Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe
-
Size
454KB
-
MD5
174f203ed04767e7c1640117dfa34ed0
-
SHA1
bd23ecec949c92696bfec0a34b12276fd2346624
-
SHA256
afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4
-
SHA512
6c33305afde6ba71abfb331ba948c6c94c1442c947bbea45ccb9f5c0579f198d1e0bddb12d0283aaef091ae322efe268faf8b3faf03ada7546c44bd895876087
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-35-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2868-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-91-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/2896-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1220-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-215-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2328-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-654-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1412-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-748-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2604-754-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1872-782-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-830-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2852-847-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-850-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-978-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-1061-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-1196-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1796-1282-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1600 nhntbb.exe 1212 dvvvj.exe 2552 9frrrlr.exe 2104 pppvp.exe 2868 xxxrxfr.exe 2768 pppdd.exe 2812 5jdpj.exe 2956 bbbnth.exe 2896 jjjvj.exe 2684 nbtbnt.exe 2076 5hbthn.exe 1592 lfxflxf.exe 2824 7btbhn.exe 1420 9vpvd.exe 2816 5tthbh.exe 796 7jvdd.exe 1220 fxrlffx.exe 1164 nnhbnb.exe 1704 vpjjp.exe 3008 xrflrll.exe 2416 pdvvd.exe 2480 5xfrrrx.exe 2236 tbthnt.exe 3052 pdvvd.exe 2328 xrffrrx.exe 764 9bbbhh.exe 2484 nnnbbt.exe 640 bhtbhh.exe 884 hthhnn.exe 2464 vpddp.exe 1992 xrlfrrx.exe 1364 lfrxlrx.exe 1496 rrfrlrf.exe 2804 3nbttn.exe 2316 3jdvd.exe 2256 xrrlfll.exe 2900 xlflrrx.exe 2860 9tbbbb.exe 2748 vvpvp.exe 2932 vdpjd.exe 2724 xlllrrx.exe 2620 5hhhhh.exe 2640 nhnnbh.exe 2700 jjdjv.exe 2340 fxrrffl.exe 632 rrrxlrf.exe 1592 tnbntb.exe 572 jdppv.exe 1584 pjdjp.exe 2828 lfxfrrf.exe 2832 ththhn.exe 756 hbtthh.exe 532 ppvjj.exe 1896 xxlxflr.exe 1544 5rlxxxl.exe 1812 bthnbb.exe 2344 vvjjv.exe 2996 9pppd.exe 2320 rxrrxfx.exe 2208 nbnnnn.exe 1152 3nhhhh.exe 960 jjvvv.exe 956 lxxxlrx.exe 2840 3htnnb.exe -
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-480-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/956-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-765-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1752-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-1245-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrrxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1600 2012 afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe 30 PID 2012 wrote to memory of 1600 2012 afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe 30 PID 2012 wrote to memory of 1600 2012 afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe 30 PID 2012 wrote to memory of 1600 2012 afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe 30 PID 1600 wrote to memory of 1212 1600 nhntbb.exe 31 PID 1600 wrote to memory of 1212 1600 nhntbb.exe 31 PID 1600 wrote to memory of 1212 1600 nhntbb.exe 31 PID 1600 wrote to memory of 1212 1600 nhntbb.exe 31 PID 1212 wrote to memory of 2552 1212 dvvvj.exe 32 PID 1212 wrote to memory of 2552 1212 dvvvj.exe 32 PID 1212 wrote to memory of 2552 1212 dvvvj.exe 32 PID 1212 wrote to memory of 2552 1212 dvvvj.exe 32 PID 2552 wrote to memory of 2104 2552 9frrrlr.exe 33 PID 2552 wrote to memory of 2104 2552 9frrrlr.exe 33 PID 2552 wrote to memory of 2104 2552 9frrrlr.exe 33 PID 2552 wrote to memory of 2104 2552 9frrrlr.exe 33 PID 2104 wrote to memory of 2868 2104 pppvp.exe 34 PID 2104 wrote to memory of 2868 2104 pppvp.exe 34 PID 2104 wrote to memory of 2868 2104 pppvp.exe 34 PID 2104 wrote to memory of 2868 2104 pppvp.exe 34 PID 2868 wrote to memory of 2768 2868 xxxrxfr.exe 35 PID 2868 wrote to memory of 2768 2868 xxxrxfr.exe 35 PID 2868 wrote to memory of 2768 2868 xxxrxfr.exe 35 PID 2868 wrote to memory of 2768 2868 xxxrxfr.exe 35 PID 2768 wrote to memory of 2812 2768 pppdd.exe 36 PID 2768 wrote to memory of 2812 2768 pppdd.exe 36 PID 2768 wrote to memory of 2812 2768 pppdd.exe 36 PID 2768 wrote to memory of 2812 2768 pppdd.exe 36 PID 2812 wrote to memory of 2956 2812 5jdpj.exe 37 PID 2812 wrote to memory of 2956 2812 5jdpj.exe 37 PID 2812 wrote to memory of 2956 2812 5jdpj.exe 37 PID 2812 wrote to memory of 2956 2812 5jdpj.exe 37 PID 2956 wrote to memory of 2896 2956 bbbnth.exe 38 PID 2956 wrote to memory of 2896 2956 bbbnth.exe 38 PID 2956 wrote to memory of 2896 2956 bbbnth.exe 38 PID 2956 wrote to memory of 2896 2956 bbbnth.exe 38 PID 2896 wrote to memory of 2684 2896 jjjvj.exe 39 PID 2896 wrote to memory of 2684 2896 jjjvj.exe 39 PID 2896 wrote to memory of 2684 2896 jjjvj.exe 39 PID 2896 wrote to memory of 2684 2896 jjjvj.exe 39 PID 2684 wrote to memory of 2076 2684 nbtbnt.exe 40 PID 2684 wrote to memory of 2076 2684 nbtbnt.exe 40 PID 2684 wrote to memory of 2076 2684 nbtbnt.exe 40 PID 2684 wrote to memory of 2076 2684 nbtbnt.exe 40 PID 2076 wrote to memory of 1592 2076 5hbthn.exe 41 PID 2076 wrote to memory of 1592 2076 5hbthn.exe 41 PID 2076 wrote to memory of 1592 2076 5hbthn.exe 41 PID 2076 wrote to memory of 1592 2076 5hbthn.exe 41 PID 1592 wrote to memory of 2824 1592 lfxflxf.exe 42 PID 1592 wrote to memory of 2824 1592 lfxflxf.exe 42 PID 1592 wrote to memory of 2824 1592 lfxflxf.exe 42 PID 1592 wrote to memory of 2824 1592 lfxflxf.exe 42 PID 2824 wrote to memory of 1420 2824 7btbhn.exe 43 PID 2824 wrote to memory of 1420 2824 7btbhn.exe 43 PID 2824 wrote to memory of 1420 2824 7btbhn.exe 43 PID 2824 wrote to memory of 1420 2824 7btbhn.exe 43 PID 1420 wrote to memory of 2816 1420 9vpvd.exe 44 PID 1420 wrote to memory of 2816 1420 9vpvd.exe 44 PID 1420 wrote to memory of 2816 1420 9vpvd.exe 44 PID 1420 wrote to memory of 2816 1420 9vpvd.exe 44 PID 2816 wrote to memory of 796 2816 5tthbh.exe 45 PID 2816 wrote to memory of 796 2816 5tthbh.exe 45 PID 2816 wrote to memory of 796 2816 5tthbh.exe 45 PID 2816 wrote to memory of 796 2816 5tthbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe"C:\Users\Admin\AppData\Local\Temp\afb83cd9abf45a699b8649748720b3fdd559585d63cfb9b32d272ce3d54daeb4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\nhntbb.exec:\nhntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\dvvvj.exec:\dvvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\9frrrlr.exec:\9frrrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pppvp.exec:\pppvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xxxrxfr.exec:\xxxrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pppdd.exec:\pppdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\5jdpj.exec:\5jdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bbbnth.exec:\bbbnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jjjvj.exec:\jjjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\nbtbnt.exec:\nbtbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\5hbthn.exec:\5hbthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\lfxflxf.exec:\lfxflxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\7btbhn.exec:\7btbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9vpvd.exec:\9vpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\5tthbh.exec:\5tthbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\7jvdd.exec:\7jvdd.exe17⤵
- Executes dropped EXE
PID:796 -
\??\c:\fxrlffx.exec:\fxrlffx.exe18⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nnhbnb.exec:\nnhbnb.exe19⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vpjjp.exec:\vpjjp.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrflrll.exec:\xrflrll.exe21⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pdvvd.exec:\pdvvd.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5xfrrrx.exec:\5xfrrrx.exe23⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tbthnt.exec:\tbthnt.exe24⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pdvvd.exec:\pdvvd.exe25⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xrffrrx.exec:\xrffrrx.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9bbbhh.exec:\9bbbhh.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\nnnbbt.exec:\nnnbbt.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bhtbhh.exec:\bhtbhh.exe29⤵
- Executes dropped EXE
PID:640 -
\??\c:\hthhnn.exec:\hthhnn.exe30⤵
- Executes dropped EXE
PID:884 -
\??\c:\vpddp.exec:\vpddp.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe32⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe33⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe34⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3nbttn.exec:\3nbttn.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3jdvd.exec:\3jdvd.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xrrlfll.exec:\xrrlfll.exe37⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xlflrrx.exec:\xlflrrx.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9tbbbb.exec:\9tbbbb.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vvpvp.exec:\vvpvp.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vdpjd.exec:\vdpjd.exe41⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xlllrrx.exec:\xlllrrx.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5hhhhh.exec:\5hhhhh.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nhnnbh.exec:\nhnnbh.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jjdjv.exec:\jjdjv.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fxrrffl.exec:\fxrrffl.exe46⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe47⤵
- Executes dropped EXE
PID:632 -
\??\c:\tnbntb.exec:\tnbntb.exe48⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jdppv.exec:\jdppv.exe49⤵
- Executes dropped EXE
PID:572 -
\??\c:\pjdjp.exec:\pjdjp.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe51⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ththhn.exec:\ththhn.exe52⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbtthh.exec:\hbtthh.exe53⤵
- Executes dropped EXE
PID:756 -
\??\c:\ppvjj.exec:\ppvjj.exe54⤵
- Executes dropped EXE
PID:532 -
\??\c:\xxlxflr.exec:\xxlxflr.exe55⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5rlxxxl.exec:\5rlxxxl.exe56⤵
- Executes dropped EXE
PID:1544 -
\??\c:\bthnbb.exec:\bthnbb.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vvjjv.exec:\vvjjv.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9pppd.exec:\9pppd.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rxrrxfx.exec:\rxrrxfx.exe60⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nbnnnn.exec:\nbnnnn.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3nhhhh.exec:\3nhhhh.exe62⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jjvvv.exec:\jjvvv.exe63⤵
- Executes dropped EXE
PID:960 -
\??\c:\lxxxlrx.exec:\lxxxlrx.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\3htnnb.exec:\3htnnb.exe65⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5bhbhn.exec:\5bhbhn.exe66⤵PID:764
-
\??\c:\pjjpd.exec:\pjjpd.exe67⤵PID:2296
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe68⤵PID:1436
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe69⤵PID:1876
-
\??\c:\nnhtbb.exec:\nnhtbb.exe70⤵PID:1440
-
\??\c:\vpjjd.exec:\vpjjd.exe71⤵PID:2008
-
\??\c:\ppppj.exec:\ppppj.exe72⤵PID:1752
-
\??\c:\xrxlfrf.exec:\xrxlfrf.exe73⤵PID:1992
-
\??\c:\bthntt.exec:\bthntt.exe74⤵PID:1724
-
\??\c:\thhhbt.exec:\thhhbt.exe75⤵PID:2936
-
\??\c:\jddvj.exec:\jddvj.exe76⤵PID:2348
-
\??\c:\frllxxf.exec:\frllxxf.exe77⤵PID:2716
-
\??\c:\1fxfllx.exec:\1fxfllx.exe78⤵PID:2892
-
\??\c:\bhtnbn.exec:\bhtnbn.exe79⤵PID:2728
-
\??\c:\1thhnh.exec:\1thhnh.exe80⤵PID:2860
-
\??\c:\vvjpv.exec:\vvjpv.exe81⤵PID:2656
-
\??\c:\xrrxflx.exec:\xrrxflx.exe82⤵PID:2932
-
\??\c:\hthnnb.exec:\hthnnb.exe83⤵PID:2648
-
\??\c:\btnntb.exec:\btnntb.exe84⤵PID:2664
-
\??\c:\7pdjp.exec:\7pdjp.exe85⤵PID:1968
-
\??\c:\jddpj.exec:\jddpj.exe86⤵PID:2700
-
\??\c:\fxrxffx.exec:\fxrxffx.exe87⤵PID:476
-
\??\c:\9hnbtb.exec:\9hnbtb.exe88⤵PID:2928
-
\??\c:\tnbhtb.exec:\tnbhtb.exe89⤵PID:2808
-
\??\c:\vpdjv.exec:\vpdjv.exe90⤵PID:572
-
\??\c:\rrlrflx.exec:\rrlrflx.exe91⤵PID:1412
-
\??\c:\hbnntb.exec:\hbnntb.exe92⤵PID:2952
-
\??\c:\nbnnnt.exec:\nbnnnt.exe93⤵PID:1088
-
\??\c:\5vpvp.exec:\5vpvp.exe94⤵PID:840
-
\??\c:\xxrxfrx.exec:\xxrxfrx.exe95⤵PID:2000
-
\??\c:\lflrxfx.exec:\lflrxfx.exe96⤵PID:1164
-
\??\c:\hhhnhn.exec:\hhhnhn.exe97⤵PID:2092
-
\??\c:\vpjjv.exec:\vpjjv.exe98⤵PID:1704
-
\??\c:\9jdvd.exec:\9jdvd.exe99⤵PID:2536
-
\??\c:\llffrrr.exec:\llffrrr.exe100⤵PID:2068
-
\??\c:\5tttbh.exec:\5tttbh.exe101⤵PID:2572
-
\??\c:\7dvdj.exec:\7dvdj.exe102⤵PID:1656
-
\??\c:\jjvvj.exec:\jjvvj.exe103⤵PID:3036
-
\??\c:\xxllxxf.exec:\xxllxxf.exe104⤵PID:1312
-
\??\c:\tnbbbb.exec:\tnbbbb.exe105⤵PID:2604
-
\??\c:\thbtbh.exec:\thbtbh.exe106⤵PID:1488
-
\??\c:\pjvvv.exec:\pjvvv.exe107⤵PID:3016
-
\??\c:\lfxfrlx.exec:\lfxfrlx.exe108⤵PID:2108
-
\??\c:\xrlrllx.exec:\xrlrllx.exe109⤵PID:1872
-
\??\c:\bnnntt.exec:\bnnntt.exe110⤵PID:2168
-
\??\c:\pjvdj.exec:\pjvdj.exe111⤵PID:2180
-
\??\c:\vvdjv.exec:\vvdjv.exe112⤵PID:2008
-
\??\c:\5xflrrf.exec:\5xflrrf.exe113⤵PID:1752
-
\??\c:\bthnnt.exec:\bthnnt.exe114⤵PID:1960
-
\??\c:\9hbhtt.exec:\9hbhtt.exe115⤵PID:3004
-
\??\c:\dpjjp.exec:\dpjjp.exe116⤵PID:2220
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe117⤵PID:2348
-
\??\c:\nthbbb.exec:\nthbbb.exe118⤵PID:2256
-
\??\c:\hbntbb.exec:\hbntbb.exe119⤵PID:2888
-
\??\c:\ddppd.exec:\ddppd.exe120⤵PID:2852
-
\??\c:\rflxxfl.exec:\rflxxfl.exe121⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-