Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:09
Behavioral task
behavioral1
Sample
ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe
-
Size
333KB
-
MD5
5560b06ed88e8eab8580e6f15f3bbfa4
-
SHA1
304b9969365e67677750eac0113e9daeea911e29
-
SHA256
ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7
-
SHA512
7157de49f9ade7353b3486c488f650a7ad64178817fdcfb0770ad6ced4a50cf8f01dae2241283b06242621f007cdbef2f9674907cd2ff417a3f3945e8fc36e6d
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeT:R4wFHoSHYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2968-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-56-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-123-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1784-129-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/108-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-332-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2832-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-356-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-362-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2548-363-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2996-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-510-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2780-592-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2656-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-774-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1684-778-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-873-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1092-902-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2976-926-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1624-959-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2396-958-0x00000000002F0000-0x0000000000317000-memory.dmp family_blackmoon behavioral1/memory/1492-1029-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-8752-0x0000000077960000-0x0000000077A7F000-memory.dmp family_blackmoon behavioral1/memory/2336-22554-0x0000000077960000-0x0000000077A7F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2968 jjjdv.exe 2156 xrlxxll.exe 2188 1tnnnt.exe 2624 hhbhnt.exe 2664 5pvjj.exe 2816 bbbtnt.exe 2660 nhttbh.exe 2652 fffrxfr.exe 2556 hhbtnt.exe 2532 pvdjp.exe 2604 tthnbh.exe 660 jdvpp.exe 588 lxrfrfr.exe 1240 nbnthh.exe 1784 jdjvj.exe 1932 xrlxlff.exe 108 hhbbhn.exe 2768 llfrflx.exe 2144 7ddjp.exe 2388 xffrlxr.exe 3000 1ddvd.exe 1128 1ddvp.exe 2736 9bntht.exe 1596 vpjpd.exe 992 7lxxxff.exe 1980 ntthhh.exe 1520 lrrlxfr.exe 1536 1frxllx.exe 2236 xrrfrxr.exe 2056 ttnhnn.exe 872 pppdv.exe 1728 llfxlxf.exe 876 thnntt.exe 2912 jjvvj.exe 3008 rlfxllx.exe 3020 flllrlf.exe 1444 ttnhth.exe 1224 dddvp.exe 2200 jjpdv.exe 2852 1fxxflf.exe 2132 hhhbtb.exe 2208 tbhtnb.exe 2908 pppvd.exe 2676 rrllxlf.exe 2832 llxlxfr.exe 2668 1bthtt.exe 2652 pjvdj.exe 2588 9jdpd.exe 2548 llllflf.exe 2532 bttttb.exe 2996 ppdjp.exe 2992 3jdpv.exe 1660 rxxlrxl.exe 1092 tbttnb.exe 2060 nhhntb.exe 2088 jpjpj.exe 1700 9fflfrx.exe 2876 7tbhth.exe 2764 bhthnn.exe 2572 dpdjj.exe 1776 7fxflrf.exe 2412 nhbhtt.exe 3004 tbtbtt.exe 2256 pdvjp.exe -
resource yara_rule behavioral1/memory/1768-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012261-5.dat upx behavioral1/memory/2968-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1768-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016dd1-17.dat upx behavioral1/files/0x0008000000016eca-25.dat upx behavioral1/memory/2188-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2156-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001706d-34.dat upx behavioral1/files/0x00070000000173f1-41.dat upx behavioral1/memory/2624-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173f4-49.dat upx behavioral1/files/0x00070000000173fc-58.dat upx behavioral1/memory/2816-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017472-65.dat upx behavioral1/memory/2660-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017487-75.dat upx behavioral1/memory/2652-73-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2556-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019244-84.dat upx behavioral1/files/0x0005000000019256-91.dat upx behavioral1/memory/2604-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/660-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-99.dat upx behavioral1/files/0x0005000000019263-108.dat upx behavioral1/memory/588-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019266-115.dat upx behavioral1/files/0x0005000000019284-124.dat upx behavioral1/memory/1240-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1784-129-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001928c-133.dat upx behavioral1/files/0x0005000000019353-141.dat upx behavioral1/files/0x0005000000019356-149.dat upx behavioral1/memory/108-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001936b-156.dat upx behavioral1/memory/2144-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001937b-164.dat upx behavioral1/files/0x0005000000019397-170.dat upx behavioral1/memory/2388-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a5-179.dat upx behavioral1/files/0x0005000000019423-187.dat upx behavioral1/memory/1596-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019426-194.dat upx behavioral1/files/0x0005000000019438-204.dat upx behavioral1/memory/992-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019442-211.dat upx behavioral1/files/0x000500000001944d-220.dat upx behavioral1/memory/1980-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1536-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019458-228.dat upx behavioral1/memory/1536-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001945c-237.dat upx behavioral1/memory/2236-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946b-245.dat upx behavioral1/memory/2056-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946e-253.dat upx behavioral1/files/0x00050000000194ae-260.dat upx behavioral1/memory/1728-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/876-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-318-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2968 1768 ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe 31 PID 1768 wrote to memory of 2968 1768 ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe 31 PID 1768 wrote to memory of 2968 1768 ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe 31 PID 1768 wrote to memory of 2968 1768 ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe 31 PID 2968 wrote to memory of 2156 2968 jjjdv.exe 32 PID 2968 wrote to memory of 2156 2968 jjjdv.exe 32 PID 2968 wrote to memory of 2156 2968 jjjdv.exe 32 PID 2968 wrote to memory of 2156 2968 jjjdv.exe 32 PID 2156 wrote to memory of 2188 2156 xrlxxll.exe 33 PID 2156 wrote to memory of 2188 2156 xrlxxll.exe 33 PID 2156 wrote to memory of 2188 2156 xrlxxll.exe 33 PID 2156 wrote to memory of 2188 2156 xrlxxll.exe 33 PID 2188 wrote to memory of 2624 2188 1tnnnt.exe 34 PID 2188 wrote to memory of 2624 2188 1tnnnt.exe 34 PID 2188 wrote to memory of 2624 2188 1tnnnt.exe 34 PID 2188 wrote to memory of 2624 2188 1tnnnt.exe 34 PID 2624 wrote to memory of 2664 2624 hhbhnt.exe 35 PID 2624 wrote to memory of 2664 2624 hhbhnt.exe 35 PID 2624 wrote to memory of 2664 2624 hhbhnt.exe 35 PID 2624 wrote to memory of 2664 2624 hhbhnt.exe 35 PID 2664 wrote to memory of 2816 2664 5pvjj.exe 36 PID 2664 wrote to memory of 2816 2664 5pvjj.exe 36 PID 2664 wrote to memory of 2816 2664 5pvjj.exe 36 PID 2664 wrote to memory of 2816 2664 5pvjj.exe 36 PID 2816 wrote to memory of 2660 2816 bbbtnt.exe 37 PID 2816 wrote to memory of 2660 2816 bbbtnt.exe 37 PID 2816 wrote to memory of 2660 2816 bbbtnt.exe 37 PID 2816 wrote to memory of 2660 2816 bbbtnt.exe 37 PID 2660 wrote to memory of 2652 2660 nhttbh.exe 38 PID 2660 wrote to memory of 2652 2660 nhttbh.exe 38 PID 2660 wrote to memory of 2652 2660 nhttbh.exe 38 PID 2660 wrote to memory of 2652 2660 nhttbh.exe 38 PID 2652 wrote to memory of 2556 2652 fffrxfr.exe 39 PID 2652 wrote to memory of 2556 2652 fffrxfr.exe 39 PID 2652 wrote to memory of 2556 2652 fffrxfr.exe 39 PID 2652 wrote to memory of 2556 2652 fffrxfr.exe 39 PID 2556 wrote to memory of 2532 2556 hhbtnt.exe 40 PID 2556 wrote to memory of 2532 2556 hhbtnt.exe 40 PID 2556 wrote to memory of 2532 2556 hhbtnt.exe 40 PID 2556 wrote to memory of 2532 2556 hhbtnt.exe 40 PID 2532 wrote to memory of 2604 2532 pvdjp.exe 41 PID 2532 wrote to memory of 2604 2532 pvdjp.exe 41 PID 2532 wrote to memory of 2604 2532 pvdjp.exe 41 PID 2532 wrote to memory of 2604 2532 pvdjp.exe 41 PID 2604 wrote to memory of 660 2604 tthnbh.exe 42 PID 2604 wrote to memory of 660 2604 tthnbh.exe 42 PID 2604 wrote to memory of 660 2604 tthnbh.exe 42 PID 2604 wrote to memory of 660 2604 tthnbh.exe 42 PID 660 wrote to memory of 588 660 jdvpp.exe 43 PID 660 wrote to memory of 588 660 jdvpp.exe 43 PID 660 wrote to memory of 588 660 jdvpp.exe 43 PID 660 wrote to memory of 588 660 jdvpp.exe 43 PID 588 wrote to memory of 1240 588 lxrfrfr.exe 44 PID 588 wrote to memory of 1240 588 lxrfrfr.exe 44 PID 588 wrote to memory of 1240 588 lxrfrfr.exe 44 PID 588 wrote to memory of 1240 588 lxrfrfr.exe 44 PID 1240 wrote to memory of 1784 1240 nbnthh.exe 45 PID 1240 wrote to memory of 1784 1240 nbnthh.exe 45 PID 1240 wrote to memory of 1784 1240 nbnthh.exe 45 PID 1240 wrote to memory of 1784 1240 nbnthh.exe 45 PID 1784 wrote to memory of 1932 1784 jdjvj.exe 46 PID 1784 wrote to memory of 1932 1784 jdjvj.exe 46 PID 1784 wrote to memory of 1932 1784 jdjvj.exe 46 PID 1784 wrote to memory of 1932 1784 jdjvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe"C:\Users\Admin\AppData\Local\Temp\ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\jjjdv.exec:\jjjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xrlxxll.exec:\xrlxxll.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\1tnnnt.exec:\1tnnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hhbhnt.exec:\hhbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\5pvjj.exec:\5pvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bbbtnt.exec:\bbbtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nhttbh.exec:\nhttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fffrxfr.exec:\fffrxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hhbtnt.exec:\hhbtnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pvdjp.exec:\pvdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tthnbh.exec:\tthnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jdvpp.exec:\jdvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\nbnthh.exec:\nbnthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\jdjvj.exec:\jdjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\xrlxlff.exec:\xrlxlff.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hhbbhn.exec:\hhbbhn.exe18⤵
- Executes dropped EXE
PID:108 -
\??\c:\llfrflx.exec:\llfrflx.exe19⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7ddjp.exec:\7ddjp.exe20⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xffrlxr.exec:\xffrlxr.exe21⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1ddvd.exec:\1ddvd.exe22⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1ddvp.exec:\1ddvp.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9bntht.exec:\9bntht.exe24⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vpjpd.exec:\vpjpd.exe25⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7lxxxff.exec:\7lxxxff.exe26⤵
- Executes dropped EXE
PID:992 -
\??\c:\ntthhh.exec:\ntthhh.exe27⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lrrlxfr.exec:\lrrlxfr.exe28⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1frxllx.exec:\1frxllx.exe29⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xrrfrxr.exec:\xrrfrxr.exe30⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ttnhnn.exec:\ttnhnn.exe31⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pppdv.exec:\pppdv.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\llfxlxf.exec:\llfxlxf.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\thnntt.exec:\thnntt.exe34⤵
- Executes dropped EXE
PID:876 -
\??\c:\jjvvj.exec:\jjvvj.exe35⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rlfxllx.exec:\rlfxllx.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\flllrlf.exec:\flllrlf.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ttnhth.exec:\ttnhth.exe38⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dddvp.exec:\dddvp.exe39⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jjpdv.exec:\jjpdv.exe40⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1fxxflf.exec:\1fxxflf.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hhhbtb.exec:\hhhbtb.exe42⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tbhtnb.exec:\tbhtnb.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pppvd.exec:\pppvd.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rrllxlf.exec:\rrllxlf.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\llxlxfr.exec:\llxlxfr.exe46⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1bthtt.exec:\1bthtt.exe47⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjvdj.exec:\pjvdj.exe48⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9jdpd.exec:\9jdpd.exe49⤵
- Executes dropped EXE
PID:2588 -
\??\c:\llllflf.exec:\llllflf.exe50⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bttttb.exec:\bttttb.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ppdjp.exec:\ppdjp.exe52⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3jdpv.exec:\3jdpv.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rxxlrxl.exec:\rxxlrxl.exe54⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tbttnb.exec:\tbttnb.exe55⤵
- Executes dropped EXE
PID:1092 -
\??\c:\nhhntb.exec:\nhhntb.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jpjpj.exec:\jpjpj.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9fflfrx.exec:\9fflfrx.exe58⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7tbhth.exec:\7tbhth.exe59⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bhthnn.exec:\bhthnn.exe60⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dpdjj.exec:\dpdjj.exe61⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7fxflrf.exec:\7fxflrf.exe62⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nhbhtt.exec:\nhbhtt.exe63⤵
- Executes dropped EXE
PID:2412 -
\??\c:\tbtbtt.exec:\tbtbtt.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdvjp.exec:\pdvjp.exe65⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rrrfxrx.exec:\rrrfxrx.exe66⤵PID:1624
-
\??\c:\nnnnht.exec:\nnnnht.exe67⤵PID:2224
-
\??\c:\hhthtb.exec:\hhthtb.exe68⤵PID:948
-
\??\c:\vpjpj.exec:\vpjpj.exe69⤵PID:1356
-
\??\c:\xlfrflf.exec:\xlfrflf.exe70⤵PID:1596
-
\??\c:\rlfrflx.exec:\rlfrflx.exe71⤵PID:836
-
\??\c:\1nhthb.exec:\1nhthb.exe72⤵PID:884
-
\??\c:\pjvpd.exec:\pjvpd.exe73⤵PID:2424
-
\??\c:\9vppj.exec:\9vppj.exe74⤵PID:1336
-
\??\c:\rfrrxrx.exec:\rfrrxrx.exe75⤵PID:2632
-
\??\c:\hbbhnb.exec:\hbbhnb.exe76⤵PID:1536
-
\??\c:\bbbthh.exec:\bbbthh.exe77⤵PID:2296
-
\??\c:\ddjjd.exec:\ddjjd.exe78⤵PID:2312
-
\??\c:\xxfxlxr.exec:\xxfxlxr.exe79⤵PID:536
-
\??\c:\tnbhtt.exec:\tnbhtt.exe80⤵PID:112
-
\??\c:\5bbnbh.exec:\5bbnbh.exe81⤵PID:2276
-
\??\c:\pvvpv.exec:\pvvpv.exe82⤵PID:1628
-
\??\c:\pppdp.exec:\pppdp.exe83⤵PID:1768
-
\??\c:\fxxflxx.exec:\fxxflxx.exe84⤵PID:2956
-
\??\c:\bbntnn.exec:\bbntnn.exe85⤵PID:1256
-
\??\c:\9jddd.exec:\9jddd.exe86⤵PID:2500
-
\??\c:\7rlxfrl.exec:\7rlxfrl.exe87⤵PID:3064
-
\??\c:\llllrrx.exec:\llllrrx.exe88⤵PID:1780
-
\??\c:\5btnbh.exec:\5btnbh.exe89⤵PID:2196
-
\??\c:\1dpjv.exec:\1dpjv.exe90⤵PID:2780
-
\??\c:\djvvp.exec:\djvvp.exe91⤵PID:2664
-
\??\c:\llflxfr.exec:\llflxfr.exe92⤵PID:2828
-
\??\c:\5nnnnt.exec:\5nnnnt.exe93⤵PID:2840
-
\??\c:\3nnntn.exec:\3nnntn.exe94⤵PID:2872
-
\??\c:\1djdj.exec:\1djdj.exe95⤵PID:2660
-
\??\c:\llfrxlr.exec:\llfrxlr.exe96⤵PID:2672
-
\??\c:\nnbnbb.exec:\nnbnbb.exe97⤵PID:2648
-
\??\c:\bhtnnb.exec:\bhtnnb.exe98⤵PID:2552
-
\??\c:\dpjjd.exec:\dpjjd.exe99⤵PID:2656
-
\??\c:\xrrxxxl.exec:\xrrxxxl.exe100⤵PID:2584
-
\??\c:\fxxflff.exec:\fxxflff.exe101⤵PID:320
-
\??\c:\nnbttn.exec:\nnbttn.exe102⤵PID:588
-
\??\c:\jjjpd.exec:\jjjpd.exe103⤵PID:2760
-
\??\c:\1xlffxr.exec:\1xlffxr.exe104⤵PID:1640
-
\??\c:\hbnbnt.exec:\hbnbnt.exe105⤵PID:540
-
\??\c:\5tbttt.exec:\5tbttt.exe106⤵PID:1932
-
\??\c:\jdvdp.exec:\jdvdp.exe107⤵PID:2732
-
\??\c:\lrxrrlr.exec:\lrxrrlr.exe108⤵PID:1104
-
\??\c:\hnhbtn.exec:\hnhbtn.exe109⤵PID:1884
-
\??\c:\ttnbnt.exec:\ttnbnt.exe110⤵PID:2112
-
\??\c:\pjjjp.exec:\pjjjp.exe111⤵PID:2032
-
\??\c:\fxffllf.exec:\fxffllf.exe112⤵PID:2400
-
\??\c:\bhnbbn.exec:\bhnbbn.exe113⤵PID:2292
-
\??\c:\jpddd.exec:\jpddd.exe114⤵PID:1128
-
\??\c:\vjdpv.exec:\vjdpv.exe115⤵PID:1396
-
\??\c:\5xrxlrl.exec:\5xrxlrl.exe116⤵PID:372
-
\??\c:\htntnh.exec:\htntnh.exe117⤵PID:1356
-
\??\c:\bbbnnb.exec:\bbbnnb.exe118⤵PID:1596
-
\??\c:\9pjpv.exec:\9pjpv.exe119⤵PID:2000
-
\??\c:\xxllxxl.exec:\xxllxxl.exe120⤵PID:884
-
\??\c:\tbhhhb.exec:\tbhhhb.exe121⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-