Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe
-
Size
454KB
-
MD5
192e94bf8caed39889841b95b7825e57
-
SHA1
2202e320316ff07d978cd91870fe53a2facd44ac
-
SHA256
ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b
-
SHA512
f91ce341c30bd5354dd7f8cd6efa520cea954ba9d0b7009c5dd2785c633d89858ee66b6f82a6b1a5462631b5f4784d49dd421c4cb52df0c74d0ef93f26bd2799
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/936-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-337-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2956-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-392-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1308-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-406-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1792-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-416-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-433-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1812-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-512-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1728-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-672-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1792-689-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/560-814-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 nnntbh.exe 2516 vjdvv.exe 2788 3httnb.exe 2220 7pddv.exe 2848 lflfffl.exe 2604 nbbbbt.exe 2964 dpdvd.exe 2644 3btnhh.exe 2616 pdpdd.exe 2640 tbnhnb.exe 1920 pdjjj.exe 1792 1btbbb.exe 1244 5nhttn.exe 936 lfxfrrx.exe 2432 thtttn.exe 396 5lfrxxf.exe 1324 1flrrfl.exe 1760 jdvdp.exe 2968 fxfxxrx.exe 1720 hnnnnn.exe 2772 pjvvd.exe 1080 bnttbt.exe 1504 jdpjj.exe 2368 bnttbt.exe 2388 tnhbhh.exe 3048 rlxlllr.exe 3056 tthhtn.exe 1928 pjvvd.exe 272 xrxxxrx.exe 848 5flrrrr.exe 1680 vjvpp.exe 2340 1nbhbh.exe 2152 7nbbtt.exe 2356 xrrrrrf.exe 1712 pjvvd.exe 2288 jdvdj.exe 2832 xllrxxl.exe 2800 bnbtbt.exe 2956 jvjjj.exe 2792 jvvpj.exe 2652 7rfxxxr.exe 2040 7ntbbh.exe 2716 djdjp.exe 2300 3fllffl.exe 1308 xrflrrf.exe 748 thnhhn.exe 1792 jvjjp.exe 1816 flffffl.exe 520 fffxxxl.exe 2336 tttbnt.exe 348 5vvvd.exe 1776 9vpjd.exe 1812 lllfllf.exe 2904 thtttt.exe 2884 pdppv.exe 2932 fxrfxxx.exe 1988 ffxfllx.exe 1856 nhbnbh.exe 2988 5jjpp.exe 684 lfllfrx.exe 1360 hbthnt.exe 1504 btntnb.exe 1728 dvpjp.exe 536 3rfxrlr.exe -
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-134-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/936-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-356-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2792-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-392-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1308-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-416-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1812-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-696-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/560-814-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1704 2524 ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe 30 PID 2524 wrote to memory of 1704 2524 ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe 30 PID 2524 wrote to memory of 1704 2524 ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe 30 PID 2524 wrote to memory of 1704 2524 ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe 30 PID 1704 wrote to memory of 2516 1704 nnntbh.exe 31 PID 1704 wrote to memory of 2516 1704 nnntbh.exe 31 PID 1704 wrote to memory of 2516 1704 nnntbh.exe 31 PID 1704 wrote to memory of 2516 1704 nnntbh.exe 31 PID 2516 wrote to memory of 2788 2516 vjdvv.exe 32 PID 2516 wrote to memory of 2788 2516 vjdvv.exe 32 PID 2516 wrote to memory of 2788 2516 vjdvv.exe 32 PID 2516 wrote to memory of 2788 2516 vjdvv.exe 32 PID 2788 wrote to memory of 2220 2788 3httnb.exe 33 PID 2788 wrote to memory of 2220 2788 3httnb.exe 33 PID 2788 wrote to memory of 2220 2788 3httnb.exe 33 PID 2788 wrote to memory of 2220 2788 3httnb.exe 33 PID 2220 wrote to memory of 2848 2220 7pddv.exe 34 PID 2220 wrote to memory of 2848 2220 7pddv.exe 34 PID 2220 wrote to memory of 2848 2220 7pddv.exe 34 PID 2220 wrote to memory of 2848 2220 7pddv.exe 34 PID 2848 wrote to memory of 2604 2848 lflfffl.exe 35 PID 2848 wrote to memory of 2604 2848 lflfffl.exe 35 PID 2848 wrote to memory of 2604 2848 lflfffl.exe 35 PID 2848 wrote to memory of 2604 2848 lflfffl.exe 35 PID 2604 wrote to memory of 2964 2604 nbbbbt.exe 36 PID 2604 wrote to memory of 2964 2604 nbbbbt.exe 36 PID 2604 wrote to memory of 2964 2604 nbbbbt.exe 36 PID 2604 wrote to memory of 2964 2604 nbbbbt.exe 36 PID 2964 wrote to memory of 2644 2964 dpdvd.exe 37 PID 2964 wrote to memory of 2644 2964 dpdvd.exe 37 PID 2964 wrote to memory of 2644 2964 dpdvd.exe 37 PID 2964 wrote to memory of 2644 2964 dpdvd.exe 37 PID 2644 wrote to memory of 2616 2644 3btnhh.exe 38 PID 2644 wrote to memory of 2616 2644 3btnhh.exe 38 PID 2644 wrote to memory of 2616 2644 3btnhh.exe 38 PID 2644 wrote to memory of 2616 2644 3btnhh.exe 38 PID 2616 wrote to memory of 2640 2616 pdpdd.exe 39 PID 2616 wrote to memory of 2640 2616 pdpdd.exe 39 PID 2616 wrote to memory of 2640 2616 pdpdd.exe 39 PID 2616 wrote to memory of 2640 2616 pdpdd.exe 39 PID 2640 wrote to memory of 1920 2640 tbnhnb.exe 40 PID 2640 wrote to memory of 1920 2640 tbnhnb.exe 40 PID 2640 wrote to memory of 1920 2640 tbnhnb.exe 40 PID 2640 wrote to memory of 1920 2640 tbnhnb.exe 40 PID 1920 wrote to memory of 1792 1920 pdjjj.exe 41 PID 1920 wrote to memory of 1792 1920 pdjjj.exe 41 PID 1920 wrote to memory of 1792 1920 pdjjj.exe 41 PID 1920 wrote to memory of 1792 1920 pdjjj.exe 41 PID 1792 wrote to memory of 1244 1792 1btbbb.exe 42 PID 1792 wrote to memory of 1244 1792 1btbbb.exe 42 PID 1792 wrote to memory of 1244 1792 1btbbb.exe 42 PID 1792 wrote to memory of 1244 1792 1btbbb.exe 42 PID 1244 wrote to memory of 936 1244 5nhttn.exe 43 PID 1244 wrote to memory of 936 1244 5nhttn.exe 43 PID 1244 wrote to memory of 936 1244 5nhttn.exe 43 PID 1244 wrote to memory of 936 1244 5nhttn.exe 43 PID 936 wrote to memory of 2432 936 lfxfrrx.exe 44 PID 936 wrote to memory of 2432 936 lfxfrrx.exe 44 PID 936 wrote to memory of 2432 936 lfxfrrx.exe 44 PID 936 wrote to memory of 2432 936 lfxfrrx.exe 44 PID 2432 wrote to memory of 396 2432 thtttn.exe 45 PID 2432 wrote to memory of 396 2432 thtttn.exe 45 PID 2432 wrote to memory of 396 2432 thtttn.exe 45 PID 2432 wrote to memory of 396 2432 thtttn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe"C:\Users\Admin\AppData\Local\Temp\ad84bc453d209c7ed23cc14769b88b3190602f9ff6b87951ee6fee181de4bd7b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\nnntbh.exec:\nnntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vjdvv.exec:\vjdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\3httnb.exec:\3httnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\7pddv.exec:\7pddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\lflfffl.exec:\lflfffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nbbbbt.exec:\nbbbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dpdvd.exec:\dpdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\3btnhh.exec:\3btnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pdpdd.exec:\pdpdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tbnhnb.exec:\tbnhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pdjjj.exec:\pdjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\1btbbb.exec:\1btbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\5nhttn.exec:\5nhttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\thtttn.exec:\thtttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\5lfrxxf.exec:\5lfrxxf.exe17⤵
- Executes dropped EXE
PID:396 -
\??\c:\1flrrfl.exec:\1flrrfl.exe18⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jdvdp.exec:\jdvdp.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\hnnnnn.exec:\hnnnnn.exe21⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pjvvd.exec:\pjvvd.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772 -
\??\c:\bnttbt.exec:\bnttbt.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jdpjj.exec:\jdpjj.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bnttbt.exec:\bnttbt.exe25⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tnhbhh.exec:\tnhbhh.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rlxlllr.exec:\rlxlllr.exe27⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tthhtn.exec:\tthhtn.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjvvd.exec:\pjvvd.exe29⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xrxxxrx.exec:\xrxxxrx.exe30⤵
- Executes dropped EXE
PID:272 -
\??\c:\5flrrrr.exec:\5flrrrr.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\vjvpp.exec:\vjvpp.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1nbhbh.exec:\1nbhbh.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7nbbtt.exec:\7nbbtt.exe34⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe35⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pjvvd.exec:\pjvvd.exe36⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jdvdj.exec:\jdvdj.exe37⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xllrxxl.exec:\xllrxxl.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bnbtbt.exec:\bnbtbt.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jvjjj.exec:\jvjjj.exe40⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jvvpj.exec:\jvvpj.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7rfxxxr.exec:\7rfxxxr.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\7ntbbh.exec:\7ntbbh.exe43⤵
- Executes dropped EXE
PID:2040 -
\??\c:\djdjp.exec:\djdjp.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3fllffl.exec:\3fllffl.exe45⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xrflrrf.exec:\xrflrrf.exe46⤵
- Executes dropped EXE
PID:1308 -
\??\c:\thnhhn.exec:\thnhhn.exe47⤵
- Executes dropped EXE
PID:748 -
\??\c:\jvjjp.exec:\jvjjp.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\flffffl.exec:\flffffl.exe49⤵
- Executes dropped EXE
PID:1816 -
\??\c:\fffxxxl.exec:\fffxxxl.exe50⤵
- Executes dropped EXE
PID:520 -
\??\c:\tttbnt.exec:\tttbnt.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5vvvd.exec:\5vvvd.exe52⤵
- Executes dropped EXE
PID:348 -
\??\c:\9vpjd.exec:\9vpjd.exe53⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lllfllf.exec:\lllfllf.exe54⤵
- Executes dropped EXE
PID:1812 -
\??\c:\thtttt.exec:\thtttt.exe55⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pdppv.exec:\pdppv.exe56⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fxrfxxx.exec:\fxrfxxx.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ffxfllx.exec:\ffxfllx.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhbnbh.exec:\nhbnbh.exe59⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5jjpp.exec:\5jjpp.exe60⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lfllfrx.exec:\lfllfrx.exe61⤵
- Executes dropped EXE
PID:684 -
\??\c:\hbthnt.exec:\hbthnt.exe62⤵
- Executes dropped EXE
PID:1360 -
\??\c:\btntnb.exec:\btntnb.exe63⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dvpjp.exec:\dvpjp.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3rfxrlr.exec:\3rfxrlr.exe65⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhbhnt.exec:\nhbhnt.exe66⤵PID:2808
-
\??\c:\5hbhtb.exec:\5hbhtb.exe67⤵PID:1436
-
\??\c:\jvjvv.exec:\jvjvv.exe68⤵PID:2448
-
\??\c:\3lrrrrr.exec:\3lrrrrr.exe69⤵PID:2324
-
\??\c:\1fllllr.exec:\1fllllr.exe70⤵PID:352
-
\??\c:\ttnbhn.exec:\ttnbhn.exe71⤵PID:1944
-
\??\c:\5vjdv.exec:\5vjdv.exe72⤵PID:1700
-
\??\c:\rllrlrx.exec:\rllrlrx.exe73⤵PID:1692
-
\??\c:\tttbhh.exec:\tttbhh.exe74⤵PID:2536
-
\??\c:\nbhhnn.exec:\nbhhnn.exe75⤵PID:2332
-
\??\c:\dvdjj.exec:\dvdjj.exe76⤵PID:2348
-
\??\c:\1jpjp.exec:\1jpjp.exe77⤵PID:2356
-
\??\c:\1flllfl.exec:\1flllfl.exe78⤵PID:2852
-
\??\c:\bbtbhh.exec:\bbtbhh.exe79⤵PID:2288
-
\??\c:\nnhhnn.exec:\nnhhnn.exe80⤵
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\7ppvv.exec:\7ppvv.exe81⤵PID:2720
-
\??\c:\xxrllfl.exec:\xxrllfl.exe82⤵PID:2636
-
\??\c:\btnttt.exec:\btnttt.exe83⤵PID:2860
-
\??\c:\bnbbhb.exec:\bnbbhb.exe84⤵PID:2644
-
\??\c:\pjvdp.exec:\pjvdp.exe85⤵PID:2652
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe86⤵PID:2036
-
\??\c:\fxllrxf.exec:\fxllrxf.exe87⤵PID:2640
-
\??\c:\bthhnh.exec:\bthhnh.exe88⤵PID:1096
-
\??\c:\1jvdv.exec:\1jvdv.exe89⤵PID:1032
-
\??\c:\5pjpd.exec:\5pjpd.exe90⤵PID:660
-
\??\c:\rlfflfl.exec:\rlfflfl.exe91⤵PID:1792
-
\??\c:\nbnhhb.exec:\nbnhhb.exe92⤵PID:756
-
\??\c:\nhthnh.exec:\nhthnh.exe93⤵PID:1644
-
\??\c:\dpddd.exec:\dpddd.exe94⤵PID:2100
-
\??\c:\fxrflrl.exec:\fxrflrl.exe95⤵PID:1300
-
\??\c:\hbnttn.exec:\hbnttn.exe96⤵PID:396
-
\??\c:\hbthbb.exec:\hbthbb.exe97⤵PID:2892
-
\??\c:\jdpdp.exec:\jdpdp.exe98⤵PID:1324
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe99⤵PID:2168
-
\??\c:\3rfxfxf.exec:\3rfxfxf.exe100⤵PID:1720
-
\??\c:\7nhbtt.exec:\7nhbtt.exe101⤵PID:2976
-
\??\c:\5jjjd.exec:\5jjjd.exe102⤵PID:732
-
\??\c:\frlrrrf.exec:\frlrrrf.exe103⤵PID:2920
-
\??\c:\lrlxrrl.exec:\lrlxrrl.exe104⤵PID:1080
-
\??\c:\bbtbbb.exec:\bbtbbb.exe105⤵PID:1268
-
\??\c:\nbhhbb.exec:\nbhhbb.exe106⤵PID:1596
-
\??\c:\vdvdp.exec:\vdvdp.exe107⤵PID:1060
-
\??\c:\5flllrx.exec:\5flllrx.exe108⤵PID:2240
-
\??\c:\9hbttt.exec:\9hbttt.exe109⤵PID:3048
-
\??\c:\3bnhbt.exec:\3bnhbt.exe110⤵PID:560
-
\??\c:\dpdpp.exec:\dpdpp.exe111⤵PID:2312
-
\??\c:\3vppp.exec:\3vppp.exe112⤵PID:2160
-
\??\c:\xrffffl.exec:\xrffffl.exe113⤵PID:1632
-
\??\c:\1thhhh.exec:\1thhhh.exe114⤵PID:1848
-
\??\c:\hbthnn.exec:\hbthnn.exe115⤵PID:1572
-
\??\c:\ddjpv.exec:\ddjpv.exe116⤵PID:1692
-
\??\c:\vpvvv.exec:\vpvvv.exe117⤵PID:2688
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe118⤵PID:2004
-
\??\c:\tnttbb.exec:\tnttbb.exe119⤵PID:2724
-
\??\c:\7htnhn.exec:\7htnhn.exe120⤵PID:2828
-
\??\c:\vvppd.exec:\vvppd.exe121⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-