Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 08:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe
-
Size
80KB
-
MD5
f42bdfb526b25e30aa34398337dd8dfb
-
SHA1
38c9e3582e3cf1d352ea222408bae1aeb64ff429
-
SHA256
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c
-
SHA512
bd68ced0d62e94f347e2561344b535a44a365b262186b6e389b39804b483716132364dad6eb1c32a8dccd4219e55b5d1a4e15a5acfa8c095c660ac046f2fb259
-
SSDEEP
1536:Y41JEOJzOhWlKXXCwsurYKnFNzofrst3ufT/FRxnd:Y49z/lKXXdFvN8Yt3ujFfd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2160-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-48-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2792-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-75-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1456-97-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1456-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-89-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2184-87-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2460-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-113-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2324-133-0x00000000002D0000-0x00000000002FA000-memory.dmp family_blackmoon behavioral1/memory/2324-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/356-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-436-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1460-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-529-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1092-545-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/396-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-697-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2188-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-922-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2072-952-0x00000000002E0000-0x000000000030A000-memory.dmp family_blackmoon behavioral1/memory/2432-956-0x0000000000270000-0x000000000029A000-memory.dmp family_blackmoon behavioral1/memory/2136-985-0x0000000000300000-0x000000000032A000-memory.dmp family_blackmoon behavioral1/memory/1144-994-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1740-1069-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2108-1140-0x00000000002F0000-0x000000000031A000-memory.dmp family_blackmoon behavioral1/memory/2768-1155-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2720-1170-0x0000000000290000-0x00000000002BA000-memory.dmp family_blackmoon behavioral1/memory/1812-1185-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1752-1200-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2412-1215-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2704 3fflffr.exe 2108 hhnnbn.exe 2576 ppvvd.exe 2792 ffrrlll.exe 2676 lflxflr.exe 2184 jdpdj.exe 1456 hbbbnn.exe 2460 btbhbt.exe 2984 xfxlxlf.exe 2324 1xrflrx.exe 2624 hhnnbb.exe 1460 pppvj.exe 1144 1xlxfxx.exe 1748 bbbnhh.exe 1804 ttbtbt.exe 2964 dvvpj.exe 1684 lfrfllr.exe 3028 nhbbhh.exe 1988 hhthtb.exe 1620 vpvdd.exe 356 lxrxflx.exe 1848 xrflrrx.exe 1792 hbnttb.exe 1948 jdjpp.exe 3068 xrxffll.exe 2640 ffrflrf.exe 2700 7btbtn.exe 2748 bhbthh.exe 2588 ppvvd.exe 2576 dvpvj.exe 2812 flxfrrx.exe 2720 tnbhtn.exe 2148 1jjpp.exe 2596 rlxxffl.exe 1484 xlxfrrf.exe 2120 9nhnnt.exe 1316 dvvjj.exe 292 vpvpd.exe 2280 xllfffx.exe 1332 ffxrfrx.exe 2260 nbhhbh.exe 2784 hbtnbb.exe 2272 1dvvd.exe 1504 frrxfff.exe 1460 frxxfff.exe 1908 xxlfxfr.exe 2152 1bthtb.exe 632 jvddv.exe 2388 jjvdp.exe 1488 xrfxxxl.exe 2988 5nthhb.exe 3020 1bthbn.exe 2528 jpvpp.exe 884 dvddd.exe 1696 1rflflr.exe 2224 tnbtbb.exe 1336 3thnnn.exe 1092 pjppd.exe 2016 1pdvp.exe 396 lfxflll.exe 872 7lrrfff.exe 2236 nhntnb.exe 1048 pjvvv.exe 2704 pdjjp.exe -
resource yara_rule behavioral1/memory/2160-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-111-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2324-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-233-0x0000000000260000-0x000000000028A000-memory.dmp upx behavioral1/memory/356-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-272-0x00000000002E0000-0x000000000030A000-memory.dmp upx behavioral1/memory/2700-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-985-0x0000000000300000-0x000000000032A000-memory.dmp upx behavioral1/memory/1740-1069-0x0000000000250000-0x000000000027A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2704 2160 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 30 PID 2160 wrote to memory of 2704 2160 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 30 PID 2160 wrote to memory of 2704 2160 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 30 PID 2160 wrote to memory of 2704 2160 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 30 PID 2704 wrote to memory of 2108 2704 3fflffr.exe 31 PID 2704 wrote to memory of 2108 2704 3fflffr.exe 31 PID 2704 wrote to memory of 2108 2704 3fflffr.exe 31 PID 2704 wrote to memory of 2108 2704 3fflffr.exe 31 PID 2108 wrote to memory of 2576 2108 hhnnbn.exe 32 PID 2108 wrote to memory of 2576 2108 hhnnbn.exe 32 PID 2108 wrote to memory of 2576 2108 hhnnbn.exe 32 PID 2108 wrote to memory of 2576 2108 hhnnbn.exe 32 PID 2576 wrote to memory of 2792 2576 ppvvd.exe 33 PID 2576 wrote to memory of 2792 2576 ppvvd.exe 33 PID 2576 wrote to memory of 2792 2576 ppvvd.exe 33 PID 2576 wrote to memory of 2792 2576 ppvvd.exe 33 PID 2792 wrote to memory of 2676 2792 ffrrlll.exe 34 PID 2792 wrote to memory of 2676 2792 ffrrlll.exe 34 PID 2792 wrote to memory of 2676 2792 ffrrlll.exe 34 PID 2792 wrote to memory of 2676 2792 ffrrlll.exe 34 PID 2676 wrote to memory of 2184 2676 lflxflr.exe 35 PID 2676 wrote to memory of 2184 2676 lflxflr.exe 35 PID 2676 wrote to memory of 2184 2676 lflxflr.exe 35 PID 2676 wrote to memory of 2184 2676 lflxflr.exe 35 PID 2184 wrote to memory of 1456 2184 jdpdj.exe 36 PID 2184 wrote to memory of 1456 2184 jdpdj.exe 36 PID 2184 wrote to memory of 1456 2184 jdpdj.exe 36 PID 2184 wrote to memory of 1456 2184 jdpdj.exe 36 PID 1456 wrote to memory of 2460 1456 hbbbnn.exe 37 PID 1456 wrote to memory of 2460 1456 hbbbnn.exe 37 PID 1456 wrote to memory of 2460 1456 hbbbnn.exe 37 PID 1456 wrote to memory of 2460 1456 hbbbnn.exe 37 PID 2460 wrote to memory of 2984 2460 btbhbt.exe 38 PID 2460 wrote to memory of 2984 2460 btbhbt.exe 38 PID 2460 wrote to memory of 2984 2460 btbhbt.exe 38 PID 2460 wrote to memory of 2984 2460 btbhbt.exe 38 PID 2984 wrote to memory of 2324 2984 xfxlxlf.exe 39 PID 2984 wrote to memory of 2324 2984 xfxlxlf.exe 39 PID 2984 wrote to memory of 2324 2984 xfxlxlf.exe 39 PID 2984 wrote to memory of 2324 2984 xfxlxlf.exe 39 PID 2324 wrote to memory of 2624 2324 1xrflrx.exe 40 PID 2324 wrote to memory of 2624 2324 1xrflrx.exe 40 PID 2324 wrote to memory of 2624 2324 1xrflrx.exe 40 PID 2324 wrote to memory of 2624 2324 1xrflrx.exe 40 PID 2624 wrote to memory of 1460 2624 hhnnbb.exe 41 PID 2624 wrote to memory of 1460 2624 hhnnbb.exe 41 PID 2624 wrote to memory of 1460 2624 hhnnbb.exe 41 PID 2624 wrote to memory of 1460 2624 hhnnbb.exe 41 PID 1460 wrote to memory of 1144 1460 pppvj.exe 42 PID 1460 wrote to memory of 1144 1460 pppvj.exe 42 PID 1460 wrote to memory of 1144 1460 pppvj.exe 42 PID 1460 wrote to memory of 1144 1460 pppvj.exe 42 PID 1144 wrote to memory of 1748 1144 1xlxfxx.exe 43 PID 1144 wrote to memory of 1748 1144 1xlxfxx.exe 43 PID 1144 wrote to memory of 1748 1144 1xlxfxx.exe 43 PID 1144 wrote to memory of 1748 1144 1xlxfxx.exe 43 PID 1748 wrote to memory of 1804 1748 bbbnhh.exe 44 PID 1748 wrote to memory of 1804 1748 bbbnhh.exe 44 PID 1748 wrote to memory of 1804 1748 bbbnhh.exe 44 PID 1748 wrote to memory of 1804 1748 bbbnhh.exe 44 PID 1804 wrote to memory of 2964 1804 ttbtbt.exe 45 PID 1804 wrote to memory of 2964 1804 ttbtbt.exe 45 PID 1804 wrote to memory of 2964 1804 ttbtbt.exe 45 PID 1804 wrote to memory of 2964 1804 ttbtbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe"C:\Users\Admin\AppData\Local\Temp\fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\3fflffr.exec:\3fflffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hhnnbn.exec:\hhnnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ppvvd.exec:\ppvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ffrrlll.exec:\ffrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lflxflr.exec:\lflxflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jdpdj.exec:\jdpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hbbbnn.exec:\hbbbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\btbhbt.exec:\btbhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\xfxlxlf.exec:\xfxlxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\1xrflrx.exec:\1xrflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\hhnnbb.exec:\hhnnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pppvj.exec:\pppvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\1xlxfxx.exec:\1xlxfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\bbbnhh.exec:\bbbnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\ttbtbt.exec:\ttbtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\dvvpj.exec:\dvvpj.exe17⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfrfllr.exec:\lfrfllr.exe18⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nhbbhh.exec:\nhbbhh.exe19⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhthtb.exec:\hhthtb.exe20⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vpvdd.exec:\vpvdd.exe21⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lxrxflx.exec:\lxrxflx.exe22⤵
- Executes dropped EXE
PID:356 -
\??\c:\xrflrrx.exec:\xrflrrx.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hbnttb.exec:\hbnttb.exe24⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jdjpp.exec:\jdjpp.exe25⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xrxffll.exec:\xrxffll.exe26⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ffrflrf.exec:\ffrflrf.exe27⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7btbtn.exec:\7btbtn.exe28⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bhbthh.exec:\bhbthh.exe29⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ppvvd.exec:\ppvvd.exe30⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dvpvj.exec:\dvpvj.exe31⤵
- Executes dropped EXE
PID:2576 -
\??\c:\flxfrrx.exec:\flxfrrx.exe32⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tnbhtn.exec:\tnbhtn.exe33⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1jjpp.exec:\1jjpp.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rlxxffl.exec:\rlxxffl.exe35⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xlxfrrf.exec:\xlxfrrf.exe36⤵
- Executes dropped EXE
PID:1484 -
\??\c:\9nhnnt.exec:\9nhnnt.exe37⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dvvjj.exec:\dvvjj.exe38⤵
- Executes dropped EXE
PID:1316 -
\??\c:\vpvpd.exec:\vpvpd.exe39⤵
- Executes dropped EXE
PID:292 -
\??\c:\xllfffx.exec:\xllfffx.exe40⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ffxrfrx.exec:\ffxrfrx.exe41⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nbhhbh.exec:\nbhhbh.exe42⤵
- Executes dropped EXE
PID:2260 -
\??\c:\hbtnbb.exec:\hbtnbb.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1dvvd.exec:\1dvvd.exe44⤵
- Executes dropped EXE
PID:2272 -
\??\c:\frrxfff.exec:\frrxfff.exe45⤵
- Executes dropped EXE
PID:1504 -
\??\c:\frxxfff.exec:\frxxfff.exe46⤵
- Executes dropped EXE
PID:1460 -
\??\c:\xxlfxfr.exec:\xxlfxfr.exe47⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1bthtb.exec:\1bthtb.exe48⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jvddv.exec:\jvddv.exe49⤵
- Executes dropped EXE
PID:632 -
\??\c:\jjvdp.exec:\jjvdp.exe50⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5nthhb.exec:\5nthhb.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\1bthbn.exec:\1bthbn.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jpvpp.exec:\jpvpp.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dvddd.exec:\dvddd.exe55⤵
- Executes dropped EXE
PID:884 -
\??\c:\1rflflr.exec:\1rflflr.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tnbtbb.exec:\tnbtbb.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3thnnn.exec:\3thnnn.exe58⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pjppd.exec:\pjppd.exe59⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1pdvp.exec:\1pdvp.exe60⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lfxflll.exec:\lfxflll.exe61⤵
- Executes dropped EXE
PID:396 -
\??\c:\7lrrfff.exec:\7lrrfff.exe62⤵
- Executes dropped EXE
PID:872 -
\??\c:\nhntnb.exec:\nhntnb.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pjvvv.exec:\pjvvv.exe64⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pdjjp.exec:\pdjjp.exe65⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1xrrxrr.exec:\1xrrxrr.exe66⤵PID:1576
-
\??\c:\xxrrxxf.exec:\xxrrxxf.exe67⤵PID:2728
-
\??\c:\hhthht.exec:\hhthht.exe68⤵PID:2752
-
\??\c:\pdppp.exec:\pdppp.exe69⤵PID:2012
-
\??\c:\3pddv.exec:\3pddv.exe70⤵PID:2740
-
\??\c:\3xxfrxl.exec:\3xxfrxl.exe71⤵PID:3008
-
\??\c:\rlrxfff.exec:\rlrxfff.exe72⤵PID:1752
-
\??\c:\9httbt.exec:\9httbt.exe73⤵PID:2056
-
\??\c:\thntbh.exec:\thntbh.exe74⤵PID:2412
-
\??\c:\dvvpv.exec:\dvvpv.exe75⤵PID:2120
-
\??\c:\jvdvv.exec:\jvdvv.exe76⤵PID:2392
-
\??\c:\fxlxxlx.exec:\fxlxxlx.exe77⤵PID:1728
-
\??\c:\hbnnbn.exec:\hbnnbn.exe78⤵PID:1276
-
\??\c:\btnttt.exec:\btnttt.exe79⤵PID:2984
-
\??\c:\pjvdj.exec:\pjvdj.exe80⤵PID:2616
-
\??\c:\jvddd.exec:\jvddd.exe81⤵PID:572
-
\??\c:\lxlffff.exec:\lxlffff.exe82⤵PID:2860
-
\??\c:\lflrfxf.exec:\lflrfxf.exe83⤵PID:2188
-
\??\c:\bnnnnh.exec:\bnnnnh.exe84⤵PID:1756
-
\??\c:\btbhnt.exec:\btbhnt.exe85⤵PID:304
-
\??\c:\pjppv.exec:\pjppv.exe86⤵PID:2152
-
\??\c:\lfrfllr.exec:\lfrfllr.exe87⤵PID:3056
-
\??\c:\xlfxxrr.exec:\xlfxxrr.exe88⤵PID:880
-
\??\c:\nhtntb.exec:\nhtntb.exe89⤵PID:2976
-
\??\c:\1bbhbb.exec:\1bbhbb.exe90⤵PID:2968
-
\??\c:\pjjjj.exec:\pjjjj.exe91⤵PID:3020
-
\??\c:\vpppp.exec:\vpppp.exe92⤵PID:1600
-
\??\c:\rlrlxfl.exec:\rlrlxfl.exe93⤵PID:2864
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe94⤵PID:1640
-
\??\c:\btbbbn.exec:\btbbbn.exe95⤵PID:2472
-
\??\c:\tnhntt.exec:\tnhntt.exe96⤵PID:1960
-
\??\c:\dpppv.exec:\dpppv.exe97⤵PID:1968
-
\??\c:\9pjpv.exec:\9pjpv.exe98⤵PID:604
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe99⤵PID:1732
-
\??\c:\3rxxfxf.exec:\3rxxfxf.exe100⤵PID:876
-
\??\c:\htbbbh.exec:\htbbbh.exe101⤵PID:2180
-
\??\c:\1hbbbb.exec:\1hbbbb.exe102⤵PID:2820
-
\??\c:\jdpdd.exec:\jdpdd.exe103⤵PID:2664
-
\??\c:\vpdvd.exec:\vpdvd.exe104⤵PID:2588
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe105⤵PID:2828
-
\??\c:\rxflfxf.exec:\rxflfxf.exe106⤵PID:2584
-
\??\c:\bnbntt.exec:\bnbntt.exe107⤵PID:2556
-
\??\c:\bbntbh.exec:\bbntbh.exe108⤵PID:2572
-
\??\c:\9vpvd.exec:\9vpvd.exe109⤵PID:2148
-
\??\c:\pdpvv.exec:\pdpvv.exe110⤵PID:3008
-
\??\c:\fxflrlx.exec:\fxflrlx.exe111⤵PID:1752
-
\??\c:\btbbbb.exec:\btbbbb.exe112⤵PID:2196
-
\??\c:\bthnbb.exec:\bthnbb.exe113⤵PID:752
-
\??\c:\5jddd.exec:\5jddd.exe114⤵PID:2652
-
\??\c:\hbtttt.exec:\hbtttt.exe115⤵PID:2072
-
\??\c:\jddpj.exec:\jddpj.exe116⤵PID:2432
-
\??\c:\jdppd.exec:\jdppd.exe117⤵PID:2848
-
\??\c:\rrlfllr.exec:\rrlfllr.exe118⤵PID:2144
-
\??\c:\xrxfflr.exec:\xrxfflr.exe119⤵PID:2784
-
\??\c:\bnttbt.exec:\bnttbt.exe120⤵PID:2136
-
\??\c:\thbhnt.exec:\thbhnt.exe121⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-