Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 08:03
Behavioral task
behavioral1
Sample
7e880f5a6281d2d8012129f67a1b5340N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7e880f5a6281d2d8012129f67a1b5340N.exe
-
Size
77KB
-
MD5
7e880f5a6281d2d8012129f67a1b5340
-
SHA1
137e73d386c6d9a8e148fa0fc4c473478bb20429
-
SHA256
6e891a0d357b113d2a5c3aae4220e27d37766d9653ffc3a3754b832166edefa9
-
SHA512
cef00dab8354bd371592af256f5917c74a8ed81b995f047b5ba7c47544d0968082ae20347ebceaf7470b794ebb76e35ce18a2d2ed7039296c2e4f1eee382e3cc
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNYWkeu3zLoYNyAN4MFmJyaz:khOmTsF93UYfwC6GIoutpYKkeu3gYNyH
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1148-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/704-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/184-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-646-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-678-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-736-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-912-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-948-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-1155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4812 60884.exe 4476 28862.exe 4908 htbtnb.exe 640 804860.exe 1848 064442.exe 2284 jpvpp.exe 1216 7pvpp.exe 4656 rrrlffx.exe 4176 3xrfrxx.exe 1104 886222.exe 3376 480640.exe 656 btbtnn.exe 3632 040440.exe 2208 6806266.exe 4600 2488000.exe 704 ppdvp.exe 1932 24284.exe 3052 084804.exe 4508 6062842.exe 3180 jpdpj.exe 2236 0888822.exe 2036 886624.exe 4912 4222222.exe 4200 rfrfxxx.exe 184 1jjdp.exe 3240 7ddpj.exe 4924 400442.exe 2500 jvdpv.exe 3940 ppjdp.exe 3784 8626082.exe 2884 404402.exe 340 bnnnth.exe 4196 42680.exe 4476 8826048.exe 1152 2268644.exe 3600 1nthnn.exe 3744 446488.exe 960 lfxrfxr.exe 3304 4240042.exe 2564 lxxrlfx.exe 1104 028024.exe 4376 8448668.exe 4148 1ffxrrl.exe 692 jdjdp.exe 3728 bntbhn.exe 1820 a4248.exe 396 8442648.exe 4600 frlxrlf.exe 2536 4408200.exe 2800 40260.exe 4488 9vjdv.exe 3224 6482828.exe 4852 nbtbnn.exe 3736 jjjjd.exe 1948 6620886.exe 4864 1xlfrxx.exe 1180 088084.exe 2580 vjjpj.exe 4064 tnbthn.exe 4428 426608.exe 1176 djddv.exe 2984 7nttht.exe 4832 04486.exe 1808 bnnhth.exe -
resource yara_rule behavioral2/memory/1148-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000235c1-3.dat upx behavioral2/memory/1148-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000235c7-8.dat upx behavioral2/memory/4812-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4476-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235c8-12.dat upx behavioral2/memory/4908-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235c9-22.dat upx behavioral2/memory/4908-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/640-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235ca-29.dat upx behavioral2/files/0x00070000000235cb-33.dat upx behavioral2/memory/1848-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235cc-40.dat upx behavioral2/memory/2284-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235cd-45.dat upx behavioral2/memory/1216-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235ce-52.dat upx behavioral2/memory/4656-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4176-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235cf-57.dat upx behavioral2/files/0x00070000000235d0-62.dat upx behavioral2/memory/1104-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d1-69.dat upx behavioral2/memory/3376-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/656-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d2-75.dat upx behavioral2/memory/656-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3632-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2208-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d3-83.dat upx behavioral2/memory/2208-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d4-91.dat upx behavioral2/files/0x00070000000235d5-96.dat upx behavioral2/memory/4600-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d6-101.dat upx behavioral2/memory/704-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1932-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d7-107.dat upx behavioral2/memory/3052-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000235c5-113.dat upx behavioral2/files/0x00070000000235d8-119.dat upx behavioral2/files/0x00070000000235d9-124.dat upx behavioral2/files/0x00070000000235da-129.dat upx behavioral2/files/0x00070000000235db-133.dat upx behavioral2/files/0x00070000000235dc-138.dat upx behavioral2/files/0x00070000000235dd-143.dat upx behavioral2/memory/184-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235de-150.dat upx behavioral2/files/0x00080000000235df-154.dat upx behavioral2/memory/3240-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4924-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000235e1-161.dat upx behavioral2/memory/4924-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2500-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e2-169.dat upx behavioral2/files/0x00070000000235e3-173.dat upx behavioral2/files/0x00070000000235e4-179.dat upx behavioral2/files/0x00070000000235e5-183.dat upx behavioral2/memory/2884-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4196-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4476-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3600-202-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8844266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 042844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g8862.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48008.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o028006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20664.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 022426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64608.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 4812 1148 7e880f5a6281d2d8012129f67a1b5340N.exe 90 PID 1148 wrote to memory of 4812 1148 7e880f5a6281d2d8012129f67a1b5340N.exe 90 PID 1148 wrote to memory of 4812 1148 7e880f5a6281d2d8012129f67a1b5340N.exe 90 PID 4812 wrote to memory of 4476 4812 60884.exe 91 PID 4812 wrote to memory of 4476 4812 60884.exe 91 PID 4812 wrote to memory of 4476 4812 60884.exe 91 PID 4476 wrote to memory of 4908 4476 28862.exe 93 PID 4476 wrote to memory of 4908 4476 28862.exe 93 PID 4476 wrote to memory of 4908 4476 28862.exe 93 PID 4908 wrote to memory of 640 4908 htbtnb.exe 94 PID 4908 wrote to memory of 640 4908 htbtnb.exe 94 PID 4908 wrote to memory of 640 4908 htbtnb.exe 94 PID 640 wrote to memory of 1848 640 804860.exe 95 PID 640 wrote to memory of 1848 640 804860.exe 95 PID 640 wrote to memory of 1848 640 804860.exe 95 PID 1848 wrote to memory of 2284 1848 064442.exe 96 PID 1848 wrote to memory of 2284 1848 064442.exe 96 PID 1848 wrote to memory of 2284 1848 064442.exe 96 PID 2284 wrote to memory of 1216 2284 jpvpp.exe 97 PID 2284 wrote to memory of 1216 2284 jpvpp.exe 97 PID 2284 wrote to memory of 1216 2284 jpvpp.exe 97 PID 1216 wrote to memory of 4656 1216 7pvpp.exe 98 PID 1216 wrote to memory of 4656 1216 7pvpp.exe 98 PID 1216 wrote to memory of 4656 1216 7pvpp.exe 98 PID 4656 wrote to memory of 4176 4656 rrrlffx.exe 99 PID 4656 wrote to memory of 4176 4656 rrrlffx.exe 99 PID 4656 wrote to memory of 4176 4656 rrrlffx.exe 99 PID 4176 wrote to memory of 1104 4176 3xrfrxx.exe 100 PID 4176 wrote to memory of 1104 4176 3xrfrxx.exe 100 PID 4176 wrote to memory of 1104 4176 3xrfrxx.exe 100 PID 1104 wrote to memory of 3376 1104 886222.exe 102 PID 1104 wrote to memory of 3376 1104 886222.exe 102 PID 1104 wrote to memory of 3376 1104 886222.exe 102 PID 3376 wrote to memory of 656 3376 480640.exe 103 PID 3376 wrote to memory of 656 3376 480640.exe 103 PID 3376 wrote to memory of 656 3376 480640.exe 103 PID 656 wrote to memory of 3632 656 btbtnn.exe 104 PID 656 wrote to memory of 3632 656 btbtnn.exe 104 PID 656 wrote to memory of 3632 656 btbtnn.exe 104 PID 3632 wrote to memory of 2208 3632 040440.exe 105 PID 3632 wrote to memory of 2208 3632 040440.exe 105 PID 3632 wrote to memory of 2208 3632 040440.exe 105 PID 2208 wrote to memory of 4600 2208 6806266.exe 106 PID 2208 wrote to memory of 4600 2208 6806266.exe 106 PID 2208 wrote to memory of 4600 2208 6806266.exe 106 PID 4600 wrote to memory of 704 4600 2488000.exe 107 PID 4600 wrote to memory of 704 4600 2488000.exe 107 PID 4600 wrote to memory of 704 4600 2488000.exe 107 PID 704 wrote to memory of 1932 704 ppdvp.exe 109 PID 704 wrote to memory of 1932 704 ppdvp.exe 109 PID 704 wrote to memory of 1932 704 ppdvp.exe 109 PID 1932 wrote to memory of 3052 1932 24284.exe 110 PID 1932 wrote to memory of 3052 1932 24284.exe 110 PID 1932 wrote to memory of 3052 1932 24284.exe 110 PID 3052 wrote to memory of 4508 3052 084804.exe 111 PID 3052 wrote to memory of 4508 3052 084804.exe 111 PID 3052 wrote to memory of 4508 3052 084804.exe 111 PID 4508 wrote to memory of 3180 4508 6062842.exe 112 PID 4508 wrote to memory of 3180 4508 6062842.exe 112 PID 4508 wrote to memory of 3180 4508 6062842.exe 112 PID 3180 wrote to memory of 2236 3180 jpdpj.exe 113 PID 3180 wrote to memory of 2236 3180 jpdpj.exe 113 PID 3180 wrote to memory of 2236 3180 jpdpj.exe 113 PID 2236 wrote to memory of 2036 2236 0888822.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e880f5a6281d2d8012129f67a1b5340N.exe"C:\Users\Admin\AppData\Local\Temp\7e880f5a6281d2d8012129f67a1b5340N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\60884.exec:\60884.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\28862.exec:\28862.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\htbtnb.exec:\htbtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\804860.exec:\804860.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\064442.exec:\064442.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\jpvpp.exec:\jpvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\7pvpp.exec:\7pvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\rrrlffx.exec:\rrrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\3xrfrxx.exec:\3xrfrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\886222.exec:\886222.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\480640.exec:\480640.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\btbtnn.exec:\btbtnn.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\040440.exec:\040440.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\6806266.exec:\6806266.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\2488000.exec:\2488000.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\ppdvp.exec:\ppdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\24284.exec:\24284.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\084804.exec:\084804.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\6062842.exec:\6062842.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\jpdpj.exec:\jpdpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\0888822.exec:\0888822.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\886624.exec:\886624.exe23⤵
- Executes dropped EXE
PID:2036 -
\??\c:\4222222.exec:\4222222.exe24⤵
- Executes dropped EXE
PID:4912 -
\??\c:\rfrfxxx.exec:\rfrfxxx.exe25⤵
- Executes dropped EXE
PID:4200 -
\??\c:\1jjdp.exec:\1jjdp.exe26⤵
- Executes dropped EXE
PID:184 -
\??\c:\7ddpj.exec:\7ddpj.exe27⤵
- Executes dropped EXE
PID:3240 -
\??\c:\400442.exec:\400442.exe28⤵
- Executes dropped EXE
PID:4924 -
\??\c:\jvdpv.exec:\jvdpv.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ppjdp.exec:\ppjdp.exe30⤵
- Executes dropped EXE
PID:3940 -
\??\c:\8626082.exec:\8626082.exe31⤵
- Executes dropped EXE
PID:3784 -
\??\c:\404402.exec:\404402.exe32⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bnnnth.exec:\bnnnth.exe33⤵
- Executes dropped EXE
PID:340 -
\??\c:\42680.exec:\42680.exe34⤵
- Executes dropped EXE
PID:4196 -
\??\c:\8826048.exec:\8826048.exe35⤵
- Executes dropped EXE
PID:4476 -
\??\c:\2268644.exec:\2268644.exe36⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1nthnn.exec:\1nthnn.exe37⤵
- Executes dropped EXE
PID:3600 -
\??\c:\446488.exec:\446488.exe38⤵
- Executes dropped EXE
PID:3744 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe39⤵
- Executes dropped EXE
PID:960 -
\??\c:\4240042.exec:\4240042.exe40⤵
- Executes dropped EXE
PID:3304 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\028024.exec:\028024.exe42⤵
- Executes dropped EXE
PID:1104 -
\??\c:\8448668.exec:\8448668.exe43⤵
- Executes dropped EXE
PID:4376 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe44⤵
- Executes dropped EXE
PID:4148 -
\??\c:\jdjdp.exec:\jdjdp.exe45⤵
- Executes dropped EXE
PID:692 -
\??\c:\bntbhn.exec:\bntbhn.exe46⤵
- Executes dropped EXE
PID:3728 -
\??\c:\a4248.exec:\a4248.exe47⤵
- Executes dropped EXE
PID:1820 -
\??\c:\8442648.exec:\8442648.exe48⤵
- Executes dropped EXE
PID:396 -
\??\c:\frlxrlf.exec:\frlxrlf.exe49⤵
- Executes dropped EXE
PID:4600 -
\??\c:\4408200.exec:\4408200.exe50⤵
- Executes dropped EXE
PID:2536 -
\??\c:\40260.exec:\40260.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9vjdv.exec:\9vjdv.exe52⤵
- Executes dropped EXE
PID:4488 -
\??\c:\6482828.exec:\6482828.exe53⤵
- Executes dropped EXE
PID:3224 -
\??\c:\nbtbnn.exec:\nbtbnn.exe54⤵
- Executes dropped EXE
PID:4852 -
\??\c:\jjjjd.exec:\jjjjd.exe55⤵
- Executes dropped EXE
PID:3736 -
\??\c:\6620886.exec:\6620886.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\1xlfrxx.exec:\1xlfrxx.exe57⤵
- Executes dropped EXE
PID:4864 -
\??\c:\088084.exec:\088084.exe58⤵
- Executes dropped EXE
PID:1180 -
\??\c:\vjjpj.exec:\vjjpj.exe59⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnbthn.exec:\tnbthn.exe60⤵
- Executes dropped EXE
PID:4064 -
\??\c:\426608.exec:\426608.exe61⤵
- Executes dropped EXE
PID:4428 -
\??\c:\djddv.exec:\djddv.exe62⤵
- Executes dropped EXE
PID:1176 -
\??\c:\7nttht.exec:\7nttht.exe63⤵
- Executes dropped EXE
PID:2984 -
\??\c:\04486.exec:\04486.exe64⤵
- Executes dropped EXE
PID:4832 -
\??\c:\bnnhth.exec:\bnnhth.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\4004482.exec:\4004482.exe66⤵PID:3568
-
\??\c:\402622.exec:\402622.exe67⤵PID:4416
-
\??\c:\5nbhbt.exec:\5nbhbt.exe68⤵PID:3448
-
\??\c:\a4442.exec:\a4442.exe69⤵PID:1220
-
\??\c:\s2608.exec:\s2608.exe70⤵PID:4164
-
\??\c:\thbnbn.exec:\thbnbn.exe71⤵PID:2748
-
\??\c:\42628.exec:\42628.exe72⤵PID:4744
-
\??\c:\488824.exec:\488824.exe73⤵PID:612
-
\??\c:\04666.exec:\04666.exe74⤵PID:3960
-
\??\c:\xxrflll.exec:\xxrflll.exe75⤵PID:1792
-
\??\c:\480480.exec:\480480.exe76⤵PID:1008
-
\??\c:\48008.exec:\48008.exe77⤵
- System Location Discovery: System Language Discovery
PID:3724 -
\??\c:\5pddj.exec:\5pddj.exe78⤵PID:960
-
\??\c:\608282.exec:\608282.exe79⤵PID:3304
-
\??\c:\248686.exec:\248686.exe80⤵PID:3188
-
\??\c:\tthtth.exec:\tthtth.exe81⤵PID:1104
-
\??\c:\9hnhtn.exec:\9hnhtn.exe82⤵PID:4376
-
\??\c:\646000.exec:\646000.exe83⤵PID:4148
-
\??\c:\e42640.exec:\e42640.exe84⤵PID:1704
-
\??\c:\pvjjv.exec:\pvjjv.exe85⤵PID:4740
-
\??\c:\httbbt.exec:\httbbt.exe86⤵PID:4848
-
\??\c:\vpvjd.exec:\vpvjd.exe87⤵PID:4532
-
\??\c:\flrlxxl.exec:\flrlxxl.exe88⤵PID:3868
-
\??\c:\3lrxfrr.exec:\3lrxfrr.exe89⤵PID:4600
-
\??\c:\6462040.exec:\6462040.exe90⤵PID:3588
-
\??\c:\1vpvp.exec:\1vpvp.exe91⤵PID:1556
-
\??\c:\68482.exec:\68482.exe92⤵PID:2104
-
\??\c:\rlfrffr.exec:\rlfrffr.exe93⤵PID:2488
-
\??\c:\7vvvd.exec:\7vvvd.exe94⤵PID:1968
-
\??\c:\w64080.exec:\w64080.exe95⤵PID:1112
-
\??\c:\xlrlllf.exec:\xlrlllf.exe96⤵PID:3208
-
\??\c:\e06484.exec:\e06484.exe97⤵PID:2988
-
\??\c:\pdvjv.exec:\pdvjv.exe98⤵PID:1744
-
\??\c:\tthbnn.exec:\tthbnn.exe99⤵PID:4828
-
\??\c:\6868464.exec:\6868464.exe100⤵PID:4936
-
\??\c:\dvjdp.exec:\dvjdp.exe101⤵PID:392
-
\??\c:\k28802.exec:\k28802.exe102⤵PID:1092
-
\??\c:\666064.exec:\666064.exe103⤵PID:4036
-
\??\c:\66226.exec:\66226.exe104⤵PID:4924
-
\??\c:\5jjdp.exec:\5jjdp.exe105⤵PID:3568
-
\??\c:\82442.exec:\82442.exe106⤵PID:4416
-
\??\c:\bhhttn.exec:\bhhttn.exe107⤵PID:3316
-
\??\c:\228826.exec:\228826.exe108⤵PID:3784
-
\??\c:\26660.exec:\26660.exe109⤵PID:4264
-
\??\c:\m2826.exec:\m2826.exe110⤵PID:632
-
\??\c:\hntnhh.exec:\hntnhh.exe111⤵PID:5100
-
\??\c:\djdjd.exec:\djdjd.exe112⤵PID:5092
-
\??\c:\rxlllxx.exec:\rxlllxx.exe113⤵PID:2960
-
\??\c:\62820.exec:\62820.exe114⤵PID:2008
-
\??\c:\4888222.exec:\4888222.exe115⤵PID:1892
-
\??\c:\44884.exec:\44884.exe116⤵PID:3744
-
\??\c:\422420.exec:\422420.exe117⤵PID:912
-
\??\c:\lrffxxr.exec:\lrffxxr.exe118⤵PID:1004
-
\??\c:\482264.exec:\482264.exe119⤵PID:3212
-
\??\c:\648822.exec:\648822.exe120⤵PID:656
-
\??\c:\2262888.exec:\2262888.exe121⤵PID:1864
-
\??\c:\i468288.exec:\i468288.exe122⤵PID:1764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-