Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe
-
Size
454KB
-
MD5
b247a8511adfe30f9b4f0741d46b6f37
-
SHA1
ccefe69e256d4f83bddf901fe0ee1563f984f114
-
SHA256
61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d
-
SHA512
464c243e7a2eb7297bcd1fa34764dfafb0336a78a5c12ecabbf882694dc79cf5279f79e44ab88d7a90e7334d3364e95e6f9e225ae2bf486681a6e41723aa5c94
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeaP:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1736-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-46-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2752-61-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-133-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2140-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-171-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2796-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-235-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-374-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2640-381-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-593-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/688-673-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2868-704-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-718-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-724-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2648-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-801-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-844-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-988-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/944-1043-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2084 rlxlxxl.exe 2092 5lffrxl.exe 2352 dvpvj.exe 2460 lfxxffl.exe 2848 hhbbtn.exe 2752 3bthhn.exe 2824 tbthnb.exe 2636 tnbbtt.exe 1984 dvpdv.exe 2684 1htbbh.exe 2144 3vpvj.exe 1472 btthbb.exe 2924 dpvvd.exe 1268 rrlxflr.exe 2876 jjvdj.exe 1724 tbnbnn.exe 2140 7pdpd.exe 1668 vpjvv.exe 2796 tnhnhn.exe 2440 9fffrrx.exe 1420 htnnbt.exe 2280 vvpjp.exe 2996 5htnnh.exe 1368 nttbtt.exe 2976 1frfffr.exe 696 nbbntt.exe 2204 pjvvj.exe 332 lxxflrf.exe 284 tttthn.exe 872 flfrflx.exe 1696 hhnbht.exe 2340 3nbnbb.exe 656 9rxrffl.exe 2352 xrlxrxl.exe 576 5hbhnn.exe 1576 pjddj.exe 2716 7lflllx.exe 2756 xrffllr.exe 2828 ttthnh.exe 2804 9pvjj.exe 2644 9lrlfxf.exe 2744 llffrxf.exe 2664 hhbbnb.exe 2640 nhthhn.exe 2164 5vpvd.exe 1512 7xrffxf.exe 2144 bnntnn.exe 344 bbnthb.exe 2948 jdpdp.exe 2040 7rlxxxf.exe 2368 ffxfxrf.exe 356 thtbnn.exe 1684 pjvjd.exe 1704 lfrfrxx.exe 2000 xrfrllr.exe 1668 tnbtht.exe 2952 3hbtnt.exe 2120 vpdjj.exe 2192 xrllxxr.exe 2304 hbnhnt.exe 1420 3bhtbb.exe 3052 vpjpv.exe 944 rrrfflf.exe 668 ffxrxfr.exe -
resource yara_rule behavioral1/memory/1736-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-46-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2752-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-226-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2976-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-593-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1720-657-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/688-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-1329-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2084 1736 61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe 30 PID 1736 wrote to memory of 2084 1736 61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe 30 PID 1736 wrote to memory of 2084 1736 61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe 30 PID 1736 wrote to memory of 2084 1736 61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe 30 PID 2084 wrote to memory of 2092 2084 rlxlxxl.exe 31 PID 2084 wrote to memory of 2092 2084 rlxlxxl.exe 31 PID 2084 wrote to memory of 2092 2084 rlxlxxl.exe 31 PID 2084 wrote to memory of 2092 2084 rlxlxxl.exe 31 PID 2092 wrote to memory of 2352 2092 5lffrxl.exe 32 PID 2092 wrote to memory of 2352 2092 5lffrxl.exe 32 PID 2092 wrote to memory of 2352 2092 5lffrxl.exe 32 PID 2092 wrote to memory of 2352 2092 5lffrxl.exe 32 PID 2352 wrote to memory of 2460 2352 dvpvj.exe 33 PID 2352 wrote to memory of 2460 2352 dvpvj.exe 33 PID 2352 wrote to memory of 2460 2352 dvpvj.exe 33 PID 2352 wrote to memory of 2460 2352 dvpvj.exe 33 PID 2460 wrote to memory of 2848 2460 lfxxffl.exe 34 PID 2460 wrote to memory of 2848 2460 lfxxffl.exe 34 PID 2460 wrote to memory of 2848 2460 lfxxffl.exe 34 PID 2460 wrote to memory of 2848 2460 lfxxffl.exe 34 PID 2848 wrote to memory of 2752 2848 hhbbtn.exe 35 PID 2848 wrote to memory of 2752 2848 hhbbtn.exe 35 PID 2848 wrote to memory of 2752 2848 hhbbtn.exe 35 PID 2848 wrote to memory of 2752 2848 hhbbtn.exe 35 PID 2752 wrote to memory of 2824 2752 3bthhn.exe 36 PID 2752 wrote to memory of 2824 2752 3bthhn.exe 36 PID 2752 wrote to memory of 2824 2752 3bthhn.exe 36 PID 2752 wrote to memory of 2824 2752 3bthhn.exe 36 PID 2824 wrote to memory of 2636 2824 tbthnb.exe 37 PID 2824 wrote to memory of 2636 2824 tbthnb.exe 37 PID 2824 wrote to memory of 2636 2824 tbthnb.exe 37 PID 2824 wrote to memory of 2636 2824 tbthnb.exe 37 PID 2636 wrote to memory of 1984 2636 tnbbtt.exe 38 PID 2636 wrote to memory of 1984 2636 tnbbtt.exe 38 PID 2636 wrote to memory of 1984 2636 tnbbtt.exe 38 PID 2636 wrote to memory of 1984 2636 tnbbtt.exe 38 PID 1984 wrote to memory of 2684 1984 dvpdv.exe 39 PID 1984 wrote to memory of 2684 1984 dvpdv.exe 39 PID 1984 wrote to memory of 2684 1984 dvpdv.exe 39 PID 1984 wrote to memory of 2684 1984 dvpdv.exe 39 PID 2684 wrote to memory of 2144 2684 1htbbh.exe 40 PID 2684 wrote to memory of 2144 2684 1htbbh.exe 40 PID 2684 wrote to memory of 2144 2684 1htbbh.exe 40 PID 2684 wrote to memory of 2144 2684 1htbbh.exe 40 PID 2144 wrote to memory of 1472 2144 3vpvj.exe 41 PID 2144 wrote to memory of 1472 2144 3vpvj.exe 41 PID 2144 wrote to memory of 1472 2144 3vpvj.exe 41 PID 2144 wrote to memory of 1472 2144 3vpvj.exe 41 PID 1472 wrote to memory of 2924 1472 btthbb.exe 42 PID 1472 wrote to memory of 2924 1472 btthbb.exe 42 PID 1472 wrote to memory of 2924 1472 btthbb.exe 42 PID 1472 wrote to memory of 2924 1472 btthbb.exe 42 PID 2924 wrote to memory of 1268 2924 dpvvd.exe 43 PID 2924 wrote to memory of 1268 2924 dpvvd.exe 43 PID 2924 wrote to memory of 1268 2924 dpvvd.exe 43 PID 2924 wrote to memory of 1268 2924 dpvvd.exe 43 PID 1268 wrote to memory of 2876 1268 rrlxflr.exe 44 PID 1268 wrote to memory of 2876 1268 rrlxflr.exe 44 PID 1268 wrote to memory of 2876 1268 rrlxflr.exe 44 PID 1268 wrote to memory of 2876 1268 rrlxflr.exe 44 PID 2876 wrote to memory of 1724 2876 jjvdj.exe 45 PID 2876 wrote to memory of 1724 2876 jjvdj.exe 45 PID 2876 wrote to memory of 1724 2876 jjvdj.exe 45 PID 2876 wrote to memory of 1724 2876 jjvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe"C:\Users\Admin\AppData\Local\Temp\61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\5lffrxl.exec:\5lffrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\dvpvj.exec:\dvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lfxxffl.exec:\lfxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\hhbbtn.exec:\hhbbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3bthhn.exec:\3bthhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\tbthnb.exec:\tbthnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\tnbbtt.exec:\tnbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\dvpdv.exec:\dvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\1htbbh.exec:\1htbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3vpvj.exec:\3vpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\btthbb.exec:\btthbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\dpvvd.exec:\dpvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rrlxflr.exec:\rrlxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\jjvdj.exec:\jjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tbnbnn.exec:\tbnbnn.exe17⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7pdpd.exec:\7pdpd.exe18⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vpjvv.exec:\vpjvv.exe19⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tnhnhn.exec:\tnhnhn.exe20⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9fffrrx.exec:\9fffrrx.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\htnnbt.exec:\htnnbt.exe22⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vvpjp.exec:\vvpjp.exe23⤵
- Executes dropped EXE
PID:2280 -
\??\c:\5htnnh.exec:\5htnnh.exe24⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nttbtt.exec:\nttbtt.exe25⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1frfffr.exec:\1frfffr.exe26⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nbbntt.exec:\nbbntt.exe27⤵
- Executes dropped EXE
PID:696 -
\??\c:\pjvvj.exec:\pjvvj.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lxxflrf.exec:\lxxflrf.exe29⤵
- Executes dropped EXE
PID:332 -
\??\c:\tttthn.exec:\tttthn.exe30⤵
- Executes dropped EXE
PID:284 -
\??\c:\flfrflx.exec:\flfrflx.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\hhnbht.exec:\hhnbht.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3nbnbb.exec:\3nbnbb.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9rxrffl.exec:\9rxrffl.exe34⤵
- Executes dropped EXE
PID:656 -
\??\c:\xrlxrxl.exec:\xrlxrxl.exe35⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5hbhnn.exec:\5hbhnn.exe36⤵
- Executes dropped EXE
PID:576 -
\??\c:\pjddj.exec:\pjddj.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7lflllx.exec:\7lflllx.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xrffllr.exec:\xrffllr.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ttthnh.exec:\ttthnh.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9pvjj.exec:\9pvjj.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9lrlfxf.exec:\9lrlfxf.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\llffrxf.exec:\llffrxf.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hhbbnb.exec:\hhbbnb.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nhthhn.exec:\nhthhn.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5vpvd.exec:\5vpvd.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7xrffxf.exec:\7xrffxf.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bnntnn.exec:\bnntnn.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bbnthb.exec:\bbnthb.exe49⤵
- Executes dropped EXE
PID:344 -
\??\c:\jdpdp.exec:\jdpdp.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7rlxxxf.exec:\7rlxxxf.exe51⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ffxfxrf.exec:\ffxfxrf.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\thtbnn.exec:\thtbnn.exe53⤵
- Executes dropped EXE
PID:356 -
\??\c:\pjvjd.exec:\pjvjd.exe54⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lfrfrxx.exec:\lfrfrxx.exe55⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrfrllr.exec:\xrfrllr.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tnbtht.exec:\tnbtht.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\3hbtnt.exec:\3hbtnt.exe58⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vpdjj.exec:\vpdjj.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xrllxxr.exec:\xrllxxr.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hbnhnt.exec:\hbnhnt.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\3bhtbb.exec:\3bhtbb.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vpjpv.exec:\vpjpv.exe63⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rrrfflf.exec:\rrrfflf.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\ffxrxfr.exec:\ffxrxfr.exe65⤵
- Executes dropped EXE
PID:668 -
\??\c:\7hbntn.exec:\7hbntn.exe66⤵PID:1548
-
\??\c:\5vdpv.exec:\5vdpv.exe67⤵PID:1752
-
\??\c:\lfrflrf.exec:\lfrflrf.exe68⤵PID:2320
-
\??\c:\1xlrrfr.exec:\1xlrrfr.exe69⤵PID:1932
-
\??\c:\hbnthn.exec:\hbnthn.exe70⤵PID:2268
-
\??\c:\pjvdj.exec:\pjvdj.exe71⤵PID:352
-
\??\c:\7jppd.exec:\7jppd.exe72⤵PID:2412
-
\??\c:\xlffffl.exec:\xlffffl.exe73⤵PID:1928
-
\??\c:\hbnbtb.exec:\hbnbtb.exe74⤵PID:1584
-
\??\c:\5tnbht.exec:\5tnbht.exe75⤵PID:1696
-
\??\c:\5vpdd.exec:\5vpdd.exe76⤵PID:2056
-
\??\c:\rflrffr.exec:\rflrffr.exe77⤵PID:3016
-
\??\c:\1lrflrl.exec:\1lrflrl.exe78⤵PID:1376
-
\??\c:\thbhnn.exec:\thbhnn.exe79⤵PID:264
-
\??\c:\nnhhbh.exec:\nnhhbh.exe80⤵PID:1576
-
\??\c:\dvvjv.exec:\dvvjv.exe81⤵PID:2464
-
\??\c:\fxlxrfr.exec:\fxlxrfr.exe82⤵PID:2840
-
\??\c:\hnttbb.exec:\hnttbb.exe83⤵PID:2816
-
\??\c:\9pdvd.exec:\9pdvd.exe84⤵PID:2804
-
\??\c:\dpdjp.exec:\dpdjp.exe85⤵PID:2916
-
\??\c:\7lxlrrx.exec:\7lxlrrx.exe86⤵PID:2744
-
\??\c:\nhbnnn.exec:\nhbnnn.exe87⤵PID:2604
-
\??\c:\hbtnht.exec:\hbtnht.exe88⤵PID:1720
-
\??\c:\dvpvd.exec:\dvpvd.exe89⤵PID:664
-
\??\c:\jvpvj.exec:\jvpvj.exe90⤵PID:2112
-
\??\c:\xrlrffx.exec:\xrlrffx.exe91⤵PID:688
-
\??\c:\nhhnbb.exec:\nhhnbb.exe92⤵PID:2912
-
\??\c:\vvpvv.exec:\vvpvv.exe93⤵PID:1972
-
\??\c:\pdvdj.exec:\pdvdj.exe94⤵PID:1996
-
\??\c:\9lfrxxx.exec:\9lfrxxx.exe95⤵PID:2868
-
\??\c:\3tttbb.exec:\3tttbb.exe96⤵PID:1916
-
\??\c:\djjdv.exec:\djjdv.exe97⤵PID:1580
-
\??\c:\ddddv.exec:\ddddv.exe98⤵PID:1688
-
\??\c:\lrlxxlx.exec:\lrlxxlx.exe99⤵PID:2000
-
\??\c:\nnbbnh.exec:\nnbbnh.exe100⤵PID:2648
-
\??\c:\pdvvd.exec:\pdvvd.exe101⤵PID:2228
-
\??\c:\jdvjd.exec:\jdvjd.exe102⤵PID:2568
-
\??\c:\rlflfff.exec:\rlflfff.exe103⤵PID:2428
-
\??\c:\3thhnn.exec:\3thhnn.exe104⤵PID:448
-
\??\c:\tnbbbh.exec:\tnbbbh.exe105⤵PID:1248
-
\??\c:\5vppv.exec:\5vppv.exe106⤵PID:2996
-
\??\c:\rfrrxrf.exec:\rfrrxrf.exe107⤵PID:1304
-
\??\c:\tnhnbb.exec:\tnhnbb.exe108⤵PID:2976
-
\??\c:\nbbhnb.exec:\nbbhnb.exe109⤵PID:1548
-
\??\c:\ppdjd.exec:\ppdjd.exe110⤵PID:1752
-
\??\c:\jjvvp.exec:\jjvvp.exe111⤵PID:2484
-
\??\c:\rlxxffx.exec:\rlxxffx.exe112⤵PID:1564
-
\??\c:\hhtbhn.exec:\hhtbhn.exe113⤵PID:1644
-
\??\c:\jvjpv.exec:\jvjpv.exe114⤵PID:468
-
\??\c:\dvvdp.exec:\dvvdp.exe115⤵PID:2212
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe116⤵PID:2336
-
\??\c:\tntbhh.exec:\tntbhh.exe117⤵PID:2392
-
\??\c:\nhbnbb.exec:\nhbnbb.exe118⤵PID:2548
-
\??\c:\7jddp.exec:\7jddp.exe119⤵PID:1968
-
\??\c:\1rlxrxl.exec:\1rlxrxl.exe120⤵PID:1940
-
\??\c:\ntnnbb.exec:\ntnnbb.exe121⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-