Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe
-
Size
456KB
-
MD5
3c609f47a1ff69c76a533502ad32b5ae
-
SHA1
d83bf3e01a72793f95f50fda4d0272819fb58d94
-
SHA256
f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5
-
SHA512
abeb47ccd62fc3328434dc7124f5ea6497606575fa2edfbc150beaeaf5ac2848254951b72037c36261fd39e46acce8755fd4850d911b402b0e6a2b12be3210f3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1756-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-67-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-62-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-80-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2800-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-176-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2908-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-194-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2216-196-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2216-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-218-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/328-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-359-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2556-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-377-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2592-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-442-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3008-468-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3008-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-487-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1860-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/752-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-788-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1692-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-929-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-935-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2496-1102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-1151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-1201-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1644-1275-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 536 5btnbb.exe 2628 7jppv.exe 2920 jdppp.exe 2268 frxrfff.exe 2744 7tntbb.exe 2676 bthttb.exe 2844 1xlrxfl.exe 2800 9nhntb.exe 2444 xlfxfff.exe 2304 1pddd.exe 2592 bhnhth.exe 2280 frflxrf.exe 1924 7nbtht.exe 1888 7vpvd.exe 2364 btbtbb.exe 624 xfxfxlr.exe 1020 tnbhnt.exe 2536 llfxrxx.exe 2908 btnthn.exe 2216 pdjpp.exe 1180 1nbbnb.exe 1296 dpppd.exe 1640 tntbhn.exe 328 dvjpj.exe 1712 thbbhn.exe 1552 vdvjv.exe 2496 vjjvj.exe 3052 5dpjv.exe 2972 pjjpj.exe 1432 7rxrfrl.exe 1916 dddpd.exe 2984 dvjjp.exe 536 vjdjj.exe 1456 fxffllf.exe 1504 ttntbb.exe 2920 nbnnhb.exe 2700 ddvvd.exe 2764 rfrrxxl.exe 2944 frflxxf.exe 2760 nnhthh.exe 2224 5jpjd.exe 2556 ffflxff.exe 2296 fxxxlfr.exe 2580 7bnnnn.exe 2604 9pjvj.exe 2796 ddvdp.exe 1920 ffxfrfl.exe 2592 bnhntt.exe 1852 3pjjj.exe 1876 jdjpp.exe 1940 fflflxr.exe 1888 hbthbb.exe 780 jvvvj.exe 1140 1jjjj.exe 1516 rllfrxr.exe 1636 bbnnnt.exe 3008 hbtbtb.exe 2884 pjjpj.exe 2644 xrffrrf.exe 1632 bnhntn.exe 1860 ttnthh.exe 604 jvpdv.exe 2388 rllrlrl.exe 2532 tnttnh.exe -
resource yara_rule behavioral1/memory/1756-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-218-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/328-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-359-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2556-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-442-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/3008-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-1102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-1201-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2364-1264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-1286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-1291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-1347-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 536 1756 f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe 31 PID 1756 wrote to memory of 536 1756 f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe 31 PID 1756 wrote to memory of 536 1756 f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe 31 PID 1756 wrote to memory of 536 1756 f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe 31 PID 536 wrote to memory of 2628 536 5btnbb.exe 32 PID 536 wrote to memory of 2628 536 5btnbb.exe 32 PID 536 wrote to memory of 2628 536 5btnbb.exe 32 PID 536 wrote to memory of 2628 536 5btnbb.exe 32 PID 2628 wrote to memory of 2920 2628 7jppv.exe 33 PID 2628 wrote to memory of 2920 2628 7jppv.exe 33 PID 2628 wrote to memory of 2920 2628 7jppv.exe 33 PID 2628 wrote to memory of 2920 2628 7jppv.exe 33 PID 2920 wrote to memory of 2268 2920 jdppp.exe 34 PID 2920 wrote to memory of 2268 2920 jdppp.exe 34 PID 2920 wrote to memory of 2268 2920 jdppp.exe 34 PID 2920 wrote to memory of 2268 2920 jdppp.exe 34 PID 2268 wrote to memory of 2744 2268 frxrfff.exe 35 PID 2268 wrote to memory of 2744 2268 frxrfff.exe 35 PID 2268 wrote to memory of 2744 2268 frxrfff.exe 35 PID 2268 wrote to memory of 2744 2268 frxrfff.exe 35 PID 2744 wrote to memory of 2676 2744 7tntbb.exe 36 PID 2744 wrote to memory of 2676 2744 7tntbb.exe 36 PID 2744 wrote to memory of 2676 2744 7tntbb.exe 36 PID 2744 wrote to memory of 2676 2744 7tntbb.exe 36 PID 2676 wrote to memory of 2844 2676 bthttb.exe 37 PID 2676 wrote to memory of 2844 2676 bthttb.exe 37 PID 2676 wrote to memory of 2844 2676 bthttb.exe 37 PID 2676 wrote to memory of 2844 2676 bthttb.exe 37 PID 2844 wrote to memory of 2800 2844 1xlrxfl.exe 38 PID 2844 wrote to memory of 2800 2844 1xlrxfl.exe 38 PID 2844 wrote to memory of 2800 2844 1xlrxfl.exe 38 PID 2844 wrote to memory of 2800 2844 1xlrxfl.exe 38 PID 2800 wrote to memory of 2444 2800 9nhntb.exe 39 PID 2800 wrote to memory of 2444 2800 9nhntb.exe 39 PID 2800 wrote to memory of 2444 2800 9nhntb.exe 39 PID 2800 wrote to memory of 2444 2800 9nhntb.exe 39 PID 2444 wrote to memory of 2304 2444 xlfxfff.exe 40 PID 2444 wrote to memory of 2304 2444 xlfxfff.exe 40 PID 2444 wrote to memory of 2304 2444 xlfxfff.exe 40 PID 2444 wrote to memory of 2304 2444 xlfxfff.exe 40 PID 2304 wrote to memory of 2592 2304 1pddd.exe 41 PID 2304 wrote to memory of 2592 2304 1pddd.exe 41 PID 2304 wrote to memory of 2592 2304 1pddd.exe 41 PID 2304 wrote to memory of 2592 2304 1pddd.exe 41 PID 2592 wrote to memory of 2280 2592 bhnhth.exe 42 PID 2592 wrote to memory of 2280 2592 bhnhth.exe 42 PID 2592 wrote to memory of 2280 2592 bhnhth.exe 42 PID 2592 wrote to memory of 2280 2592 bhnhth.exe 42 PID 2280 wrote to memory of 1924 2280 frflxrf.exe 43 PID 2280 wrote to memory of 1924 2280 frflxrf.exe 43 PID 2280 wrote to memory of 1924 2280 frflxrf.exe 43 PID 2280 wrote to memory of 1924 2280 frflxrf.exe 43 PID 1924 wrote to memory of 1888 1924 7nbtht.exe 44 PID 1924 wrote to memory of 1888 1924 7nbtht.exe 44 PID 1924 wrote to memory of 1888 1924 7nbtht.exe 44 PID 1924 wrote to memory of 1888 1924 7nbtht.exe 44 PID 1888 wrote to memory of 2364 1888 7vpvd.exe 45 PID 1888 wrote to memory of 2364 1888 7vpvd.exe 45 PID 1888 wrote to memory of 2364 1888 7vpvd.exe 45 PID 1888 wrote to memory of 2364 1888 7vpvd.exe 45 PID 2364 wrote to memory of 624 2364 btbtbb.exe 46 PID 2364 wrote to memory of 624 2364 btbtbb.exe 46 PID 2364 wrote to memory of 624 2364 btbtbb.exe 46 PID 2364 wrote to memory of 624 2364 btbtbb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe"C:\Users\Admin\AppData\Local\Temp\f035841bd7cbe1352c035b4983dd6122e28b3752df6916f744d03afb5f0a96e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\5btnbb.exec:\5btnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\7jppv.exec:\7jppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jdppp.exec:\jdppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\frxrfff.exec:\frxrfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\7tntbb.exec:\7tntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bthttb.exec:\bthttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1xlrxfl.exec:\1xlrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\9nhntb.exec:\9nhntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\xlfxfff.exec:\xlfxfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\1pddd.exec:\1pddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\bhnhth.exec:\bhnhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\frflxrf.exec:\frflxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\7nbtht.exec:\7nbtht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\7vpvd.exec:\7vpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\btbtbb.exec:\btbtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\xfxfxlr.exec:\xfxfxlr.exe17⤵
- Executes dropped EXE
PID:624 -
\??\c:\tnbhnt.exec:\tnbhnt.exe18⤵
- Executes dropped EXE
PID:1020 -
\??\c:\llfxrxx.exec:\llfxrxx.exe19⤵
- Executes dropped EXE
PID:2536 -
\??\c:\btnthn.exec:\btnthn.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pdjpp.exec:\pdjpp.exe21⤵
- Executes dropped EXE
PID:2216 -
\??\c:\1nbbnb.exec:\1nbbnb.exe22⤵
- Executes dropped EXE
PID:1180 -
\??\c:\dpppd.exec:\dpppd.exe23⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tntbhn.exec:\tntbhn.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dvjpj.exec:\dvjpj.exe25⤵
- Executes dropped EXE
PID:328 -
\??\c:\thbbhn.exec:\thbbhn.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vdvjv.exec:\vdvjv.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vjjvj.exec:\vjjvj.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5dpjv.exec:\5dpjv.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pjjpj.exec:\pjjpj.exe30⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7rxrfrl.exec:\7rxrfrl.exe31⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dddpd.exec:\dddpd.exe32⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dvjjp.exec:\dvjjp.exe33⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vjdjj.exec:\vjdjj.exe34⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxffllf.exec:\fxffllf.exe35⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ttntbb.exec:\ttntbb.exe36⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nbnnhb.exec:\nbnnhb.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ddvvd.exec:\ddvvd.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\frflxxf.exec:\frflxxf.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nnhthh.exec:\nnhthh.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5jpjd.exec:\5jpjd.exe42⤵
- Executes dropped EXE
PID:2224 -
\??\c:\ffflxff.exec:\ffflxff.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxxxlfr.exec:\fxxxlfr.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7bnnnn.exec:\7bnnnn.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9pjvj.exec:\9pjvj.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ddvdp.exec:\ddvdp.exe47⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ffxfrfl.exec:\ffxfrfl.exe48⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bnhntt.exec:\bnhntt.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3pjjj.exec:\3pjjj.exe50⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jdjpp.exec:\jdjpp.exe51⤵
- Executes dropped EXE
PID:1876 -
\??\c:\fflflxr.exec:\fflflxr.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hbthbb.exec:\hbthbb.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jvvvj.exec:\jvvvj.exe54⤵
- Executes dropped EXE
PID:780 -
\??\c:\1jjjj.exec:\1jjjj.exe55⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rllfrxr.exec:\rllfrxr.exe56⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bbnnnt.exec:\bbnnnt.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbtbtb.exec:\hbtbtb.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pjjpj.exec:\pjjpj.exe59⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xrffrrf.exec:\xrffrrf.exe60⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bnhntn.exec:\bnhntn.exe61⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ttnthh.exec:\ttnthh.exe62⤵
- Executes dropped EXE
PID:1860 -
\??\c:\jvpdv.exec:\jvpdv.exe63⤵
- Executes dropped EXE
PID:604 -
\??\c:\rllrlrl.exec:\rllrlrl.exe64⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnttnh.exec:\tnttnh.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vpvdj.exec:\vpvdj.exe66⤵PID:2436
-
\??\c:\pjjpv.exec:\pjjpv.exe67⤵PID:1716
-
\??\c:\nbnntb.exec:\nbnntb.exe68⤵PID:1208
-
\??\c:\nhbbth.exec:\nhbbth.exe69⤵PID:300
-
\??\c:\5ppdj.exec:\5ppdj.exe70⤵PID:884
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe71⤵PID:236
-
\??\c:\3btthn.exec:\3btthn.exe72⤵PID:2412
-
\??\c:\vpdvv.exec:\vpdvv.exe73⤵PID:752
-
\??\c:\vpjjj.exec:\vpjjj.exe74⤵PID:2340
-
\??\c:\3rxlxfr.exec:\3rxlxfr.exe75⤵PID:2980
-
\??\c:\nnhnbh.exec:\nnhnbh.exe76⤵PID:2512
-
\??\c:\3hnnnn.exec:\3hnnnn.exe77⤵PID:2632
-
\??\c:\3dvpp.exec:\3dvpp.exe78⤵PID:2096
-
\??\c:\rfflllx.exec:\rfflllx.exe79⤵PID:3036
-
\??\c:\tthtbh.exec:\tthtbh.exe80⤵PID:352
-
\??\c:\hbtbbt.exec:\hbtbbt.exe81⤵PID:2836
-
\??\c:\3vpdj.exec:\3vpdj.exe82⤵PID:2268
-
\??\c:\7rfflrr.exec:\7rfflrr.exe83⤵PID:2804
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe84⤵PID:2944
-
\??\c:\9bbnbt.exec:\9bbnbt.exe85⤵PID:2584
-
\??\c:\pppdj.exec:\pppdj.exe86⤵PID:2716
-
\??\c:\vvpvp.exec:\vvpvp.exe87⤵PID:2664
-
\??\c:\rlxxffl.exec:\rlxxffl.exe88⤵PID:2568
-
\??\c:\tnhnnt.exec:\tnhnnt.exe89⤵PID:2580
-
\??\c:\vvvjd.exec:\vvvjd.exe90⤵PID:2008
-
\??\c:\7dppv.exec:\7dppv.exe91⤵PID:2796
-
\??\c:\7xlflrf.exec:\7xlflrf.exe92⤵PID:1748
-
\??\c:\btnttt.exec:\btnttt.exe93⤵PID:1548
-
\??\c:\3nhhbh.exec:\3nhhbh.exe94⤵PID:1852
-
\??\c:\ppjdj.exec:\ppjdj.exe95⤵PID:2368
-
\??\c:\ffxrlxf.exec:\ffxrlxf.exe96⤵PID:544
-
\??\c:\7bnnnn.exec:\7bnnnn.exe97⤵PID:1620
-
\??\c:\tbbbnt.exec:\tbbbnt.exe98⤵PID:1260
-
\??\c:\vvvdp.exec:\vvvdp.exe99⤵PID:2776
-
\??\c:\xrrxlxf.exec:\xrrxlxf.exe100⤵PID:1020
-
\??\c:\7xffrff.exec:\7xffrff.exe101⤵PID:2988
-
\??\c:\nnttbh.exec:\nnttbh.exe102⤵PID:2900
-
\??\c:\1dvdj.exec:\1dvdj.exe103⤵PID:1980
-
\??\c:\jjvvd.exec:\jjvvd.exe104⤵PID:2120
-
\??\c:\xxxfxrf.exec:\xxxfxrf.exe105⤵PID:1264
-
\??\c:\hbnthn.exec:\hbnthn.exe106⤵PID:2164
-
\??\c:\9btnnt.exec:\9btnnt.exe107⤵PID:3032
-
\??\c:\dvppv.exec:\dvppv.exe108⤵PID:1428
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe109⤵PID:1692
-
\??\c:\frxxffl.exec:\frxxffl.exe110⤵PID:2016
-
\??\c:\7thhnt.exec:\7thhnt.exe111⤵PID:1712
-
\??\c:\7pjpv.exec:\7pjpv.exe112⤵PID:1424
-
\??\c:\5vppv.exec:\5vppv.exe113⤵PID:1208
-
\??\c:\9xrfflr.exec:\9xrfflr.exe114⤵PID:1116
-
\??\c:\bhnbnb.exec:\bhnbnb.exe115⤵PID:2168
-
\??\c:\1fxfffx.exec:\1fxfffx.exe116⤵PID:1672
-
\??\c:\hhbntb.exec:\hhbntb.exe117⤵PID:1680
-
\??\c:\tbnthb.exec:\tbnthb.exe118⤵PID:3040
-
\??\c:\jvppj.exec:\jvppj.exe119⤵PID:1916
-
\??\c:\xrllxxr.exec:\xrllxxr.exe120⤵PID:896
-
\??\c:\tnhtbb.exec:\tnhtbb.exe121⤵PID:2488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-