2672 rxxlfrr.exe 35 PID 2672 wrote to memory of 2808 2672 rxxlfrr.exe 35 PID 2672 wrote to memory of 2808 2672 rxxlfrr.exe 35 PID 2672 wrote to memory of 2808 2672 rxxlfrr.exe 35 PID 2808 wrote to memory of 2544 2808 ppppp.exe 36 PID 2808 wrote to memory of 2544 2808 ppppp.exe 36 PID 2808 wrote to memory of 2544 2808 ppppp.exe 36 PID 2808 wrote to memory of 2544 2808 ppppp.exe 36 PID 2544 wrote to memory of 2572 2544 rrxxlrx.exe 37 PID 2544 wrote to memory of 2572 2544 rrxxlrx.exe 37 PID 2544 wrote to memory of 2572 2544 rrxxlrx.exe 37 PID 2544 wrote to memory of 2572 2544 rrxxlrx.exe 37 PID 2572 wrote to memory of 1088 2572 jdppj.exe 38 PID 2572 wrote to memory of 1088 2572 jdppj.exe 38 PID 2572 wrote to memory of 1088 2572 jdppj.exe 38 PID 2572 wrote to memory of 1088 2572 jdppj.exe 38 PID 1088 wrote to memory of 2536 1088 1xlrfxl.exe 39 PID 1088 wrote to memory of 2536 1088 1xlrfxl.exe 39 PID 1088 wrote to memory of 2536 1088 1xlrfxl.exe 39 PID 1088 wrote to memory of 2536 1088 1xlrfxl.exe 39 PID 2536 wrote to memory of 2444 2536 ntbbnh.exe 40 PID 2536 wrote to memory of 2444 2536 ntbbnh.exe 40 PID 2536 wrote to memory of 2444 2536 ntbbnh.exe 40 PID 2536 wrote to memory of 2444 2536 ntbbnh.exe 40 PID 2444 wrote to memory of 3012 2444 1rxllfr.exe 41 PID 2444 wrote to memory of 3012 2444 1rxllfr.exe 41 PID 2444 wrote to memory of 3012 2444 1rxllfr.exe 41 PID 2444 wrote to memory of 3012 2444 1rxllfr.exe 41 PID 3012 wrote to memory of 1524 3012 ttbbhh.exe 42 PID 3012 wrote to memory of 1524 3012 ttbbhh.exe 42 PID 3012 wrote to memory of 1524 3012 ttbbhh.exe 42 PID 3012 wrote to memory of 1524 3012 ttbbhh.exe 42 PID 1524 wrote to memory of 2872 1524 ddppd.exe 43 PID 1524 wrote to memory of 2872 1524 ddppd.exe 43 PID 1524 wrote to memory of 2872 1524 ddppd.exe 43 PID 1524 wrote to memory of 2872 1524 ddppd.exe 43 PID 2872 wrote to memory of 1076 2872 5thtbh.exe 44 PID 2872 wrote to memory of 1076 2872 5thtbh.exe 44 PID 2872 wrote to memory of 1076 2872 5thtbh.exe 44 PID 2872 wrote to memory of 1076 2872 5thtbh.exe 44 PID 1076 wrote to memory of 1852 1076 dvvvd.exe 45 PID 1076 wrote to memory of 1852 1076 dvvvd.exe 45 PID 1076 wrote to memory of 1852 1076 dvvvd.exe 45 PID 1076 wrote to memory of 1852 1076 dvvvd.exe 45 PID 1852 wrote to memory of 2856 1852 xrlrxlr.exe 46 PID 1852 wrote to memory of 2856 1852 xrlrxlr.exe 46 PID 1852 wrote to memory of 2856 1852 xrlrxlr.exe 46 PID 1852 wrote to memory of 2856 1852 xrlrxlr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe"C:\Users\Admin\AppData\Local\Temp\1b46ca2796918f9cc170c11a37edc6e1703031ea1fcc6f59c330173c5c17af2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\nthttn.exec:\nthttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xxrlrrf.exec:\xxrlrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\5jvdj.exec:\5jvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rxxlfrr.exec:\rxxlfrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ppppp.exec:\ppppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jdppj.exec:\jdppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\1xlrfxl.exec:\1xlrfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\ntbbnh.exec:\ntbbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1rxllfr.exec:\1rxllfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\ttbbhh.exec:\ttbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ddppd.exec:\ddppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\5thtbh.exec:\5thtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\dvvvd.exec:\dvvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\xrlrxlr.exec:\xrlrxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\1tnbnb.exec:\1tnbnb.exe17⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rxlxlrf.exec:\rxlxlrf.exe18⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7bbnnn.exec:\7bbnnn.exe19⤵
- Executes dropped EXE
PID:264 -
\??\c:\ffrllrr.exec:\ffrllrr.exe20⤵
- Executes dropped EXE
PID:1484 -
\??\c:\3tbtbb.exec:\3tbtbb.exe21⤵
- Executes dropped EXE
PID:2576 -
\??\c:\frfflff.exec:\frfflff.exe22⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vpdvd.exec:\vpdvd.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bbnbnh.exec:\bbnbnh.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3nbtbb.exec:\3nbtbb.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\lrfxflx.exec:\lrfxflx.exe26⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nhtnnn.exec:\nhtnnn.exe27⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrxfffl.exec:\xrxfffl.exe28⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jjppd.exec:\jjppd.exe30⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rrfllrx.exec:\rrfllrx.exe31⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dvdvd.exec:\dvdvd.exe32⤵
- Executes dropped EXE
PID:864 -
\??\c:\5lrxllr.exec:\5lrxllr.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1nbthb.exec:\1nbthb.exe34⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jjvdj.exec:\jjvdj.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\1lrxxrx.exec:\1lrxxrx.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1frrxxf.exec:\1frrxxf.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7hnnnn.exec:\7hnnnn.exe38⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pvvdj.exec:\pvvdj.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrxxfxl.exec:\xrxxfxl.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lxfrflr.exec:\lxfrflr.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nnhnnt.exec:\nnhnnt.exe42⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jjvdp.exec:\jjvdp.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3dpjj.exec:\3dpjj.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxrxrxr.exec:\fxrxrxr.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bhtnhn.exec:\bhtnhn.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pppdv.exec:\pppdv.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jjvpd.exec:\jjvpd.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9xflflr.exec:\9xflflr.exe49⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bnnntn.exec:\bnnntn.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nnthnn.exec:\nnthnn.exe51⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jpvdj.exec:\jpvdj.exe52⤵
- Executes dropped EXE
PID:2292 -
\??\c:\llrrfll.exec:\llrrfll.exe53⤵
- Executes dropped EXE
PID:1728 -
\??\c:\llrfrxf.exec:\llrfrxf.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nttnbn.exec:\nttnbn.exe55⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jpvvp.exec:\jpvvp.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1jvdp.exec:\1jvdp.exe57⤵
- Executes dropped EXE
PID:448 -
\??\c:\fllrxxl.exec:\fllrxxl.exe58⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nthhtt.exec:\nthhtt.exe59⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vvdjv.exec:\vvdjv.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jppdj.exec:\jppdj.exe61⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fllfllr.exec:\fllfllr.exe62⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhthnt.exec:\hhthnt.exe63⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5jvvd.exec:\5jvvd.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dddjv.exec:\dddjv.exe65⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5lxflrx.exec:\5lxflrx.exe66⤵PID:960
-
\??\c:\9hntht.exec:\9hntht.exe67⤵PID:1048
-
\??\c:\dvjdp.exec:\dvjdp.exe68⤵PID:1980
-
\??\c:\3rfxxll.exec:\3rfxxll.exe69⤵PID:2140
-
\??\c:\3xxxfll.exec:\3xxxfll.exe70⤵PID:1796
-
\??\c:\nbbtnn.exec:\nbbtnn.exe71⤵PID:1060
-
\??\c:\vvvvv.exec:\vvvvv.exe72⤵PID:808
-
\??\c:\jdppd.exec:\jdppd.exe73⤵PID:1984
-
\??\c:\lrflllr.exec:\lrflllr.exe74⤵PID:1548
-
\??\c:\7rrfrfr.exec:\7rrfrfr.exe75⤵PID:2980
-
\??\c:\1thntt.exec:\1thntt.exe76⤵PID:2400
-
\??\c:\3dpjd.exec:\3dpjd.exe77⤵PID:2496
-
\??\c:\pvdjp.exec:\pvdjp.exe78⤵PID:1444
-
\??\c:\9xlfrrx.exec:\9xlfrrx.exe79⤵
- System Location Discovery: System Language Discovery
PID:1860 -
\??\c:\xfflxrx.exec:\xfflxrx.exe80⤵PID:2932
-
\??\c:\5bhnnb.exec:\5bhnnb.exe81⤵PID:1696
-
\??\c:\9xxfffr.exec:\9xxfffr.exe82⤵PID:2112
-
\??\c:\hnbhtn.exec:\hnbhtn.exe83⤵PID:2456
-
\??\c:\nntttb.exec:\nntttb.exe84⤵PID:2892
-
\??\c:\djdvd.exec:\djdvd.exe85⤵PID:2284
-
\??\c:\flrllrr.exec:\flrllrr.exe86⤵PID:608
-
\??\c:\5lfrxlx.exec:\5lfrxlx.exe87⤵PID:2776
-
\??\c:\ntbhtb.exec:\ntbhtb.exe88⤵PID:2804
-
\??\c:\9vpvd.exec:\9vpvd.exe89⤵PID:2912
-
\??\c:\vdjvv.exec:\vdjvv.exe90⤵PID:2712
-
\??\c:\3rllrrx.exec:\3rllrrx.exe91⤵PID:2460
-
\??\c:\tbnntb.exec:\tbnntb.exe92⤵PID:2784
-
\??\c:\7tnthh.exec:\7tnthh.exe93⤵PID:2732
-
\??\c:\jjjvd.exec:\jjjvd.exe94⤵PID:2728
-
\??\c:\1rfrlll.exec:\1rfrlll.exe95⤵PID:2600
-
\??\c:\9xflrrx.exec:\9xflrrx.exe96⤵PID:2540
-
\??\c:\bttnnn.exec:\bttnnn.exe97⤵PID:2060
-
\??\c:\jpjpj.exec:\jpjpj.exe98⤵PID:1732
-
\??\c:\vdvdj.exec:\vdvdj.exe99⤵PID:2768
-
\??\c:\flrlflf.exec:\flrlflf.exe100⤵PID:880
-
\??\c:\xxlxrlx.exec:\xxlxrlx.exe101⤵PID:2844
-
\??\c:\tbtbtt.exec:\tbtbtt.exe102⤵PID:2800
-
\??\c:\9dvvd.exec:\9dvvd.exe103⤵PID:2376
-
\??\c:\1vjdj.exec:\1vjdj.exe104⤵PID:2380
-
\??\c:\rxflffr.exec:\rxflffr.exe105⤵PID:1628
-
\??\c:\bhbhhb.exec:\bhbhhb.exe106⤵PID:2876
-
\??\c:\hnttnh.exec:\hnttnh.exe107⤵PID:964
-
\??\c:\vdjdv.exec:\vdjdv.exe108⤵PID:2300
-
\??\c:\lrxfxfr.exec:\lrxfxfr.exe109⤵PID:2624
-
\??\c:\nbthbb.exec:\nbthbb.exe110⤵PID:2900
-
\??\c:\ntnhtt.exec:\ntnhtt.exe111⤵PID:2176
-
\??\c:\vvddp.exec:\vvddp.exe112⤵PID:2944
-
\??\c:\3fflrlr.exec:\3fflrlr.exe113⤵PID:2632
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe114⤵PID:2236
-
\??\c:\nnbtbb.exec:\nnbtbb.exe115⤵PID:980
-
\??\c:\nhnnbh.exec:\nhnnbh.exe116⤵PID:1048
-
\??\c:\1jvdd.exec:\1jvdd.exe117⤵PID:1624
-
\??\c:\lrxfflr.exec:\lrxfflr.exe118⤵PID:1876
-
\??\c:\9xflrff.exec:\9xflrff.exe119⤵PID:2348
-
\??\c:\nthbtb.exec:\nthbtb.exe120⤵PID:1536
-
\??\c:\jvddd.exec:\jvddd.exe121⤵PID:808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-