Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe
-
Size
453KB
-
MD5
1cb30e45b0ec8e92cd12f8f4ef624117
-
SHA1
f13ac8129b511014ec189bd4205cae332f25e3a3
-
SHA256
7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d
-
SHA512
731de5fdb6ec0ff9af8a5a4e8f0c2823bcc5d7028f6604ceaa9fe82abe0a4bb2a7b341b5188f2770d83b0f59847e21ead9b93c3cd3b68b9302f4bf435aa679a4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1788-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-114-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2180-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-253-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-274-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-339-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2792-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-418-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1420-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-688-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-689-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-702-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-1031-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2316-1040-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2908-1053-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1684-1136-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/964-1238-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1792-1290-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 xxrfrrl.exe 852 ppjpd.exe 2240 5fxflrx.exe 2300 xrrxfrx.exe 2884 btbbhh.exe 2876 ttnnnn.exe 2896 1jvdv.exe 2612 7bnbnt.exe 2888 btnnht.exe 2660 rxllrfl.exe 2180 btnnbh.exe 776 vvjpd.exe 1032 xflfxfl.exe 284 9bnhhh.exe 844 1pvpv.exe 2000 tbhntt.exe 2644 tntttt.exe 2924 ddvdd.exe 3024 fxlrxxl.exe 1792 ddpdv.exe 560 jvppd.exe 1092 hhnhnn.exe 1624 djvjp.exe 1992 7hhhhh.exe 1364 vpdvd.exe 976 xrffrrx.exe 1656 rrlrflx.exe 3060 7tnbbb.exe 3012 9jvjv.exe 2308 vpppd.exe 812 3nbntn.exe 1272 jdvjp.exe 1584 rlllllr.exe 3056 hbnbnh.exe 2380 9tnhhb.exe 2952 vvdpp.exe 2740 rfrlfxf.exe 2892 xrxrrrr.exe 2736 bbnhhb.exe 2448 jvjdd.exe 2792 rfrrffr.exe 2608 bnbthh.exe 2612 jdvvj.exe 2636 dvvdv.exe 1704 1frrfxf.exe 1832 hbtthh.exe 688 jjvdp.exe 2396 9xrrrrx.exe 1524 lxlrffl.exe 1480 nthhtt.exe 1620 1vppv.exe 1800 jvjjd.exe 2572 rfrflrx.exe 1420 hbhntt.exe 1756 dvjjp.exe 2800 djdpd.exe 2424 flflxfr.exe 2088 5nbbhh.exe 344 htnbtb.exe 1816 9dvpd.exe 448 rlflxxl.exe 1044 rlffrxf.exe 1664 3bhbhh.exe 2012 ddvdj.exe -
resource yara_rule behavioral1/memory/1788-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-1054-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-1086-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-1129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-1167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-1245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-1284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-1290-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2188 1788 7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe 30 PID 1788 wrote to memory of 2188 1788 7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe 30 PID 1788 wrote to memory of 2188 1788 7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe 30 PID 1788 wrote to memory of 2188 1788 7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe 30 PID 2188 wrote to memory of 852 2188 xxrfrrl.exe 31 PID 2188 wrote to memory of 852 2188 xxrfrrl.exe 31 PID 2188 wrote to memory of 852 2188 xxrfrrl.exe 31 PID 2188 wrote to memory of 852 2188 xxrfrrl.exe 31 PID 852 wrote to memory of 2240 852 ppjpd.exe 32 PID 852 wrote to memory of 2240 852 ppjpd.exe 32 PID 852 wrote to memory of 2240 852 ppjpd.exe 32 PID 852 wrote to memory of 2240 852 ppjpd.exe 32 PID 2240 wrote to memory of 2300 2240 5fxflrx.exe 33 PID 2240 wrote to memory of 2300 2240 5fxflrx.exe 33 PID 2240 wrote to memory of 2300 2240 5fxflrx.exe 33 PID 2240 wrote to memory of 2300 2240 5fxflrx.exe 33 PID 2300 wrote to memory of 2884 2300 xrrxfrx.exe 34 PID 2300 wrote to memory of 2884 2300 xrrxfrx.exe 34 PID 2300 wrote to memory of 2884 2300 xrrxfrx.exe 34 PID 2300 wrote to memory of 2884 2300 xrrxfrx.exe 34 PID 2884 wrote to memory of 2876 2884 btbbhh.exe 35 PID 2884 wrote to memory of 2876 2884 btbbhh.exe 35 PID 2884 wrote to memory of 2876 2884 btbbhh.exe 35 PID 2884 wrote to memory of 2876 2884 btbbhh.exe 35 PID 2876 wrote to memory of 2896 2876 ttnnnn.exe 36 PID 2876 wrote to memory of 2896 2876 ttnnnn.exe 36 PID 2876 wrote to memory of 2896 2876 ttnnnn.exe 36 PID 2876 wrote to memory of 2896 2876 ttnnnn.exe 36 PID 2896 wrote to memory of 2612 2896 1jvdv.exe 37 PID 2896 wrote to memory of 2612 2896 1jvdv.exe 37 PID 2896 wrote to memory of 2612 2896 1jvdv.exe 37 PID 2896 wrote to memory of 2612 2896 1jvdv.exe 37 PID 2612 wrote to memory of 2888 2612 7bnbnt.exe 38 PID 2612 wrote to memory of 2888 2612 7bnbnt.exe 38 PID 2612 wrote to memory of 2888 2612 7bnbnt.exe 38 PID 2612 wrote to memory of 2888 2612 7bnbnt.exe 38 PID 2888 wrote to memory of 2660 2888 btnnht.exe 39 PID 2888 wrote to memory of 2660 2888 btnnht.exe 39 PID 2888 wrote to memory of 2660 2888 btnnht.exe 39 PID 2888 wrote to memory of 2660 2888 btnnht.exe 39 PID 2660 wrote to memory of 2180 2660 rxllrfl.exe 40 PID 2660 wrote to memory of 2180 2660 rxllrfl.exe 40 PID 2660 wrote to memory of 2180 2660 rxllrfl.exe 40 PID 2660 wrote to memory of 2180 2660 rxllrfl.exe 40 PID 2180 wrote to memory of 776 2180 btnnbh.exe 41 PID 2180 wrote to memory of 776 2180 btnnbh.exe 41 PID 2180 wrote to memory of 776 2180 btnnbh.exe 41 PID 2180 wrote to memory of 776 2180 btnnbh.exe 41 PID 776 wrote to memory of 1032 776 vvjpd.exe 42 PID 776 wrote to memory of 1032 776 vvjpd.exe 42 PID 776 wrote to memory of 1032 776 vvjpd.exe 42 PID 776 wrote to memory of 1032 776 vvjpd.exe 42 PID 1032 wrote to memory of 284 1032 xflfxfl.exe 43 PID 1032 wrote to memory of 284 1032 xflfxfl.exe 43 PID 1032 wrote to memory of 284 1032 xflfxfl.exe 43 PID 1032 wrote to memory of 284 1032 xflfxfl.exe 43 PID 284 wrote to memory of 844 284 9bnhhh.exe 44 PID 284 wrote to memory of 844 284 9bnhhh.exe 44 PID 284 wrote to memory of 844 284 9bnhhh.exe 44 PID 284 wrote to memory of 844 284 9bnhhh.exe 44 PID 844 wrote to memory of 2000 844 1pvpv.exe 45 PID 844 wrote to memory of 2000 844 1pvpv.exe 45 PID 844 wrote to memory of 2000 844 1pvpv.exe 45 PID 844 wrote to memory of 2000 844 1pvpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe"C:\Users\Admin\AppData\Local\Temp\7fa49a806fe4533617e06102ca38412714f8002c8f01a8fc28665fe979de401d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\xxrfrrl.exec:\xxrfrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\ppjpd.exec:\ppjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\5fxflrx.exec:\5fxflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\xrrxfrx.exec:\xrrxfrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\btbbhh.exec:\btbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ttnnnn.exec:\ttnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1jvdv.exec:\1jvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\7bnbnt.exec:\7bnbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\btnnht.exec:\btnnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rxllrfl.exec:\rxllrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\btnnbh.exec:\btnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vvjpd.exec:\vvjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\xflfxfl.exec:\xflfxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\9bnhhh.exec:\9bnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\1pvpv.exec:\1pvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\tbhntt.exec:\tbhntt.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tntttt.exec:\tntttt.exe18⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ddvdd.exec:\ddvdd.exe19⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe20⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ddpdv.exec:\ddpdv.exe21⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jvppd.exec:\jvppd.exe22⤵
- Executes dropped EXE
PID:560 -
\??\c:\hhnhnn.exec:\hhnhnn.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\djvjp.exec:\djvjp.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7hhhhh.exec:\7hhhhh.exe25⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vpdvd.exec:\vpdvd.exe26⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xrffrrx.exec:\xrffrrx.exe27⤵
- Executes dropped EXE
PID:976 -
\??\c:\rrlrflx.exec:\rrlrflx.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7tnbbb.exec:\7tnbbb.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9jvjv.exec:\9jvjv.exe30⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vpppd.exec:\vpppd.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3nbntn.exec:\3nbntn.exe32⤵
- Executes dropped EXE
PID:812 -
\??\c:\jdvjp.exec:\jdvjp.exe33⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rlllllr.exec:\rlllllr.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hbnbnh.exec:\hbnbnh.exe35⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9tnhhb.exec:\9tnhhb.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vvdpp.exec:\vvdpp.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rfrlfxf.exec:\rfrlfxf.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bbnhhb.exec:\bbnhhb.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jvjdd.exec:\jvjdd.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rfrrffr.exec:\rfrrffr.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bnbthh.exec:\bnbthh.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jdvvj.exec:\jdvvj.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dvvdv.exec:\dvvdv.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1frrfxf.exec:\1frrfxf.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1704 -
\??\c:\hbtthh.exec:\hbtthh.exe47⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jjvdp.exec:\jjvdp.exe48⤵
- Executes dropped EXE
PID:688 -
\??\c:\9xrrrrx.exec:\9xrrrrx.exe49⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lxlrffl.exec:\lxlrffl.exe50⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nthhtt.exec:\nthhtt.exe51⤵
- Executes dropped EXE
PID:1480 -
\??\c:\1vppv.exec:\1vppv.exe52⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jvjjd.exec:\jvjjd.exe53⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rfrflrx.exec:\rfrflrx.exe54⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hbhntt.exec:\hbhntt.exe55⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dvjjp.exec:\dvjjp.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1756 -
\??\c:\djdpd.exec:\djdpd.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\flflxfr.exec:\flflxfr.exe58⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5nbbhh.exec:\5nbbhh.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\htnbtb.exec:\htnbtb.exe60⤵
- Executes dropped EXE
PID:344 -
\??\c:\9dvpd.exec:\9dvpd.exe61⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rlflxxl.exec:\rlflxxl.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\rlffrxf.exec:\rlffrxf.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\3bhbhh.exec:\3bhbhh.exe64⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ddvdj.exec:\ddvdj.exe65⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rrllxxl.exec:\rrllxxl.exe66⤵PID:1352
-
\??\c:\nhbhnn.exec:\nhbhnn.exe67⤵PID:568
-
\??\c:\1hnnnn.exec:\1hnnnn.exe68⤵PID:2284
-
\??\c:\pjdjj.exec:\pjdjj.exe69⤵PID:1656
-
\??\c:\vppvd.exec:\vppvd.exe70⤵PID:788
-
\??\c:\ffrrffr.exec:\ffrrffr.exe71⤵PID:2404
-
\??\c:\hbntbb.exec:\hbntbb.exe72⤵PID:2144
-
\??\c:\tnbhhh.exec:\tnbhhh.exe73⤵PID:2308
-
\??\c:\pdvvd.exec:\pdvvd.exe74⤵PID:896
-
\??\c:\9xlfflr.exec:\9xlfflr.exe75⤵
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\xrlrflx.exec:\xrlrflx.exe76⤵PID:1588
-
\??\c:\ttbhnn.exec:\ttbhnn.exe77⤵PID:2524
-
\??\c:\3hnntt.exec:\3hnntt.exe78⤵PID:2484
-
\??\c:\jdpvd.exec:\jdpvd.exe79⤵PID:2184
-
\??\c:\llrlxxf.exec:\llrlxxf.exe80⤵PID:2148
-
\??\c:\bnttht.exec:\bnttht.exe81⤵PID:2900
-
\??\c:\tbhnbh.exec:\tbhnbh.exe82⤵PID:2844
-
\??\c:\vvvdp.exec:\vvvdp.exe83⤵PID:2864
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe84⤵PID:2860
-
\??\c:\lfrrflr.exec:\lfrrflr.exe85⤵PID:2808
-
\??\c:\9bttbh.exec:\9bttbh.exe86⤵PID:2632
-
\??\c:\hbnhbb.exec:\hbnhbb.exe87⤵PID:2928
-
\??\c:\jdvvp.exec:\jdvvp.exe88⤵PID:2648
-
\??\c:\1fxrxxf.exec:\1fxrxxf.exe89⤵PID:2660
-
\??\c:\llxfrxf.exec:\llxfrxf.exe90⤵PID:2416
-
\??\c:\hhtbhh.exec:\hhtbhh.exe91⤵PID:1844
-
\??\c:\nbtnbt.exec:\nbtnbt.exe92⤵PID:776
-
\??\c:\vpjdj.exec:\vpjdj.exe93⤵PID:1304
-
\??\c:\rlxrflr.exec:\rlxrflr.exe94⤵PID:2412
-
\??\c:\nbbhtb.exec:\nbbhtb.exe95⤵PID:1468
-
\??\c:\nhtbtt.exec:\nhtbtt.exe96⤵PID:580
-
\??\c:\jjdpv.exec:\jjdpv.exe97⤵PID:1808
-
\??\c:\rrffxxf.exec:\rrffxxf.exe98⤵PID:2032
-
\??\c:\llflxxl.exec:\llflxxl.exe99⤵PID:2652
-
\??\c:\hbthnb.exec:\hbthnb.exe100⤵PID:2436
-
\??\c:\vjpjp.exec:\vjpjp.exe101⤵PID:2164
-
\??\c:\rxxxlrf.exec:\rxxxlrf.exe102⤵PID:2424
-
\??\c:\5bbbnn.exec:\5bbbnn.exe103⤵PID:1720
-
\??\c:\nbhbhb.exec:\nbhbhb.exe104⤵PID:344
-
\??\c:\5vpvd.exec:\5vpvd.exe105⤵PID:1816
-
\??\c:\lffrxxx.exec:\lffrxxx.exe106⤵PID:1744
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe107⤵PID:2908
-
\??\c:\hhthnt.exec:\hhthnt.exe108⤵PID:1664
-
\??\c:\5bnttb.exec:\5bnttb.exe109⤵PID:1672
-
\??\c:\dvppd.exec:\dvppd.exe110⤵PID:1352
-
\??\c:\5fffrrx.exec:\5fffrrx.exe111⤵PID:1036
-
\??\c:\lfflllr.exec:\lfflllr.exe112⤵PID:584
-
\??\c:\btnttt.exec:\btnttt.exe113⤵PID:1656
-
\??\c:\3vjjp.exec:\3vjjp.exe114⤵PID:3060
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe115⤵PID:2404
-
\??\c:\rfllxxf.exec:\rfllxxf.exe116⤵PID:1556
-
\??\c:\tthtbh.exec:\tthtbh.exe117⤵PID:2364
-
\??\c:\7ttttn.exec:\7ttttn.exe118⤵PID:888
-
\??\c:\jvdvv.exec:\jvdvv.exe119⤵PID:2664
-
\??\c:\7fxxffl.exec:\7fxxffl.exe120⤵PID:1684
-
\??\c:\frrrrrr.exec:\frrrrrr.exe121⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-