Analysis
- max time kernel
150s - max time network
121s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 04:46
Behavioral task
behavioral1
Sample
955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
- Target 955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe
- Size 333KB
- Sample250108-feaphaxkfm
- SHA256 955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4
- MD5 af5dd4a22905b691573b8336d067e257
- SHA1 88565884ff2c487405e604ab91092097a8958c33
- SHA512 00b137fdd837274e6de7c294abdb81a4fc6458d649c0043a2235e7dae4cdef715fc3104ba5de027c615af7ca5ee15899e0bf0a3af420afad7c9e246991f6884d
- SSDEEP 6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeq:R4wFHoSHYHUrAwfMp3CDq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1696-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-92-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2132-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-117-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2784-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-202-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1292-201-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1292-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/408-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-412-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-733-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-750-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2120-777-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-793-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-819-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2340-9569-0x0000000077070000-0x000000007718F000-memory.dmp family_blackmoon behavioral1/memory/2340-24546-0x0000000077070000-0x000000007718F000-memory.dmp family_blackmoon behavioral1/memory/2340-26747-0x0000000077070000-0x000000007718F000-memory.dmp family_blackmoon behavioral1/memory/2340-27851-0x0000000077070000-0x000000007718F000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2508 hhtbnb.exe 3060 dvpdp.exe 1796 5frlrll.exe 2304 ttntnt.exe 2864 5djjd.exe 2828 7rfflrx.exe 2856 hhbhtb.exe 2976 jdjpv.exe 2692 3xxrxxl.exe 2592 jdvvj.exe 2132 xxllxfl.exe 2184 1thntt.exe 1924 ddvpv.exe 2784 fxxflrx.exe 2480 3thtbh.exe 1632 vvvdv.exe 2768 xxrxfrx.exe 2900 bbtbnb.exe 1896 dvvjp.exe 2676 5frrrrl.exe 2464 hthnnt.exe 1492 9frrxrr.exe 1292 3rffllx.exe 408 5tbbbh.exe 1104 9dvdd.exe 1656 xlxfllf.exe 776 tthtbh.exe 264 vjvvd.exe 852 3rfrrxx.exe 1920 hthhhb.exe 2368 dvjjp.exe 320 rlxrrrf.exe 2348 thnhhb.exe 2312 vppjp.exe 1288 djddp.exe 2116 lxrlfxf.exe 1620 7flxrlf.exe 2688 httnnh.exe 2880 jdjpp.exe 1800 rfrxxrf.exe 2712 rfrrxff.exe 2140 3tbnhb.exe 2896 htnhnh.exe 2940 5jjvv.exe 2752 dvjdj.exe 2884 5lrrlff.exe 2892 3bnnbn.exe 1864 9httnb.exe 1932 jppjp.exe 1664 lxlfxlx.exe 2808 xlfflff.exe 1868 nthbnh.exe 2112 thbbnn.exe 108 9vpjv.exe 828 rflffxr.exe 1496 5lrllfx.exe 2416 thnhtn.exe 2000 1nbbbb.exe 2936 pppjd.exe 2772 3djjp.exe 3052 lfrflxx.exe 2444 5bhbtb.exe 2496 hhthbb.exe 1948 pdpjj.exe -
resource yara_rule behavioral1/memory/1696-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f4-8.dat upx behavioral1/memory/1696-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d59-17.dat upx behavioral1/files/0x0008000000015d81-24.dat upx behavioral1/memory/2508-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e48-32.dat upx behavioral1/memory/2304-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1796-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ec9-42.dat upx behavioral1/memory/2304-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f71-50.dat upx behavioral1/files/0x0007000000015ff5-58.dat upx behavioral1/files/0x0008000000016241-67.dat upx behavioral1/memory/2976-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d3f-76.dat upx behavioral1/memory/2692-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d47-84.dat upx behavioral1/files/0x0006000000016d4f-93.dat upx behavioral1/memory/2184-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d63-100.dat upx behavioral1/files/0x0006000000016d69-110.dat upx behavioral1/memory/1924-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6d-118.dat upx behavioral1/memory/2784-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d72-127.dat upx behavioral1/memory/2480-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd9-135.dat upx behavioral1/files/0x0006000000016de0-144.dat upx behavioral1/memory/1632-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dea-152.dat upx behavioral1/memory/2900-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016eb4-162.dat upx behavioral1/memory/1896-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017047-171.dat upx behavioral1/memory/2676-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001743a-178.dat upx behavioral1/files/0x000600000001747d-188.dat upx behavioral1/memory/2464-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017491-194.dat upx behavioral1/files/0x0008000000015d0e-203.dat upx behavioral1/memory/1292-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/408-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175e7-211.dat upx behavioral1/memory/1104-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018669-220.dat upx behavioral1/files/0x001400000001866f-227.dat upx behavioral1/files/0x0011000000018682-235.dat upx behavioral1/memory/776-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001868b-242.dat upx behavioral1/files/0x00050000000186f2-250.dat upx behavioral1/memory/1920-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f8-258.dat upx behavioral1/memory/2368-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018731-266.dat upx behavioral1/memory/1288-288-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1620-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-313-0x0000000000400000-0x0000000000427000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2508 1696 955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe 30 PID 1696 wrote to memory of 2508 1696 955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe 30 PID 1696 wrote to memory of 2508 1696 955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe 30 PID 1696 wrote to memory of 2508 1696 955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe 30 PID 2508 wrote to memory of 3060 2508 hhtbnb.exe 31 PID 2508 wrote to memory of 3060 2508 hhtbnb.exe 31 PID 2508 wrote to memory of 3060 2508 hhtbnb.exe 31 PID 2508 wrote to memory of 3060 2508 hhtbnb.exe 31 PID 3060 wrote to memory of 1796 3060 dvpdp.exe 32 PID 3060 wrote to memory of 1796 3060 dvpdp.exe 32 PID 3060 wrote to memory of 1796 3060 dvpdp.exe 32 PID 3060 wrote to memory of 1796 3060 dvpdp.exe 32 PID 1796 wrote to memory of 2304 1796 5frlrll.exe 33 PID 1796 wrote to memory of 2304 1796 5frlrll.exe 33 PID 1796 wrote to memory of 2304 1796 5frlrll.exe 33 PID 1796 wrote to memory of 2304 1796 5frlrll.exe 33 PID 2304 wrote to memory of 2864 2304 ttntnt.exe 34 PID 2304 wrote to memory of 2864 2304 ttntnt.exe 34 PID 2304 wrote to memory of 2864 2304 ttntnt.exe 34 PID 2304 wrote to memory of 2864 2304 ttntnt.exe 34 PID 2864 wrote to memory of 2828 2864 5djjd.exe 35 PID 2864 wrote to memory of 2828 2864 5djjd.exe 35 PID 2864 wrote to memory of 2828 2864 5djjd.exe 35 PID 2864 wrote to memory of 2828 2864 5djjd.exe 35 PID 2828 wrote to memory of 2856 2828 7rfflrx.exe 36 PID 2828 wrote to memory of 2856 2828 7rfflrx.exe 36 PID 2828 wrote to memory of 2856 2828 7rfflrx.exe 36 PID 2828 wrote to memory of 2856 2828 7rfflrx.exe 36 PID 2856 wrote to memory of 2976 2856 hhbhtb.exe 37 PID 2856 wrote to memory of 2976 2856 hhbhtb.exe 37 PID 2856 wrote to memory of 2976 2856 hhbhtb.exe 37 PID 2856 wrote to memory of 2976 2856 hhbhtb.exe 37 PID 2976 wrote to memory of 2692 2976 jdjpv.exe 38 PID 2976 wrote to memory of 2692 2976 jdjpv.exe 38 PID 2976 wrote to memory of 2692 2976 jdjpv.exe 38 PID 2976 wrote to memory of 2692 2976 jdjpv.exe 38 PID 2692 wrote to memory of 2592 2692 3xxrxxl.exe 39 PID 2692 wrote to memory of 2592 2692 3xxrxxl.exe 39 PID 2692 wrote to memory of 2592 2692 3xxrxxl.exe 39 PID 2692 wrote to memory of 2592 2692 3xxrxxl.exe 39 PID 2592 wrote to memory of 2132 2592 jdvvj.exe 40 PID 2592 wrote to memory of 2132 2592 jdvvj.exe 40 PID 2592 wrote to memory of 2132 2592 jdvvj.exe 40 PID 2592 wrote to memory of 2132 2592 jdvvj.exe 40 PID 2132 wrote to memory of 2184 2132 xxllxfl.exe 41 PID 2132 wrote to memory of 2184 2132 xxllxfl.exe 41 PID 2132 wrote to memory of 2184 2132 xxllxfl.exe 41 PID 2132 wrote to memory of 2184 2132 xxllxfl.exe 41 PID 2184 wrote to memory of 1924 2184 1thntt.exe 42 PID 2184 wrote to memory of 1924 2184 1thntt.exe 42 PID 2184 wrote to memory of 1924 2184 1thntt.exe 42 PID 2184 wrote to memory of 1924 2184 1thntt.exe 42 PID 1924 wrote to memory of 2784 1924 ddvpv.exe 43 PID 1924 wrote to memory of 2784 1924 ddvpv.exe 43 PID 1924 wrote to memory of 2784 1924 ddvpv.exe 43 PID 1924 wrote to memory of 2784 1924 ddvpv.exe 43 PID 2784 wrote to memory of 2480 2784 fxxflrx.exe 44 PID 2784 wrote to memory of 2480 2784 fxxflrx.exe 44 PID 2784 wrote to memory of 2480 2784 fxxflrx.exe 44 PID 2784 wrote to memory of 2480 2784 fxxflrx.exe 44 PID 2480 wrote to memory of 1632 2480 3thtbh.exe 45 PID 2480 wrote to memory of 1632 2480 3thtbh.exe 45 PID 2480 wrote to memory of 1632 2480 3thtbh.exe 45 PID 2480 wrote to memory of 1632 2480 3thtbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe"C:\Users\Admin\AppData\Local\Temp\955db8cc80e6ec138d577681a36045631db86c7a2d751b2110c4113c8c4929b4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\hhtbnb.exec:\hhtbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\dvpdp.exec:\dvpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\5frlrll.exec:\5frlrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\ttntnt.exec:\ttntnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\5djjd.exec:\5djjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\7rfflrx.exec:\7rfflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hhbhtb.exec:\hhbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jdjpv.exec:\jdjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\3xxrxxl.exec:\3xxrxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jdvvj.exec:\jdvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xxllxfl.exec:\xxllxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\1thntt.exec:\1thntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\ddvpv.exec:\ddvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\fxxflrx.exec:\fxxflrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\3thtbh.exec:\3thtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\vvvdv.exec:\vvvdv.exe17⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\bbtbnb.exec:\bbtbnb.exe19⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dvvjp.exec:\dvvjp.exe20⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5frrrrl.exec:\5frrrrl.exe21⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hthnnt.exec:\hthnnt.exe22⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9frrxrr.exec:\9frrxrr.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3rffllx.exec:\3rffllx.exe24⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5tbbbh.exec:\5tbbbh.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\9dvdd.exec:\9dvdd.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xlxfllf.exec:\xlxfllf.exe27⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tthtbh.exec:\tthtbh.exe28⤵
- Executes dropped EXE
PID:776 -
\??\c:\vjvvd.exec:\vjvvd.exe29⤵
- Executes dropped EXE
PID:264 -
\??\c:\3rfrrxx.exec:\3rfrrxx.exe30⤵
- Executes dropped EXE
PID:852 -
\??\c:\hthhhb.exec:\hthhhb.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dvjjp.exec:\dvjjp.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe33⤵
- Executes dropped EXE
PID:320 -
\??\c:\thnhhb.exec:\thnhhb.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vppjp.exec:\vppjp.exe35⤵
- Executes dropped EXE
PID:2312 -
\??\c:\djddp.exec:\djddp.exe36⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lxrlfxf.exec:\lxrlfxf.exe37⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7flxrlf.exec:\7flxrlf.exe38⤵
- Executes dropped EXE
PID:1620 -
\??\c:\httnnh.exec:\httnnh.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdjpp.exec:\jdjpp.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rfrxxrf.exec:\rfrxxrf.exe41⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rfrrxff.exec:\rfrrxff.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3tbnhb.exec:\3tbnhb.exe43⤵
- Executes dropped EXE
PID:2140 -
\??\c:\htnhnh.exec:\htnhnh.exe44⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5jjvv.exec:\5jjvv.exe45⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvjdj.exec:\dvjdj.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5lrrlff.exec:\5lrrlff.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3bnnbn.exec:\3bnnbn.exe48⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9httnb.exec:\9httnb.exe49⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jppjp.exec:\jppjp.exe50⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxlfxlx.exec:\lxlfxlx.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xlfflff.exec:\xlfflff.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nthbnh.exec:\nthbnh.exe53⤵
- Executes dropped EXE
PID:1868 -
\??\c:\thbbnn.exec:\thbbnn.exe54⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9vpjv.exec:\9vpjv.exe55⤵
- Executes dropped EXE
PID:108 -
\??\c:\rflffxr.exec:\rflffxr.exe56⤵
- Executes dropped EXE
PID:828 -
\??\c:\5lrllfx.exec:\5lrllfx.exe57⤵
- Executes dropped EXE
PID:1496 -
\??\c:\thnhtn.exec:\thnhtn.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1nbbbb.exec:\1nbbbb.exe59⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pppjd.exec:\pppjd.exe60⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3djjp.exec:\3djjp.exe61⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfrflxx.exec:\lfrflxx.exe62⤵
- Executes dropped EXE
PID:3052 -
\??\c:\5bhbtb.exec:\5bhbtb.exe63⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hhthbb.exec:\hhthbb.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pdpjj.exec:\pdpjj.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvpdd.exec:\dvpdd.exe66⤵PID:1312
-
\??\c:\lxlflff.exec:\lxlflff.exe67⤵PID:1916
-
\??\c:\1flrrlx.exec:\1flrrlx.exe68⤵PID:276
-
\??\c:\nthbbb.exec:\nthbbb.exe69⤵PID:3020
-
\??\c:\7vvpj.exec:\7vvpj.exe70⤵PID:612
-
\??\c:\pdvpj.exec:\pdvpj.exe71⤵PID:2344
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe72⤵PID:2548
-
\??\c:\lxlrfxx.exec:\lxlrfxx.exe73⤵PID:2204
-
\??\c:\hnbbbt.exec:\hnbbbt.exe74⤵PID:2372
-
\??\c:\vjvpp.exec:\vjvpp.exe75⤵PID:988
-
\??\c:\vpvvv.exec:\vpvvv.exe76⤵PID:2160
-
\??\c:\ffrxllf.exec:\ffrxllf.exe77⤵PID:1908
-
\??\c:\rllllfl.exec:\rllllfl.exe78⤵PID:2460
-
\??\c:\nbttbb.exec:\nbttbb.exe79⤵PID:2488
-
\??\c:\jvdjp.exec:\jvdjp.exe80⤵PID:2288
-
\??\c:\pdjdd.exec:\pdjdd.exe81⤵PID:1892
-
\??\c:\lxllrrx.exec:\lxllrrx.exe82⤵PID:1592
-
\??\c:\1rxrrrl.exec:\1rxrrrl.exe83⤵PID:2116
-
\??\c:\7nbhnh.exec:\7nbhnh.exe84⤵PID:2984
-
\??\c:\nbbhnb.exec:\nbbhnb.exe85⤵PID:2688
-
\??\c:\5dpvp.exec:\5dpvp.exe86⤵PID:2824
-
\??\c:\5vjjd.exec:\5vjjd.exe87⤵PID:2916
-
\??\c:\xllxrxx.exec:\xllxrxx.exe88⤵PID:2704
-
\??\c:\hbhbtb.exec:\hbhbtb.exe89⤵PID:2844
-
\??\c:\nbbbnn.exec:\nbbbnn.exe90⤵PID:2968
-
\??\c:\jvddj.exec:\jvddj.exe91⤵PID:2632
-
\??\c:\1vddj.exec:\1vddj.exe92⤵PID:2608
-
\??\c:\3flrrrr.exec:\3flrrrr.exe93⤵PID:2572
-
\??\c:\fllrlff.exec:\fllrlff.exe94⤵PID:1056
-
\??\c:\1bhbbt.exec:\1bhbbt.exe95⤵PID:1872
-
\??\c:\tnbhnb.exec:\tnbhnb.exe96⤵PID:1320
-
\??\c:\dvdpv.exec:\dvdpv.exe97⤵PID:2184
-
\??\c:\1pvvp.exec:\1pvvp.exe98⤵PID:1380
-
\??\c:\flrrlff.exec:\flrrlff.exe99⤵PID:1356
-
\??\c:\1ntttn.exec:\1ntttn.exe100⤵PID:1712
-
\??\c:\5tnbhb.exec:\5tnbhb.exe101⤵PID:2480
-
\??\c:\3pvdd.exec:\3pvdd.exe102⤵PID:2796
-
\??\c:\jppdv.exec:\jppdv.exe103⤵PID:992
-
\??\c:\lrrlllr.exec:\lrrlllr.exe104⤵PID:2028
-
\??\c:\7xlffrl.exec:\7xlffrl.exe105⤵PID:2416
-
\??\c:\ntthbt.exec:\ntthbt.exe106⤵PID:2944
-
\??\c:\thhbtn.exec:\thhbtn.exe107⤵PID:2956
-
\??\c:\ppvpj.exec:\ppvpj.exe108⤵PID:2676
-
\??\c:\flrlxrx.exec:\flrlxrx.exe109⤵PID:2224
-
\??\c:\3xlflll.exec:\3xlflll.exe110⤵PID:2544
-
\??\c:\nhtbbb.exec:\nhtbbb.exe111⤵PID:2496
-
\??\c:\hnbtbb.exec:\hnbtbb.exe112⤵PID:1076
-
\??\c:\jpjpv.exec:\jpjpv.exe113⤵PID:1312
-
\??\c:\5frrflf.exec:\5frrflf.exe114⤵PID:3008
-
\??\c:\frllflx.exec:\frllflx.exe115⤵PID:1524
-
\??\c:\5nnntn.exec:\5nnntn.exe116⤵PID:1096
-
\??\c:\nbhtth.exec:\nbhtth.exe117⤵PID:2172
-
\??\c:\vpdjp.exec:\vpdjp.exe118⤵PID:776
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe119⤵PID:1136
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe120⤵PID:2392
-
\??\c:\bbbbtt.exec:\bbbbtt.exe121⤵PID:900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-