Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 05:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe
-
Size
455KB
-
MD5
1da44f9fd608b126fb8e183381d827f1
-
SHA1
41ded087fe895c7e9cf559acdc3f18e8e214e32f
-
SHA256
eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f
-
SHA512
b7990f0d7a77365fb0cc7926c1accda37f33c1db5626717a6b4cadd96e6ed68df98341d05f6d1d68ae63f4b71a4fa18d8d068f215a514b7b2a3b6d4d633db54a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2276-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2440-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-31-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2552-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-745-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2016-743-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/936-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-799-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2824-860-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-886-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/3028-1013-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1644-1034-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2908 ffrlxlx.exe 2552 ttnbnb.exe 2832 pjjvj.exe 2572 hhbhbb.exe 2440 7rlrfrx.exe 1972 ppdvj.exe 2484 rffxxfr.exe 1492 btntbb.exe 1936 vvpvj.exe 1792 9bbhnt.exe 1048 pvjvp.exe 2332 1ttbnn.exe 1160 ttthhb.exe 2148 xrlfrxl.exe 812 5bbnbh.exe 1320 pjddp.exe 1760 xlxxllr.exe 2772 pjjpp.exe 1656 1dddp.exe 1684 hhbbhn.exe 844 3jdvp.exe 1052 nhhtbh.exe 2388 pdvdd.exe 2740 xfxlxxr.exe 764 tnbbtn.exe 1484 frxrrfl.exe 1920 7tthnn.exe 1736 rrffrxr.exe 1712 tttbbh.exe 2968 lrflfff.exe 2516 rrlrlrf.exe 2668 xxlxlrx.exe 2984 nnhtnt.exe 2528 pjvvd.exe 2640 jjpvp.exe 2788 xxrfxlx.exe 2460 9tnbhn.exe 2440 bhnnbt.exe 2456 jdvvd.exe 2900 lfxfrrf.exe 2204 xxlfrxl.exe 1952 hntntb.exe 1808 vjvpj.exe 1620 jpjvj.exe 1624 xxlflxl.exe 1800 xrflxfr.exe 1812 1bntbb.exe 2308 jvppv.exe 2320 3vpdp.exe 1796 rlllflx.exe 2148 bbhtbb.exe 2736 1thntb.exe 308 pjddj.exe 2780 5rrrxxf.exe 1992 1xffrxf.exe 2716 nhbhhn.exe 3020 5nhbnt.exe 404 5dvvp.exe 3004 jdvpp.exe 1192 xrrrlrf.exe 956 ttnbtb.exe 1268 dvdpd.exe 1696 5pdjj.exe 1196 rlxfxfl.exe -
resource yara_rule behavioral1/memory/2276-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-1020-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffrfr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1544 wrote to memory of 2908 1544 eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe 29 PID 1544 wrote to memory of 2908 1544 eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe 29 PID 1544 wrote to memory of 2908 1544 eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe 29 PID 1544 wrote to memory of 2908 1544 eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe 29 PID 2908 wrote to memory of 2552 2908 ffrlxlx.exe 30 PID 2908 wrote to memory of 2552 2908 ffrlxlx.exe 30 PID 2908 wrote to memory of 2552 2908 ffrlxlx.exe 30 PID 2908 wrote to memory of 2552 2908 ffrlxlx.exe 30 PID 2552 wrote to memory of 2832 2552 ttnbnb.exe 31 PID 2552 wrote to memory of 2832 2552 ttnbnb.exe 31 PID 2552 wrote to memory of 2832 2552 ttnbnb.exe 31 PID 2552 wrote to memory of 2832 2552 ttnbnb.exe 31 PID 2832 wrote to memory of 2572 2832 pjjvj.exe 32 PID 2832 wrote to memory of 2572 2832 pjjvj.exe 32 PID 2832 wrote to memory of 2572 2832 pjjvj.exe 32 PID 2832 wrote to memory of 2572 2832 pjjvj.exe 32 PID 2572 wrote to memory of 2440 2572 hhbhbb.exe 33 PID 2572 wrote to memory of 2440 2572 hhbhbb.exe 33 PID 2572 wrote to memory of 2440 2572 hhbhbb.exe 33 PID 2572 wrote to memory of 2440 2572 hhbhbb.exe 33 PID 2440 wrote to memory of 1972 2440 7rlrfrx.exe 34 PID 2440 wrote to memory of 1972 2440 7rlrfrx.exe 34 PID 2440 wrote to memory of 1972 2440 7rlrfrx.exe 34 PID 2440 wrote to memory of 1972 2440 7rlrfrx.exe 34 PID 1972 wrote to memory of 2484 1972 ppdvj.exe 35 PID 1972 wrote to memory of 2484 1972 ppdvj.exe 35 PID 1972 wrote to memory of 2484 1972 ppdvj.exe 35 PID 1972 wrote to memory of 2484 1972 ppdvj.exe 35 PID 2484 wrote to memory of 1492 2484 rffxxfr.exe 36 PID 2484 wrote to memory of 1492 2484 rffxxfr.exe 36 PID 2484 wrote to memory of 1492 2484 rffxxfr.exe 36 PID 2484 wrote to memory of 1492 2484 rffxxfr.exe 36 PID 1492 wrote to memory of 1936 1492 btntbb.exe 37 PID 1492 wrote to memory of 1936 1492 btntbb.exe 37 PID 1492 wrote to memory of 1936 1492 btntbb.exe 37 PID 1492 wrote to memory of 1936 1492 btntbb.exe 37 PID 1936 wrote to memory of 1792 1936 vvpvj.exe 38 PID 1936 wrote to memory of 1792 1936 vvpvj.exe 38 PID 1936 wrote to memory of 1792 1936 vvpvj.exe 38 PID 1936 wrote to memory of 1792 1936 vvpvj.exe 38 PID 1792 wrote to memory of 1048 1792 9bbhnt.exe 39 PID 1792 wrote to memory of 1048 1792 9bbhnt.exe 39 PID 1792 wrote to memory of 1048 1792 9bbhnt.exe 39 PID 1792 wrote to memory of 1048 1792 9bbhnt.exe 39 PID 1048 wrote to memory of 2332 1048 pvjvp.exe 40 PID 1048 wrote to memory of 2332 1048 pvjvp.exe 40 PID 1048 wrote to memory of 2332 1048 pvjvp.exe 40 PID 1048 wrote to memory of 2332 1048 pvjvp.exe 40 PID 2332 wrote to memory of 1160 2332 1ttbnn.exe 41 PID 2332 wrote to memory of 1160 2332 1ttbnn.exe 41 PID 2332 wrote to memory of 1160 2332 1ttbnn.exe 41 PID 2332 wrote to memory of 1160 2332 1ttbnn.exe 41 PID 1160 wrote to memory of 2148 1160 ttthhb.exe 42 PID 1160 wrote to memory of 2148 1160 ttthhb.exe 42 PID 1160 wrote to memory of 2148 1160 ttthhb.exe 42 PID 1160 wrote to memory of 2148 1160 ttthhb.exe 42 PID 2148 wrote to memory of 812 2148 xrlfrxl.exe 43 PID 2148 wrote to memory of 812 2148 xrlfrxl.exe 43 PID 2148 wrote to memory of 812 2148 xrlfrxl.exe 43 PID 2148 wrote to memory of 812 2148 xrlfrxl.exe 43 PID 812 wrote to memory of 1320 812 5bbnbh.exe 44 PID 812 wrote to memory of 1320 812 5bbnbh.exe 44 PID 812 wrote to memory of 1320 812 5bbnbh.exe 44 PID 812 wrote to memory of 1320 812 5bbnbh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe"C:\Users\Admin\AppData\Local\Temp\eba0c024a3cdd2cab2d87a3c201d0b999f57a675097ae5079e12aa66ab985f7f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\ffrlxlx.exec:\ffrlxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ttnbnb.exec:\ttnbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pjjvj.exec:\pjjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\hhbhbb.exec:\hhbhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\7rlrfrx.exec:\7rlrfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\ppdvj.exec:\ppdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\rffxxfr.exec:\rffxxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\btntbb.exec:\btntbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\vvpvj.exec:\vvpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\9bbhnt.exec:\9bbhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\pvjvp.exec:\pvjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\1ttbnn.exec:\1ttbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\ttthhb.exec:\ttthhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\xrlfrxl.exec:\xrlfrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5bbnbh.exec:\5bbnbh.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\pjddp.exec:\pjddp.exe17⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xlxxllr.exec:\xlxxllr.exe18⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pjjpp.exec:\pjjpp.exe19⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1dddp.exec:\1dddp.exe20⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hhbbhn.exec:\hhbbhn.exe21⤵
- Executes dropped EXE
PID:1684 -
\??\c:\3jdvp.exec:\3jdvp.exe22⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhhtbh.exec:\nhhtbh.exe23⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pdvdd.exec:\pdvdd.exe24⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xfxlxxr.exec:\xfxlxxr.exe25⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tnbbtn.exec:\tnbbtn.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\frxrrfl.exec:\frxrrfl.exe27⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7tthnn.exec:\7tthnn.exe28⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rrffrxr.exec:\rrffrxr.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tttbbh.exec:\tttbbh.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lrflfff.exec:\lrflfff.exe31⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe32⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xxlxlrx.exec:\xxlxlrx.exe33⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nnhtnt.exec:\nnhtnt.exe34⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pjvvd.exec:\pjvvd.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jjpvp.exec:\jjpvp.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9tnbhn.exec:\9tnbhn.exe38⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bhnnbt.exec:\bhnnbt.exe39⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdvvd.exec:\jdvvd.exe40⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xxlfrxl.exec:\xxlfrxl.exe42⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hntntb.exec:\hntntb.exe43⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vjvpj.exec:\vjvpj.exe44⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jpjvj.exec:\jpjvj.exe45⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xxlflxl.exec:\xxlflxl.exe46⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrflxfr.exec:\xrflxfr.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1bntbb.exec:\1bntbb.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jvppv.exec:\jvppv.exe49⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3vpdp.exec:\3vpdp.exe50⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rlllflx.exec:\rlllflx.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bbhtbb.exec:\bbhtbb.exe52⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1thntb.exec:\1thntb.exe53⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pjddj.exec:\pjddj.exe54⤵
- Executes dropped EXE
PID:308 -
\??\c:\5rrrxxf.exec:\5rrrxxf.exe55⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1xffrxf.exec:\1xffrxf.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nhbhhn.exec:\nhbhhn.exe57⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5nhbnt.exec:\5nhbnt.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5dvvp.exec:\5dvvp.exe59⤵
- Executes dropped EXE
PID:404 -
\??\c:\jdvpp.exec:\jdvpp.exe60⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrrrlrf.exec:\xrrrlrf.exe61⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ttnbtb.exec:\ttnbtb.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\dvdpd.exec:\dvdpd.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5pdjj.exec:\5pdjj.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlxfxfl.exec:\rlxfxfl.exe65⤵
- Executes dropped EXE
PID:1196 -
\??\c:\frrxrxl.exec:\frrxrxl.exe66⤵PID:2244
-
\??\c:\bbbhtb.exec:\bbbhtb.exe67⤵PID:2816
-
\??\c:\vpdjv.exec:\vpdjv.exe68⤵PID:1560
-
\??\c:\jjvjd.exec:\jjvjd.exe69⤵PID:1920
-
\??\c:\fxrxxrx.exec:\fxrxxrx.exe70⤵PID:2080
-
\??\c:\hhbtnb.exec:\hhbtnb.exe71⤵PID:2276
-
\??\c:\hhbhnt.exec:\hhbhnt.exe72⤵PID:2232
-
\??\c:\ppvjd.exec:\ppvjd.exe73⤵PID:2648
-
\??\c:\lxlflfl.exec:\lxlflfl.exe74⤵PID:2520
-
\??\c:\jjjpd.exec:\jjjpd.exe75⤵PID:2696
-
\??\c:\rlfrffx.exec:\rlfrffx.exe76⤵PID:1580
-
\??\c:\bthntb.exec:\bthntb.exe77⤵PID:2832
-
\??\c:\ppjvv.exec:\ppjvv.exe78⤵PID:2616
-
\??\c:\1rlxffl.exec:\1rlxffl.exe79⤵PID:2452
-
\??\c:\bhhtht.exec:\bhhtht.exe80⤵PID:2684
-
\??\c:\pjjpj.exec:\pjjpj.exe81⤵PID:2408
-
\??\c:\lrlrxlx.exec:\lrlrxlx.exe82⤵PID:2944
-
\??\c:\9nhbnb.exec:\9nhbnb.exe83⤵PID:2052
-
\??\c:\7jvvj.exec:\7jvvj.exe84⤵PID:1068
-
\??\c:\5fxlrxf.exec:\5fxlrxf.exe85⤵PID:864
-
\??\c:\bbtbnt.exec:\bbtbnt.exe86⤵PID:1964
-
\??\c:\jjvdp.exec:\jjvdp.exe87⤵PID:2152
-
\??\c:\lxfxrlx.exec:\lxfxrlx.exe88⤵PID:852
-
\??\c:\1vpjj.exec:\1vpjj.exe89⤵PID:1048
-
\??\c:\rlrfxrr.exec:\rlrfxrr.exe90⤵PID:1436
-
\??\c:\bnnnbh.exec:\bnnnbh.exe91⤵PID:1804
-
\??\c:\djvjd.exec:\djvjd.exe92⤵PID:820
-
\??\c:\5xxflxl.exec:\5xxflxl.exe93⤵PID:1824
-
\??\c:\bbntbn.exec:\bbntbn.exe94⤵PID:2776
-
\??\c:\jjpvd.exec:\jjpvd.exe95⤵PID:1060
-
\??\c:\lrrxllx.exec:\lrrxllx.exe96⤵PID:268
-
\??\c:\tbhttb.exec:\tbhttb.exe97⤵PID:308
-
\??\c:\9dppd.exec:\9dppd.exe98⤵PID:3032
-
\??\c:\lrxfrxr.exec:\lrxfrxr.exe99⤵PID:2604
-
\??\c:\tbbnhh.exec:\tbbnhh.exe100⤵PID:1656
-
\??\c:\pvpjp.exec:\pvpjp.exe101⤵PID:1512
-
\??\c:\lffrlfr.exec:\lffrlfr.exe102⤵PID:2016
-
\??\c:\bbtbtb.exec:\bbtbtb.exe103⤵PID:2292
-
\??\c:\9jdjj.exec:\9jdjj.exe104⤵PID:1924
-
\??\c:\xrflrrl.exec:\xrflrrl.exe105⤵PID:936
-
\??\c:\nhbhnt.exec:\nhbhnt.exe106⤵PID:3008
-
\??\c:\dvppv.exec:\dvppv.exe107⤵PID:2996
-
\??\c:\rxlxfxl.exec:\rxlxfxl.exe108⤵PID:764
-
\??\c:\ntnttb.exec:\ntnttb.exe109⤵PID:2172
-
\??\c:\nnbhnt.exec:\nnbhnt.exe110⤵PID:692
-
\??\c:\pjvdp.exec:\pjvdp.exe111⤵PID:900
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe112⤵PID:1688
-
\??\c:\hnthth.exec:\hnthth.exe113⤵PID:1712
-
\??\c:\jjpdp.exec:\jjpdp.exe114⤵PID:1780
-
\??\c:\rrllfrr.exec:\rrllfrr.exe115⤵PID:2656
-
\??\c:\1btbtb.exec:\1btbtb.exe116⤵PID:2824
-
\??\c:\jjvjd.exec:\jjvjd.exe117⤵PID:2696
-
\??\c:\bbbhtb.exec:\bbbhtb.exe118⤵PID:2820
-
\??\c:\5bhntt.exec:\5bhntt.exe119⤵PID:2056
-
\??\c:\9pjjd.exec:\9pjjd.exe120⤵PID:2784
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe121⤵PID:2452
-
\??\c:\nhthbh.exec:\nhthbh.exe122⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-