Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe
-
Size
455KB
-
MD5
4408c81524407c77c2f5d538d0590e16
-
SHA1
a95426ff6df0c3a9243879492a0ebd6bea2d799a
-
SHA256
ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91
-
SHA512
4ad5a8bf407742c288e0ccb669e384d434a73889588d0ed174be927d58eea1fa33fca3ea8bcb0523923e868229e534f7f27ac6f272535146330cd7928dd04c89
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1628-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-34-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1812-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-109-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2964-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-210-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/532-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-280-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-334-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2096-373-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2096-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-408-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-443-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2240-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-471-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-490-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-675-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-700-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2980-719-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-740-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-1046-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1392-1072-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2512-1269-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1632-1308-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2284 jjvpd.exe 2212 7xxlflf.exe 1616 dvvdp.exe 1812 7ttbnb.exe 3044 jddjd.exe 2664 nnnbtb.exe 2632 ddvvj.exe 2732 xxxrlxl.exe 2620 dvjpd.exe 2696 hhhnbh.exe 2660 vddpj.exe 2496 7fflllx.exe 2964 nbnnbh.exe 1848 tnhhtt.exe 2388 pjvpv.exe 2024 frrxllf.exe 2040 btbnbb.exe 1524 1xffrrf.exe 2804 nttnht.exe 2952 ffxrxlf.exe 2204 xrlflrf.exe 2944 3dvdj.exe 2572 rlfflfr.exe 532 hhbnnh.exe 1908 ffxfllf.exe 2816 hnbbnn.exe 1324 1dppv.exe 1708 ffrlxfx.exe 2376 nnhnbb.exe 2668 jvpjp.exe 1532 llflrxl.exe 2216 3djpd.exe 2292 djpjj.exe 2244 btnthn.exe 2452 jdjjp.exe 1704 9tthht.exe 1712 pjddj.exe 2256 frxflrf.exe 2304 lrrfrlx.exe 2908 nnhthn.exe 2404 vpvdj.exe 2016 9flrffr.exe 2856 tnhhnn.exe 2096 jddpv.exe 3060 vvppd.exe 2612 flrxlrf.exe 2700 tnhhtb.exe 2620 dddjp.exe 2528 rxxfrxx.exe 2476 1ffrxlr.exe 2548 tbhtnb.exe 2108 ddpvj.exe 3024 flrfxfr.exe 1012 ffxlrfr.exe 2240 1htbht.exe 1984 djjjp.exe 1656 lllfxlf.exe 2252 hbntbb.exe 1824 nnnnhh.exe 1736 vvdpv.exe 2840 fxxrxfl.exe 2936 ffxlxlf.exe 1764 nntbht.exe 1356 pjdjj.exe -
resource yara_rule behavioral1/memory/1628-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-719-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1676-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-1140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-1190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-1239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-1277-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2284 1628 ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe 28 PID 1628 wrote to memory of 2284 1628 ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe 28 PID 1628 wrote to memory of 2284 1628 ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe 28 PID 1628 wrote to memory of 2284 1628 ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe 28 PID 2284 wrote to memory of 2212 2284 jjvpd.exe 29 PID 2284 wrote to memory of 2212 2284 jjvpd.exe 29 PID 2284 wrote to memory of 2212 2284 jjvpd.exe 29 PID 2284 wrote to memory of 2212 2284 jjvpd.exe 29 PID 2212 wrote to memory of 1616 2212 7xxlflf.exe 30 PID 2212 wrote to memory of 1616 2212 7xxlflf.exe 30 PID 2212 wrote to memory of 1616 2212 7xxlflf.exe 30 PID 2212 wrote to memory of 1616 2212 7xxlflf.exe 30 PID 1616 wrote to memory of 1812 1616 dvvdp.exe 31 PID 1616 wrote to memory of 1812 1616 dvvdp.exe 31 PID 1616 wrote to memory of 1812 1616 dvvdp.exe 31 PID 1616 wrote to memory of 1812 1616 dvvdp.exe 31 PID 1812 wrote to memory of 3044 1812 7ttbnb.exe 32 PID 1812 wrote to memory of 3044 1812 7ttbnb.exe 32 PID 1812 wrote to memory of 3044 1812 7ttbnb.exe 32 PID 1812 wrote to memory of 3044 1812 7ttbnb.exe 32 PID 3044 wrote to memory of 2664 3044 jddjd.exe 33 PID 3044 wrote to memory of 2664 3044 jddjd.exe 33 PID 3044 wrote to memory of 2664 3044 jddjd.exe 33 PID 3044 wrote to memory of 2664 3044 jddjd.exe 33 PID 2664 wrote to memory of 2632 2664 nnnbtb.exe 34 PID 2664 wrote to memory of 2632 2664 nnnbtb.exe 34 PID 2664 wrote to memory of 2632 2664 nnnbtb.exe 34 PID 2664 wrote to memory of 2632 2664 nnnbtb.exe 34 PID 2632 wrote to memory of 2732 2632 ddvvj.exe 35 PID 2632 wrote to memory of 2732 2632 ddvvj.exe 35 PID 2632 wrote to memory of 2732 2632 ddvvj.exe 35 PID 2632 wrote to memory of 2732 2632 ddvvj.exe 35 PID 2732 wrote to memory of 2620 2732 xxxrlxl.exe 36 PID 2732 wrote to memory of 2620 2732 xxxrlxl.exe 36 PID 2732 wrote to memory of 2620 2732 xxxrlxl.exe 36 PID 2732 wrote to memory of 2620 2732 xxxrlxl.exe 36 PID 2620 wrote to memory of 2696 2620 dvjpd.exe 37 PID 2620 wrote to memory of 2696 2620 dvjpd.exe 37 PID 2620 wrote to memory of 2696 2620 dvjpd.exe 37 PID 2620 wrote to memory of 2696 2620 dvjpd.exe 37 PID 2696 wrote to memory of 2660 2696 hhhnbh.exe 38 PID 2696 wrote to memory of 2660 2696 hhhnbh.exe 38 PID 2696 wrote to memory of 2660 2696 hhhnbh.exe 38 PID 2696 wrote to memory of 2660 2696 hhhnbh.exe 38 PID 2660 wrote to memory of 2496 2660 vddpj.exe 39 PID 2660 wrote to memory of 2496 2660 vddpj.exe 39 PID 2660 wrote to memory of 2496 2660 vddpj.exe 39 PID 2660 wrote to memory of 2496 2660 vddpj.exe 39 PID 2496 wrote to memory of 2964 2496 7fflllx.exe 40 PID 2496 wrote to memory of 2964 2496 7fflllx.exe 40 PID 2496 wrote to memory of 2964 2496 7fflllx.exe 40 PID 2496 wrote to memory of 2964 2496 7fflllx.exe 40 PID 2964 wrote to memory of 1848 2964 nbnnbh.exe 41 PID 2964 wrote to memory of 1848 2964 nbnnbh.exe 41 PID 2964 wrote to memory of 1848 2964 nbnnbh.exe 41 PID 2964 wrote to memory of 1848 2964 nbnnbh.exe 41 PID 1848 wrote to memory of 2388 1848 tnhhtt.exe 42 PID 1848 wrote to memory of 2388 1848 tnhhtt.exe 42 PID 1848 wrote to memory of 2388 1848 tnhhtt.exe 42 PID 1848 wrote to memory of 2388 1848 tnhhtt.exe 42 PID 2388 wrote to memory of 2024 2388 pjvpv.exe 43 PID 2388 wrote to memory of 2024 2388 pjvpv.exe 43 PID 2388 wrote to memory of 2024 2388 pjvpv.exe 43 PID 2388 wrote to memory of 2024 2388 pjvpv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe"C:\Users\Admin\AppData\Local\Temp\ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jjvpd.exec:\jjvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\7xxlflf.exec:\7xxlflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dvvdp.exec:\dvvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\7ttbnb.exec:\7ttbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\jddjd.exec:\jddjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\nnnbtb.exec:\nnnbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ddvvj.exec:\ddvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xxxrlxl.exec:\xxxrlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dvjpd.exec:\dvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hhhnbh.exec:\hhhnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vddpj.exec:\vddpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7fflllx.exec:\7fflllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\nbnnbh.exec:\nbnnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\tnhhtt.exec:\tnhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\pjvpv.exec:\pjvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\frrxllf.exec:\frrxllf.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\btbnbb.exec:\btbnbb.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1xffrrf.exec:\1xffrrf.exe19⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nttnht.exec:\nttnht.exe20⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ffxrxlf.exec:\ffxrxlf.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xrlflrf.exec:\xrlflrf.exe22⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3dvdj.exec:\3dvdj.exe23⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlfflfr.exec:\rlfflfr.exe24⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hhbnnh.exec:\hhbnnh.exe25⤵
- Executes dropped EXE
PID:532 -
\??\c:\ffxfllf.exec:\ffxfllf.exe26⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hnbbnn.exec:\hnbbnn.exe27⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1dppv.exec:\1dppv.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ffrlxfx.exec:\ffrlxfx.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nnhnbb.exec:\nnhnbb.exe30⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jvpjp.exec:\jvpjp.exe31⤵
- Executes dropped EXE
PID:2668 -
\??\c:\llflrxl.exec:\llflrxl.exe32⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3djpd.exec:\3djpd.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\djpjj.exec:\djpjj.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\btnthn.exec:\btnthn.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jdjjp.exec:\jdjjp.exe36⤵
- Executes dropped EXE
PID:2452 -
\??\c:\9tthht.exec:\9tthht.exe37⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pjddj.exec:\pjddj.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\frxflrf.exec:\frxflrf.exe39⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe40⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nnhthn.exec:\nnhthn.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpvdj.exec:\vpvdj.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9flrffr.exec:\9flrffr.exe43⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tnhhnn.exec:\tnhhnn.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jddpv.exec:\jddpv.exe45⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vvppd.exec:\vvppd.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\flrxlrf.exec:\flrxlrf.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnhhtb.exec:\tnhhtb.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dddjp.exec:\dddjp.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rxxfrxx.exec:\rxxfrxx.exe50⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1ffrxlr.exec:\1ffrxlr.exe51⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tbhtnb.exec:\tbhtnb.exe52⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ddpvj.exec:\ddpvj.exe53⤵
- Executes dropped EXE
PID:2108 -
\??\c:\flrfxfr.exec:\flrfxfr.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ffxlrfr.exec:\ffxlrfr.exe55⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1htbht.exec:\1htbht.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\djjjp.exec:\djjjp.exe57⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lllfxlf.exec:\lllfxlf.exe58⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hbntbb.exec:\hbntbb.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nnnnhh.exec:\nnnnhh.exe60⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvdpv.exec:\vvdpv.exe61⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fxxrxfl.exec:\fxxrxfl.exe62⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe63⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nntbht.exec:\nntbht.exe64⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pjdjj.exec:\pjdjj.exe65⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1frrffr.exec:\1frrffr.exe66⤵PID:1292
-
\??\c:\lllxlrl.exec:\lllxlrl.exe67⤵PID:1104
-
\??\c:\7tnhth.exec:\7tnhth.exe68⤵PID:2468
-
\??\c:\ddjvd.exec:\ddjvd.exe69⤵PID:1544
-
\??\c:\rrrxlxl.exec:\rrrxlxl.exe70⤵PID:612
-
\??\c:\rrlfrlx.exec:\rrlfrlx.exe71⤵PID:1284
-
\??\c:\9bthbb.exec:\9bthbb.exe72⤵PID:896
-
\??\c:\jjjvd.exec:\jjjvd.exe73⤵PID:1708
-
\??\c:\xflfxlr.exec:\xflfxlr.exe74⤵PID:2196
-
\??\c:\rlxflrx.exec:\rlxflrx.exe75⤵PID:592
-
\??\c:\thtbtt.exec:\thtbtt.exe76⤵PID:3056
-
\??\c:\vdvdp.exec:\vdvdp.exe77⤵PID:1532
-
\??\c:\vdjvv.exec:\vdjvv.exe78⤵PID:1036
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe79⤵PID:2224
-
\??\c:\tnbnth.exec:\tnbnth.exe80⤵PID:1624
-
\??\c:\1pjvj.exec:\1pjvj.exe81⤵PID:1592
-
\??\c:\xxfrfrl.exec:\xxfrfrl.exe82⤵PID:1596
-
\??\c:\fxrlxll.exec:\fxrlxll.exe83⤵PID:1224
-
\??\c:\3btbtb.exec:\3btbtb.exe84⤵PID:2408
-
\??\c:\5vpdj.exec:\5vpdj.exe85⤵PID:316
-
\??\c:\rrfflll.exec:\rrfflll.exe86⤵PID:2920
-
\??\c:\3lrrrxr.exec:\3lrrrxr.exe87⤵PID:2940
-
\??\c:\htttnn.exec:\htttnn.exe88⤵PID:2148
-
\??\c:\jdppj.exec:\jdppj.exe89⤵PID:2704
-
\??\c:\7pdpp.exec:\7pdpp.exe90⤵PID:2740
-
\??\c:\rrfrxlx.exec:\rrfrxlx.exe91⤵PID:2640
-
\??\c:\hbthbn.exec:\hbthbn.exe92⤵PID:2488
-
\??\c:\9djpv.exec:\9djpv.exe93⤵PID:2508
-
\??\c:\5dvjv.exec:\5dvjv.exe94⤵PID:2696
-
\??\c:\lllxlxl.exec:\lllxlxl.exe95⤵PID:2424
-
\??\c:\hhthth.exec:\hhthth.exe96⤵PID:2484
-
\??\c:\jpdjv.exec:\jpdjv.exe97⤵PID:2968
-
\??\c:\xfflxfr.exec:\xfflxfr.exe98⤵PID:2980
-
\??\c:\xxfrfrr.exec:\xxfrfrr.exe99⤵PID:1752
-
\??\c:\nhhnbn.exec:\nhhnbn.exe100⤵PID:1516
-
\??\c:\vdpdp.exec:\vdpdp.exe101⤵PID:2248
-
\??\c:\dvjpv.exec:\dvjpv.exe102⤵PID:1652
-
\??\c:\fxrrxfx.exec:\fxrrxfx.exe103⤵PID:1676
-
\??\c:\9bhbbb.exec:\9bhbbb.exe104⤵PID:1788
-
\??\c:\dvpjj.exec:\dvpjj.exe105⤵PID:2760
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe106⤵PID:2784
-
\??\c:\llxlxrl.exec:\llxlxrl.exe107⤵PID:2800
-
\??\c:\bbtttb.exec:\bbtttb.exe108⤵PID:1804
-
\??\c:\3vdjd.exec:\3vdjd.exe109⤵PID:2948
-
\??\c:\xxrflxr.exec:\xxrflxr.exe110⤵PID:2764
-
\??\c:\lllxrfr.exec:\lllxrfr.exe111⤵PID:2088
-
\??\c:\bbbhth.exec:\bbbhth.exe112⤵PID:3004
-
\??\c:\bhhnbn.exec:\bhhnbn.exe113⤵PID:1608
-
\??\c:\jpvjd.exec:\jpvjd.exe114⤵PID:948
-
\??\c:\xffrfxf.exec:\xffrfxf.exe115⤵PID:1772
-
\??\c:\bhhtht.exec:\bhhtht.exe116⤵PID:772
-
\??\c:\hhbnhn.exec:\hhbnhn.exe117⤵PID:1668
-
\??\c:\jjjvj.exec:\jjjvj.exe118⤵PID:1996
-
\??\c:\xffxfrx.exec:\xffxfrx.exe119⤵PID:2208
-
\??\c:\tnnbht.exec:\tnnbht.exe120⤵PID:1972
-
\??\c:\9dddp.exec:\9dddp.exe121⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-