Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 02:55
Behavioral task
behavioral1
Sample
778c75f6ed032dbd225be82f6e7baf70N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
778c75f6ed032dbd225be82f6e7baf70N.exe
-
Size
59KB
-
MD5
778c75f6ed032dbd225be82f6e7baf70
-
SHA1
90f7dc76e9a65a3948d45a527cb446550f8a3f0d
-
SHA256
60449e2705d99a54366a4fc690970dfe1702ec9ab5042c89ea3b4693843329f6
-
SHA512
8ba3b4e5a0dbc1143236b848b073b999261c6bd671707c1180382bbf68b67e254b88f6d8f95cc64fe85f1dabf0a1e0d48967d14bcd10d738a7da7911e800c6f0
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQjdWZ9+J8:khOmTsF93UYfwC6GIoutpYcvjdWn
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/1956-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-56-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2988-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-126-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1008-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-137-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2784-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-167-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2168-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-181-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-208-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2548-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/524-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-231-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1228-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-241-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1948-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-260-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2060-258-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2256-275-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/788-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-339-0x0000000001B50000-0x0000000001B77000-memory.dmp family_blackmoon behavioral1/memory/2900-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-375-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2752-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-386-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2580-396-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-417-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1944-424-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1524-431-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2308-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-503-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1228-511-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1556-539-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1796-554-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2516-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-637-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2868-663-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-670-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1452-734-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/264-747-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2592-935-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-965-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 752 vdjjp.exe 1736 ffrxllr.exe 2396 7bbntb.exe 2908 dpvvj.exe 2720 3bbhhb.exe 2988 btbbhh.exe 2916 fxrxffr.exe 1972 7xrxrll.exe 2744 3bthtt.exe 2600 jddjp.exe 3056 pjjpd.exe 1008 fxrxffl.exe 2784 btntbh.exe 1012 hbtttt.exe 2824 jdppv.exe 2796 flxfxff.exe 1916 hbtbhn.exe 2168 3htnhh.exe 2472 ddvpd.exe 524 1vpvv.exe 2548 lfrrxxx.exe 1100 htbbhh.exe 1228 3pppv.exe 1548 vpvvp.exe 2180 flflxfl.exe 2060 ntbtbt.exe 1948 3pddd.exe 2256 9dddj.exe 788 rlffxxf.exe 1752 3rfflfr.exe 2508 bntbhn.exe 2124 jvdjj.exe 2400 ppdjp.exe 2120 7rlllrx.exe 2108 rlrxrxx.exe 2912 hnhntb.exe 2832 pjddj.exe 2900 rlxrrrr.exe 2864 rlfflrx.exe 2320 1htbnn.exe 2884 5htttn.exe 2752 jvpjd.exe 2692 dvpvj.exe 2580 7flfllr.exe 2260 hbhthh.exe 2764 3htnnh.exe 1268 9vvjp.exe 1944 jvddj.exe 1524 7frrlrx.exe 492 fxfxffr.exe 2952 ttnthn.exe 2768 hbhhhn.exe 1648 vvdvv.exe 2308 dpddp.exe 2168 lfxfrfr.exe 480 lxrrrlr.exe 908 3hhnnb.exe 1144 5nhhnn.exe 2424 7jvvv.exe 1528 jdvjv.exe 1100 1xrlxxx.exe 1228 xflrxfr.exe 1864 3tbnhb.exe 1632 3bntbb.exe -
resource yara_rule behavioral1/memory/1956-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000122e3-11.dat upx behavioral1/memory/1956-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/752-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016db1-20.dat upx behavioral1/memory/2396-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016dbf-29.dat upx behavioral1/memory/2908-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dd3-41.dat upx behavioral1/memory/2396-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dda-53.dat upx behavioral1/memory/2908-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-49-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000016ddf-62.dat upx behavioral1/memory/2720-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000170f2-71.dat upx behavioral1/memory/2988-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018c16-81.dat upx behavioral1/memory/2916-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c3b-92.dat upx behavioral1/files/0x0006000000018c44-100.dat upx behavioral1/memory/2600-108-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/3056-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019209-110.dat upx behavioral1/files/0x00050000000193b7-118.dat upx behavioral1/memory/1008-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e6-127.dat upx behavioral1/files/0x000500000001940f-138.dat upx behavioral1/memory/2784-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019419-146.dat upx behavioral1/memory/2824-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1012-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194cc-156.dat upx behavioral1/files/0x00050000000194d4-165.dat upx behavioral1/files/0x00050000000194e0-172.dat upx behavioral1/memory/2472-187-0x00000000003B0000-0x00000000003D7000-memory.dmp upx behavioral1/files/0x00050000000194e9-184.dat upx behavioral1/memory/2168-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f3-192.dat upx behavioral1/memory/2548-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019503-204.dat upx behavioral1/memory/524-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/524-201-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0005000000019526-213.dat upx behavioral1/memory/1100-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019553-221.dat upx behavioral1/files/0x0005000000019557-232.dat upx behavioral1/memory/1228-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019571-243.dat upx behavioral1/memory/1548-239-0x00000000005C0000-0x00000000005E7000-memory.dmp upx behavioral1/files/0x00050000000195c9-251.dat upx behavioral1/memory/1948-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960a-262.dat upx behavioral1/files/0x000500000001960c-270.dat upx behavioral1/files/0x000500000001960e-279.dat upx behavioral1/memory/788-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019610-288.dat upx behavioral1/files/0x0009000000016d66-296.dat upx behavioral1/files/0x0005000000019612-304.dat upx behavioral1/memory/2400-319-0x0000000001B50000-0x0000000001B77000-memory.dmp upx behavioral1/memory/2400-318-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 752 1956 778c75f6ed032dbd225be82f6e7baf70N.exe 30 PID 1956 wrote to memory of 752 1956 778c75f6ed032dbd225be82f6e7baf70N.exe 30 PID 1956 wrote to memory of 752 1956 778c75f6ed032dbd225be82f6e7baf70N.exe 30 PID 1956 wrote to memory of 752 1956 778c75f6ed032dbd225be82f6e7baf70N.exe 30 PID 752 wrote to memory of 1736 752 vdjjp.exe 31 PID 752 wrote to memory of 1736 752 vdjjp.exe 31 PID 752 wrote to memory of 1736 752 vdjjp.exe 31 PID 752 wrote to memory of 1736 752 vdjjp.exe 31 PID 1736 wrote to memory of 2396 1736 ffrxllr.exe 32 PID 1736 wrote to memory of 2396 1736 ffrxllr.exe 32 PID 1736 wrote to memory of 2396 1736 ffrxllr.exe 32 PID 1736 wrote to memory of 2396 1736 ffrxllr.exe 32 PID 2396 wrote to memory of 2908 2396 7bbntb.exe 33 PID 2396 wrote to memory of 2908 2396 7bbntb.exe 33 PID 2396 wrote to memory of 2908 2396 7bbntb.exe 33 PID 2396 wrote to memory of 2908 2396 7bbntb.exe 33 PID 2908 wrote to memory of 2720 2908 dpvvj.exe 34 PID 2908 wrote to memory of 2720 2908 dpvvj.exe 34 PID 2908 wrote to memory of 2720 2908 dpvvj.exe 34 PID 2908 wrote to memory of 2720 2908 dpvvj.exe 34 PID 2720 wrote to memory of 2988 2720 3bbhhb.exe 35 PID 2720 wrote to memory of 2988 2720 3bbhhb.exe 35 PID 2720 wrote to memory of 2988 2720 3bbhhb.exe 35 PID 2720 wrote to memory of 2988 2720 3bbhhb.exe 35 PID 2988 wrote to memory of 2916 2988 btbbhh.exe 36 PID 2988 wrote to memory of 2916 2988 btbbhh.exe 36 PID 2988 wrote to memory of 2916 2988 btbbhh.exe 36 PID 2988 wrote to memory of 2916 2988 btbbhh.exe 36 PID 2916 wrote to memory of 1972 2916 fxrxffr.exe 37 PID 2916 wrote to memory of 1972 2916 fxrxffr.exe 37 PID 2916 wrote to memory of 1972 2916 fxrxffr.exe 37 PID 2916 wrote to memory of 1972 2916 fxrxffr.exe 37 PID 1972 wrote to memory of 2744 1972 7xrxrll.exe 38 PID 1972 wrote to memory of 2744 1972 7xrxrll.exe 38 PID 1972 wrote to memory of 2744 1972 7xrxrll.exe 38 PID 1972 wrote to memory of 2744 1972 7xrxrll.exe 38 PID 2744 wrote to memory of 2600 2744 3bthtt.exe 39 PID 2744 wrote to memory of 2600 2744 3bthtt.exe 39 PID 2744 wrote to memory of 2600 2744 3bthtt.exe 39 PID 2744 wrote to memory of 2600 2744 3bthtt.exe 39 PID 2600 wrote to memory of 3056 2600 jddjp.exe 40 PID 2600 wrote to memory of 3056 2600 jddjp.exe 40 PID 2600 wrote to memory of 3056 2600 jddjp.exe 40 PID 2600 wrote to memory of 3056 2600 jddjp.exe 40 PID 3056 wrote to memory of 1008 3056 pjjpd.exe 41 PID 3056 wrote to memory of 1008 3056 pjjpd.exe 41 PID 3056 wrote to memory of 1008 3056 pjjpd.exe 41 PID 3056 wrote to memory of 1008 3056 pjjpd.exe 41 PID 1008 wrote to memory of 2784 1008 fxrxffl.exe 42 PID 1008 wrote to memory of 2784 1008 fxrxffl.exe 42 PID 1008 wrote to memory of 2784 1008 fxrxffl.exe 42 PID 1008 wrote to memory of 2784 1008 fxrxffl.exe 42 PID 2784 wrote to memory of 1012 2784 btntbh.exe 43 PID 2784 wrote to memory of 1012 2784 btntbh.exe 43 PID 2784 wrote to memory of 1012 2784 btntbh.exe 43 PID 2784 wrote to memory of 1012 2784 btntbh.exe 43 PID 1012 wrote to memory of 2824 1012 hbtttt.exe 44 PID 1012 wrote to memory of 2824 1012 hbtttt.exe 44 PID 1012 wrote to memory of 2824 1012 hbtttt.exe 44 PID 1012 wrote to memory of 2824 1012 hbtttt.exe 44 PID 2824 wrote to memory of 2796 2824 jdppv.exe 45 PID 2824 wrote to memory of 2796 2824 jdppv.exe 45 PID 2824 wrote to memory of 2796 2824 jdppv.exe 45 PID 2824 wrote to memory of 2796 2824 jdppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\778c75f6ed032dbd225be82f6e7baf70N.exe"C:\Users\Admin\AppData\Local\Temp\778c75f6ed032dbd225be82f6e7baf70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vdjjp.exec:\vdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\ffrxllr.exec:\ffrxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\7bbntb.exec:\7bbntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\dpvvj.exec:\dpvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\3bbhhb.exec:\3bbhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\btbbhh.exec:\btbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\fxrxffr.exec:\fxrxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\7xrxrll.exec:\7xrxrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\3bthtt.exec:\3bthtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jddjp.exec:\jddjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pjjpd.exec:\pjjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\fxrxffl.exec:\fxrxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\btntbh.exec:\btntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hbtttt.exec:\hbtttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\jdppv.exec:\jdppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\flxfxff.exec:\flxfxff.exe17⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbtbhn.exec:\hbtbhn.exe18⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3htnhh.exec:\3htnhh.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ddvpd.exec:\ddvpd.exe20⤵
- Executes dropped EXE
PID:2472 -
\??\c:\1vpvv.exec:\1vpvv.exe21⤵
- Executes dropped EXE
PID:524 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2548 -
\??\c:\htbbhh.exec:\htbbhh.exe23⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3pppv.exec:\3pppv.exe24⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vpvvp.exec:\vpvvp.exe25⤵
- Executes dropped EXE
PID:1548 -
\??\c:\flflxfl.exec:\flflxfl.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ntbtbt.exec:\ntbtbt.exe27⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3pddd.exec:\3pddd.exe28⤵
- Executes dropped EXE
PID:1948 -
\??\c:\9dddj.exec:\9dddj.exe29⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rlffxxf.exec:\rlffxxf.exe30⤵
- Executes dropped EXE
PID:788 -
\??\c:\3rfflfr.exec:\3rfflfr.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bntbhn.exec:\bntbhn.exe32⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvdjj.exec:\jvdjj.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ppdjp.exec:\ppdjp.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7rlllrx.exec:\7rlllrx.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rlrxrxx.exec:\rlrxrxx.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hnhntb.exec:\hnhntb.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjddj.exec:\pjddj.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rlfflrx.exec:\rlfflrx.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1htbnn.exec:\1htbnn.exe41⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5htttn.exec:\5htttn.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jvpjd.exec:\jvpjd.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dvpvj.exec:\dvpvj.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7flfllr.exec:\7flfllr.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hbhthh.exec:\hbhthh.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3htnnh.exec:\3htnnh.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9vvjp.exec:\9vvjp.exe48⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jvddj.exec:\jvddj.exe49⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7frrlrx.exec:\7frrlrx.exe50⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxfxffr.exec:\fxfxffr.exe51⤵
- Executes dropped EXE
PID:492 -
\??\c:\ttnthn.exec:\ttnthn.exe52⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbhhhn.exec:\hbhhhn.exe53⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vvdvv.exec:\vvdvv.exe54⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dpddp.exec:\dpddp.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lxrrrlr.exec:\lxrrrlr.exe57⤵
- Executes dropped EXE
PID:480 -
\??\c:\3hhnnb.exec:\3hhnnb.exe58⤵
- Executes dropped EXE
PID:908 -
\??\c:\5nhhnn.exec:\5nhhnn.exe59⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7jvvv.exec:\7jvvv.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jdvjv.exec:\jdvjv.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1xrlxxx.exec:\1xrlxxx.exe62⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xflrxfr.exec:\xflrxfr.exe63⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3tbnhb.exec:\3tbnhb.exe64⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3bntbb.exec:\3bntbb.exe65⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjvdj.exec:\pjvdj.exe66⤵PID:2996
-
\??\c:\5pjpp.exec:\5pjpp.exe67⤵PID:1556
-
\??\c:\fxrfflx.exec:\fxrfflx.exe68⤵PID:2464
-
\??\c:\7frrrxf.exec:\7frrrxf.exe69⤵PID:1796
-
\??\c:\ttbhtt.exec:\ttbhtt.exe70⤵PID:1504
-
\??\c:\bnthbt.exec:\bnthbt.exe71⤵PID:3016
-
\??\c:\dvvjd.exec:\dvvjd.exe72⤵PID:2152
-
\??\c:\1vjjj.exec:\1vjjj.exe73⤵PID:752
-
\??\c:\1lfrrrx.exec:\1lfrrrx.exe74⤵PID:2516
-
\??\c:\9ffrrlf.exec:\9ffrrlf.exe75⤵PID:1612
-
\??\c:\tntbtn.exec:\tntbtn.exe76⤵PID:2552
-
\??\c:\hbbbbb.exec:\hbbbbb.exe77⤵PID:1736
-
\??\c:\nnntbh.exec:\nnntbh.exe78⤵PID:2076
-
\??\c:\vpvjd.exec:\vpvjd.exe79⤵PID:2708
-
\??\c:\lfrfllx.exec:\lfrfllx.exe80⤵PID:2724
-
\??\c:\ffrxffx.exec:\ffrxffx.exe81⤵PID:2684
-
\??\c:\1lxxlrf.exec:\1lxxlrf.exe82⤵PID:2712
-
\??\c:\3tnttb.exec:\3tnttb.exe83⤵PID:2892
-
\??\c:\1bnhhh.exec:\1bnhhh.exe84⤵PID:2696
-
\??\c:\vpvvj.exec:\vpvvj.exe85⤵PID:2616
-
\??\c:\ppjvj.exec:\ppjvj.exe86⤵PID:2868
-
\??\c:\lxlfllr.exec:\lxlfllr.exe87⤵PID:2692
-
\??\c:\xxrrxlr.exec:\xxrrxlr.exe88⤵PID:2580
-
\??\c:\bnbhbb.exec:\bnbhbb.exe89⤵PID:2584
-
\??\c:\tnhbbh.exec:\tnhbbh.exe90⤵PID:660
-
\??\c:\dddjj.exec:\dddjj.exe91⤵PID:2288
-
\??\c:\5pdpp.exec:\5pdpp.exe92⤵PID:2568
-
\??\c:\jdppv.exec:\jdppv.exe93⤵PID:2808
-
\??\c:\3lrrxxl.exec:\3lrrxxl.exe94⤵PID:1356
-
\??\c:\xrxxrlx.exec:\xrxxrlx.exe95⤵
- System Location Discovery: System Language Discovery
PID:2032 -
\??\c:\btbntb.exec:\btbntb.exe96⤵PID:1140
-
\??\c:\nhnntt.exec:\nhnntt.exe97⤵PID:1032
-
\??\c:\1jvjp.exec:\1jvjp.exe98⤵PID:1452
-
\??\c:\dpddj.exec:\dpddj.exe99⤵PID:2524
-
\??\c:\rllrrrf.exec:\rllrrrf.exe100⤵PID:264
-
\??\c:\fxlrlll.exec:\fxlrlll.exe101⤵PID:768
-
\??\c:\nhtbbn.exec:\nhtbbn.exe102⤵PID:2248
-
\??\c:\5nhbhb.exec:\5nhbhb.exe103⤵PID:444
-
\??\c:\vpjjv.exec:\vpjjv.exe104⤵PID:1152
-
\??\c:\7jpjj.exec:\7jpjj.exe105⤵PID:336
-
\??\c:\5xxlrrf.exec:\5xxlrrf.exe106⤵PID:1340
-
\??\c:\9lxxxxl.exec:\9lxxxxl.exe107⤵PID:1084
-
\??\c:\tbbthn.exec:\tbbthn.exe108⤵PID:984
-
\??\c:\htbhnn.exec:\htbhnn.exe109⤵PID:1632
-
\??\c:\dvpvj.exec:\dvpvj.exe110⤵PID:2676
-
\??\c:\jddjp.exec:\jddjp.exe111⤵PID:2144
-
\??\c:\fxlxllx.exec:\fxlxllx.exe112⤵PID:1492
-
\??\c:\rlllrxf.exec:\rlllrxf.exe113⤵PID:596
-
\??\c:\xrxxllr.exec:\xrxxllr.exe114⤵PID:1504
-
\??\c:\7nhtht.exec:\7nhtht.exe115⤵PID:2476
-
\??\c:\tnbbnt.exec:\tnbbnt.exe116⤵PID:2084
-
\??\c:\jddjp.exec:\jddjp.exe117⤵PID:1616
-
\??\c:\fxffxfl.exec:\fxffxfl.exe118⤵PID:2392
-
\??\c:\lflrxfl.exec:\lflrxfl.exe119⤵PID:2004
-
\??\c:\3fxxffl.exec:\3fxxffl.exe120⤵PID:2532
-
\??\c:\thnnbb.exec:\thnnbb.exe121⤵PID:2388
-
\??\c:\bnhntb.exec:\bnhntb.exe122⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-