Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe
-
Size
456KB
-
MD5
d663d0b24e312b1cf43e709a9f158d10
-
SHA1
823c50891b770f3fa2f961d1e59c79cc0c8e7d69
-
SHA256
60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9
-
SHA512
28bb5f9acf10339785b6a07c032c9881d77b44e2c12b74f2d8268a05d9442d06ae26e2419e161f5731ce4aa26712eff66ed1a5974314eeebd12433b10fc671db
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/1860-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-48-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-52-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2760-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-111-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/920-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1496-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-158-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2440-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-463-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2924-473-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1628-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-652-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/816-659-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2644-667-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/932-674-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1812-687-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1668-819-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1032-831-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-1090-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1004-1110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-1123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-1131-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2340 btbbbb.exe 2104 3bthhh.exe 2408 5vpvd.exe 1948 vpjvj.exe 2760 1ttthn.exe 2800 xrxfrfr.exe 2764 btntbh.exe 2832 9jdjv.exe 2792 ppjvj.exe 2632 ddvdv.exe 2652 ddddp.exe 920 9hnnhn.exe 484 bttthn.exe 604 5vpdj.exe 1496 fxrxllx.exe 2136 jdpvj.exe 2440 jjvjv.exe 1644 nnhhtt.exe 2936 nhtbhh.exe 2640 xlflflr.exe 2144 tnbbnt.exe 1212 ddvvj.exe 1152 lxrfrrl.exe 2580 5hnntt.exe 996 3pvvd.exe 1600 3rffrxf.exe 2572 nnhnbh.exe 2364 frlxlrf.exe 3036 7ffxflf.exe 2404 djddj.exe 2288 7rlrrxl.exe 1860 vpdjv.exe 1612 9vpdd.exe 2388 7djjj.exe 1736 1dpvd.exe 1740 lfrfflr.exe 2408 tnbhtb.exe 2448 vjdjj.exe 2732 jdjdp.exe 2840 rxrfflx.exe 2704 3htbhn.exe 1632 pdvvd.exe 2832 jdvdp.exe 2868 lxxrxfl.exe 2792 bbtttt.exe 2180 vpjjv.exe 1572 rfrxxrf.exe 2848 9xrrxfl.exe 1120 bbbhtb.exe 1828 5pjpv.exe 2884 3jvvv.exe 1496 3rllxxl.exe 1984 xlflrxx.exe 1748 3bnnbb.exe 2440 vjpvd.exe 2916 fxflxxf.exe 2900 lxllrrf.exe 2924 1httbb.exe 2064 9pjjv.exe 3048 jvdvd.exe 1796 ffrrrfx.exe 2996 1btnhh.exe 1152 7tbbht.exe 2580 3djvd.exe -
resource yara_rule behavioral1/memory/1860-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-473-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2064-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-632-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2688-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2340 1860 60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe 30 PID 1860 wrote to memory of 2340 1860 60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe 30 PID 1860 wrote to memory of 2340 1860 60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe 30 PID 1860 wrote to memory of 2340 1860 60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe 30 PID 2340 wrote to memory of 2104 2340 btbbbb.exe 31 PID 2340 wrote to memory of 2104 2340 btbbbb.exe 31 PID 2340 wrote to memory of 2104 2340 btbbbb.exe 31 PID 2340 wrote to memory of 2104 2340 btbbbb.exe 31 PID 2104 wrote to memory of 2408 2104 3bthhh.exe 32 PID 2104 wrote to memory of 2408 2104 3bthhh.exe 32 PID 2104 wrote to memory of 2408 2104 3bthhh.exe 32 PID 2104 wrote to memory of 2408 2104 3bthhh.exe 32 PID 2408 wrote to memory of 1948 2408 5vpvd.exe 33 PID 2408 wrote to memory of 1948 2408 5vpvd.exe 33 PID 2408 wrote to memory of 1948 2408 5vpvd.exe 33 PID 2408 wrote to memory of 1948 2408 5vpvd.exe 33 PID 1948 wrote to memory of 2760 1948 vpjvj.exe 34 PID 1948 wrote to memory of 2760 1948 vpjvj.exe 34 PID 1948 wrote to memory of 2760 1948 vpjvj.exe 34 PID 1948 wrote to memory of 2760 1948 vpjvj.exe 34 PID 2760 wrote to memory of 2800 2760 1ttthn.exe 35 PID 2760 wrote to memory of 2800 2760 1ttthn.exe 35 PID 2760 wrote to memory of 2800 2760 1ttthn.exe 35 PID 2760 wrote to memory of 2800 2760 1ttthn.exe 35 PID 2800 wrote to memory of 2764 2800 xrxfrfr.exe 36 PID 2800 wrote to memory of 2764 2800 xrxfrfr.exe 36 PID 2800 wrote to memory of 2764 2800 xrxfrfr.exe 36 PID 2800 wrote to memory of 2764 2800 xrxfrfr.exe 36 PID 2764 wrote to memory of 2832 2764 btntbh.exe 37 PID 2764 wrote to memory of 2832 2764 btntbh.exe 37 PID 2764 wrote to memory of 2832 2764 btntbh.exe 37 PID 2764 wrote to memory of 2832 2764 btntbh.exe 37 PID 2832 wrote to memory of 2792 2832 9jdjv.exe 38 PID 2832 wrote to memory of 2792 2832 9jdjv.exe 38 PID 2832 wrote to memory of 2792 2832 9jdjv.exe 38 PID 2832 wrote to memory of 2792 2832 9jdjv.exe 38 PID 2792 wrote to memory of 2632 2792 ppjvj.exe 39 PID 2792 wrote to memory of 2632 2792 ppjvj.exe 39 PID 2792 wrote to memory of 2632 2792 ppjvj.exe 39 PID 2792 wrote to memory of 2632 2792 ppjvj.exe 39 PID 2632 wrote to memory of 2652 2632 ddvdv.exe 40 PID 2632 wrote to memory of 2652 2632 ddvdv.exe 40 PID 2632 wrote to memory of 2652 2632 ddvdv.exe 40 PID 2632 wrote to memory of 2652 2632 ddvdv.exe 40 PID 2652 wrote to memory of 920 2652 ddddp.exe 41 PID 2652 wrote to memory of 920 2652 ddddp.exe 41 PID 2652 wrote to memory of 920 2652 ddddp.exe 41 PID 2652 wrote to memory of 920 2652 ddddp.exe 41 PID 920 wrote to memory of 484 920 9hnnhn.exe 42 PID 920 wrote to memory of 484 920 9hnnhn.exe 42 PID 920 wrote to memory of 484 920 9hnnhn.exe 42 PID 920 wrote to memory of 484 920 9hnnhn.exe 42 PID 484 wrote to memory of 604 484 bttthn.exe 43 PID 484 wrote to memory of 604 484 bttthn.exe 43 PID 484 wrote to memory of 604 484 bttthn.exe 43 PID 484 wrote to memory of 604 484 bttthn.exe 43 PID 604 wrote to memory of 1496 604 5vpdj.exe 44 PID 604 wrote to memory of 1496 604 5vpdj.exe 44 PID 604 wrote to memory of 1496 604 5vpdj.exe 44 PID 604 wrote to memory of 1496 604 5vpdj.exe 44 PID 1496 wrote to memory of 2136 1496 fxrxllx.exe 45 PID 1496 wrote to memory of 2136 1496 fxrxllx.exe 45 PID 1496 wrote to memory of 2136 1496 fxrxllx.exe 45 PID 1496 wrote to memory of 2136 1496 fxrxllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe"C:\Users\Admin\AppData\Local\Temp\60d3f71b1465bd8b44fd1d942ae9d4654bd7a1abc9f2c0dd47b268ec0f95deb9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\btbbbb.exec:\btbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\3bthhh.exec:\3bthhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5vpvd.exec:\5vpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\vpjvj.exec:\vpjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\1ttthn.exec:\1ttthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xrxfrfr.exec:\xrxfrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\btntbh.exec:\btntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\9jdjv.exec:\9jdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ppjvj.exec:\ppjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ddvdv.exec:\ddvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ddddp.exec:\ddddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\9hnnhn.exec:\9hnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\bttthn.exec:\bttthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\5vpdj.exec:\5vpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\fxrxllx.exec:\fxrxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jjvjv.exec:\jjvjv.exe18⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nnhhtt.exec:\nnhhtt.exe19⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhtbhh.exec:\nhtbhh.exe20⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xlflflr.exec:\xlflflr.exe21⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tnbbnt.exec:\tnbbnt.exe22⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ddvvj.exec:\ddvvj.exe23⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lxrfrrl.exec:\lxrfrrl.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\5hnntt.exec:\5hnntt.exe25⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3pvvd.exec:\3pvvd.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\3rffrxf.exec:\3rffrxf.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nnhnbh.exec:\nnhnbh.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\frlxlrf.exec:\frlxlrf.exe29⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7ffxflf.exec:\7ffxflf.exe30⤵
- Executes dropped EXE
PID:3036 -
\??\c:\djddj.exec:\djddj.exe31⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7rlrrxl.exec:\7rlrrxl.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vpdjv.exec:\vpdjv.exe33⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9vpdd.exec:\9vpdd.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7djjj.exec:\7djjj.exe35⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1dpvd.exec:\1dpvd.exe36⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lfrfflr.exec:\lfrfflr.exe37⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tnbhtb.exec:\tnbhtb.exe38⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vjdjj.exec:\vjdjj.exe39⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jdjdp.exec:\jdjdp.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rxrfflx.exec:\rxrfflx.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3htbhn.exec:\3htbhn.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pdvvd.exec:\pdvvd.exe43⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdvdp.exec:\jdvdp.exe44⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lxxrxfl.exec:\lxxrxfl.exe45⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bbtttt.exec:\bbtttt.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpjjv.exec:\vpjjv.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rfrxxrf.exec:\rfrxxrf.exe48⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9xrrxfl.exec:\9xrrxfl.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbbhtb.exec:\bbbhtb.exe50⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5pjpv.exec:\5pjpv.exe51⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3jvvv.exec:\3jvvv.exe52⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3rllxxl.exec:\3rllxxl.exe53⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xlflrxx.exec:\xlflrxx.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3bnnbb.exec:\3bnnbb.exe55⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vjpvd.exec:\vjpvd.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fxflxxf.exec:\fxflxxf.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lxllrrf.exec:\lxllrrf.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1httbb.exec:\1httbb.exe59⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9pjjv.exec:\9pjjv.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jvdvd.exec:\jvdvd.exe61⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ffrrrfx.exec:\ffrrrfx.exe62⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1btnhh.exec:\1btnhh.exe63⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7tbbht.exec:\7tbbht.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\3djvd.exec:\3djvd.exe65⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fxlrflx.exec:\fxlrflx.exe66⤵PID:1672
-
\??\c:\9xfxlrx.exec:\9xfxlrx.exe67⤵PID:1628
-
\??\c:\9tnhtb.exec:\9tnhtb.exe68⤵PID:1908
-
\??\c:\pjjpv.exec:\pjjpv.exe69⤵PID:2312
-
\??\c:\jvjjd.exec:\jvjjd.exe70⤵PID:2068
-
\??\c:\xlfxllf.exec:\xlfxllf.exe71⤵PID:620
-
\??\c:\hhtthn.exec:\hhtthn.exe72⤵PID:1036
-
\??\c:\9btnhh.exec:\9btnhh.exe73⤵PID:2404
-
\??\c:\vdvdj.exec:\vdvdj.exe74⤵PID:2108
-
\??\c:\rlxxflr.exec:\rlxxflr.exe75⤵PID:1076
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe76⤵PID:1724
-
\??\c:\ttntbt.exec:\ttntbt.exe77⤵PID:2528
-
\??\c:\3pjdd.exec:\3pjdd.exe78⤵PID:2388
-
\??\c:\9dvvj.exec:\9dvvj.exe79⤵PID:1736
-
\??\c:\rlrxfrx.exec:\rlrxfrx.exe80⤵PID:2804
-
\??\c:\bbnhhb.exec:\bbnhhb.exe81⤵PID:2408
-
\??\c:\hnbnth.exec:\hnbnth.exe82⤵PID:2752
-
\??\c:\pdvpp.exec:\pdvpp.exe83⤵PID:2744
-
\??\c:\xrrlrlf.exec:\xrrlrlf.exe84⤵PID:2796
-
\??\c:\ffxfflx.exec:\ffxfflx.exe85⤵PID:2688
-
\??\c:\thhbbt.exec:\thhbbt.exe86⤵PID:2764
-
\??\c:\vjjpd.exec:\vjjpd.exe87⤵PID:2784
-
\??\c:\pdddj.exec:\pdddj.exe88⤵PID:816
-
\??\c:\1flflrx.exec:\1flflrx.exe89⤵PID:2644
-
\??\c:\hbthtt.exec:\hbthtt.exe90⤵PID:932
-
\??\c:\pjvvd.exec:\pjvvd.exe91⤵PID:1764
-
\??\c:\llxxflr.exec:\llxxflr.exe92⤵PID:1812
-
\??\c:\1xxxxff.exec:\1xxxxff.exe93⤵PID:1120
-
\??\c:\bnhtbn.exec:\bnhtbn.exe94⤵PID:1828
-
\??\c:\tthttb.exec:\tthttb.exe95⤵PID:536
-
\??\c:\1jdjj.exec:\1jdjj.exe96⤵PID:1496
-
\??\c:\xrffllx.exec:\xrffllx.exe97⤵PID:1560
-
\??\c:\btnthh.exec:\btnthh.exe98⤵PID:1744
-
\??\c:\9nbhtn.exec:\9nbhtn.exe99⤵PID:2928
-
\??\c:\1vjpd.exec:\1vjpd.exe100⤵PID:2908
-
\??\c:\lfrxxlr.exec:\lfrxxlr.exe101⤵PID:2412
-
\??\c:\hhhntt.exec:\hhhntt.exe102⤵PID:2372
-
\??\c:\1thntb.exec:\1thntb.exe103⤵PID:2300
-
\??\c:\ppjjv.exec:\ppjjv.exe104⤵PID:2144
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe105⤵PID:2696
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe106⤵PID:2992
-
\??\c:\nnbntb.exec:\nnbntb.exe107⤵PID:1820
-
\??\c:\pjdjv.exec:\pjdjv.exe108⤵PID:1920
-
\??\c:\lrlrllf.exec:\lrlrllf.exe109⤵PID:3052
-
\??\c:\7xrfllr.exec:\7xrfllr.exe110⤵PID:1776
-
\??\c:\tnnnbh.exec:\tnnnbh.exe111⤵PID:3020
-
\??\c:\jdvpd.exec:\jdvpd.exe112⤵PID:1908
-
\??\c:\7vjpv.exec:\7vjpv.exe113⤵PID:1668
-
\??\c:\7lffllr.exec:\7lffllr.exe114⤵PID:1928
-
\??\c:\tnttbb.exec:\tnttbb.exe115⤵PID:1032
-
\??\c:\5thtbb.exec:\5thtbb.exe116⤵PID:2092
-
\??\c:\jvppd.exec:\jvppd.exe117⤵PID:2400
-
\??\c:\rxrxlxf.exec:\rxrxlxf.exe118⤵PID:2544
-
\??\c:\llffffr.exec:\llffffr.exe119⤵PID:2536
-
\??\c:\nbtthh.exec:\nbtthh.exe120⤵PID:2576
-
\??\c:\vvpvj.exec:\vvpvj.exe121⤵PID:1960
-
\??\c:\dvjpp.exec:\dvjpp.exe122⤵PID:1224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-