Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 07:27
Behavioral task
behavioral1
Sample
8e1b89113f9b091071ca7f44eb82f1c0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
8e1b89113f9b091071ca7f44eb82f1c0N.exe
-
Size
69KB
-
MD5
8e1b89113f9b091071ca7f44eb82f1c0
-
SHA1
fac0ec38fa977490214902569ec35c5e7c67a0fc
-
SHA256
f6ac656d474ac57be788845f91a556da4f5a81f552c952b66aa374aad3a280bb
-
SHA512
475154e44c3b7cb0d503ccd951bbfd74579bf99bf68478b3170567d29fc54cf3e24915f32d3e3d88620dd885473a4205446cd18679233d7880b478448c586d03
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8Aey:ChOmTsF93UYfwC6GIoutAey
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2552-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-151-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3032-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-206-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2172-205-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1012-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/712-252-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/712-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-437-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2092-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-555-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2948-572-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-585-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-654-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2828-653-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2812-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-707-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-726-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-733-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1328-964-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-1180-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1944-1203-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2568-1323-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 376 3ppdd.exe 580 jdjjj.exe 2300 xlffrxf.exe 2264 fxffrrx.exe 2784 7bhhnt.exe 2844 5dpvp.exe 2924 3lxlxff.exe 2672 rflrxxf.exe 2808 1flrffl.exe 2632 thbtbb.exe 1076 pjvjj.exe 1560 9pjjj.exe 2032 3xllflr.exe 2872 thbhnb.exe 2988 hhtttt.exe 1944 dvjpv.exe 3032 jdppp.exe 840 frrrxfl.exe 1828 7bnntb.exe 2260 bthnhh.exe 2156 dvpjv.exe 2172 rlfxffl.exe 1012 nntbtt.exe 2068 nhthnt.exe 1552 pdpjj.exe 2244 llxfrxl.exe 2248 xflllff.exe 712 ttnhtb.exe 1728 nnhhnb.exe 1436 jddpd.exe 848 xrllxxr.exe 1464 nhtnth.exe 1992 bbnbhb.exe 2220 7ntnnn.exe 2496 pjdvv.exe 1636 ppppp.exe 1060 rlrlfxx.exe 2848 fxfxxrr.exe 2784 1nbtbb.exe 3068 hbntbb.exe 2916 vjvvp.exe 2664 xrxfrrx.exe 2800 flrllff.exe 2652 7hhnnh.exe 2648 thnhht.exe 2756 pjvvp.exe 1520 9pjjj.exe 3028 xllrrrl.exe 2880 xlfrrrx.exe 2412 5frlllr.exe 3044 nbtbtn.exe 2988 thttbb.exe 3040 dpvvp.exe 1908 pdvvd.exe 3032 5fllxff.exe 284 ffffllx.exe 576 lrrrxrx.exe 2160 7nhthh.exe 2168 thtntb.exe 2092 5ppvv.exe 2024 dvdjp.exe 2620 3frrrxl.exe 340 xxlxrxf.exe 836 bbhnnn.exe -
resource yara_rule behavioral1/memory/2552-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000d00000001224d-5.dat upx behavioral1/memory/376-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000015d6f-17.dat upx behavioral1/memory/580-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000015d78-25.dat upx behavioral1/memory/2264-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015d80-35.dat upx behavioral1/memory/2300-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015d8b-43.dat upx behavioral1/files/0x0007000000015d98-51.dat upx behavioral1/memory/2784-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015da2-61.dat upx behavioral1/memory/2924-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000015db6-72.dat upx behavioral1/files/0x0006000000018c08-79.dat upx behavioral1/memory/2808-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018c25-87.dat upx behavioral1/memory/2632-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018c27-98.dat upx behavioral1/files/0x0006000000018c2e-105.dat upx behavioral1/memory/1076-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018d40-116.dat upx behavioral1/files/0x0006000000018d6b-122.dat upx behavioral1/memory/2872-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018d74-134.dat upx behavioral1/files/0x0006000000018d80-141.dat upx behavioral1/memory/2988-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018d87-152.dat upx behavioral1/memory/3032-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018d89-159.dat upx behavioral1/memory/840-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018f94-168.dat upx behavioral1/files/0x000600000001904f-177.dat upx behavioral1/memory/1828-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00050000000191fe-188.dat upx behavioral1/memory/2260-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0005000000019221-195.dat upx behavioral1/files/0x000500000001923a-207.dat upx behavioral1/files/0x0005000000019246-217.dat upx behavioral1/memory/1012-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0005000000019249-224.dat upx behavioral1/files/0x0005000000019253-233.dat upx behavioral1/files/0x0005000000019256-238.dat upx behavioral1/files/0x000500000001925b-248.dat upx behavioral1/files/0x0005000000019272-258.dat upx behavioral1/memory/712-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00050000000192fe-266.dat upx behavioral1/files/0x0005000000019309-274.dat upx behavioral1/files/0x0005000000019346-282.dat upx behavioral1/memory/1464-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-368-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrlr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 376 2552 8e1b89113f9b091071ca7f44eb82f1c0N.exe 30 PID 2552 wrote to memory of 376 2552 8e1b89113f9b091071ca7f44eb82f1c0N.exe 30 PID 2552 wrote to memory of 376 2552 8e1b89113f9b091071ca7f44eb82f1c0N.exe 30 PID 2552 wrote to memory of 376 2552 8e1b89113f9b091071ca7f44eb82f1c0N.exe 30 PID 376 wrote to memory of 580 376 3ppdd.exe 31 PID 376 wrote to memory of 580 376 3ppdd.exe 31 PID 376 wrote to memory of 580 376 3ppdd.exe 31 PID 376 wrote to memory of 580 376 3ppdd.exe 31 PID 580 wrote to memory of 2300 580 jdjjj.exe 32 PID 580 wrote to memory of 2300 580 jdjjj.exe 32 PID 580 wrote to memory of 2300 580 jdjjj.exe 32 PID 580 wrote to memory of 2300 580 jdjjj.exe 32 PID 2300 wrote to memory of 2264 2300 xlffrxf.exe 33 PID 2300 wrote to memory of 2264 2300 xlffrxf.exe 33 PID 2300 wrote to memory of 2264 2300 xlffrxf.exe 33 PID 2300 wrote to memory of 2264 2300 xlffrxf.exe 33 PID 2264 wrote to memory of 2784 2264 fxffrrx.exe 34 PID 2264 wrote to memory of 2784 2264 fxffrrx.exe 34 PID 2264 wrote to memory of 2784 2264 fxffrrx.exe 34 PID 2264 wrote to memory of 2784 2264 fxffrrx.exe 34 PID 2784 wrote to memory of 2844 2784 7bhhnt.exe 35 PID 2784 wrote to memory of 2844 2784 7bhhnt.exe 35 PID 2784 wrote to memory of 2844 2784 7bhhnt.exe 35 PID 2784 wrote to memory of 2844 2784 7bhhnt.exe 35 PID 2844 wrote to memory of 2924 2844 5dpvp.exe 36 PID 2844 wrote to memory of 2924 2844 5dpvp.exe 36 PID 2844 wrote to memory of 2924 2844 5dpvp.exe 36 PID 2844 wrote to memory of 2924 2844 5dpvp.exe 36 PID 2924 wrote to memory of 2672 2924 3lxlxff.exe 37 PID 2924 wrote to memory of 2672 2924 3lxlxff.exe 37 PID 2924 wrote to memory of 2672 2924 3lxlxff.exe 37 PID 2924 wrote to memory of 2672 2924 3lxlxff.exe 37 PID 2672 wrote to memory of 2808 2672 rflrxxf.exe 38 PID 2672 wrote to memory of 2808 2672 rflrxxf.exe 38 PID 2672 wrote to memory of 2808 2672 rflrxxf.exe 38 PID 2672 wrote to memory of 2808 2672 rflrxxf.exe 38 PID 2808 wrote to memory of 2632 2808 1flrffl.exe 39 PID 2808 wrote to memory of 2632 2808 1flrffl.exe 39 PID 2808 wrote to memory of 2632 2808 1flrffl.exe 39 PID 2808 wrote to memory of 2632 2808 1flrffl.exe 39 PID 2632 wrote to memory of 1076 2632 thbtbb.exe 40 PID 2632 wrote to memory of 1076 2632 thbtbb.exe 40 PID 2632 wrote to memory of 1076 2632 thbtbb.exe 40 PID 2632 wrote to memory of 1076 2632 thbtbb.exe 40 PID 1076 wrote to memory of 1560 1076 pjvjj.exe 41 PID 1076 wrote to memory of 1560 1076 pjvjj.exe 41 PID 1076 wrote to memory of 1560 1076 pjvjj.exe 41 PID 1076 wrote to memory of 1560 1076 pjvjj.exe 41 PID 1560 wrote to memory of 2032 1560 9pjjj.exe 42 PID 1560 wrote to memory of 2032 1560 9pjjj.exe 42 PID 1560 wrote to memory of 2032 1560 9pjjj.exe 42 PID 1560 wrote to memory of 2032 1560 9pjjj.exe 42 PID 2032 wrote to memory of 2872 2032 3xllflr.exe 43 PID 2032 wrote to memory of 2872 2032 3xllflr.exe 43 PID 2032 wrote to memory of 2872 2032 3xllflr.exe 43 PID 2032 wrote to memory of 2872 2032 3xllflr.exe 43 PID 2872 wrote to memory of 2988 2872 thbhnb.exe 44 PID 2872 wrote to memory of 2988 2872 thbhnb.exe 44 PID 2872 wrote to memory of 2988 2872 thbhnb.exe 44 PID 2872 wrote to memory of 2988 2872 thbhnb.exe 44 PID 2988 wrote to memory of 1944 2988 hhtttt.exe 45 PID 2988 wrote to memory of 1944 2988 hhtttt.exe 45 PID 2988 wrote to memory of 1944 2988 hhtttt.exe 45 PID 2988 wrote to memory of 1944 2988 hhtttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e1b89113f9b091071ca7f44eb82f1c0N.exe"C:\Users\Admin\AppData\Local\Temp\8e1b89113f9b091071ca7f44eb82f1c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3ppdd.exec:\3ppdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\jdjjj.exec:\jdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\xlffrxf.exec:\xlffrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\fxffrrx.exec:\fxffrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\7bhhnt.exec:\7bhhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\5dpvp.exec:\5dpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\3lxlxff.exec:\3lxlxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rflrxxf.exec:\rflrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\1flrffl.exec:\1flrffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\thbtbb.exec:\thbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pjvjj.exec:\pjvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\9pjjj.exec:\9pjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\3xllflr.exec:\3xllflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\thbhnb.exec:\thbhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hhtttt.exec:\hhtttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dvjpv.exec:\dvjpv.exe17⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jdppp.exec:\jdppp.exe18⤵
- Executes dropped EXE
PID:3032 -
\??\c:\frrrxfl.exec:\frrrxfl.exe19⤵
- Executes dropped EXE
PID:840 -
\??\c:\7bnntb.exec:\7bnntb.exe20⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bthnhh.exec:\bthnhh.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dvpjv.exec:\dvpjv.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rlfxffl.exec:\rlfxffl.exe23⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nntbtt.exec:\nntbtt.exe24⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nhthnt.exec:\nhthnt.exe25⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pdpjj.exec:\pdpjj.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\llxfrxl.exec:\llxfrxl.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xflllff.exec:\xflllff.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ttnhtb.exec:\ttnhtb.exe29⤵
- Executes dropped EXE
PID:712 -
\??\c:\nnhhnb.exec:\nnhhnb.exe30⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jddpd.exec:\jddpd.exe31⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xrllxxr.exec:\xrllxxr.exe32⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhtnth.exec:\nhtnth.exe33⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bbnbhb.exec:\bbnbhb.exe34⤵
- Executes dropped EXE
PID:1992 -
\??\c:\7ntnnn.exec:\7ntnnn.exe35⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pjdvv.exec:\pjdvv.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ppppp.exec:\ppppp.exe37⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlrlfxx.exec:\rlrlfxx.exe38⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1nbtbb.exec:\1nbtbb.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbntbb.exec:\hbntbb.exe41⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vjvvp.exec:\vjvvp.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\flrllff.exec:\flrllff.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7hhnnh.exec:\7hhnnh.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\thnhht.exec:\thnhht.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjvvp.exec:\pjvvp.exe47⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9pjjj.exec:\9pjjj.exe48⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xllrrrl.exec:\xllrrrl.exe49⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xlfrrrx.exec:\xlfrrrx.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5frlllr.exec:\5frlllr.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nbtbtn.exec:\nbtbtn.exe52⤵
- Executes dropped EXE
PID:3044 -
\??\c:\thttbb.exec:\thttbb.exe53⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dpvvp.exec:\dpvvp.exe54⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pdvvd.exec:\pdvvd.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5fllxff.exec:\5fllxff.exe56⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ffffllx.exec:\ffffllx.exe57⤵
- Executes dropped EXE
PID:284 -
\??\c:\lrrrxrx.exec:\lrrrxrx.exe58⤵
- Executes dropped EXE
PID:576 -
\??\c:\7nhthh.exec:\7nhthh.exe59⤵
- Executes dropped EXE
PID:2160 -
\??\c:\thtntb.exec:\thtntb.exe60⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5ppvv.exec:\5ppvv.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dvdjp.exec:\dvdjp.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3frrrxl.exec:\3frrrxl.exe63⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xxlxrxf.exec:\xxlxrxf.exe64⤵
- Executes dropped EXE
PID:340 -
\??\c:\bbhnnn.exec:\bbhnnn.exe65⤵
- Executes dropped EXE
PID:836 -
\??\c:\hthbtt.exec:\hthbtt.exe66⤵PID:468
-
\??\c:\ppdjv.exec:\ppdjv.exe67⤵PID:2436
-
\??\c:\vjpjd.exec:\vjpjd.exe68⤵PID:1732
-
\??\c:\lxxllfl.exec:\lxxllfl.exe69⤵PID:2564
-
\??\c:\rflrxrx.exec:\rflrxrx.exe70⤵PID:2004
-
\??\c:\lxrfrxl.exec:\lxrfrxl.exe71⤵PID:1632
-
\??\c:\9nbnhn.exec:\9nbnhn.exe72⤵PID:2544
-
\??\c:\3tbbnt.exec:\3tbbnt.exe73⤵PID:1680
-
\??\c:\pjpdv.exec:\pjpdv.exe74⤵PID:596
-
\??\c:\dvjpp.exec:\dvjpp.exe75⤵PID:1464
-
\??\c:\9xfflll.exec:\9xfflll.exe76⤵
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\frffffl.exec:\frffffl.exe77⤵PID:2948
-
\??\c:\1hhnbb.exec:\1hhnbb.exe78⤵PID:2496
-
\??\c:\3bnhhh.exec:\3bnhhh.exe79⤵PID:2860
-
\??\c:\dpddj.exec:\dpddj.exe80⤵PID:1060
-
\??\c:\rlxlxrx.exec:\rlxlxrx.exe81⤵PID:2760
-
\??\c:\btnttb.exec:\btnttb.exe82⤵PID:2784
-
\??\c:\7nbnnn.exec:\7nbnnn.exe83⤵PID:3068
-
\??\c:\dvdjd.exec:\dvdjd.exe84⤵PID:2916
-
\??\c:\9jjdd.exec:\9jjdd.exe85⤵PID:2672
-
\??\c:\xrlrrlr.exec:\xrlrrlr.exe86⤵PID:2684
-
\??\c:\rlrxfxf.exec:\rlrxfxf.exe87⤵PID:2652
-
\??\c:\btbbbh.exec:\btbbbh.exe88⤵PID:2708
-
\??\c:\nhhnth.exec:\nhhnth.exe89⤵PID:1580
-
\??\c:\vpvdj.exec:\vpvdj.exe90⤵PID:2828
-
\??\c:\5dpvv.exec:\5dpvv.exe91⤵PID:1832
-
\??\c:\9fxxxfl.exec:\9fxxxfl.exe92⤵PID:2812
-
\??\c:\rxrfrrf.exec:\rxrfrrf.exe93⤵PID:3012
-
\??\c:\nnbttb.exec:\nnbttb.exe94⤵PID:2624
-
\??\c:\pdppv.exec:\pdppv.exe95⤵PID:2820
-
\??\c:\dpjjj.exec:\dpjjj.exe96⤵PID:1616
-
\??\c:\dvjdd.exec:\dvjdd.exe97⤵PID:1908
-
\??\c:\llxfxrr.exec:\llxfxrr.exe98⤵PID:1828
-
\??\c:\9tbbbt.exec:\9tbbbt.exe99⤵PID:2200
-
\??\c:\nhbnhn.exec:\nhbnhn.exe100⤵PID:576
-
\??\c:\dvpdv.exec:\dvpdv.exe101⤵PID:2420
-
\??\c:\jdvvd.exec:\jdvvd.exe102⤵PID:2168
-
\??\c:\1lfrrfl.exec:\1lfrrfl.exe103⤵PID:408
-
\??\c:\lxrrxxx.exec:\lxrrxxx.exe104⤵PID:2732
-
\??\c:\nbhnbb.exec:\nbhnbb.exe105⤵PID:620
-
\??\c:\5ththb.exec:\5ththb.exe106⤵PID:1480
-
\??\c:\djvvv.exec:\djvvv.exe107⤵PID:2256
-
\??\c:\dpvvp.exec:\dpvvp.exe108⤵PID:468
-
\??\c:\7lxxrfl.exec:\7lxxrfl.exe109⤵PID:2436
-
\??\c:\lxrlxrx.exec:\lxrlxrx.exe110⤵PID:1420
-
\??\c:\hbtbhh.exec:\hbtbhh.exe111⤵PID:332
-
\??\c:\bbhntt.exec:\bbhntt.exe112⤵PID:2004
-
\??\c:\dpddj.exec:\dpddj.exe113⤵PID:320
-
\??\c:\djddd.exec:\djddd.exe114⤵PID:1220
-
\??\c:\xrffffl.exec:\xrffffl.exe115⤵PID:1680
-
\??\c:\fxffrxf.exec:\fxffrxf.exe116⤵PID:2484
-
\??\c:\nhbhtt.exec:\nhbhtt.exe117⤵PID:1464
-
\??\c:\btnbnt.exec:\btnbnt.exe118⤵PID:1696
-
\??\c:\vvpvd.exec:\vvpvd.exe119⤵PID:2728
-
\??\c:\vvvjd.exec:\vvvjd.exe120⤵PID:2496
-
\??\c:\1lflxrx.exec:\1lflxrx.exe121⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-