Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 21:26
Behavioral task
behavioral1
Sample
586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe
-
Size
92KB
-
MD5
fb721cdc8ec37139881060f3912b8925
-
SHA1
194b2a876681063553db56de33adcdf462aebc3d
-
SHA256
586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b
-
SHA512
9c46c107f50b735310a6835738e6f46376d4f9d49efa9cb1dad6870dbab8329de1f1d3511a3f4b443363eef1feb3c769dcdb1ef1780fafda689110d50709d265
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5fVBA1zO:8hOmTsF93UYfwC6GIout0fmCiiiXA6NL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1276-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-112-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1248-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1248-130-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2392-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-161-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1956-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-224-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1396-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/492-241-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2128-258-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2128-257-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-399-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1872-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-564-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-592-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-645-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1888-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-779-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1492-15856-0x0000000077460000-0x000000007757F000-memory.dmp family_blackmoon behavioral1/memory/1492-18393-0x0000000077460000-0x000000007757F000-memory.dmp family_blackmoon behavioral1/memory/1492-29006-0x0000000077360000-0x000000007745A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2364 hthhtt.exe 2956 hbtthn.exe 540 3jvdj.exe 2924 lfrrlrf.exe 2628 nhtbnn.exe 2716 nbnntt.exe 2852 jjvdd.exe 2772 lxlfffl.exe 2756 lxlllxx.exe 2740 jjvjv.exe 2516 9jvdd.exe 2936 fxrlfrf.exe 2260 btbhtt.exe 1400 tnttnn.exe 1248 1vpvd.exe 2392 dvpvp.exe 2292 9rlxflr.exe 2388 bthhnt.exe 1716 vjppv.exe 1556 9pjpd.exe 1956 1jjvj.exe 1788 xrflxlx.exe 2576 tnbbtn.exe 2724 jvppv.exe 560 jdpvj.exe 1660 ddvdp.exe 1524 xrflllx.exe 1396 5hthbb.exe 492 pdpjj.exe 3068 jvjdd.exe 2128 jvvdj.exe 1184 xxffxfr.exe 2000 bthtnh.exe 2152 vjpjp.exe 2132 3pddj.exe 2968 9xrrfxf.exe 2960 rlrxlrx.exe 1620 5xxllxf.exe 2972 bnnnbb.exe 288 thttbt.exe 2924 jvdjp.exe 2636 pjpvv.exe 2428 3rlflfr.exe 2640 xxflxxl.exe 2848 1bnnbt.exe 2620 hhtbhb.exe 2772 3vjjp.exe 2748 rrffxxf.exe 2544 xxrlfxf.exe 2560 bthntt.exe 2984 1btntt.exe 2944 vpddj.exe 1256 jvpjv.exe 2260 fxffllx.exe 1972 rlrxrlx.exe 1244 tthhtt.exe 2272 bnttbh.exe 1872 dvjpd.exe 1940 5pdjj.exe 1748 1xrxxfl.exe 1360 rlxfrrx.exe 1732 7nnnhh.exe 1908 hbnntt.exe 2040 5jpvp.exe -
resource yara_rule behavioral1/memory/1276-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001227f-5.dat upx behavioral1/memory/2364-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1276-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001925e-17.dat upx behavioral1/files/0x0007000000019261-25.dat upx behavioral1/memory/2956-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2364-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019350-41.dat upx behavioral1/memory/2924-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019334-34.dat upx behavioral1/memory/540-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000193b4-49.dat upx behavioral1/memory/2628-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193e1-56.dat upx behavioral1/memory/2852-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019611-63.dat upx behavioral1/files/0x0005000000019613-73.dat upx behavioral1/memory/2772-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019615-80.dat upx behavioral1/memory/2740-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019617-89.dat upx behavioral1/files/0x0005000000019619-97.dat upx behavioral1/files/0x000500000001961b-105.dat upx behavioral1/memory/2936-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-116.dat upx behavioral1/memory/1400-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961f-122.dat upx behavioral1/memory/1248-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019621-131.dat upx behavioral1/files/0x0005000000019622-139.dat upx behavioral1/memory/2392-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2292-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-146.dat upx behavioral1/files/0x0005000000019625-154.dat upx behavioral1/files/0x0005000000019667-162.dat upx behavioral1/files/0x00050000000196af-169.dat upx behavioral1/memory/1956-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196b1-176.dat upx behavioral1/memory/1788-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001977d-185.dat upx behavioral1/files/0x00050000000197f8-192.dat upx behavioral1/memory/2724-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019838-200.dat upx behavioral1/memory/2724-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/560-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000198f0-210.dat upx behavioral1/files/0x00050000000199bf-217.dat upx behavioral1/memory/1660-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1396-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c57-227.dat upx behavioral1/memory/1524-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c5b-244.dat upx behavioral1/files/0x0005000000019c59-235.dat upx behavioral1/files/0x0005000000019cb9-250.dat upx behavioral1/files/0x0005000000019dc0-260.dat upx behavioral1/memory/2128-257-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2152-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-324-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2364 1276 586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe 31 PID 1276 wrote to memory of 2364 1276 586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe 31 PID 1276 wrote to memory of 2364 1276 586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe 31 PID 1276 wrote to memory of 2364 1276 586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe 31 PID 2364 wrote to memory of 2956 2364 hthhtt.exe 32 PID 2364 wrote to memory of 2956 2364 hthhtt.exe 32 PID 2364 wrote to memory of 2956 2364 hthhtt.exe 32 PID 2364 wrote to memory of 2956 2364 hthhtt.exe 32 PID 2956 wrote to memory of 540 2956 hbtthn.exe 33 PID 2956 wrote to memory of 540 2956 hbtthn.exe 33 PID 2956 wrote to memory of 540 2956 hbtthn.exe 33 PID 2956 wrote to memory of 540 2956 hbtthn.exe 33 PID 540 wrote to memory of 2924 540 3jvdj.exe 34 PID 540 wrote to memory of 2924 540 3jvdj.exe 34 PID 540 wrote to memory of 2924 540 3jvdj.exe 34 PID 540 wrote to memory of 2924 540 3jvdj.exe 34 PID 2924 wrote to memory of 2628 2924 lfrrlrf.exe 35 PID 2924 wrote to memory of 2628 2924 lfrrlrf.exe 35 PID 2924 wrote to memory of 2628 2924 lfrrlrf.exe 35 PID 2924 wrote to memory of 2628 2924 lfrrlrf.exe 35 PID 2628 wrote to memory of 2716 2628 nhtbnn.exe 36 PID 2628 wrote to memory of 2716 2628 nhtbnn.exe 36 PID 2628 wrote to memory of 2716 2628 nhtbnn.exe 36 PID 2628 wrote to memory of 2716 2628 nhtbnn.exe 36 PID 2716 wrote to memory of 2852 2716 nbnntt.exe 37 PID 2716 wrote to memory of 2852 2716 nbnntt.exe 37 PID 2716 wrote to memory of 2852 2716 nbnntt.exe 37 PID 2716 wrote to memory of 2852 2716 nbnntt.exe 37 PID 2852 wrote to memory of 2772 2852 jjvdd.exe 38 PID 2852 wrote to memory of 2772 2852 jjvdd.exe 38 PID 2852 wrote to memory of 2772 2852 jjvdd.exe 38 PID 2852 wrote to memory of 2772 2852 jjvdd.exe 38 PID 2772 wrote to memory of 2756 2772 lxlfffl.exe 39 PID 2772 wrote to memory of 2756 2772 lxlfffl.exe 39 PID 2772 wrote to memory of 2756 2772 lxlfffl.exe 39 PID 2772 wrote to memory of 2756 2772 lxlfffl.exe 39 PID 2756 wrote to memory of 2740 2756 lxlllxx.exe 40 PID 2756 wrote to memory of 2740 2756 lxlllxx.exe 40 PID 2756 wrote to memory of 2740 2756 lxlllxx.exe 40 PID 2756 wrote to memory of 2740 2756 lxlllxx.exe 40 PID 2740 wrote to memory of 2516 2740 jjvjv.exe 41 PID 2740 wrote to memory of 2516 2740 jjvjv.exe 41 PID 2740 wrote to memory of 2516 2740 jjvjv.exe 41 PID 2740 wrote to memory of 2516 2740 jjvjv.exe 41 PID 2516 wrote to memory of 2936 2516 9jvdd.exe 42 PID 2516 wrote to memory of 2936 2516 9jvdd.exe 42 PID 2516 wrote to memory of 2936 2516 9jvdd.exe 42 PID 2516 wrote to memory of 2936 2516 9jvdd.exe 42 PID 2936 wrote to memory of 2260 2936 fxrlfrf.exe 43 PID 2936 wrote to memory of 2260 2936 fxrlfrf.exe 43 PID 2936 wrote to memory of 2260 2936 fxrlfrf.exe 43 PID 2936 wrote to memory of 2260 2936 fxrlfrf.exe 43 PID 2260 wrote to memory of 1400 2260 btbhtt.exe 44 PID 2260 wrote to memory of 1400 2260 btbhtt.exe 44 PID 2260 wrote to memory of 1400 2260 btbhtt.exe 44 PID 2260 wrote to memory of 1400 2260 btbhtt.exe 44 PID 1400 wrote to memory of 1248 1400 tnttnn.exe 45 PID 1400 wrote to memory of 1248 1400 tnttnn.exe 45 PID 1400 wrote to memory of 1248 1400 tnttnn.exe 45 PID 1400 wrote to memory of 1248 1400 tnttnn.exe 45 PID 1248 wrote to memory of 2392 1248 1vpvd.exe 46 PID 1248 wrote to memory of 2392 1248 1vpvd.exe 46 PID 1248 wrote to memory of 2392 1248 1vpvd.exe 46 PID 1248 wrote to memory of 2392 1248 1vpvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe"C:\Users\Admin\AppData\Local\Temp\586bbd5e5a4b5cf47ad9e1a752ece69fe0e48686ab3381d87ecfeca0ee73bc2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\hthhtt.exec:\hthhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\hbtthn.exec:\hbtthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\3jvdj.exec:\3jvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\lfrrlrf.exec:\lfrrlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nhtbnn.exec:\nhtbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\nbnntt.exec:\nbnntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jjvdd.exec:\jjvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\lxlfffl.exec:\lxlfffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\lxlllxx.exec:\lxlllxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jjvjv.exec:\jjvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\9jvdd.exec:\9jvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\fxrlfrf.exec:\fxrlfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\btbhtt.exec:\btbhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tnttnn.exec:\tnttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\1vpvd.exec:\1vpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\dvpvp.exec:\dvpvp.exe17⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9rlxflr.exec:\9rlxflr.exe18⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bthhnt.exec:\bthhnt.exe19⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vjppv.exec:\vjppv.exe20⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9pjpd.exec:\9pjpd.exe21⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1jjvj.exec:\1jjvj.exe22⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xrflxlx.exec:\xrflxlx.exe23⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tnbbtn.exec:\tnbbtn.exe24⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jvppv.exec:\jvppv.exe25⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jdpvj.exec:\jdpvj.exe26⤵
- Executes dropped EXE
PID:560 -
\??\c:\ddvdp.exec:\ddvdp.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xrflllx.exec:\xrflllx.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5hthbb.exec:\5hthbb.exe29⤵
- Executes dropped EXE
PID:1396 -
\??\c:\pdpjj.exec:\pdpjj.exe30⤵
- Executes dropped EXE
PID:492 -
\??\c:\jvjdd.exec:\jvjdd.exe31⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jvvdj.exec:\jvvdj.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xxffxfr.exec:\xxffxfr.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184 -
\??\c:\bthtnh.exec:\bthtnh.exe34⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vjpjp.exec:\vjpjp.exe35⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3pddj.exec:\3pddj.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9xrrfxf.exec:\9xrrfxf.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rlrxlrx.exec:\rlrxlrx.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5xxllxf.exec:\5xxllxf.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bnnnbb.exec:\bnnnbb.exe40⤵
- Executes dropped EXE
PID:2972 -
\??\c:\thttbt.exec:\thttbt.exe41⤵
- Executes dropped EXE
PID:288 -
\??\c:\jvdjp.exec:\jvdjp.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pjpvv.exec:\pjpvv.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3rlflfr.exec:\3rlflfr.exe44⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xxflxxl.exec:\xxflxxl.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1bnnbt.exec:\1bnnbt.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hhtbhb.exec:\hhtbhb.exe47⤵
- Executes dropped EXE
PID:2620 -
\??\c:\3vjjp.exec:\3vjjp.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rrffxxf.exec:\rrffxxf.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xxrlfxf.exec:\xxrlfxf.exe50⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bthntt.exec:\bthntt.exe51⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1btntt.exec:\1btntt.exe52⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpddj.exec:\vpddj.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jvpjv.exec:\jvpjv.exe54⤵
- Executes dropped EXE
PID:1256 -
\??\c:\fxffllx.exec:\fxffllx.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlrxrlx.exec:\rlrxrlx.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tthhtt.exec:\tthhtt.exe57⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bnttbh.exec:\bnttbh.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dvjpd.exec:\dvjpd.exe59⤵
- Executes dropped EXE
PID:1872 -
\??\c:\5pdjj.exec:\5pdjj.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\1xrxxfl.exec:\1xrxxfl.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe62⤵
- Executes dropped EXE
PID:1360 -
\??\c:\7nnnhh.exec:\7nnnhh.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbnntt.exec:\hbnntt.exe64⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5jpvp.exec:\5jpvp.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dpvvd.exec:\dpvvd.exe66⤵PID:1356
-
\??\c:\rfxfxxl.exec:\rfxfxxl.exe67⤵PID:1204
-
\??\c:\rlxxllr.exec:\rlxxllr.exe68⤵PID:2792
-
\??\c:\hbhhnn.exec:\hbhhnn.exe69⤵PID:1840
-
\??\c:\bnhntn.exec:\bnhntn.exe70⤵PID:2724
-
\??\c:\9vjjp.exec:\9vjjp.exe71⤵PID:560
-
\??\c:\5vdjd.exec:\5vdjd.exe72⤵PID:2044
-
\??\c:\lfffrxx.exec:\lfffrxx.exe73⤵PID:1660
-
\??\c:\1xrxfff.exec:\1xrxfff.exe74⤵PID:2796
-
\??\c:\7llrffl.exec:\7llrffl.exe75⤵PID:2196
-
\??\c:\nhntbt.exec:\nhntbt.exe76⤵PID:632
-
\??\c:\5nnhtb.exec:\5nnhtb.exe77⤵PID:1548
-
\??\c:\jdvpd.exec:\jdvpd.exe78⤵PID:788
-
\??\c:\dvjpv.exec:\dvjpv.exe79⤵PID:2996
-
\??\c:\ffxlffr.exec:\ffxlffr.exe80⤵PID:1888
-
\??\c:\rlfrflr.exec:\rlfrflr.exe81⤵PID:2880
-
\??\c:\fxflxxr.exec:\fxflxxr.exe82⤵PID:1016
-
\??\c:\7ththh.exec:\7ththh.exe83⤵PID:1404
-
\??\c:\9bhhbb.exec:\9bhhbb.exe84⤵PID:1276
-
\??\c:\3jvdj.exec:\3jvdj.exe85⤵PID:2364
-
\??\c:\dvddj.exec:\dvddj.exe86⤵PID:2068
-
\??\c:\xrllfll.exec:\xrllfll.exe87⤵PID:1484
-
\??\c:\lfffrrr.exec:\lfffrrr.exe88⤵PID:1628
-
\??\c:\tnbbhh.exec:\tnbbhh.exe89⤵PID:2180
-
\??\c:\tthhhh.exec:\tthhhh.exe90⤵PID:2916
-
\??\c:\pdjvj.exec:\pdjvj.exe91⤵PID:2840
-
\??\c:\1dpvd.exec:\1dpvd.exe92⤵PID:2628
-
\??\c:\1vjjp.exec:\1vjjp.exe93⤵PID:2720
-
\??\c:\ffrrffl.exec:\ffrrffl.exe94⤵PID:3044
-
\??\c:\rrlrxff.exec:\rrlrxff.exe95⤵PID:2612
-
\??\c:\tnhtnt.exec:\tnhtnt.exe96⤵PID:2520
-
\??\c:\hbnbtt.exec:\hbnbtt.exe97⤵PID:2828
-
\??\c:\vpjjv.exec:\vpjjv.exe98⤵PID:2440
-
\??\c:\3pddd.exec:\3pddd.exe99⤵PID:2656
-
\??\c:\lxfflll.exec:\lxfflll.exe100⤵PID:2480
-
\??\c:\xlfrffl.exec:\xlfrffl.exe101⤵PID:2552
-
\??\c:\7hbhtt.exec:\7hbhtt.exe102⤵PID:1416
-
\??\c:\9btbtt.exec:\9btbtt.exe103⤵PID:1312
-
\??\c:\3jjjp.exec:\3jjjp.exe104⤵PID:2400
-
\??\c:\pjdjv.exec:\pjdjv.exe105⤵PID:1664
-
\??\c:\5frlxxf.exec:\5frlxxf.exe106⤵PID:2404
-
\??\c:\5xlrfrx.exec:\5xlrfrx.exe107⤵PID:1128
-
\??\c:\9lrxrrx.exec:\9lrxrrx.exe108⤵PID:1964
-
\??\c:\nnhhbb.exec:\nnhhbb.exe109⤵PID:1584
-
\??\c:\hbhbnh.exec:\hbhbnh.exe110⤵PID:1960
-
\??\c:\vjvvd.exec:\vjvvd.exe111⤵PID:1896
-
\??\c:\jdvjj.exec:\jdvjj.exe112⤵PID:1716
-
\??\c:\9fxfxxf.exec:\9fxfxxf.exe113⤵PID:1260
-
\??\c:\fxfxffl.exec:\fxfxffl.exe114⤵PID:1044
-
\??\c:\5bbbbb.exec:\5bbbbb.exe115⤵PID:2736
-
\??\c:\3nbbnn.exec:\3nbbnn.exe116⤵PID:1788
-
\??\c:\3dpdv.exec:\3dpdv.exe117⤵PID:2792
-
\??\c:\dvdpv.exec:\dvdpv.exe118⤵PID:956
-
\??\c:\fxxfffl.exec:\fxxfffl.exe119⤵PID:3024
-
\??\c:\7lrxffl.exec:\7lrxffl.exe120⤵PID:560
-
\??\c:\btntnt.exec:\btntnt.exe121⤵PID:912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-