Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe
-
Size
458KB
-
MD5
0b6a803003055ab4909f395fe5850e9c
-
SHA1
004d519293df979ef5c3a5ee73f65f004603f316
-
SHA256
4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65
-
SHA512
99b39b87a7b9aefd456b78bcd464a16b88f1fe2df0a09ace9fa5567c9ccefd1fe12f99baea48af5760dafc82dc7066be8f2600753cc1d8b36e8ab6e874ccbd47
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2940-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-298-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2760-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-360-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-426-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2076-482-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2560-483-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-480-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2240-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-582-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2140-622-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2840-697-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2024-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-777-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2264 1xlxflf.exe 2892 btbbnh.exe 2712 xfxxllx.exe 2204 7httbn.exe 2968 5lxlxfl.exe 2932 tthntt.exe 2636 5frrxlr.exe 3068 bhthht.exe 824 5lxflfr.exe 2428 tthntt.exe 1880 jdddv.exe 2572 rrflxrf.exe 1832 hbtbtb.exe 2028 ppddp.exe 2420 lxlflfl.exe 2424 tbnbbt.exe 764 3lrllff.exe 2024 tnbbhh.exe 2296 dvvpv.exe 2484 hthhbt.exe 1816 jjjjp.exe 2584 1xrrxxl.exe 1132 dvppv.exe 1612 ppdjp.exe 292 lfxxlrf.exe 1348 tnbbhh.exe 1776 lfrrrrf.exe 600 7htnbb.exe 2392 vvjpd.exe 2540 rlxfrxl.exe 2176 pjjjj.exe 1692 rllrrxl.exe 2312 3tbhhb.exe 1596 dvjpp.exe 2140 ffxxflx.exe 2884 nnbbnt.exe 2760 btnhht.exe 2724 fxfxffl.exe 2916 rfrlllr.exe 2204 btnthh.exe 2628 vjvpv.exe 2624 lfxxllr.exe 2684 tnnnhh.exe 2172 9jjjd.exe 3068 xrxllff.exe 2040 5xfxxxx.exe 2144 htnhnh.exe 1812 vjppj.exe 1280 xrfflrx.exe 2804 7rllxxx.exe 2948 nnnnnh.exe 2008 1vjjp.exe 2824 ppddp.exe 2452 1flllfl.exe 2192 bthbnn.exe 832 pdppv.exe 2560 xrfxfxf.exe 2116 1xllrxf.exe 2128 9tbnnh.exe 2076 jdppv.exe 288 1dpjd.exe 2320 lxffxrl.exe 1356 bnbbbt.exe 2500 pjpvp.exe -
resource yara_rule behavioral1/memory/2940-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-447-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/832-454-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2076-480-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2240-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-582-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2900-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-621-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2672-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-697-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2024-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-777-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1688-784-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2264 2940 4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe 30 PID 2940 wrote to memory of 2264 2940 4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe 30 PID 2940 wrote to memory of 2264 2940 4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe 30 PID 2940 wrote to memory of 2264 2940 4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe 30 PID 2264 wrote to memory of 2892 2264 1xlxflf.exe 31 PID 2264 wrote to memory of 2892 2264 1xlxflf.exe 31 PID 2264 wrote to memory of 2892 2264 1xlxflf.exe 31 PID 2264 wrote to memory of 2892 2264 1xlxflf.exe 31 PID 2892 wrote to memory of 2712 2892 btbbnh.exe 32 PID 2892 wrote to memory of 2712 2892 btbbnh.exe 32 PID 2892 wrote to memory of 2712 2892 btbbnh.exe 32 PID 2892 wrote to memory of 2712 2892 btbbnh.exe 32 PID 2712 wrote to memory of 2204 2712 xfxxllx.exe 33 PID 2712 wrote to memory of 2204 2712 xfxxllx.exe 33 PID 2712 wrote to memory of 2204 2712 xfxxllx.exe 33 PID 2712 wrote to memory of 2204 2712 xfxxllx.exe 33 PID 2204 wrote to memory of 2968 2204 7httbn.exe 34 PID 2204 wrote to memory of 2968 2204 7httbn.exe 34 PID 2204 wrote to memory of 2968 2204 7httbn.exe 34 PID 2204 wrote to memory of 2968 2204 7httbn.exe 34 PID 2968 wrote to memory of 2932 2968 5lxlxfl.exe 35 PID 2968 wrote to memory of 2932 2968 5lxlxfl.exe 35 PID 2968 wrote to memory of 2932 2968 5lxlxfl.exe 35 PID 2968 wrote to memory of 2932 2968 5lxlxfl.exe 35 PID 2932 wrote to memory of 2636 2932 tthntt.exe 36 PID 2932 wrote to memory of 2636 2932 tthntt.exe 36 PID 2932 wrote to memory of 2636 2932 tthntt.exe 36 PID 2932 wrote to memory of 2636 2932 tthntt.exe 36 PID 2636 wrote to memory of 3068 2636 5frrxlr.exe 37 PID 2636 wrote to memory of 3068 2636 5frrxlr.exe 37 PID 2636 wrote to memory of 3068 2636 5frrxlr.exe 37 PID 2636 wrote to memory of 3068 2636 5frrxlr.exe 37 PID 3068 wrote to memory of 824 3068 bhthht.exe 38 PID 3068 wrote to memory of 824 3068 bhthht.exe 38 PID 3068 wrote to memory of 824 3068 bhthht.exe 38 PID 3068 wrote to memory of 824 3068 bhthht.exe 38 PID 824 wrote to memory of 2428 824 5lxflfr.exe 39 PID 824 wrote to memory of 2428 824 5lxflfr.exe 39 PID 824 wrote to memory of 2428 824 5lxflfr.exe 39 PID 824 wrote to memory of 2428 824 5lxflfr.exe 39 PID 2428 wrote to memory of 1880 2428 tthntt.exe 40 PID 2428 wrote to memory of 1880 2428 tthntt.exe 40 PID 2428 wrote to memory of 1880 2428 tthntt.exe 40 PID 2428 wrote to memory of 1880 2428 tthntt.exe 40 PID 1880 wrote to memory of 2572 1880 jdddv.exe 41 PID 1880 wrote to memory of 2572 1880 jdddv.exe 41 PID 1880 wrote to memory of 2572 1880 jdddv.exe 41 PID 1880 wrote to memory of 2572 1880 jdddv.exe 41 PID 2572 wrote to memory of 1832 2572 rrflxrf.exe 42 PID 2572 wrote to memory of 1832 2572 rrflxrf.exe 42 PID 2572 wrote to memory of 1832 2572 rrflxrf.exe 42 PID 2572 wrote to memory of 1832 2572 rrflxrf.exe 42 PID 1832 wrote to memory of 2028 1832 hbtbtb.exe 43 PID 1832 wrote to memory of 2028 1832 hbtbtb.exe 43 PID 1832 wrote to memory of 2028 1832 hbtbtb.exe 43 PID 1832 wrote to memory of 2028 1832 hbtbtb.exe 43 PID 2028 wrote to memory of 2420 2028 ppddp.exe 44 PID 2028 wrote to memory of 2420 2028 ppddp.exe 44 PID 2028 wrote to memory of 2420 2028 ppddp.exe 44 PID 2028 wrote to memory of 2420 2028 ppddp.exe 44 PID 2420 wrote to memory of 2424 2420 lxlflfl.exe 45 PID 2420 wrote to memory of 2424 2420 lxlflfl.exe 45 PID 2420 wrote to memory of 2424 2420 lxlflfl.exe 45 PID 2420 wrote to memory of 2424 2420 lxlflfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe"C:\Users\Admin\AppData\Local\Temp\4cf6e207498ffdebe0da0c3748b5c27dd91e019ae159cb65bc2eea7878ee7e65.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\1xlxflf.exec:\1xlxflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\btbbnh.exec:\btbbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xfxxllx.exec:\xfxxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7httbn.exec:\7httbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\5lxlxfl.exec:\5lxlxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\tthntt.exec:\tthntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\5frrxlr.exec:\5frrxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\bhthht.exec:\bhthht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\5lxflfr.exec:\5lxflfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\tthntt.exec:\tthntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\jdddv.exec:\jdddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\rrflxrf.exec:\rrflxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hbtbtb.exec:\hbtbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\ppddp.exec:\ppddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\lxlflfl.exec:\lxlflfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tbnbbt.exec:\tbnbbt.exe17⤵
- Executes dropped EXE
PID:2424 -
\??\c:\3lrllff.exec:\3lrllff.exe18⤵
- Executes dropped EXE
PID:764 -
\??\c:\tnbbhh.exec:\tnbbhh.exe19⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dvvpv.exec:\dvvpv.exe20⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hthhbt.exec:\hthhbt.exe21⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jjjjp.exec:\jjjjp.exe22⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1xrrxxl.exec:\1xrrxxl.exe23⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvppv.exec:\dvppv.exe24⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ppdjp.exec:\ppdjp.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe26⤵
- Executes dropped EXE
PID:292 -
\??\c:\tnbbhh.exec:\tnbbhh.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe28⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7htnbb.exec:\7htnbb.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\vvjpd.exec:\vvjpd.exe30⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe31⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pjjjj.exec:\pjjjj.exe32⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rllrrxl.exec:\rllrrxl.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3tbhhb.exec:\3tbhhb.exe34⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvjpp.exec:\dvjpp.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ffxxflx.exec:\ffxxflx.exe36⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nnbbnt.exec:\nnbbnt.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\btnhht.exec:\btnhht.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fxfxffl.exec:\fxfxffl.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rfrlllr.exec:\rfrlllr.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btnthh.exec:\btnthh.exe41⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vjvpv.exec:\vjvpv.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lfxxllr.exec:\lfxxllr.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnnnhh.exec:\tnnnhh.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9jjjd.exec:\9jjjd.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xrxllff.exec:\xrxllff.exe46⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5xfxxxx.exec:\5xfxxxx.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\htnhnh.exec:\htnhnh.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\vjppj.exec:\vjppj.exe49⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xrfflrx.exec:\xrfflrx.exe50⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7rllxxx.exec:\7rllxxx.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnnnnh.exec:\nnnnnh.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1vjjp.exec:\1vjjp.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ppddp.exec:\ppddp.exe54⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1flllfl.exec:\1flllfl.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bthbnn.exec:\bthbnn.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pdppv.exec:\pdppv.exe57⤵
- Executes dropped EXE
PID:832 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe58⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1xllrxf.exec:\1xllrxf.exe59⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9tbnnh.exec:\9tbnnh.exe60⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdppv.exec:\jdppv.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1dpjd.exec:\1dpjd.exe62⤵
- Executes dropped EXE
PID:288 -
\??\c:\lxffxrl.exec:\lxffxrl.exe63⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bnbbbt.exec:\bnbbbt.exe64⤵
- Executes dropped EXE
PID:1356 -
\??\c:\pjpvp.exec:\pjpvp.exe65⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjvvv.exec:\pjvvv.exe66⤵PID:1540
-
\??\c:\xrlflll.exec:\xrlflll.exe67⤵PID:2240
-
\??\c:\7nbhbb.exec:\7nbhbb.exe68⤵PID:1752
-
\??\c:\hbnntt.exec:\hbnntt.exe69⤵PID:568
-
\??\c:\ppdvv.exec:\ppdvv.exe70⤵PID:948
-
\??\c:\fxllxxl.exec:\fxllxxl.exe71⤵PID:2504
-
\??\c:\9hhhbh.exec:\9hhhbh.exe72⤵PID:1252
-
\??\c:\nbnthn.exec:\nbnthn.exe73⤵PID:284
-
\??\c:\3jddv.exec:\3jddv.exe74⤵PID:2412
-
\??\c:\rrllxxf.exec:\rrllxxf.exe75⤵PID:2080
-
\??\c:\htnntn.exec:\htnntn.exe76⤵PID:1728
-
\??\c:\thhtnh.exec:\thhtnh.exe77⤵PID:2444
-
\??\c:\7vvpj.exec:\7vvpj.exe78⤵PID:2140
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe79⤵PID:2884
-
\??\c:\hthhhb.exec:\hthhhb.exe80⤵PID:2900
-
\??\c:\5nhnnn.exec:\5nhnnn.exe81⤵PID:2724
-
\??\c:\dpddd.exec:\dpddd.exe82⤵PID:2772
-
\??\c:\5fllrrf.exec:\5fllrrf.exe83⤵PID:2204
-
\??\c:\bbnnnn.exec:\bbnnnn.exe84⤵PID:2672
-
\??\c:\3bnnnn.exec:\3bnnnn.exe85⤵PID:2624
-
\??\c:\5vjjj.exec:\5vjjj.exe86⤵PID:2684
-
\??\c:\jvvdj.exec:\jvvdj.exe87⤵PID:2232
-
\??\c:\rlfrrlr.exec:\rlfrrlr.exe88⤵PID:2208
-
\??\c:\9tbhtt.exec:\9tbhtt.exe89⤵PID:2040
-
\??\c:\7pddd.exec:\7pddd.exe90⤵PID:2144
-
\??\c:\ddddp.exec:\ddddp.exe91⤵PID:1396
-
\??\c:\frllllx.exec:\frllllx.exe92⤵PID:2840
-
\??\c:\hbnthh.exec:\hbnthh.exe93⤵PID:2152
-
\??\c:\7thhbh.exec:\7thhbh.exe94⤵
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\7jvvp.exec:\7jvvp.exe95⤵PID:1128
-
\??\c:\5lxrllr.exec:\5lxrllr.exe96⤵PID:2788
-
\??\c:\xrlrflr.exec:\xrlrflr.exe97⤵PID:2452
-
\??\c:\7nbhbt.exec:\7nbhbt.exe98⤵PID:1696
-
\??\c:\ddvdj.exec:\ddvdj.exe99⤵PID:2024
-
\??\c:\9jdpv.exec:\9jdpv.exe100⤵PID:2440
-
\??\c:\5xllfxf.exec:\5xllfxf.exe101⤵PID:2296
-
\??\c:\nbnnnn.exec:\nbnnnn.exe102⤵PID:2200
-
\??\c:\jdjjd.exec:\jdjjd.exe103⤵PID:2076
-
\??\c:\dpvvv.exec:\dpvvv.exe104⤵PID:1244
-
\??\c:\llxxflx.exec:\llxxflx.exe105⤵PID:1344
-
\??\c:\hbttbb.exec:\hbttbb.exe106⤵PID:1688
-
\??\c:\jjvjj.exec:\jjvjj.exe107⤵PID:1612
-
\??\c:\dpjvv.exec:\dpjvv.exe108⤵PID:1780
-
\??\c:\lxffxxr.exec:\lxffxxr.exe109⤵PID:1760
-
\??\c:\5tbhbb.exec:\5tbhbb.exe110⤵PID:1776
-
\??\c:\hbnntt.exec:\hbnntt.exe111⤵PID:1568
-
\??\c:\vdvvv.exec:\vdvvv.exe112⤵PID:1892
-
\??\c:\jvpdj.exec:\jvpdj.exe113⤵PID:772
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe114⤵PID:1036
-
\??\c:\tnhthh.exec:\tnhthh.exe115⤵PID:1684
-
\??\c:\ttntbh.exec:\ttntbh.exe116⤵PID:284
-
\??\c:\dvppv.exec:\dvppv.exe117⤵PID:2412
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe118⤵PID:2312
-
\??\c:\bbthth.exec:\bbthth.exe119⤵PID:2344
-
\??\c:\5tnnnh.exec:\5tnnnh.exe120⤵PID:2872
-
\??\c:\jjdpp.exec:\jjdpp.exe121⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-