Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe
-
Size
457KB
-
MD5
555e8cb22d88948be0c1e26c92f470e9
-
SHA1
4c04fd08e9c423defad367e5a5d9ab17140c1ef4
-
SHA256
adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde
-
SHA512
b1f840645311046e49dd4aa92a2bae2e279e02077eaf846578ede524d3f110e52d6ac1ffbd43abf43e7b43110bd1fa5cf6b58a52763b35e41cba3da8811eada4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA8:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2804-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-35-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2836-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-77-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2896-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-246-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-546-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2268-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-849-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2816 hbttht.exe 2852 nhbtht.exe 2892 1nhthb.exe 2836 7jdjp.exe 2588 ttnhnn.exe 3000 fxxlrxf.exe 1800 hbthhn.exe 2772 jjdpd.exe 2896 hbtbtb.exe 2388 9jjpj.exe 1176 tbnnbt.exe 1036 pvvvv.exe 352 bbhbbt.exe 676 pjvjv.exe 532 hhbhbh.exe 1876 pjdjv.exe 1668 5tnbhn.exe 764 5pvvd.exe 652 flxfrrf.exe 1860 7thbbh.exe 2532 jdpvj.exe 1720 ddppj.exe 1072 lrfxfxr.exe 1928 jdjjd.exe 1696 xrrflxl.exe 608 vjjjv.exe 1796 rfrrfxl.exe 1964 ppdjp.exe 1952 xrlrflx.exe 2420 3pjpv.exe 1516 5xfflrx.exe 2876 dvjdv.exe 2688 rxrfrfx.exe 2564 hbhhtt.exe 2592 vvpvp.exe 2644 5lfxxxl.exe 2836 hnbhnn.exe 2988 vvdvv.exe 3004 xlrlfxl.exe 1684 rrlxlxl.exe 1940 tttbtt.exe 2784 pdppv.exe 2736 fxrfxrx.exe 2384 hthbnn.exe 1332 5vpdd.exe 1700 jvjvd.exe 1372 rrfflxf.exe 1036 bnhnnh.exe 2616 jpjpj.exe 1032 3xrrlll.exe 2540 bbbnht.exe 2940 jvddj.exe 1256 9jvdj.exe 2312 xxfxxfl.exe 848 9ttthn.exe 440 1ntttn.exe 652 9pjvd.exe 1296 lxffffl.exe 2304 bbbhtt.exe 1748 jvjjv.exe 956 pjdpv.exe 1856 3rxrxxx.exe 1688 ttnthn.exe 2448 vppdp.exe -
resource yara_rule behavioral1/memory/2804-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-55-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1800-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-214-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1720-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-605-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2644-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-791-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2808-836-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2708-849-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2816 2804 adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe 31 PID 2804 wrote to memory of 2816 2804 adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe 31 PID 2804 wrote to memory of 2816 2804 adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe 31 PID 2804 wrote to memory of 2816 2804 adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe 31 PID 2816 wrote to memory of 2852 2816 hbttht.exe 32 PID 2816 wrote to memory of 2852 2816 hbttht.exe 32 PID 2816 wrote to memory of 2852 2816 hbttht.exe 32 PID 2816 wrote to memory of 2852 2816 hbttht.exe 32 PID 2852 wrote to memory of 2892 2852 nhbtht.exe 33 PID 2852 wrote to memory of 2892 2852 nhbtht.exe 33 PID 2852 wrote to memory of 2892 2852 nhbtht.exe 33 PID 2852 wrote to memory of 2892 2852 nhbtht.exe 33 PID 2892 wrote to memory of 2836 2892 1nhthb.exe 34 PID 2892 wrote to memory of 2836 2892 1nhthb.exe 34 PID 2892 wrote to memory of 2836 2892 1nhthb.exe 34 PID 2892 wrote to memory of 2836 2892 1nhthb.exe 34 PID 2836 wrote to memory of 2588 2836 7jdjp.exe 35 PID 2836 wrote to memory of 2588 2836 7jdjp.exe 35 PID 2836 wrote to memory of 2588 2836 7jdjp.exe 35 PID 2836 wrote to memory of 2588 2836 7jdjp.exe 35 PID 2588 wrote to memory of 3000 2588 ttnhnn.exe 36 PID 2588 wrote to memory of 3000 2588 ttnhnn.exe 36 PID 2588 wrote to memory of 3000 2588 ttnhnn.exe 36 PID 2588 wrote to memory of 3000 2588 ttnhnn.exe 36 PID 3000 wrote to memory of 1800 3000 fxxlrxf.exe 37 PID 3000 wrote to memory of 1800 3000 fxxlrxf.exe 37 PID 3000 wrote to memory of 1800 3000 fxxlrxf.exe 37 PID 3000 wrote to memory of 1800 3000 fxxlrxf.exe 37 PID 1800 wrote to memory of 2772 1800 hbthhn.exe 38 PID 1800 wrote to memory of 2772 1800 hbthhn.exe 38 PID 1800 wrote to memory of 2772 1800 hbthhn.exe 38 PID 1800 wrote to memory of 2772 1800 hbthhn.exe 38 PID 2772 wrote to memory of 2896 2772 jjdpd.exe 39 PID 2772 wrote to memory of 2896 2772 jjdpd.exe 39 PID 2772 wrote to memory of 2896 2772 jjdpd.exe 39 PID 2772 wrote to memory of 2896 2772 jjdpd.exe 39 PID 2896 wrote to memory of 2388 2896 hbtbtb.exe 40 PID 2896 wrote to memory of 2388 2896 hbtbtb.exe 40 PID 2896 wrote to memory of 2388 2896 hbtbtb.exe 40 PID 2896 wrote to memory of 2388 2896 hbtbtb.exe 40 PID 2388 wrote to memory of 1176 2388 9jjpj.exe 41 PID 2388 wrote to memory of 1176 2388 9jjpj.exe 41 PID 2388 wrote to memory of 1176 2388 9jjpj.exe 41 PID 2388 wrote to memory of 1176 2388 9jjpj.exe 41 PID 1176 wrote to memory of 1036 1176 tbnnbt.exe 42 PID 1176 wrote to memory of 1036 1176 tbnnbt.exe 42 PID 1176 wrote to memory of 1036 1176 tbnnbt.exe 42 PID 1176 wrote to memory of 1036 1176 tbnnbt.exe 42 PID 1036 wrote to memory of 352 1036 pvvvv.exe 43 PID 1036 wrote to memory of 352 1036 pvvvv.exe 43 PID 1036 wrote to memory of 352 1036 pvvvv.exe 43 PID 1036 wrote to memory of 352 1036 pvvvv.exe 43 PID 352 wrote to memory of 676 352 bbhbbt.exe 44 PID 352 wrote to memory of 676 352 bbhbbt.exe 44 PID 352 wrote to memory of 676 352 bbhbbt.exe 44 PID 352 wrote to memory of 676 352 bbhbbt.exe 44 PID 676 wrote to memory of 532 676 pjvjv.exe 45 PID 676 wrote to memory of 532 676 pjvjv.exe 45 PID 676 wrote to memory of 532 676 pjvjv.exe 45 PID 676 wrote to memory of 532 676 pjvjv.exe 45 PID 532 wrote to memory of 1876 532 hhbhbh.exe 46 PID 532 wrote to memory of 1876 532 hhbhbh.exe 46 PID 532 wrote to memory of 1876 532 hhbhbh.exe 46 PID 532 wrote to memory of 1876 532 hhbhbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe"C:\Users\Admin\AppData\Local\Temp\adf0bf3c7b01a36dbb022bcbd8563c185b9f326c7e5cf51a32ac104d62be2cde.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hbttht.exec:\hbttht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nhbtht.exec:\nhbtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\1nhthb.exec:\1nhthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7jdjp.exec:\7jdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ttnhnn.exec:\ttnhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\fxxlrxf.exec:\fxxlrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hbthhn.exec:\hbthhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\jjdpd.exec:\jjdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbtbtb.exec:\hbtbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\9jjpj.exec:\9jjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\tbnnbt.exec:\tbnnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\pvvvv.exec:\pvvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\bbhbbt.exec:\bbhbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\pjvjv.exec:\pjvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\hhbhbh.exec:\hhbhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\pjdjv.exec:\pjdjv.exe17⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5tnbhn.exec:\5tnbhn.exe18⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5pvvd.exec:\5pvvd.exe19⤵
- Executes dropped EXE
PID:764 -
\??\c:\flxfrrf.exec:\flxfrrf.exe20⤵
- Executes dropped EXE
PID:652 -
\??\c:\7thbbh.exec:\7thbbh.exe21⤵
- Executes dropped EXE
PID:1860 -
\??\c:\jdpvj.exec:\jdpvj.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ddppj.exec:\ddppj.exe23⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lrfxfxr.exec:\lrfxfxr.exe24⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jdjjd.exec:\jdjjd.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xrrflxl.exec:\xrrflxl.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vjjjv.exec:\vjjjv.exe27⤵
- Executes dropped EXE
PID:608 -
\??\c:\rfrrfxl.exec:\rfrrfxl.exe28⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ppdjp.exec:\ppdjp.exe29⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xrlrflx.exec:\xrlrflx.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3pjpv.exec:\3pjpv.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5xfflrx.exec:\5xfflrx.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvjdv.exec:\dvjdv.exe33⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rxrfrfx.exec:\rxrfrfx.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbhhtt.exec:\hbhhtt.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vvpvp.exec:\vvpvp.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5lfxxxl.exec:\5lfxxxl.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hnbhnn.exec:\hnbhnn.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vvdvv.exec:\vvdvv.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tttbtt.exec:\tttbtt.exe42⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pdppv.exec:\pdppv.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxrfxrx.exec:\fxrfxrx.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hthbnn.exec:\hthbnn.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5vpdd.exec:\5vpdd.exe46⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jvjvd.exec:\jvjvd.exe47⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrfflxf.exec:\rrfflxf.exe48⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bnhnnh.exec:\bnhnnh.exe49⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jpjpj.exec:\jpjpj.exe50⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3xrrlll.exec:\3xrrlll.exe51⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bbbnht.exec:\bbbnht.exe52⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jvddj.exec:\jvddj.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9jvdj.exec:\9jvdj.exe54⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xxfxxfl.exec:\xxfxxfl.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9ttthn.exec:\9ttthn.exe56⤵
- Executes dropped EXE
PID:848 -
\??\c:\1ntttn.exec:\1ntttn.exe57⤵
- Executes dropped EXE
PID:440 -
\??\c:\9pjvd.exec:\9pjvd.exe58⤵
- Executes dropped EXE
PID:652 -
\??\c:\lxffffl.exec:\lxffffl.exe59⤵
- Executes dropped EXE
PID:1296 -
\??\c:\bbbhtt.exec:\bbbhtt.exe60⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jvjjv.exec:\jvjjv.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pjdpv.exec:\pjdpv.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\3rxrxxx.exec:\3rxrxxx.exe63⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ttnthn.exec:\ttnthn.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vppdp.exec:\vppdp.exe65⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dddjd.exec:\dddjd.exe66⤵PID:812
-
\??\c:\lllfrff.exec:\lllfrff.exe67⤵PID:2056
-
\??\c:\hhhbhh.exec:\hhhbhh.exe68⤵PID:2368
-
\??\c:\vvvjd.exec:\vvvjd.exe69⤵PID:2316
-
\??\c:\pppvj.exec:\pppvj.exe70⤵PID:2432
-
\??\c:\5xlflfx.exec:\5xlflfx.exe71⤵PID:1952
-
\??\c:\bbttbh.exec:\bbttbh.exe72⤵PID:2812
-
\??\c:\5ppvd.exec:\5ppvd.exe73⤵PID:2792
-
\??\c:\ddvdv.exec:\ddvdv.exe74⤵PID:2268
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe75⤵PID:3068
-
\??\c:\thbbnn.exec:\thbbnn.exe76⤵PID:2688
-
\??\c:\vvpvj.exec:\vvpvj.exe77⤵PID:2564
-
\??\c:\vpddp.exec:\vpddp.exe78⤵PID:2872
-
\??\c:\rflfxxx.exec:\rflfxxx.exe79⤵PID:2644
-
\??\c:\7hnthn.exec:\7hnthn.exe80⤵PID:3044
-
\??\c:\5ppvd.exec:\5ppvd.exe81⤵PID:2988
-
\??\c:\xxrxfrf.exec:\xxrxfrf.exe82⤵PID:1236
-
\??\c:\hntbnn.exec:\hntbnn.exe83⤵PID:1144
-
\??\c:\bhnbtb.exec:\bhnbtb.exe84⤵PID:2856
-
\??\c:\vpjpp.exec:\vpjpp.exe85⤵PID:2784
-
\??\c:\7rxfxlr.exec:\7rxfxlr.exe86⤵PID:2896
-
\??\c:\hbnntb.exec:\hbnntb.exe87⤵PID:3012
-
\??\c:\jjjdv.exec:\jjjdv.exe88⤵PID:288
-
\??\c:\rfxrxxl.exec:\rfxrxxl.exe89⤵PID:1832
-
\??\c:\hhhnbb.exec:\hhhnbb.exe90⤵PID:1420
-
\??\c:\vvpvd.exec:\vvpvd.exe91⤵PID:2064
-
\??\c:\frfllrf.exec:\frfllrf.exe92⤵PID:1140
-
\??\c:\7xrxxfr.exec:\7xrxxfr.exe93⤵PID:2536
-
\??\c:\bbhbtn.exec:\bbhbtn.exe94⤵PID:1088
-
\??\c:\pjdpp.exec:\pjdpp.exe95⤵PID:2396
-
\??\c:\rlflllx.exec:\rlflllx.exe96⤵PID:2248
-
\??\c:\llxfrrx.exec:\llxfrrx.exe97⤵PID:2344
-
\??\c:\bbtnnb.exec:\bbtnnb.exe98⤵PID:2336
-
\??\c:\ppdvj.exec:\ppdvj.exe99⤵PID:2052
-
\??\c:\rrrfxlf.exec:\rrrfxlf.exe100⤵PID:980
-
\??\c:\flffxfx.exec:\flffxfx.exe101⤵PID:1404
-
\??\c:\hhhhtb.exec:\hhhhtb.exe102⤵PID:2304
-
\??\c:\pjvjv.exec:\pjvjv.exe103⤵PID:1916
-
\??\c:\xxrxxfx.exec:\xxrxxfx.exe104⤵PID:2184
-
\??\c:\hbtbtt.exec:\hbtbtt.exe105⤵PID:1380
-
\??\c:\3pjjv.exec:\3pjjv.exe106⤵PID:1716
-
\??\c:\vvpvv.exec:\vvpvv.exe107⤵PID:1752
-
\??\c:\frlfllx.exec:\frlfllx.exe108⤵PID:1696
-
\??\c:\hhhnht.exec:\hhhnht.exe109⤵PID:2968
-
\??\c:\hhbnbh.exec:\hhbnbh.exe110⤵PID:1040
-
\??\c:\1dppv.exec:\1dppv.exe111⤵PID:1960
-
\??\c:\lxllfxl.exec:\lxllfxl.exe112⤵PID:1000
-
\??\c:\nhhbnn.exec:\nhhbnn.exe113⤵PID:2808
-
\??\c:\pjddv.exec:\pjddv.exe114⤵PID:2804
-
\??\c:\1vjjp.exec:\1vjjp.exe115⤵PID:2708
-
\??\c:\5lfflrf.exec:\5lfflrf.exe116⤵PID:2876
-
\??\c:\1hnntb.exec:\1hnntb.exe117⤵PID:2584
-
\??\c:\pvppd.exec:\pvppd.exe118⤵PID:3020
-
\??\c:\ttntnt.exec:\ttntnt.exe119⤵PID:2720
-
\??\c:\3jddp.exec:\3jddp.exe120⤵PID:2892
-
\??\c:\xrlxlll.exec:\xrlxlll.exe121⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-