Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
-
Size
454KB
-
MD5
54cfbe2a1c7bd739fd53a7066ba9c02e
-
SHA1
7eb9ea5d7d2df34c520702a33d1f2a8ea908562c
-
SHA256
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be
-
SHA512
70810c39f33e86dea480580f5aec356edb6c4882e0249581a7b7e4af8ac13d458a09c92b02bd9f03573f8ad2804841a9873f15b2b62337c9b5843ecb9dd91945
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2072-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-105-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2768-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-162-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2908-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-197-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1856-215-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/636-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-489-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2060-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-513-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1840-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-751-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1732-778-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-777-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-836-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-903-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2608-924-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-959-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-1048-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-1179-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1316-1214-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2368-1375-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1308 xxrlrxr.exe 2964 7btbhh.exe 316 ffxlrfr.exe 2096 vvdjv.exe 2748 rrfxffx.exe 2988 tthnhn.exe 2852 vpddp.exe 2928 jjvvj.exe 2644 1fffrrx.exe 2608 btntnb.exe 2768 jpjvj.exe 2640 tbtbnn.exe 892 fxllxfr.exe 1052 nhbhth.exe 836 ttnbtt.exe 2668 djdjd.exe 1872 9hhnnn.exe 1988 jvpvd.exe 2908 bbbhtt.exe 2952 7llrflx.exe 3056 hbbhtb.exe 2140 hhntnh.exe 1856 ffrrflr.exe 1036 nnnbhn.exe 636 ddvdv.exe 1724 lfrxflf.exe 2260 vpvvj.exe 2428 7bbbnb.exe 1564 jpppd.exe 1376 9rllrrx.exe 1348 hbntbh.exe 3024 lfrxflx.exe 2876 lfflrfr.exe 1696 ddddv.exe 2396 ddjvd.exe 1800 fxrxxfl.exe 316 1nnnbh.exe 2744 1ttbnt.exe 2824 jdddp.exe 2752 3flrrxl.exe 2476 xxxxxfr.exe 2632 9tnthb.exe 2848 tnntht.exe 2828 dvjvd.exe 2644 rlrxlrx.exe 1836 9lfxflx.exe 2176 nnhnth.exe 580 jjjpd.exe 592 pjvdd.exe 2020 lfrrxxf.exe 1052 bbbhnt.exe 2496 5nnntt.exe 2156 jddjp.exe 2668 xrlrllf.exe 2792 lrlrflr.exe 1824 hbttnt.exe 1244 pvpdj.exe 2008 vjddj.exe 2940 5fxlrxf.exe 2236 bbtbnn.exe 3056 thtthb.exe 2416 ddvvj.exe 2060 lxrrrlx.exe 1904 bbbhth.exe -
resource yara_rule behavioral1/memory/2072-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-105-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/2768-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-1008-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-1074-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-1214-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/908-1283-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1308 2072 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 2072 wrote to memory of 1308 2072 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 2072 wrote to memory of 1308 2072 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 2072 wrote to memory of 1308 2072 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 30 PID 1308 wrote to memory of 2964 1308 xxrlrxr.exe 31 PID 1308 wrote to memory of 2964 1308 xxrlrxr.exe 31 PID 1308 wrote to memory of 2964 1308 xxrlrxr.exe 31 PID 1308 wrote to memory of 2964 1308 xxrlrxr.exe 31 PID 2964 wrote to memory of 316 2964 7btbhh.exe 32 PID 2964 wrote to memory of 316 2964 7btbhh.exe 32 PID 2964 wrote to memory of 316 2964 7btbhh.exe 32 PID 2964 wrote to memory of 316 2964 7btbhh.exe 32 PID 316 wrote to memory of 2096 316 ffxlrfr.exe 33 PID 316 wrote to memory of 2096 316 ffxlrfr.exe 33 PID 316 wrote to memory of 2096 316 ffxlrfr.exe 33 PID 316 wrote to memory of 2096 316 ffxlrfr.exe 33 PID 2096 wrote to memory of 2748 2096 vvdjv.exe 34 PID 2096 wrote to memory of 2748 2096 vvdjv.exe 34 PID 2096 wrote to memory of 2748 2096 vvdjv.exe 34 PID 2096 wrote to memory of 2748 2096 vvdjv.exe 34 PID 2748 wrote to memory of 2988 2748 rrfxffx.exe 35 PID 2748 wrote to memory of 2988 2748 rrfxffx.exe 35 PID 2748 wrote to memory of 2988 2748 rrfxffx.exe 35 PID 2748 wrote to memory of 2988 2748 rrfxffx.exe 35 PID 2988 wrote to memory of 2852 2988 tthnhn.exe 36 PID 2988 wrote to memory of 2852 2988 tthnhn.exe 36 PID 2988 wrote to memory of 2852 2988 tthnhn.exe 36 PID 2988 wrote to memory of 2852 2988 tthnhn.exe 36 PID 2852 wrote to memory of 2928 2852 vpddp.exe 37 PID 2852 wrote to memory of 2928 2852 vpddp.exe 37 PID 2852 wrote to memory of 2928 2852 vpddp.exe 37 PID 2852 wrote to memory of 2928 2852 vpddp.exe 37 PID 2928 wrote to memory of 2644 2928 jjvvj.exe 38 PID 2928 wrote to memory of 2644 2928 jjvvj.exe 38 PID 2928 wrote to memory of 2644 2928 jjvvj.exe 38 PID 2928 wrote to memory of 2644 2928 jjvvj.exe 38 PID 2644 wrote to memory of 2608 2644 1fffrrx.exe 39 PID 2644 wrote to memory of 2608 2644 1fffrrx.exe 39 PID 2644 wrote to memory of 2608 2644 1fffrrx.exe 39 PID 2644 wrote to memory of 2608 2644 1fffrrx.exe 39 PID 2608 wrote to memory of 2768 2608 btntnb.exe 40 PID 2608 wrote to memory of 2768 2608 btntnb.exe 40 PID 2608 wrote to memory of 2768 2608 btntnb.exe 40 PID 2608 wrote to memory of 2768 2608 btntnb.exe 40 PID 2768 wrote to memory of 2640 2768 jpjvj.exe 41 PID 2768 wrote to memory of 2640 2768 jpjvj.exe 41 PID 2768 wrote to memory of 2640 2768 jpjvj.exe 41 PID 2768 wrote to memory of 2640 2768 jpjvj.exe 41 PID 2640 wrote to memory of 892 2640 tbtbnn.exe 42 PID 2640 wrote to memory of 892 2640 tbtbnn.exe 42 PID 2640 wrote to memory of 892 2640 tbtbnn.exe 42 PID 2640 wrote to memory of 892 2640 tbtbnn.exe 42 PID 892 wrote to memory of 1052 892 fxllxfr.exe 43 PID 892 wrote to memory of 1052 892 fxllxfr.exe 43 PID 892 wrote to memory of 1052 892 fxllxfr.exe 43 PID 892 wrote to memory of 1052 892 fxllxfr.exe 43 PID 1052 wrote to memory of 836 1052 nhbhth.exe 44 PID 1052 wrote to memory of 836 1052 nhbhth.exe 44 PID 1052 wrote to memory of 836 1052 nhbhth.exe 44 PID 1052 wrote to memory of 836 1052 nhbhth.exe 44 PID 836 wrote to memory of 2668 836 ttnbtt.exe 45 PID 836 wrote to memory of 2668 836 ttnbtt.exe 45 PID 836 wrote to memory of 2668 836 ttnbtt.exe 45 PID 836 wrote to memory of 2668 836 ttnbtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\xxrlrxr.exec:\xxrlrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\7btbhh.exec:\7btbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ffxlrfr.exec:\ffxlrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\vvdjv.exec:\vvdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\rrfxffx.exec:\rrfxffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tthnhn.exec:\tthnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vpddp.exec:\vpddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jjvvj.exec:\jjvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\1fffrrx.exec:\1fffrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\btntnb.exec:\btntnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jpjvj.exec:\jpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tbtbnn.exec:\tbtbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\fxllxfr.exec:\fxllxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\nhbhth.exec:\nhbhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\ttnbtt.exec:\ttnbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\djdjd.exec:\djdjd.exe17⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9hhnnn.exec:\9hhnnn.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jvpvd.exec:\jvpvd.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbbhtt.exec:\bbbhtt.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7llrflx.exec:\7llrflx.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbbhtb.exec:\hbbhtb.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056 -
\??\c:\hhntnh.exec:\hhntnh.exe23⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ffrrflr.exec:\ffrrflr.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nnnbhn.exec:\nnnbhn.exe25⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ddvdv.exec:\ddvdv.exe26⤵
- Executes dropped EXE
PID:636 -
\??\c:\lfrxflf.exec:\lfrxflf.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpvvj.exec:\vpvvj.exe28⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7bbbnb.exec:\7bbbnb.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jpppd.exec:\jpppd.exe30⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9rllrrx.exec:\9rllrrx.exe31⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hbntbh.exec:\hbntbh.exe32⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lfrxflx.exec:\lfrxflx.exe33⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lfflrfr.exec:\lfflrfr.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddddv.exec:\ddddv.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ddjvd.exec:\ddjvd.exe36⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\1nnnbh.exec:\1nnnbh.exe38⤵
- Executes dropped EXE
PID:316 -
\??\c:\1ttbnt.exec:\1ttbnt.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdddp.exec:\jdddp.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3flrrxl.exec:\3flrrxl.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xxxxxfr.exec:\xxxxxfr.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9tnthb.exec:\9tnthb.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnntht.exec:\tnntht.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dvjvd.exec:\dvjvd.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rlrxlrx.exec:\rlrxlrx.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9lfxflx.exec:\9lfxflx.exe47⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nnhnth.exec:\nnhnth.exe48⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jjjpd.exec:\jjjpd.exe49⤵
- Executes dropped EXE
PID:580 -
\??\c:\pjvdd.exec:\pjvdd.exe50⤵
- Executes dropped EXE
PID:592 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bbbhnt.exec:\bbbhnt.exe52⤵
- Executes dropped EXE
PID:1052 -
\??\c:\5nnntt.exec:\5nnntt.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\jddjp.exec:\jddjp.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrlrllf.exec:\xrlrllf.exe55⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lrlrflr.exec:\lrlrflr.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hbttnt.exec:\hbttnt.exe57⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pvpdj.exec:\pvpdj.exe58⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vjddj.exec:\vjddj.exe59⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5fxlrxf.exec:\5fxlrxf.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bbtbnn.exec:\bbtbnn.exe61⤵
- Executes dropped EXE
PID:2236 -
\??\c:\thtthb.exec:\thtthb.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ddvvj.exec:\ddvvj.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lxrrrlx.exec:\lxrrrlx.exe64⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bbbhth.exec:\bbbhth.exe65⤵
- Executes dropped EXE
PID:1904 -
\??\c:\tnhhtb.exec:\tnhhtb.exe66⤵PID:1312
-
\??\c:\vvppd.exec:\vvppd.exe67⤵PID:1744
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe68⤵PID:1628
-
\??\c:\thhhtt.exec:\thhhtt.exe69⤵PID:1840
-
\??\c:\7nhhtb.exec:\7nhhtb.exe70⤵PID:2984
-
\??\c:\pjddv.exec:\pjddv.exe71⤵PID:332
-
\??\c:\lllxrrl.exec:\lllxrrl.exe72⤵PID:2464
-
\??\c:\ttntnb.exec:\ttntnb.exe73⤵PID:1120
-
\??\c:\bbttnn.exec:\bbttnn.exe74⤵PID:1284
-
\??\c:\vpdjj.exec:\vpdjj.exe75⤵PID:2160
-
\??\c:\9xllllx.exec:\9xllllx.exe76⤵PID:1560
-
\??\c:\xrrxllx.exec:\xrrxllx.exe77⤵PID:2368
-
\??\c:\nnhnhh.exec:\nnhnhh.exe78⤵PID:2364
-
\??\c:\ppjpd.exec:\ppjpd.exe79⤵PID:2104
-
\??\c:\pppvj.exec:\pppvj.exe80⤵PID:2528
-
\??\c:\3xxllrx.exec:\3xxllrx.exe81⤵PID:2784
-
\??\c:\bbhnhn.exec:\bbhnhn.exe82⤵PID:2816
-
\??\c:\7nntbh.exec:\7nntbh.exe83⤵PID:2756
-
\??\c:\jjvdv.exec:\jjvdv.exe84⤵PID:2988
-
\??\c:\1frrxfr.exec:\1frrxfr.exe85⤵PID:2604
-
\??\c:\hbtbtb.exec:\hbtbtb.exe86⤵PID:2344
-
\??\c:\nhbntb.exec:\nhbntb.exe87⤵PID:2712
-
\??\c:\9jpjp.exec:\9jpjp.exe88⤵PID:2652
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe89⤵PID:2608
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe90⤵PID:1092
-
\??\c:\hhhnht.exec:\hhhnht.exe91⤵PID:1484
-
\??\c:\5vddd.exec:\5vddd.exe92⤵PID:2640
-
\??\c:\vvddd.exec:\vvddd.exe93⤵PID:1388
-
\??\c:\xrflffr.exec:\xrflffr.exe94⤵PID:2888
-
\??\c:\bthhnh.exec:\bthhnh.exe95⤵PID:1184
-
\??\c:\ntbnth.exec:\ntbnth.exe96⤵PID:2868
-
\??\c:\jppdj.exec:\jppdj.exe97⤵PID:2108
-
\??\c:\lfxxxfr.exec:\lfxxxfr.exe98⤵PID:1268
-
\??\c:\rrrxllx.exec:\rrrxllx.exe99⤵PID:2040
-
\??\c:\nhtntt.exec:\nhtntt.exe100⤵PID:2012
-
\??\c:\dvppd.exec:\dvppd.exe101⤵PID:2004
-
\??\c:\5vpjp.exec:\5vpjp.exe102⤵PID:2924
-
\??\c:\rlfrflx.exec:\rlfrflx.exe103⤵PID:2932
-
\??\c:\nnbthh.exec:\nnbthh.exe104⤵
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\5pjdj.exec:\5pjdj.exe105⤵PID:2232
-
\??\c:\pjdvj.exec:\pjdvj.exe106⤵PID:908
-
\??\c:\lfxxllx.exec:\lfxxllx.exe107⤵PID:448
-
\??\c:\3hthbt.exec:\3hthbt.exe108⤵PID:1036
-
\??\c:\hhnnbb.exec:\hhnnbb.exe109⤵PID:1732
-
\??\c:\ppjdv.exec:\ppjdv.exe110⤵PID:1320
-
\??\c:\lfflxfr.exec:\lfflxfr.exe111⤵PID:1040
-
\??\c:\rrrxflr.exec:\rrrxflr.exe112⤵PID:1612
-
\??\c:\bthnhn.exec:\bthnhn.exe113⤵PID:2896
-
\??\c:\ddpvj.exec:\ddpvj.exe114⤵PID:2984
-
\??\c:\pjddd.exec:\pjddd.exe115⤵PID:1700
-
\??\c:\xxrfflf.exec:\xxrfflf.exe116⤵PID:2464
-
\??\c:\nhttbb.exec:\nhttbb.exe117⤵PID:1448
-
\??\c:\bnhhtn.exec:\bnhhtn.exe118⤵PID:1284
-
\??\c:\jjddp.exec:\jjddp.exe119⤵PID:2120
-
\??\c:\rlffxfl.exec:\rlffxfl.exe120⤵PID:1584
-
\??\c:\frxxflx.exec:\frxxflx.exe121⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-