Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe
-
Size
455KB
-
MD5
06f04c9fedab81839549ae9925be4022
-
SHA1
a4b3bca993f3a23c3a877e40a2a308d674522c57
-
SHA256
514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f
-
SHA512
97646e9ab16cbed9d57c2e64829767ffd8552c4785c32765fe4bf824ab0b83f6031e60cf3837f87315b2fdf1bc30fce26acad009236e269dc90fd2d4389483e2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/1748-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-52-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-91-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2600-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-247-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/960-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-342-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-363-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-377-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2732-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-437-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1012-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-450-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1944-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-611-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1576-712-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2428-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-788-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2852-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-828-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2336-958-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2648-984-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-1016-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-1097-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-1116-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/796-1182-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1592-1190-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2228 ffxlxxl.exe 1224 hnhtnb.exe 2304 7rfxrxx.exe 2396 1btnbt.exe 2916 hbhthn.exe 2120 ddjdv.exe 2352 djjvv.exe 2704 jvvdv.exe 2644 djvjp.exe 2364 flfllxx.exe 2772 9vpvp.exe 2600 jpjvj.exe 2532 vvddd.exe 2540 nnhntb.exe 572 ppjpj.exe 1604 xrrrrlr.exe 2248 pjdjv.exe 1652 xxfrlrl.exe 1864 hbhtnt.exe 2796 vvpdp.exe 3012 7nhtbn.exe 2136 1fllllx.exe 1392 hbhnht.exe 404 rxxlxlx.exe 1780 hhthbh.exe 1396 rrrfxlx.exe 2128 tnnbnb.exe 1288 nnnbnh.exe 828 rlfrflf.exe 264 vvpdd.exe 1020 pppvp.exe 1092 dvppv.exe 960 7lrllfx.exe 872 bhthhh.exe 2224 1hbnht.exe 2032 vpjvj.exe 2276 rrrfxll.exe 2452 xxxlxlf.exe 2304 3btbnb.exe 1616 pjpvd.exe 2912 jjdjv.exe 2416 rrxlxlf.exe 2664 tttbth.exe 2592 jpvpv.exe 2096 xxfrrfx.exe 2732 nnhnbh.exe 2744 bbbbht.exe 2648 5pdjp.exe 2748 ffflxfr.exe 2504 5hnnht.exe 2524 bbbhnb.exe 2500 pppdd.exe 2980 flfrfxl.exe 1752 lfxlxfr.exe 1012 hbnhth.exe 1920 nnntnt.exe 2040 1rrxxfr.exe 1856 9tbhnb.exe 1988 nnhthh.exe 2252 ddddp.exe 1944 xlrxxfl.exe 2956 fxxlrfr.exe 1424 hhhtnt.exe 2384 7dvdp.exe -
resource yara_rule behavioral1/memory/1748-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-854-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-922-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-1072-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-1097-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-1116-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/3032-1224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-1249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-1287-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9httht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btbnb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2228 1748 514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe 28 PID 1748 wrote to memory of 2228 1748 514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe 28 PID 1748 wrote to memory of 2228 1748 514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe 28 PID 1748 wrote to memory of 2228 1748 514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe 28 PID 2228 wrote to memory of 1224 2228 ffxlxxl.exe 29 PID 2228 wrote to memory of 1224 2228 ffxlxxl.exe 29 PID 2228 wrote to memory of 1224 2228 ffxlxxl.exe 29 PID 2228 wrote to memory of 1224 2228 ffxlxxl.exe 29 PID 1224 wrote to memory of 2304 1224 hnhtnb.exe 30 PID 1224 wrote to memory of 2304 1224 hnhtnb.exe 30 PID 1224 wrote to memory of 2304 1224 hnhtnb.exe 30 PID 1224 wrote to memory of 2304 1224 hnhtnb.exe 30 PID 2304 wrote to memory of 2396 2304 7rfxrxx.exe 31 PID 2304 wrote to memory of 2396 2304 7rfxrxx.exe 31 PID 2304 wrote to memory of 2396 2304 7rfxrxx.exe 31 PID 2304 wrote to memory of 2396 2304 7rfxrxx.exe 31 PID 2396 wrote to memory of 2916 2396 1btnbt.exe 32 PID 2396 wrote to memory of 2916 2396 1btnbt.exe 32 PID 2396 wrote to memory of 2916 2396 1btnbt.exe 32 PID 2396 wrote to memory of 2916 2396 1btnbt.exe 32 PID 2916 wrote to memory of 2120 2916 hbhthn.exe 33 PID 2916 wrote to memory of 2120 2916 hbhthn.exe 33 PID 2916 wrote to memory of 2120 2916 hbhthn.exe 33 PID 2916 wrote to memory of 2120 2916 hbhthn.exe 33 PID 2120 wrote to memory of 2352 2120 ddjdv.exe 34 PID 2120 wrote to memory of 2352 2120 ddjdv.exe 34 PID 2120 wrote to memory of 2352 2120 ddjdv.exe 34 PID 2120 wrote to memory of 2352 2120 ddjdv.exe 34 PID 2352 wrote to memory of 2704 2352 djjvv.exe 35 PID 2352 wrote to memory of 2704 2352 djjvv.exe 35 PID 2352 wrote to memory of 2704 2352 djjvv.exe 35 PID 2352 wrote to memory of 2704 2352 djjvv.exe 35 PID 2704 wrote to memory of 2644 2704 jvvdv.exe 36 PID 2704 wrote to memory of 2644 2704 jvvdv.exe 36 PID 2704 wrote to memory of 2644 2704 jvvdv.exe 36 PID 2704 wrote to memory of 2644 2704 jvvdv.exe 36 PID 2644 wrote to memory of 2364 2644 djvjp.exe 37 PID 2644 wrote to memory of 2364 2644 djvjp.exe 37 PID 2644 wrote to memory of 2364 2644 djvjp.exe 37 PID 2644 wrote to memory of 2364 2644 djvjp.exe 37 PID 2364 wrote to memory of 2772 2364 flfllxx.exe 38 PID 2364 wrote to memory of 2772 2364 flfllxx.exe 38 PID 2364 wrote to memory of 2772 2364 flfllxx.exe 38 PID 2364 wrote to memory of 2772 2364 flfllxx.exe 38 PID 2772 wrote to memory of 2600 2772 9vpvp.exe 39 PID 2772 wrote to memory of 2600 2772 9vpvp.exe 39 PID 2772 wrote to memory of 2600 2772 9vpvp.exe 39 PID 2772 wrote to memory of 2600 2772 9vpvp.exe 39 PID 2600 wrote to memory of 2532 2600 jpjvj.exe 40 PID 2600 wrote to memory of 2532 2600 jpjvj.exe 40 PID 2600 wrote to memory of 2532 2600 jpjvj.exe 40 PID 2600 wrote to memory of 2532 2600 jpjvj.exe 40 PID 2532 wrote to memory of 2540 2532 vvddd.exe 41 PID 2532 wrote to memory of 2540 2532 vvddd.exe 41 PID 2532 wrote to memory of 2540 2532 vvddd.exe 41 PID 2532 wrote to memory of 2540 2532 vvddd.exe 41 PID 2540 wrote to memory of 572 2540 nnhntb.exe 42 PID 2540 wrote to memory of 572 2540 nnhntb.exe 42 PID 2540 wrote to memory of 572 2540 nnhntb.exe 42 PID 2540 wrote to memory of 572 2540 nnhntb.exe 42 PID 572 wrote to memory of 1604 572 ppjpj.exe 43 PID 572 wrote to memory of 1604 572 ppjpj.exe 43 PID 572 wrote to memory of 1604 572 ppjpj.exe 43 PID 572 wrote to memory of 1604 572 ppjpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe"C:\Users\Admin\AppData\Local\Temp\514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\hnhtnb.exec:\hnhtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\7rfxrxx.exec:\7rfxrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1btnbt.exec:\1btnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hbhthn.exec:\hbhthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ddjdv.exec:\ddjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\djjvv.exec:\djjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jvvdv.exec:\jvvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\djvjp.exec:\djvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\flfllxx.exec:\flfllxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\9vpvp.exec:\9vpvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jpjvj.exec:\jpjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vvddd.exec:\vvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nnhntb.exec:\nnhntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\ppjpj.exec:\ppjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\xrrrrlr.exec:\xrrrrlr.exe17⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pjdjv.exec:\pjdjv.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xxfrlrl.exec:\xxfrlrl.exe19⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbhtnt.exec:\hbhtnt.exe20⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vvpdp.exec:\vvpdp.exe21⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7nhtbn.exec:\7nhtbn.exe22⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1fllllx.exec:\1fllllx.exe23⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbhnht.exec:\hbhnht.exe24⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rxxlxlx.exec:\rxxlxlx.exe25⤵
- Executes dropped EXE
PID:404 -
\??\c:\hhthbh.exec:\hhthbh.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rrrfxlx.exec:\rrrfxlx.exe27⤵
- Executes dropped EXE
PID:1396 -
\??\c:\tnnbnb.exec:\tnnbnb.exe28⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnnbnh.exec:\nnnbnh.exe29⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rlfrflf.exec:\rlfrflf.exe30⤵
- Executes dropped EXE
PID:828 -
\??\c:\vvpdd.exec:\vvpdd.exe31⤵
- Executes dropped EXE
PID:264 -
\??\c:\pppvp.exec:\pppvp.exe32⤵
- Executes dropped EXE
PID:1020 -
\??\c:\dvppv.exec:\dvppv.exe33⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7lrllfx.exec:\7lrllfx.exe34⤵
- Executes dropped EXE
PID:960 -
\??\c:\bhthhh.exec:\bhthhh.exe35⤵
- Executes dropped EXE
PID:872 -
\??\c:\1hbnht.exec:\1hbnht.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpjvj.exec:\vpjvj.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rrrfxll.exec:\rrrfxll.exe38⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe39⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3btbnb.exec:\3btbnb.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\pjpvd.exec:\pjpvd.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjdjv.exec:\jjdjv.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrxlxlf.exec:\rrxlxlf.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tttbth.exec:\tttbth.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jpvpv.exec:\jpvpv.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxfrrfx.exec:\xxfrrfx.exe46⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nnhnbh.exec:\nnhnbh.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bbbbht.exec:\bbbbht.exe48⤵
- Executes dropped EXE
PID:2744 -
\??\c:\5pdjp.exec:\5pdjp.exe49⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ffflxfr.exec:\ffflxfr.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5hnnht.exec:\5hnnht.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bbbhnb.exec:\bbbhnb.exe52⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pppdd.exec:\pppdd.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\flfrfxl.exec:\flfrfxl.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hbnhth.exec:\hbnhth.exe56⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nnntnt.exec:\nnntnt.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1rrxxfr.exec:\1rrxxfr.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9tbhnb.exec:\9tbhnb.exe59⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nnhthh.exec:\nnhthh.exe60⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ddddp.exec:\ddddp.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xlrxxfl.exec:\xlrxxfl.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\fxxlrfr.exec:\fxxlrfr.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hhhtnt.exec:\hhhtnt.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\7dvdp.exec:\7dvdp.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5xrfrfr.exec:\5xrfrfr.exe66⤵PID:3008
-
\??\c:\1flxxlx.exec:\1flxxlx.exe67⤵PID:1392
-
\??\c:\9tbtht.exec:\9tbtht.exe68⤵PID:1528
-
\??\c:\5pjvj.exec:\5pjvj.exe69⤵PID:532
-
\??\c:\flfrfll.exec:\flfrfll.exe70⤵PID:944
-
\??\c:\xxfrlrl.exec:\xxfrlrl.exe71⤵PID:1324
-
\??\c:\9tnbhn.exec:\9tnbhn.exe72⤵PID:1312
-
\??\c:\vpvjv.exec:\vpvjv.exe73⤵PID:1288
-
\??\c:\vjdjd.exec:\vjdjd.exe74⤵PID:1336
-
\??\c:\rllxlrx.exec:\rllxlrx.exe75⤵PID:1996
-
\??\c:\bnhttn.exec:\bnhttn.exe76⤵PID:1532
-
\??\c:\hbtbht.exec:\hbtbht.exe77⤵PID:1020
-
\??\c:\vpvpv.exec:\vpvpv.exe78⤵PID:2372
-
\??\c:\xffrfrr.exec:\xffrfrr.exe79⤵PID:880
-
\??\c:\lfffllx.exec:\lfffllx.exe80⤵PID:1744
-
\??\c:\btntbh.exec:\btntbh.exe81⤵PID:1624
-
\??\c:\jjdpj.exec:\jjdpj.exe82⤵PID:1596
-
\??\c:\ffxxffr.exec:\ffxxffr.exe83⤵PID:2432
-
\??\c:\5xlrffr.exec:\5xlrffr.exe84⤵PID:316
-
\??\c:\bnhhnn.exec:\bnhhnn.exe85⤵PID:108
-
\??\c:\5vvjp.exec:\5vvjp.exe86⤵PID:2404
-
\??\c:\rlrlxxl.exec:\rlrlxxl.exe87⤵PID:2308
-
\??\c:\rlflffl.exec:\rlflffl.exe88⤵PID:2916
-
\??\c:\nhtttb.exec:\nhtttb.exe89⤵PID:2576
-
\??\c:\5tthnb.exec:\5tthnb.exe90⤵PID:3064
-
\??\c:\9djjp.exec:\9djjp.exe91⤵PID:2720
-
\??\c:\3lfflrx.exec:\3lfflrx.exe92⤵PID:2704
-
\??\c:\flrxlxl.exec:\flrxlxl.exe93⤵PID:2700
-
\??\c:\bnhhhn.exec:\bnhhhn.exe94⤵PID:2676
-
\??\c:\9pddj.exec:\9pddj.exe95⤵PID:2752
-
\??\c:\1jvdj.exec:\1jvdj.exe96⤵PID:2652
-
\??\c:\hnthbn.exec:\hnthbn.exe97⤵PID:1576
-
\??\c:\bthnhn.exec:\bthnhn.exe98⤵PID:2496
-
\??\c:\1vjpv.exec:\1vjpv.exe99⤵PID:2428
-
\??\c:\xlflxfl.exec:\xlflxfl.exe100⤵PID:1720
-
\??\c:\hhbhnt.exec:\hhbhnt.exe101⤵PID:1516
-
\??\c:\tnbhnt.exec:\tnbhnt.exe102⤵PID:1520
-
\??\c:\9jpvj.exec:\9jpvj.exe103⤵PID:1688
-
\??\c:\frrxffr.exec:\frrxffr.exe104⤵PID:2268
-
\??\c:\7llxlxl.exec:\7llxlxl.exe105⤵PID:1524
-
\??\c:\9nntbb.exec:\9nntbb.exe106⤵PID:668
-
\??\c:\jpjvj.exec:\jpjvj.exe107⤵PID:2836
-
\??\c:\dvvdj.exec:\dvvdj.exe108⤵PID:2984
-
\??\c:\rlflfrl.exec:\rlflfrl.exe109⤵PID:2840
-
\??\c:\nhtbhh.exec:\nhtbhh.exe110⤵PID:2852
-
\??\c:\3tnhnn.exec:\3tnhnn.exe111⤵PID:1764
-
\??\c:\jdppv.exec:\jdppv.exe112⤵PID:820
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe113⤵PID:1620
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe114⤵PID:948
-
\??\c:\hhhnbh.exec:\hhhnbh.exe115⤵PID:304
-
\??\c:\vvjjp.exec:\vvjjp.exe116⤵PID:1540
-
\??\c:\rfxxflr.exec:\rfxxflr.exe117⤵PID:2128
-
\??\c:\7rrllll.exec:\7rrllll.exe118⤵PID:1668
-
\??\c:\hbthnn.exec:\hbthnn.exe119⤵PID:564
-
\??\c:\7vjpj.exec:\7vjpj.exe120⤵PID:1040
-
\??\c:\9lrxllf.exec:\9lrxllf.exe121⤵PID:1972
-
\??\c:\lllxrxf.exec:\lllxrxf.exe122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-