Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe
-
Size
454KB
-
MD5
c1bd2986f735a8c2e9dd7b425b1cb4cb
-
SHA1
cfba901e715fc7dd77804c4d4f630ba970365e20
-
SHA256
c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9
-
SHA512
f1757a98809634301c32d4df17ea93135f8eef6ec0443cf30d658e20dc9e75ee0e51443b5dc46161a4ac974b3c4ecfa1c06605e54dd2c02d023a04c7e586b713
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTU:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/1480-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-188-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-292-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-345-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2856-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-361-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1172-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-419-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-632-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2940-639-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-667-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1148-706-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/808-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-730-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1016-782-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1676-781-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/832-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-865-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2208-891-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/2208-890-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-1082-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1672-1084-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2752-1156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-1163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-1172-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2188-1266-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 xrlfxfl.exe 2156 tthnth.exe 532 hhbnbn.exe 2300 9jjpp.exe 2760 bbttbh.exe 2756 tthtnb.exe 2612 vvpdv.exe 2852 1bbnhb.exe 2740 vpdpj.exe 2616 7nnhth.exe 3044 lfrrffr.exe 664 3llxrrl.exe 1588 xrlxlrf.exe 1900 hnhhhn.exe 1272 7xrfxlf.exe 616 3rrfflx.exe 2468 9rrfrrf.exe 2552 9nnbhn.exe 2472 ntthth.exe 2456 1fflxfx.exe 2952 ppjvp.exe 1120 jdpvp.exe 980 pjdjp.exe 1824 frlxrxl.exe 1708 5ntbht.exe 2880 jdjpv.exe 1560 hhthbn.exe 1332 9ddvd.exe 2540 ttntht.exe 2028 bbnbnn.exe 1060 xxxfrxl.exe 1744 7ttbnb.exe 1572 1frxlrf.exe 1576 bbnthn.exe 2976 9vvpp.exe 1788 rlxfllr.exe 2792 rfxxxfl.exe 1768 bttbnn.exe 2300 nnnthn.exe 2208 5jpdv.exe 2856 xxxxfrx.exe 2940 tnhnbb.exe 2628 3vvdd.exe 2772 xrrxflf.exe 2624 ttnthh.exe 2284 hhhntb.exe 624 pjddd.exe 1624 rllxllf.exe 1172 7rllxxf.exe 2592 1bhnbh.exe 1892 pdvvv.exe 1148 xxrxllx.exe 2500 xrlxlrx.exe 1992 tbhbht.exe 3012 ppddj.exe 2304 lllxllf.exe 1916 3rfflxf.exe 2232 1bnnth.exe 1544 jjdpv.exe 2968 fxrxffx.exe 1472 rlrlrxf.exe 440 ththtb.exe 1732 1pddd.exe 828 pjvdp.exe -
resource yara_rule behavioral1/memory/1480-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-318-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2300-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-419-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2232-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-525-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2380-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-632-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2940-639-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2652-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-719-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/808-725-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/808-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-865-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2208-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-1082-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1672-1084-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2752-1156-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2776-1172-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/836-1207-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1480 wrote to memory of 3004 1480 c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe 30 PID 1480 wrote to memory of 3004 1480 c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe 30 PID 1480 wrote to memory of 3004 1480 c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe 30 PID 1480 wrote to memory of 3004 1480 c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe 30 PID 3004 wrote to memory of 2156 3004 xrlfxfl.exe 31 PID 3004 wrote to memory of 2156 3004 xrlfxfl.exe 31 PID 3004 wrote to memory of 2156 3004 xrlfxfl.exe 31 PID 3004 wrote to memory of 2156 3004 xrlfxfl.exe 31 PID 2156 wrote to memory of 532 2156 tthnth.exe 32 PID 2156 wrote to memory of 532 2156 tthnth.exe 32 PID 2156 wrote to memory of 532 2156 tthnth.exe 32 PID 2156 wrote to memory of 532 2156 tthnth.exe 32 PID 532 wrote to memory of 2300 532 hhbnbn.exe 33 PID 532 wrote to memory of 2300 532 hhbnbn.exe 33 PID 532 wrote to memory of 2300 532 hhbnbn.exe 33 PID 532 wrote to memory of 2300 532 hhbnbn.exe 33 PID 2300 wrote to memory of 2760 2300 9jjpp.exe 34 PID 2300 wrote to memory of 2760 2300 9jjpp.exe 34 PID 2300 wrote to memory of 2760 2300 9jjpp.exe 34 PID 2300 wrote to memory of 2760 2300 9jjpp.exe 34 PID 2760 wrote to memory of 2756 2760 bbttbh.exe 35 PID 2760 wrote to memory of 2756 2760 bbttbh.exe 35 PID 2760 wrote to memory of 2756 2760 bbttbh.exe 35 PID 2760 wrote to memory of 2756 2760 bbttbh.exe 35 PID 2756 wrote to memory of 2612 2756 tthtnb.exe 36 PID 2756 wrote to memory of 2612 2756 tthtnb.exe 36 PID 2756 wrote to memory of 2612 2756 tthtnb.exe 36 PID 2756 wrote to memory of 2612 2756 tthtnb.exe 36 PID 2612 wrote to memory of 2852 2612 vvpdv.exe 37 PID 2612 wrote to memory of 2852 2612 vvpdv.exe 37 PID 2612 wrote to memory of 2852 2612 vvpdv.exe 37 PID 2612 wrote to memory of 2852 2612 vvpdv.exe 37 PID 2852 wrote to memory of 2740 2852 1bbnhb.exe 38 PID 2852 wrote to memory of 2740 2852 1bbnhb.exe 38 PID 2852 wrote to memory of 2740 2852 1bbnhb.exe 38 PID 2852 wrote to memory of 2740 2852 1bbnhb.exe 38 PID 2740 wrote to memory of 2616 2740 vpdpj.exe 39 PID 2740 wrote to memory of 2616 2740 vpdpj.exe 39 PID 2740 wrote to memory of 2616 2740 vpdpj.exe 39 PID 2740 wrote to memory of 2616 2740 vpdpj.exe 39 PID 2616 wrote to memory of 3044 2616 7nnhth.exe 40 PID 2616 wrote to memory of 3044 2616 7nnhth.exe 40 PID 2616 wrote to memory of 3044 2616 7nnhth.exe 40 PID 2616 wrote to memory of 3044 2616 7nnhth.exe 40 PID 3044 wrote to memory of 664 3044 lfrrffr.exe 41 PID 3044 wrote to memory of 664 3044 lfrrffr.exe 41 PID 3044 wrote to memory of 664 3044 lfrrffr.exe 41 PID 3044 wrote to memory of 664 3044 lfrrffr.exe 41 PID 664 wrote to memory of 1588 664 3llxrrl.exe 42 PID 664 wrote to memory of 1588 664 3llxrrl.exe 42 PID 664 wrote to memory of 1588 664 3llxrrl.exe 42 PID 664 wrote to memory of 1588 664 3llxrrl.exe 42 PID 1588 wrote to memory of 1900 1588 xrlxlrf.exe 43 PID 1588 wrote to memory of 1900 1588 xrlxlrf.exe 43 PID 1588 wrote to memory of 1900 1588 xrlxlrf.exe 43 PID 1588 wrote to memory of 1900 1588 xrlxlrf.exe 43 PID 1900 wrote to memory of 1272 1900 hnhhhn.exe 44 PID 1900 wrote to memory of 1272 1900 hnhhhn.exe 44 PID 1900 wrote to memory of 1272 1900 hnhhhn.exe 44 PID 1900 wrote to memory of 1272 1900 hnhhhn.exe 44 PID 1272 wrote to memory of 616 1272 7xrfxlf.exe 45 PID 1272 wrote to memory of 616 1272 7xrfxlf.exe 45 PID 1272 wrote to memory of 616 1272 7xrfxlf.exe 45 PID 1272 wrote to memory of 616 1272 7xrfxlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe"C:\Users\Admin\AppData\Local\Temp\c19be7e025657c493f23a91b93a47f68e445d94ada334c021c2931dbae5562a9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\xrlfxfl.exec:\xrlfxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\tthnth.exec:\tthnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\hhbnbn.exec:\hhbnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\9jjpp.exec:\9jjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\bbttbh.exec:\bbttbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tthtnb.exec:\tthtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vvpdv.exec:\vvpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1bbnhb.exec:\1bbnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vpdpj.exec:\vpdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7nnhth.exec:\7nnhth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\lfrrffr.exec:\lfrrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\3llxrrl.exec:\3llxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\hnhhhn.exec:\hnhhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\7xrfxlf.exec:\7xrfxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\3rrfflx.exec:\3rrfflx.exe17⤵
- Executes dropped EXE
PID:616 -
\??\c:\9rrfrrf.exec:\9rrfrrf.exe18⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9nnbhn.exec:\9nnbhn.exe19⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ntthth.exec:\ntthth.exe20⤵
- Executes dropped EXE
PID:2472 -
\??\c:\1fflxfx.exec:\1fflxfx.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ppjvp.exec:\ppjvp.exe22⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jdpvp.exec:\jdpvp.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pjdjp.exec:\pjdjp.exe24⤵
- Executes dropped EXE
PID:980 -
\??\c:\frlxrxl.exec:\frlxrxl.exe25⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5ntbht.exec:\5ntbht.exe26⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jdjpv.exec:\jdjpv.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\hhthbn.exec:\hhthbn.exe28⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9ddvd.exec:\9ddvd.exe29⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ttntht.exec:\ttntht.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bbnbnn.exec:\bbnbnn.exe31⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe32⤵
- Executes dropped EXE
PID:1060 -
\??\c:\7ttbnb.exec:\7ttbnb.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\1frxlrf.exec:\1frxlrf.exe34⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bbnthn.exec:\bbnthn.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9vvpp.exec:\9vvpp.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rlxfllr.exec:\rlxfllr.exe37⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bttbnn.exec:\bttbnn.exe39⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nnnthn.exec:\nnnthn.exe40⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5jpdv.exec:\5jpdv.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xxxxfrx.exec:\xxxxfrx.exe42⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tnhnbb.exec:\tnhnbb.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3vvdd.exec:\3vvdd.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xrrxflf.exec:\xrrxflf.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ttnthh.exec:\ttnthh.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hhhntb.exec:\hhhntb.exe47⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pjddd.exec:\pjddd.exe48⤵
- Executes dropped EXE
PID:624 -
\??\c:\rllxllf.exec:\rllxllf.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7rllxxf.exec:\7rllxxf.exe50⤵
- Executes dropped EXE
PID:1172 -
\??\c:\1bhnbh.exec:\1bhnbh.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pdvvv.exec:\pdvvv.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\xxrxllx.exec:\xxrxllx.exe53⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe54⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tbhbht.exec:\tbhbht.exe55⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ppddj.exec:\ppddj.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lllxllf.exec:\lllxllf.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\3rfflxf.exec:\3rfflxf.exe58⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1bnnth.exec:\1bnnth.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jjdpv.exec:\jjdpv.exe60⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fxrxffx.exec:\fxrxffx.exe61⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rlrlrxf.exec:\rlrlrxf.exe62⤵
- Executes dropped EXE
PID:1472 -
\??\c:\ththtb.exec:\ththtb.exe63⤵
- Executes dropped EXE
PID:440 -
\??\c:\1pddd.exec:\1pddd.exe64⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pjvdp.exec:\pjvdp.exe65⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrlfffl.exec:\rrlfffl.exe66⤵PID:1016
-
\??\c:\bttthn.exec:\bttthn.exe67⤵PID:832
-
\??\c:\nnbbbh.exec:\nnbbbh.exe68⤵PID:1940
-
\??\c:\jdvdj.exec:\jdvdj.exe69⤵PID:2192
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe70⤵PID:2140
-
\??\c:\3xflxfr.exec:\3xflxfr.exe71⤵PID:1332
-
\??\c:\1hbnbt.exec:\1hbnbt.exe72⤵PID:2436
-
\??\c:\vpjjp.exec:\vpjjp.exe73⤵PID:2088
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe74⤵PID:2948
-
\??\c:\rxxxffx.exec:\rxxxffx.exe75⤵PID:1060
-
\??\c:\9ttbbb.exec:\9ttbbb.exe76⤵PID:3060
-
\??\c:\djvvj.exec:\djvvj.exe77⤵PID:3008
-
\??\c:\ddppv.exec:\ddppv.exe78⤵PID:2380
-
\??\c:\5xxrffr.exec:\5xxrffr.exe79⤵PID:2320
-
\??\c:\ttntbh.exec:\ttntbh.exe80⤵PID:264
-
\??\c:\pjdjp.exec:\pjdjp.exe81⤵PID:2308
-
\??\c:\jdvvv.exec:\jdvvv.exe82⤵PID:2444
-
\??\c:\xrllrrf.exec:\xrllrrf.exe83⤵PID:2712
-
\??\c:\bnbbnt.exec:\bnbbnt.exe84⤵PID:2876
-
\??\c:\9btbbh.exec:\9btbbh.exe85⤵PID:2756
-
\??\c:\9jddv.exec:\9jddv.exe86⤵PID:2840
-
\??\c:\xfflrxl.exec:\xfflrxl.exe87⤵PID:2940
-
\??\c:\rrrlfxf.exec:\rrrlfxf.exe88⤵PID:2628
-
\??\c:\bbnthb.exec:\bbnthb.exe89⤵PID:2652
-
\??\c:\jdvvd.exec:\jdvvd.exe90⤵PID:2620
-
\??\c:\5xxrlrf.exec:\5xxrlrf.exe91⤵PID:3056
-
\??\c:\7xflrfr.exec:\7xflrfr.exe92⤵PID:3044
-
\??\c:\hbntbh.exec:\hbntbh.exe93⤵PID:664
-
\??\c:\pjdjj.exec:\pjdjj.exe94⤵PID:1172
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe95⤵PID:2008
-
\??\c:\5fllffl.exec:\5fllffl.exe96⤵PID:1504
-
\??\c:\7bbhnt.exec:\7bbhnt.exe97⤵PID:1148
-
\??\c:\vpppp.exec:\vpppp.exe98⤵PID:1992
-
\??\c:\xlxflfr.exec:\xlxflfr.exe99⤵PID:2448
-
\??\c:\bbtthh.exec:\bbtthh.exe100⤵PID:808
-
\??\c:\dpjjp.exec:\dpjjp.exe101⤵PID:2584
-
\??\c:\1xxlflx.exec:\1xxlflx.exe102⤵PID:2456
-
\??\c:\llxfxxf.exec:\llxfxxf.exe103⤵PID:2784
-
\??\c:\hbttbh.exec:\hbttbh.exe104⤵PID:1612
-
\??\c:\5jdvv.exec:\5jdvv.exe105⤵PID:1676
-
\??\c:\9jddp.exec:\9jddp.exe106⤵PID:1076
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe107⤵PID:1528
-
\??\c:\5hhhtb.exec:\5hhhtb.exe108⤵PID:1016
-
\??\c:\9vjvj.exec:\9vjvj.exe109⤵PID:832
-
\??\c:\pjppv.exec:\pjppv.exe110⤵PID:648
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe111⤵PID:2132
-
\??\c:\hbnhnt.exec:\hbnhnt.exe112⤵PID:2540
-
\??\c:\dvpjj.exec:\dvpjj.exe113⤵PID:1952
-
\??\c:\7frxflr.exec:\7frxflr.exe114⤵PID:2028
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe115⤵PID:2428
-
\??\c:\1tnntb.exec:\1tnntb.exe116⤵PID:1480
-
\??\c:\ddvpp.exec:\ddvpp.exe117⤵PID:1744
-
\??\c:\vvjvd.exec:\vvjvd.exe118⤵PID:3068
-
\??\c:\fxflxxr.exec:\fxflxxr.exe119⤵PID:2032
-
\??\c:\vpjpd.exec:\vpjpd.exe120⤵PID:2976
-
\??\c:\xrllrrf.exec:\xrllrrf.exe121⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-