Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 01:20
Behavioral task
behavioral1
Sample
2c75f5b0b73da8378aa2025737180fc0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
2c75f5b0b73da8378aa2025737180fc0N.exe
-
Size
337KB
-
MD5
2c75f5b0b73da8378aa2025737180fc0
-
SHA1
5c7e9c9e5e6d0036e15298a5abcb532b4377206d
-
SHA256
d1f3338e6c605c28ff1594bc274846623e6a62c0333cfa68441456ad872992dc
-
SHA512
463d80669ce93d90857acfc1246f27141165fab3fc92a14c7194dfcad686fcbc5510ba604c457938813a2068a9211f606173fe92dd7be1a31b33eeccb133cf3d
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/K:x4wFHoS3eFaKHpv/VycgE8oK
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/484-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1416-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-156-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3040-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/564-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-295-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-591-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2308-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-614-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-646-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/468-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-822-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2788-888-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-1170-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1416 tnhhbb.exe 2088 7jdpd.exe 2496 xrlrxlx.exe 2220 9thhth.exe 2820 vpvjp.exe 2768 pjjjp.exe 2744 rxlxrfl.exe 3004 tnbthh.exe 2676 vjdpv.exe 2652 hthtnt.exe 2664 hbhhtt.exe 584 9frxlrf.exe 2024 bbtttt.exe 2728 3vpdj.exe 2584 jvdpp.exe 344 tnttbb.exe 612 vjpjj.exe 3040 fxrxffr.exe 2164 7thhtt.exe 2480 dvvpj.exe 1092 rlrxflr.exe 2604 tntthn.exe 1312 jdvpd.exe 2108 9jjpv.exe 564 1bhhtt.exe 660 vpvpp.exe 1476 vpddd.exe 2268 fffxrfl.exe 556 bntbnb.exe 1900 jjdjp.exe 1752 djvvp.exe 1864 9bnntt.exe 2448 jdpjv.exe 1596 5djjj.exe 2476 lfxlffr.exe 684 3tnbhn.exe 2772 1nbbnn.exe 2716 3vvvd.exe 2824 pjjvv.exe 2820 xlxfffl.exe 2752 rlrxffl.exe 2648 tnbhtb.exe 2764 vpjvd.exe 2800 jjdjv.exe 2688 frxxlrf.exe 332 fxrrxxl.exe 588 hbhntt.exe 1108 9hbtth.exe 2952 3vjjv.exe 1528 hbnttb.exe 3028 9dpvd.exe 2872 xfrrxxf.exe 1760 hbhhbh.exe 2852 pdjdd.exe 768 bbhttt.exe 1692 vvvpd.exe 2428 nhbtbb.exe 2660 bnbhhb.exe 2480 vpvpd.exe 1908 xrffllr.exe 2036 lfxxffr.exe 320 hbhhhn.exe 1816 nbnhnh.exe 1300 7pvdp.exe -
resource yara_rule behavioral1/memory/484-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000120f9-5.dat upx behavioral1/memory/484-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2496-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001752e-27.dat upx behavioral1/memory/2088-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000174ab-18.dat upx behavioral1/memory/1416-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0013000000018676-36.dat upx behavioral1/files/0x0006000000018798-45.dat upx behavioral1/memory/2820-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018c22-56.dat upx behavioral1/memory/2768-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018c2c-64.dat upx behavioral1/files/0x0008000000018f58-74.dat upx behavioral1/memory/3004-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3004-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001903f-81.dat upx behavioral1/files/0x000500000001939d-89.dat upx behavioral1/memory/2652-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ab-100.dat upx behavioral1/files/0x000500000001942a-107.dat upx behavioral1/memory/584-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/584-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001942d-118.dat upx behavioral1/files/0x000500000001943e-127.dat upx behavioral1/memory/2024-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019448-137.dat upx behavioral1/files/0x0005000000019453-148.dat upx behavioral1/memory/344-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001945e-158.dat upx behavioral1/files/0x0005000000019462-166.dat upx behavioral1/memory/3040-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946f-176.dat upx behavioral1/memory/3040-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017409-183.dat upx behavioral1/memory/1092-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019473-193.dat upx behavioral1/memory/2480-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b4-203.dat upx behavioral1/files/0x00050000000194e5-219.dat upx behavioral1/files/0x00050000000194cd-212.dat upx behavioral1/memory/1092-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019505-229.dat upx behavioral1/files/0x0005000000019532-238.dat upx behavioral1/files/0x0005000000019638-246.dat upx behavioral1/memory/564-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001963a-253.dat upx behavioral1/memory/2108-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001963f-268.dat upx behavioral1/files/0x00050000000197b0-278.dat upx behavioral1/memory/1900-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019a68-287.dat upx behavioral1/memory/2448-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-326-0x00000000001B0000-0x00000000001D7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 484 wrote to memory of 1416 484 2c75f5b0b73da8378aa2025737180fc0N.exe 30 PID 484 wrote to memory of 1416 484 2c75f5b0b73da8378aa2025737180fc0N.exe 30 PID 484 wrote to memory of 1416 484 2c75f5b0b73da8378aa2025737180fc0N.exe 30 PID 484 wrote to memory of 1416 484 2c75f5b0b73da8378aa2025737180fc0N.exe 30 PID 1416 wrote to memory of 2088 1416 tnhhbb.exe 31 PID 1416 wrote to memory of 2088 1416 tnhhbb.exe 31 PID 1416 wrote to memory of 2088 1416 tnhhbb.exe 31 PID 1416 wrote to memory of 2088 1416 tnhhbb.exe 31 PID 2088 wrote to memory of 2496 2088 7jdpd.exe 32 PID 2088 wrote to memory of 2496 2088 7jdpd.exe 32 PID 2088 wrote to memory of 2496 2088 7jdpd.exe 32 PID 2088 wrote to memory of 2496 2088 7jdpd.exe 32 PID 2496 wrote to memory of 2220 2496 xrlrxlx.exe 33 PID 2496 wrote to memory of 2220 2496 xrlrxlx.exe 33 PID 2496 wrote to memory of 2220 2496 xrlrxlx.exe 33 PID 2496 wrote to memory of 2220 2496 xrlrxlx.exe 33 PID 2220 wrote to memory of 2820 2220 9thhth.exe 34 PID 2220 wrote to memory of 2820 2220 9thhth.exe 34 PID 2220 wrote to memory of 2820 2220 9thhth.exe 34 PID 2220 wrote to memory of 2820 2220 9thhth.exe 34 PID 2820 wrote to memory of 2768 2820 vpvjp.exe 35 PID 2820 wrote to memory of 2768 2820 vpvjp.exe 35 PID 2820 wrote to memory of 2768 2820 vpvjp.exe 35 PID 2820 wrote to memory of 2768 2820 vpvjp.exe 35 PID 2768 wrote to memory of 2744 2768 pjjjp.exe 36 PID 2768 wrote to memory of 2744 2768 pjjjp.exe 36 PID 2768 wrote to memory of 2744 2768 pjjjp.exe 36 PID 2768 wrote to memory of 2744 2768 pjjjp.exe 36 PID 2744 wrote to memory of 3004 2744 rxlxrfl.exe 37 PID 2744 wrote to memory of 3004 2744 rxlxrfl.exe 37 PID 2744 wrote to memory of 3004 2744 rxlxrfl.exe 37 PID 2744 wrote to memory of 3004 2744 rxlxrfl.exe 37 PID 3004 wrote to memory of 2676 3004 tnbthh.exe 38 PID 3004 wrote to memory of 2676 3004 tnbthh.exe 38 PID 3004 wrote to memory of 2676 3004 tnbthh.exe 38 PID 3004 wrote to memory of 2676 3004 tnbthh.exe 38 PID 2676 wrote to memory of 2652 2676 vjdpv.exe 39 PID 2676 wrote to memory of 2652 2676 vjdpv.exe 39 PID 2676 wrote to memory of 2652 2676 vjdpv.exe 39 PID 2676 wrote to memory of 2652 2676 vjdpv.exe 39 PID 2652 wrote to memory of 2664 2652 hthtnt.exe 40 PID 2652 wrote to memory of 2664 2652 hthtnt.exe 40 PID 2652 wrote to memory of 2664 2652 hthtnt.exe 40 PID 2652 wrote to memory of 2664 2652 hthtnt.exe 40 PID 2664 wrote to memory of 584 2664 hbhhtt.exe 41 PID 2664 wrote to memory of 584 2664 hbhhtt.exe 41 PID 2664 wrote to memory of 584 2664 hbhhtt.exe 41 PID 2664 wrote to memory of 584 2664 hbhhtt.exe 41 PID 584 wrote to memory of 2024 584 9frxlrf.exe 42 PID 584 wrote to memory of 2024 584 9frxlrf.exe 42 PID 584 wrote to memory of 2024 584 9frxlrf.exe 42 PID 584 wrote to memory of 2024 584 9frxlrf.exe 42 PID 2024 wrote to memory of 2728 2024 bbtttt.exe 43 PID 2024 wrote to memory of 2728 2024 bbtttt.exe 43 PID 2024 wrote to memory of 2728 2024 bbtttt.exe 43 PID 2024 wrote to memory of 2728 2024 bbtttt.exe 43 PID 2728 wrote to memory of 2584 2728 3vpdj.exe 44 PID 2728 wrote to memory of 2584 2728 3vpdj.exe 44 PID 2728 wrote to memory of 2584 2728 3vpdj.exe 44 PID 2728 wrote to memory of 2584 2728 3vpdj.exe 44 PID 2584 wrote to memory of 344 2584 jvdpp.exe 45 PID 2584 wrote to memory of 344 2584 jvdpp.exe 45 PID 2584 wrote to memory of 344 2584 jvdpp.exe 45 PID 2584 wrote to memory of 344 2584 jvdpp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c75f5b0b73da8378aa2025737180fc0N.exe"C:\Users\Admin\AppData\Local\Temp\2c75f5b0b73da8378aa2025737180fc0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\tnhhbb.exec:\tnhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\7jdpd.exec:\7jdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\9thhth.exec:\9thhth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\vpvjp.exec:\vpvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pjjjp.exec:\pjjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rxlxrfl.exec:\rxlxrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tnbthh.exec:\tnbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\vjdpv.exec:\vjdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hthtnt.exec:\hthtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hbhhtt.exec:\hbhhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9frxlrf.exec:\9frxlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\bbtttt.exec:\bbtttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\3vpdj.exec:\3vpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jvdpp.exec:\jvdpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tnttbb.exec:\tnttbb.exe17⤵
- Executes dropped EXE
PID:344 -
\??\c:\vjpjj.exec:\vjpjj.exe18⤵
- Executes dropped EXE
PID:612 -
\??\c:\fxrxffr.exec:\fxrxffr.exe19⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7thhtt.exec:\7thhtt.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dvvpj.exec:\dvvpj.exe21⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rlrxflr.exec:\rlrxflr.exe22⤵
- Executes dropped EXE
PID:1092 -
\??\c:\tntthn.exec:\tntthn.exe23⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdvpd.exec:\jdvpd.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9jjpv.exec:\9jjpv.exe25⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1bhhtt.exec:\1bhhtt.exe26⤵
- Executes dropped EXE
PID:564 -
\??\c:\vpvpp.exec:\vpvpp.exe27⤵
- Executes dropped EXE
PID:660 -
\??\c:\vpddd.exec:\vpddd.exe28⤵
- Executes dropped EXE
PID:1476 -
\??\c:\fffxrfl.exec:\fffxrfl.exe29⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bntbnb.exec:\bntbnb.exe30⤵
- Executes dropped EXE
PID:556 -
\??\c:\jjdjp.exec:\jjdjp.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\djvvp.exec:\djvvp.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\9bnntt.exec:\9bnntt.exe33⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jdpjv.exec:\jdpjv.exe34⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5djjj.exec:\5djjj.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lfxlffr.exec:\lfxlffr.exe36⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3tnbhn.exec:\3tnbhn.exe37⤵
- Executes dropped EXE
PID:684 -
\??\c:\1nbbnn.exec:\1nbbnn.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3vvvd.exec:\3vvvd.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pjjvv.exec:\pjjvv.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xlxfffl.exec:\xlxfffl.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rlrxffl.exec:\rlrxffl.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tnbhtb.exec:\tnbhtb.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vpjvd.exec:\vpjvd.exe44⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jjdjv.exec:\jjdjv.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\frxxlrf.exec:\frxxlrf.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe47⤵
- Executes dropped EXE
PID:332 -
\??\c:\hbhntt.exec:\hbhntt.exe48⤵
- Executes dropped EXE
PID:588 -
\??\c:\9hbtth.exec:\9hbtth.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1108 -
\??\c:\3vjjv.exec:\3vjjv.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbnttb.exec:\hbnttb.exe51⤵
- Executes dropped EXE
PID:1528 -
\??\c:\9dpvd.exec:\9dpvd.exe52⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xfrrxxf.exec:\xfrrxxf.exe53⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hbhhbh.exec:\hbhhbh.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pdjdd.exec:\pdjdd.exe55⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bbhttt.exec:\bbhttt.exe56⤵
- Executes dropped EXE
PID:768 -
\??\c:\vvvpd.exec:\vvvpd.exe57⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhbtbb.exec:\nhbtbb.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bnbhhb.exec:\bnbhhb.exe59⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vpvpd.exec:\vpvpd.exe60⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xrffllr.exec:\xrffllr.exe61⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lfxxffr.exec:\lfxxffr.exe62⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hbhhhn.exec:\hbhhhn.exe63⤵
- Executes dropped EXE
PID:320 -
\??\c:\nbnhnh.exec:\nbnhnh.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\7pvdp.exec:\7pvdp.exe65⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pjvvj.exec:\pjvvj.exe66⤵PID:1540
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe67⤵PID:2384
-
\??\c:\hbntnn.exec:\hbntnn.exe68⤵PID:948
-
\??\c:\btnttb.exec:\btnttb.exe69⤵PID:2524
-
\??\c:\5jdjv.exec:\5jdjv.exe70⤵PID:352
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe71⤵PID:1544
-
\??\c:\xrxfllx.exec:\xrxfllx.exe72⤵PID:1756
-
\??\c:\1bnnbh.exec:\1bnnbh.exe73⤵PID:1736
-
\??\c:\nbbhhb.exec:\nbbhhb.exe74⤵PID:2004
-
\??\c:\7pddd.exec:\7pddd.exe75⤵PID:1864
-
\??\c:\frxlrfl.exec:\frxlrfl.exe76⤵PID:2128
-
\??\c:\3xlrxxf.exec:\3xlrxxf.exe77⤵PID:1596
-
\??\c:\hbhntb.exec:\hbhntb.exe78⤵PID:2272
-
\??\c:\hhbhtt.exec:\hhbhtt.exe79⤵PID:2308
-
\??\c:\1jppp.exec:\1jppp.exe80⤵PID:2364
-
\??\c:\rlxflxl.exec:\rlxflxl.exe81⤵PID:2776
-
\??\c:\3flrffl.exec:\3flrffl.exe82⤵PID:2732
-
\??\c:\bnbnnn.exec:\bnbnnn.exe83⤵PID:2788
-
\??\c:\9thntt.exec:\9thntt.exe84⤵PID:2836
-
\??\c:\jdjdp.exec:\jdjdp.exe85⤵PID:1484
-
\??\c:\xxrflxl.exec:\xxrflxl.exe86⤵PID:2620
-
\??\c:\frfrrrr.exec:\frfrrrr.exe87⤵PID:2792
-
\??\c:\btbbhn.exec:\btbbhn.exe88⤵PID:2800
-
\??\c:\vjjjv.exec:\vjjjv.exe89⤵PID:1808
-
\??\c:\vpjvp.exec:\vpjvp.exe90⤵PID:2672
-
\??\c:\xrflrxr.exec:\xrflrxr.exe91⤵PID:1640
-
\??\c:\bnnhnh.exec:\bnnhnh.exe92⤵PID:2856
-
\??\c:\bnbhtn.exec:\bnbhtn.exe93⤵PID:2980
-
\??\c:\dvppd.exec:\dvppd.exe94⤵PID:2968
-
\??\c:\5jvdj.exec:\5jvdj.exe95⤵PID:1444
-
\??\c:\fxrxfxf.exec:\fxrxfxf.exe96⤵PID:3068
-
\??\c:\1rfxffl.exec:\1rfxffl.exe97⤵PID:612
-
\??\c:\nbhhtt.exec:\nbhhtt.exe98⤵PID:1936
-
\??\c:\jdppv.exec:\jdppv.exe99⤵PID:3056
-
\??\c:\pdjpp.exec:\pdjpp.exe100⤵PID:536
-
\??\c:\xlxxfrr.exec:\xlxxfrr.exe101⤵PID:2860
-
\??\c:\lrxrrll.exec:\lrxrrll.exe102⤵PID:2284
-
\??\c:\tthhnn.exec:\tthhnn.exe103⤵PID:1048
-
\??\c:\1dvvd.exec:\1dvvd.exe104⤵PID:288
-
\??\c:\vjvpd.exec:\vjvpd.exe105⤵PID:548
-
\??\c:\7xlrfll.exec:\7xlrfll.exe106⤵PID:964
-
\??\c:\1lfrfrx.exec:\1lfrfrx.exe107⤵PID:1556
-
\??\c:\bnnhnb.exec:\bnnhnb.exe108⤵PID:1552
-
\??\c:\bbtbnt.exec:\bbtbnt.exe109⤵PID:2680
-
\??\c:\3vdpv.exec:\3vdpv.exe110⤵PID:2384
-
\??\c:\3rxfffl.exec:\3rxfffl.exe111⤵PID:948
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe112⤵PID:2160
-
\??\c:\7ntttt.exec:\7ntttt.exe113⤵PID:2268
-
\??\c:\5vjpj.exec:\5vjpj.exe114⤵PID:468
-
\??\c:\jvppd.exec:\jvppd.exe115⤵PID:1900
-
\??\c:\9lrxffl.exec:\9lrxffl.exe116⤵PID:1744
-
\??\c:\fxlxfll.exec:\fxlxfll.exe117⤵PID:1604
-
\??\c:\5bnttn.exec:\5bnttn.exe118⤵PID:1864
-
\??\c:\3ppvj.exec:\3ppvj.exe119⤵PID:2128
-
\??\c:\jjvdp.exec:\jjvdp.exe120⤵PID:2580
-
\??\c:\xrfflrf.exec:\xrfflrf.exe121⤵PID:684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-