Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-01-2025 23:51
Behavioral task
behavioral1
Sample
fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe
-
Size
3.7MB
-
MD5
791dcaac2e4fdcdeebe66a3fb363173c
-
SHA1
7f56c44a71ede39cd132adb87864ec827f5b42b4
-
SHA256
fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130
-
SHA512
bfd4c89d9602562e5f393a1685c58ce52dafb8c3a0473cb47ce40dddd5be125045b2584d91db1fe4c0b95439d07de1ebb57a5f2c53ea261a95dbdbf5bdb13446
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98u:U6XLq/qPPslzKx/dJg1ErmNP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2696-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-23-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-47-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2144-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-125-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2160-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/824-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-244-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2512-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/528-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-441-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3068-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-698-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-841-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-858-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-872-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/576-920-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2332-931-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1720-962-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-976-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1420-989-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-1020-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-1046-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-1271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2844 hbbbnn.exe 2900 nhhnhh.exe 2736 nbtntb.exe 2604 bbnbbh.exe 2144 nhbbnb.exe 776 rxrrfrl.exe 1500 7lxfrxr.exe 1628 xlrxxll.exe 2540 jvvpd.exe 2560 jjdjp.exe 1248 lrlllrr.exe 1084 lxrxxrf.exe 2872 xllrxlx.exe 2160 bbtbhn.exe 2224 thbbhn.exe 1284 hhbnht.exe 1860 3tnttt.exe 1952 hthhnn.exe 2312 ddppv.exe 1456 vjvvj.exe 1868 vjppv.exe 1028 tnbbbt.exe 1732 ppdvv.exe 824 bhnnnn.exe 1960 hhntbh.exe 1552 ffrllll.exe 1756 9fxffff.exe 2512 rxxflxl.exe 2432 dpddj.exe 2412 lrfrlrl.exe 2344 fxrxffl.exe 2776 nthnbt.exe 2212 fxlrxff.exe 1608 xrlfffx.exe 2696 7xrrxxx.exe 2884 bnhhnb.exe 2620 7htbnn.exe 2572 fllxrlf.exe 2592 rllrrxx.exe 2024 vpvdj.exe 344 jdpjp.exe 1492 1jjjj.exe 828 7nnttt.exe 2264 7xrrxxx.exe 2816 llrxflr.exe 2996 3jvpp.exe 1236 3vdpp.exe 3044 1bbttn.exe 2568 tnbhnt.exe 2268 llflxlx.exe 528 ppppp.exe 544 7bhtbh.exe 1144 7ffxxrr.exe 2140 xlffflf.exe 3068 pdjpp.exe 2964 nbntbh.exe 1788 bhttbt.exe 2492 xlllfff.exe 904 vpjjp.exe 2384 jvjjp.exe 2528 1ttnbt.exe 1616 hntnnh.exe 2752 lxrlrxx.exe 1864 1pdpp.exe -
resource yara_rule behavioral1/memory/2696-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012259-5.dat upx behavioral1/memory/2844-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d75-18.dat upx behavioral1/files/0x0008000000015d7f-31.dat upx behavioral1/memory/2900-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015dc3-40.dat upx behavioral1/memory/2736-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2604-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2144-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e47-51.dat upx behavioral1/memory/2144-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f1b-57.dat upx behavioral1/files/0x0007000000015f2a-67.dat upx behavioral1/memory/776-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0031000000015d5c-78.dat upx behavioral1/files/0x00080000000160d5-87.dat upx behavioral1/memory/1628-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019030-96.dat upx behavioral1/files/0x000600000001903d-104.dat upx behavioral1/memory/1084-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001920f-113.dat upx behavioral1/files/0x0005000000019228-122.dat upx behavioral1/files/0x0005000000019234-130.dat upx behavioral1/files/0x0005000000019241-139.dat upx behavioral1/memory/2160-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925c-148.dat upx behavioral1/memory/2224-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019273-158.dat upx behavioral1/memory/1860-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1284-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192f0-166.dat upx behavioral1/files/0x000500000001932a-174.dat upx behavioral1/memory/2312-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933e-187.dat upx behavioral1/memory/1456-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-182-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0005000000019346-194.dat upx behavioral1/memory/1028-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019384-204.dat upx behavioral1/memory/1732-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a2-212.dat upx behavioral1/files/0x00050000000193af-221.dat upx behavioral1/files/0x00050000000193c9-230.dat upx behavioral1/memory/824-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193f8-237.dat upx behavioral1/memory/1756-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193fa-247.dat upx behavioral1/files/0x0005000000019408-256.dat upx behavioral1/files/0x0005000000019494-264.dat upx behavioral1/memory/2512-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a7-273.dat upx behavioral1/memory/2432-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b4-283.dat upx behavioral1/memory/2344-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d4-293.dat upx behavioral1/memory/2212-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2024-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/344-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1492-364-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2844 2696 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2696 wrote to memory of 2844 2696 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2696 wrote to memory of 2844 2696 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2696 wrote to memory of 2844 2696 fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe 30 PID 2844 wrote to memory of 2900 2844 hbbbnn.exe 31 PID 2844 wrote to memory of 2900 2844 hbbbnn.exe 31 PID 2844 wrote to memory of 2900 2844 hbbbnn.exe 31 PID 2844 wrote to memory of 2900 2844 hbbbnn.exe 31 PID 2900 wrote to memory of 2736 2900 nhhnhh.exe 32 PID 2900 wrote to memory of 2736 2900 nhhnhh.exe 32 PID 2900 wrote to memory of 2736 2900 nhhnhh.exe 32 PID 2900 wrote to memory of 2736 2900 nhhnhh.exe 32 PID 2736 wrote to memory of 2604 2736 nbtntb.exe 33 PID 2736 wrote to memory of 2604 2736 nbtntb.exe 33 PID 2736 wrote to memory of 2604 2736 nbtntb.exe 33 PID 2736 wrote to memory of 2604 2736 nbtntb.exe 33 PID 2604 wrote to memory of 2144 2604 bbnbbh.exe 34 PID 2604 wrote to memory of 2144 2604 bbnbbh.exe 34 PID 2604 wrote to memory of 2144 2604 bbnbbh.exe 34 PID 2604 wrote to memory of 2144 2604 bbnbbh.exe 34 PID 2144 wrote to memory of 776 2144 nhbbnb.exe 35 PID 2144 wrote to memory of 776 2144 nhbbnb.exe 35 PID 2144 wrote to memory of 776 2144 nhbbnb.exe 35 PID 2144 wrote to memory of 776 2144 nhbbnb.exe 35 PID 776 wrote to memory of 1500 776 rxrrfrl.exe 36 PID 776 wrote to memory of 1500 776 rxrrfrl.exe 36 PID 776 wrote to memory of 1500 776 rxrrfrl.exe 36 PID 776 wrote to memory of 1500 776 rxrrfrl.exe 36 PID 1500 wrote to memory of 1628 1500 7lxfrxr.exe 37 PID 1500 wrote to memory of 1628 1500 7lxfrxr.exe 37 PID 1500 wrote to memory of 1628 1500 7lxfrxr.exe 37 PID 1500 wrote to memory of 1628 1500 7lxfrxr.exe 37 PID 1628 wrote to memory of 2540 1628 xlrxxll.exe 38 PID 1628 wrote to memory of 2540 1628 xlrxxll.exe 38 PID 1628 wrote to memory of 2540 1628 xlrxxll.exe 38 PID 1628 wrote to memory of 2540 1628 xlrxxll.exe 38 PID 2540 wrote to memory of 2560 2540 jvvpd.exe 39 PID 2540 wrote to memory of 2560 2540 jvvpd.exe 39 PID 2540 wrote to memory of 2560 2540 jvvpd.exe 39 PID 2540 wrote to memory of 2560 2540 jvvpd.exe 39 PID 2560 wrote to memory of 1248 2560 jjdjp.exe 40 PID 2560 wrote to memory of 1248 2560 jjdjp.exe 40 PID 2560 wrote to memory of 1248 2560 jjdjp.exe 40 PID 2560 wrote to memory of 1248 2560 jjdjp.exe 40 PID 1248 wrote to memory of 1084 1248 lrlllrr.exe 41 PID 1248 wrote to memory of 1084 1248 lrlllrr.exe 41 PID 1248 wrote to memory of 1084 1248 lrlllrr.exe 41 PID 1248 wrote to memory of 1084 1248 lrlllrr.exe 41 PID 1084 wrote to memory of 2872 1084 lxrxxrf.exe 42 PID 1084 wrote to memory of 2872 1084 lxrxxrf.exe 42 PID 1084 wrote to memory of 2872 1084 lxrxxrf.exe 42 PID 1084 wrote to memory of 2872 1084 lxrxxrf.exe 42 PID 2872 wrote to memory of 2160 2872 xllrxlx.exe 43 PID 2872 wrote to memory of 2160 2872 xllrxlx.exe 43 PID 2872 wrote to memory of 2160 2872 xllrxlx.exe 43 PID 2872 wrote to memory of 2160 2872 xllrxlx.exe 43 PID 2160 wrote to memory of 2224 2160 bbtbhn.exe 44 PID 2160 wrote to memory of 2224 2160 bbtbhn.exe 44 PID 2160 wrote to memory of 2224 2160 bbtbhn.exe 44 PID 2160 wrote to memory of 2224 2160 bbtbhn.exe 44 PID 2224 wrote to memory of 1284 2224 thbbhn.exe 45 PID 2224 wrote to memory of 1284 2224 thbbhn.exe 45 PID 2224 wrote to memory of 1284 2224 thbbhn.exe 45 PID 2224 wrote to memory of 1284 2224 thbbhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe"C:\Users\Admin\AppData\Local\Temp\fd9300813703fe36bfee43d2eeb6b0a955964ab367c18bef326759fa7bd23130.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\hbbbnn.exec:\hbbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nhhnhh.exec:\nhhnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nbtntb.exec:\nbtntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bbnbbh.exec:\bbnbbh.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nhbbnb.exec:\nhbbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\rxrrfrl.exec:\rxrrfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\7lxfrxr.exec:\7lxfrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\xlrxxll.exec:\xlrxxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jvvpd.exec:\jvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jjdjp.exec:\jjdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\lrlllrr.exec:\lrlllrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\lxrxxrf.exec:\lxrxxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\xllrxlx.exec:\xllrxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\bbtbhn.exec:\bbtbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\thbbhn.exec:\thbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\hhbnht.exec:\hhbnht.exe17⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3tnttt.exec:\3tnttt.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hthhnn.exec:\hthhnn.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ddppv.exec:\ddppv.exe20⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vjvvj.exec:\vjvvj.exe21⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vjppv.exec:\vjppv.exe22⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tnbbbt.exec:\tnbbbt.exe23⤵
- Executes dropped EXE
PID:1028 -
\??\c:\ppdvv.exec:\ppdvv.exe24⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bhnnnn.exec:\bhnnnn.exe25⤵
- Executes dropped EXE
PID:824 -
\??\c:\hhntbh.exec:\hhntbh.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ffrllll.exec:\ffrllll.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9fxffff.exec:\9fxffff.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rxxflxl.exec:\rxxflxl.exe29⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dpddj.exec:\dpddj.exe30⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lrfrlrl.exec:\lrfrlrl.exe31⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxrxffl.exec:\fxrxffl.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nthnbt.exec:\nthnbt.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\fxlrxff.exec:\fxlrxff.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xrlfffx.exec:\xrlfffx.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7xrrxxx.exec:\7xrrxxx.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bnhhnb.exec:\bnhhnb.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7htbnn.exec:\7htbnn.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fllxrlf.exec:\fllxrlf.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rllrrxx.exec:\rllrrxx.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vpvdj.exec:\vpvdj.exe41⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jdpjp.exec:\jdpjp.exe42⤵
- Executes dropped EXE
PID:344 -
\??\c:\1jjjj.exec:\1jjjj.exe43⤵
- Executes dropped EXE
PID:1492 -
\??\c:\7nnttt.exec:\7nnttt.exe44⤵
- Executes dropped EXE
PID:828 -
\??\c:\7xrrxxx.exec:\7xrrxxx.exe45⤵
- Executes dropped EXE
PID:2264 -
\??\c:\llrxflr.exec:\llrxflr.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3jvpp.exec:\3jvpp.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3vdpp.exec:\3vdpp.exe48⤵
- Executes dropped EXE
PID:1236 -
\??\c:\1bbttn.exec:\1bbttn.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tnbhnt.exec:\tnbhnt.exe50⤵
- Executes dropped EXE
PID:2568 -
\??\c:\llflxlx.exec:\llflxlx.exe51⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ppppp.exec:\ppppp.exe52⤵
- Executes dropped EXE
PID:528 -
\??\c:\7bhtbh.exec:\7bhtbh.exe53⤵
- Executes dropped EXE
PID:544 -
\??\c:\7ffxxrr.exec:\7ffxxrr.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xlffflf.exec:\xlffflf.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pdjpp.exec:\pdjpp.exe56⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nbntbh.exec:\nbntbh.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bhttbt.exec:\bhttbt.exe58⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xlllfff.exec:\xlllfff.exe59⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpjjp.exec:\vpjjp.exe60⤵
- Executes dropped EXE
PID:904 -
\??\c:\jvjjp.exec:\jvjjp.exe61⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1ttnbt.exec:\1ttnbt.exe62⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hntnnh.exec:\hntnnh.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616 -
\??\c:\lxrlrxx.exec:\lxrlrxx.exe64⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1pdpp.exec:\1pdpp.exe65⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nhbhnt.exec:\nhbhnt.exe66⤵PID:1664
-
\??\c:\lflrxrl.exec:\lflrxrl.exe67⤵PID:1556
-
\??\c:\lxffflr.exec:\lxffflr.exe68⤵PID:1668
-
\??\c:\7pjjv.exec:\7pjjv.exe69⤵PID:2516
-
\??\c:\btntth.exec:\btntth.exe70⤵PID:760
-
\??\c:\hntbnh.exec:\hntbnh.exe71⤵PID:604
-
\??\c:\frllxfl.exec:\frllxfl.exe72⤵PID:960
-
\??\c:\jvjpp.exec:\jvjpp.exe73⤵PID:1128
-
\??\c:\bnhhhb.exec:\bnhhhb.exe74⤵
- System Location Discovery: System Language Discovery
PID:2800 -
\??\c:\9nntbh.exec:\9nntbh.exe75⤵PID:2776
-
\??\c:\llxffff.exec:\llxffff.exe76⤵PID:1576
-
\??\c:\5ntttb.exec:\5ntttb.exe77⤵PID:956
-
\??\c:\rlxxfff.exec:\rlxxfff.exe78⤵PID:2732
-
\??\c:\djdjv.exec:\djdjv.exe79⤵PID:2696
-
\??\c:\5hbbbt.exec:\5hbbbt.exe80⤵PID:2884
-
\??\c:\3htthh.exec:\3htthh.exe81⤵PID:2636
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe82⤵
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\jdjjp.exec:\jdjjp.exe83⤵PID:3028
-
\??\c:\ddpdv.exec:\ddpdv.exe84⤵PID:564
-
\??\c:\1bnntt.exec:\1bnntt.exe85⤵PID:624
-
\??\c:\bthtnh.exec:\bthtnh.exe86⤵PID:1652
-
\??\c:\llfrxrl.exec:\llfrxrl.exe87⤵PID:1096
-
\??\c:\pjvdv.exec:\pjvdv.exe88⤵PID:1708
-
\??\c:\nhbbbb.exec:\nhbbbb.exe89⤵
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\btntbh.exec:\btntbh.exe90⤵PID:1496
-
\??\c:\rflfrfl.exec:\rflfrfl.exe91⤵PID:2020
-
\??\c:\ddjpd.exec:\ddjpd.exe92⤵PID:2028
-
\??\c:\5bhntt.exec:\5bhntt.exe93⤵PID:2632
-
\??\c:\7tnnbt.exec:\7tnnbt.exe94⤵PID:3044
-
\??\c:\frllxfr.exec:\frllxfr.exe95⤵PID:2888
-
\??\c:\9dpjp.exec:\9dpjp.exe96⤵PID:2196
-
\??\c:\hbhhhh.exec:\hbhhhh.exe97⤵PID:1040
-
\??\c:\nhbbtb.exec:\nhbbtb.exe98⤵PID:300
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe99⤵PID:1844
-
\??\c:\9jddp.exec:\9jddp.exe100⤵PID:1704
-
\??\c:\dvjpp.exec:\dvjpp.exe101⤵PID:1440
-
\??\c:\nbhbhb.exec:\nbhbhb.exe102⤵PID:1656
-
\??\c:\3frllll.exec:\3frllll.exe103⤵PID:2004
-
\??\c:\ppjpv.exec:\ppjpv.exe104⤵PID:1812
-
\??\c:\1hnbbb.exec:\1hnbbb.exe105⤵PID:1076
-
\??\c:\5tnntb.exec:\5tnntb.exe106⤵PID:1304
-
\??\c:\fxffrxf.exec:\fxffrxf.exe107⤵PID:752
-
\??\c:\jjdvj.exec:\jjdvj.exe108⤵PID:2080
-
\??\c:\bthhnt.exec:\bthhnt.exe109⤵PID:824
-
\??\c:\frxxllr.exec:\frxxllr.exe110⤵PID:2128
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe111⤵PID:316
-
\??\c:\jdppj.exec:\jdppj.exe112⤵
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\hbbtbb.exec:\hbbtbb.exe113⤵PID:2352
-
\??\c:\llrrxrx.exec:\llrrxrx.exe114⤵PID:1668
-
\??\c:\pjvdj.exec:\pjvdj.exe115⤵PID:1648
-
\??\c:\5dvvd.exec:\5dvvd.exe116⤵PID:2096
-
\??\c:\bthbnh.exec:\bthbnh.exe117⤵PID:604
-
\??\c:\nhbbbt.exec:\nhbbbt.exe118⤵PID:960
-
\??\c:\7rxxlfl.exec:\7rxxlfl.exe119⤵PID:1128
-
\??\c:\rllrffr.exec:\rllrffr.exe120⤵PID:1008
-
\??\c:\7djjj.exec:\7djjj.exe121⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-