Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe
-
Size
454KB
-
MD5
5bd3c5a83b4a45614e163ce8d8c4648e
-
SHA1
810a05636b2e38176953f9714a6ae652ae93654c
-
SHA256
ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852
-
SHA512
df12dadf9b63696841f17015d2ded03a68e2819edf165428d73690d4f0b26fb1dbba085c03cfaf241b76c9c003da024e2a466b14a407562265439edd5566d879
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/768-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-52-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-134-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2924-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-201-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1348-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-297-0x00000000771F0000-0x000000007730F000-memory.dmp family_blackmoon behavioral1/memory/2260-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-430-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/708-516-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1328-523-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2396-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-683-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1684-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-1066-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1784-1079-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1848-1080-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-1280-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1056 dpvvd.exe 2260 9bhhtn.exe 2116 7rllrrf.exe 2484 7htbhn.exe 2808 3tnbtb.exe 2768 5xllxrx.exe 1916 ttnhbb.exe 2980 1vjjd.exe 2660 5rxxrrr.exe 2676 nbthhh.exe 2360 ddvjv.exe 1096 fflrxfr.exe 2924 tthnbb.exe 976 llfflrf.exe 2916 thtttt.exe 2368 lflxflf.exe 1644 tnhhnt.exe 1192 pvdvv.exe 2996 rlxxlfr.exe 1964 lrrxlrf.exe 1632 jvjpv.exe 1348 hnhnnn.exe 2124 9jvpj.exe 1768 ntnntb.exe 1680 7btttb.exe 2348 rlxrrrf.exe 2856 tntbhh.exe 2500 jdddd.exe 2408 rlflfxr.exe 2464 vjpjp.exe 884 7vjjj.exe 2300 bhhnbb.exe 2236 9fxrxxf.exe 3068 ttnbhn.exe 2260 5pjvv.exe 1736 rlxfflr.exe 2704 5thnnt.exe 2888 nnbhbh.exe 2736 jdvvj.exe 3016 lfffflx.exe 3012 xlrrrll.exe 2900 hthntb.exe 2724 vvjpp.exe 2780 fxrllfl.exe 2252 xfrrlfr.exe 2248 nthntt.exe 2492 ddjpd.exe 352 dvpvj.exe 2792 9lrrrxf.exe 1472 tnhhnt.exe 696 jdvpj.exe 776 vpddj.exe 532 fxrxrrf.exe 1900 nbntbb.exe 2852 dpdjj.exe 1248 5ppvd.exe 2992 rfxxffr.exe 2996 hbnttb.exe 2132 nthnhh.exe 784 vvjdj.exe 708 1xxxxxf.exe 2552 5lflrrf.exe 2052 hbnnnn.exe 764 3pdjp.exe -
resource yara_rule behavioral1/memory/768-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-297-0x00000000771F0000-0x000000007730F000-memory.dmp upx behavioral1/memory/2260-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-1079-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1848-1080-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-1106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-1223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-1267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-1294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-1344-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 1056 768 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 768 wrote to memory of 1056 768 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 768 wrote to memory of 1056 768 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 768 wrote to memory of 1056 768 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 1056 wrote to memory of 2260 1056 dpvvd.exe 31 PID 1056 wrote to memory of 2260 1056 dpvvd.exe 31 PID 1056 wrote to memory of 2260 1056 dpvvd.exe 31 PID 1056 wrote to memory of 2260 1056 dpvvd.exe 31 PID 2260 wrote to memory of 2116 2260 9bhhtn.exe 32 PID 2260 wrote to memory of 2116 2260 9bhhtn.exe 32 PID 2260 wrote to memory of 2116 2260 9bhhtn.exe 32 PID 2260 wrote to memory of 2116 2260 9bhhtn.exe 32 PID 2116 wrote to memory of 2484 2116 7rllrrf.exe 33 PID 2116 wrote to memory of 2484 2116 7rllrrf.exe 33 PID 2116 wrote to memory of 2484 2116 7rllrrf.exe 33 PID 2116 wrote to memory of 2484 2116 7rllrrf.exe 33 PID 2484 wrote to memory of 2808 2484 7htbhn.exe 34 PID 2484 wrote to memory of 2808 2484 7htbhn.exe 34 PID 2484 wrote to memory of 2808 2484 7htbhn.exe 34 PID 2484 wrote to memory of 2808 2484 7htbhn.exe 34 PID 2808 wrote to memory of 2768 2808 3tnbtb.exe 35 PID 2808 wrote to memory of 2768 2808 3tnbtb.exe 35 PID 2808 wrote to memory of 2768 2808 3tnbtb.exe 35 PID 2808 wrote to memory of 2768 2808 3tnbtb.exe 35 PID 2768 wrote to memory of 1916 2768 5xllxrx.exe 36 PID 2768 wrote to memory of 1916 2768 5xllxrx.exe 36 PID 2768 wrote to memory of 1916 2768 5xllxrx.exe 36 PID 2768 wrote to memory of 1916 2768 5xllxrx.exe 36 PID 1916 wrote to memory of 2980 1916 ttnhbb.exe 37 PID 1916 wrote to memory of 2980 1916 ttnhbb.exe 37 PID 1916 wrote to memory of 2980 1916 ttnhbb.exe 37 PID 1916 wrote to memory of 2980 1916 ttnhbb.exe 37 PID 2980 wrote to memory of 2660 2980 1vjjd.exe 38 PID 2980 wrote to memory of 2660 2980 1vjjd.exe 38 PID 2980 wrote to memory of 2660 2980 1vjjd.exe 38 PID 2980 wrote to memory of 2660 2980 1vjjd.exe 38 PID 2660 wrote to memory of 2676 2660 5rxxrrr.exe 39 PID 2660 wrote to memory of 2676 2660 5rxxrrr.exe 39 PID 2660 wrote to memory of 2676 2660 5rxxrrr.exe 39 PID 2660 wrote to memory of 2676 2660 5rxxrrr.exe 39 PID 2676 wrote to memory of 2360 2676 nbthhh.exe 40 PID 2676 wrote to memory of 2360 2676 nbthhh.exe 40 PID 2676 wrote to memory of 2360 2676 nbthhh.exe 40 PID 2676 wrote to memory of 2360 2676 nbthhh.exe 40 PID 2360 wrote to memory of 1096 2360 ddvjv.exe 41 PID 2360 wrote to memory of 1096 2360 ddvjv.exe 41 PID 2360 wrote to memory of 1096 2360 ddvjv.exe 41 PID 2360 wrote to memory of 1096 2360 ddvjv.exe 41 PID 1096 wrote to memory of 2924 1096 fflrxfr.exe 42 PID 1096 wrote to memory of 2924 1096 fflrxfr.exe 42 PID 1096 wrote to memory of 2924 1096 fflrxfr.exe 42 PID 1096 wrote to memory of 2924 1096 fflrxfr.exe 42 PID 2924 wrote to memory of 976 2924 tthnbb.exe 43 PID 2924 wrote to memory of 976 2924 tthnbb.exe 43 PID 2924 wrote to memory of 976 2924 tthnbb.exe 43 PID 2924 wrote to memory of 976 2924 tthnbb.exe 43 PID 976 wrote to memory of 2916 976 llfflrf.exe 44 PID 976 wrote to memory of 2916 976 llfflrf.exe 44 PID 976 wrote to memory of 2916 976 llfflrf.exe 44 PID 976 wrote to memory of 2916 976 llfflrf.exe 44 PID 2916 wrote to memory of 2368 2916 thtttt.exe 45 PID 2916 wrote to memory of 2368 2916 thtttt.exe 45 PID 2916 wrote to memory of 2368 2916 thtttt.exe 45 PID 2916 wrote to memory of 2368 2916 thtttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe"C:\Users\Admin\AppData\Local\Temp\ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\dpvvd.exec:\dpvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\9bhhtn.exec:\9bhhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\7rllrrf.exec:\7rllrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7htbhn.exec:\7htbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\3tnbtb.exec:\3tnbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5xllxrx.exec:\5xllxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ttnhbb.exec:\ttnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\1vjjd.exec:\1vjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5rxxrrr.exec:\5rxxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nbthhh.exec:\nbthhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ddvjv.exec:\ddvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\fflrxfr.exec:\fflrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\tthnbb.exec:\tthnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llfflrf.exec:\llfflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\thtttt.exec:\thtttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lflxflf.exec:\lflxflf.exe17⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tnhhnt.exec:\tnhhnt.exe18⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pvdvv.exec:\pvdvv.exe19⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rlxxlfr.exec:\rlxxlfr.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lrrxlrf.exec:\lrrxlrf.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jvjpv.exec:\jvjpv.exe22⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hnhnnn.exec:\hnhnnn.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1348 -
\??\c:\9jvpj.exec:\9jvpj.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ntnntb.exec:\ntnntb.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7btttb.exec:\7btttb.exe26⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe27⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tntbhh.exec:\tntbhh.exe28⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jdddd.exec:\jdddd.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rlflfxr.exec:\rlflfxr.exe30⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vjpjp.exec:\vjpjp.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7vjjj.exec:\7vjjj.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\bhhnbb.exec:\bhhnbb.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ppjjv.exec:\ppjjv.exe34⤵PID:3064
-
\??\c:\9fxrxxf.exec:\9fxrxxf.exe35⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ttnbhn.exec:\ttnbhn.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5pjvv.exec:\5pjvv.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlxfflr.exec:\rlxfflr.exe38⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5thnnt.exec:\5thnnt.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nnbhbh.exec:\nnbhbh.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdvvj.exec:\jdvvj.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lfffflx.exec:\lfffflx.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xlrrrll.exec:\xlrrrll.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hthntb.exec:\hthntb.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvjpp.exec:\vvjpp.exe45⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxrllfl.exec:\fxrllfl.exe46⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xfrrlfr.exec:\xfrrlfr.exe47⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nthntt.exec:\nthntt.exe48⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ddjpd.exec:\ddjpd.exe49⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dvpvj.exec:\dvpvj.exe50⤵
- Executes dropped EXE
PID:352 -
\??\c:\9lrrrxf.exec:\9lrrrxf.exe51⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tnhhnt.exec:\tnhhnt.exe52⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jdvpj.exec:\jdvpj.exe53⤵
- Executes dropped EXE
PID:696 -
\??\c:\vpddj.exec:\vpddj.exe54⤵
- Executes dropped EXE
PID:776 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe55⤵
- Executes dropped EXE
PID:532 -
\??\c:\nbntbb.exec:\nbntbb.exe56⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dpdjj.exec:\dpdjj.exe57⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5ppvd.exec:\5ppvd.exe58⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rfxxffr.exec:\rfxxffr.exe59⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hbnttb.exec:\hbnttb.exe60⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nthnhh.exec:\nthnhh.exe61⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvjdj.exec:\vvjdj.exe62⤵
- Executes dropped EXE
PID:784 -
\??\c:\1xxxxxf.exec:\1xxxxxf.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\5lflrrf.exec:\5lflrrf.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hbnnnn.exec:\hbnnnn.exe65⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3pdjp.exec:\3pdjp.exe66⤵
- Executes dropped EXE
PID:764 -
\??\c:\lxlflfl.exec:\lxlflfl.exe67⤵PID:1328
-
\??\c:\1nnhnh.exec:\1nnhnh.exe68⤵PID:840
-
\??\c:\hhbbtt.exec:\hhbbtt.exe69⤵PID:2156
-
\??\c:\5vpvv.exec:\5vpvv.exe70⤵PID:1540
-
\??\c:\lrxrrrx.exec:\lrxrrrx.exe71⤵PID:2600
-
\??\c:\tnbbhh.exec:\tnbbhh.exe72⤵PID:704
-
\??\c:\bbnbhn.exec:\bbnbhn.exe73⤵PID:2396
-
\??\c:\jvdjv.exec:\jvdjv.exe74⤵PID:2464
-
\??\c:\9fxxllf.exec:\9fxxllf.exe75⤵PID:2188
-
\??\c:\3lffffl.exec:\3lffffl.exe76⤵PID:1512
-
\??\c:\5hbhnt.exec:\5hbhnt.exe77⤵PID:1056
-
\??\c:\hbnhnt.exec:\hbnhnt.exe78⤵PID:1324
-
\??\c:\jvvvd.exec:\jvvvd.exe79⤵PID:2392
-
\??\c:\1xllrxx.exec:\1xllrxx.exe80⤵PID:2480
-
\??\c:\rfllllr.exec:\rfllllr.exe81⤵PID:2116
-
\??\c:\1thbbb.exec:\1thbbb.exe82⤵PID:2820
-
\??\c:\3jvpv.exec:\3jvpv.exe83⤵PID:3028
-
\??\c:\5fxfrrx.exec:\5fxfrrx.exe84⤵PID:2928
-
\??\c:\rlfflrx.exec:\rlfflrx.exe85⤵PID:2728
-
\??\c:\1bbbnh.exec:\1bbbnh.exe86⤵PID:2640
-
\??\c:\vjvvj.exec:\vjvvj.exe87⤵
- System Location Discovery: System Language Discovery
PID:1792 -
\??\c:\pdpvd.exec:\pdpvd.exe88⤵PID:2880
-
\??\c:\7lxxllr.exec:\7lxxllr.exe89⤵PID:2688
-
\??\c:\hbhnbb.exec:\hbhnbb.exe90⤵PID:2684
-
\??\c:\vvjpv.exec:\vvjpv.exe91⤵PID:1280
-
\??\c:\vpdjp.exec:\vpdjp.exe92⤵PID:2244
-
\??\c:\xlfflll.exec:\xlfflll.exe93⤵PID:1032
-
\??\c:\frlrxxf.exec:\frlrxxf.exe94⤵PID:852
-
\??\c:\7nhntt.exec:\7nhntt.exe95⤵PID:1256
-
\??\c:\9jdjj.exec:\9jdjj.exe96⤵PID:1472
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe97⤵PID:1684
-
\??\c:\9rfffxf.exec:\9rfffxf.exe98⤵PID:1124
-
\??\c:\tnbhbh.exec:\tnbhbh.exe99⤵PID:532
-
\??\c:\jdvvd.exec:\jdvvd.exe100⤵PID:1408
-
\??\c:\7vvpj.exec:\7vvpj.exe101⤵PID:2852
-
\??\c:\7xfffff.exec:\7xfffff.exe102⤵PID:1756
-
\??\c:\tbhbhb.exec:\tbhbhb.exe103⤵PID:2992
-
\??\c:\djpjj.exec:\djpjj.exe104⤵PID:1964
-
\??\c:\1vvvv.exec:\1vvvv.exe105⤵PID:2944
-
\??\c:\lxflxxl.exec:\lxflxxl.exe106⤵PID:2364
-
\??\c:\5bbttn.exec:\5bbttn.exe107⤵PID:628
-
\??\c:\1tttbh.exec:\1tttbh.exe108⤵PID:988
-
\??\c:\7vpjj.exec:\7vpjj.exe109⤵PID:2376
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe110⤵PID:1660
-
\??\c:\1lrrrrf.exec:\1lrrrrf.exe111⤵PID:1796
-
\??\c:\5hnhtt.exec:\5hnhtt.exe112⤵PID:1788
-
\??\c:\pjdvp.exec:\pjdvp.exe113⤵PID:2568
-
\??\c:\ffxffrx.exec:\ffxffrx.exe114⤵PID:2856
-
\??\c:\rlflrrl.exec:\rlflrrl.exe115⤵PID:2500
-
\??\c:\hhnntn.exec:\hhnntn.exe116⤵PID:1492
-
\??\c:\pjdjj.exec:\pjdjj.exe117⤵PID:1652
-
\??\c:\ddvvv.exec:\ddvvv.exe118⤵PID:2564
-
\??\c:\rxxxfxf.exec:\rxxxfxf.exe119⤵PID:884
-
\??\c:\rfxfllx.exec:\rfxfllx.exe120⤵PID:2188
-
\??\c:\3nntbh.exec:\3nntbh.exe121⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-