Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 06:56
Behavioral task
behavioral1
Sample
97070f456d6acb0eca7fe28c8f39b0d0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
97070f456d6acb0eca7fe28c8f39b0d0N.exe
-
Size
230KB
-
MD5
97070f456d6acb0eca7fe28c8f39b0d0
-
SHA1
43f7067ee0ccc1f6dd73d8c0995fba2154d22d2e
-
SHA256
fdc31efee5c2ae6026c7e3a35b37522de0c1ff69c1e8c164e62df92f54ee7d6d
-
SHA512
e84724c65dbc4872ab0eaba9866b7f2f85b55c68d35db6d3960e335c3944360eecd0d69d7b9de1744518b894ee1a0b280488b4c8998a9aef34b25bea2817b073
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzl+SQ:T4wFHoS3dJS4ZzeFaKHpCcg
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2360-1-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2176-21-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2056-18-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2392-39-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2124-30-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2720-57-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2144-48-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2884-66-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2336-92-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2772-90-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2772-88-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1304-107-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/2684-111-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2572-119-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2104-143-0x00000000002B0000-0x00000000002E5000-memory.dmp family_blackmoon behavioral1/memory/2104-142-0x00000000002B0000-0x00000000002E5000-memory.dmp family_blackmoon behavioral1/memory/1148-159-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/1788-169-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1952-179-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2264-224-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/684-235-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1128-232-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/552-250-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2072-259-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1096-268-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2360-294-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2348-404-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2700-448-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2240-480-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/444-500-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1128-508-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1544-515-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1516-553-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1516-554-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2184-574-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/264-641-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2956-666-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2432-697-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/872-704-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/620-773-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2748-915-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2944-1036-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1060-1049-0x0000000001B90000-0x0000000001BC5000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 jpvdv.exe 2176 rxrfxxl.exe 2124 hhbnnt.exe 2392 bhhthn.exe 2144 vvjpv.exe 2720 3jvdd.exe 2884 lfxflxr.exe 2836 bbbbbt.exe 2772 dpdvv.exe 2336 7bthnb.exe 1304 vpddj.exe 2684 btnbnb.exe 2572 djvdd.exe 316 fxrxrfx.exe 2104 rrrrffl.exe 1972 pjvdp.exe 1148 dvpvv.exe 1788 bttbbb.exe 1952 ppjjv.exe 2868 rlrrxxx.exe 2652 xrrrffr.exe 2244 hbttbh.exe 2224 7vpjd.exe 2264 xxrfxfl.exe 1128 9tnbtt.exe 684 1jddv.exe 552 7xxxlfr.exe 2072 dvjdp.exe 1096 xrlfflx.exe 2564 5nhnth.exe 1532 1pddj.exe 2360 fxrrrxl.exe 1608 thntbh.exe 2532 bthhtb.exe 2404 vpddp.exe 2324 lfffrxr.exe 2060 rrflrrx.exe 2500 htnbhh.exe 2752 jdjdv.exe 2720 jjdpv.exe 2896 5rffrrl.exe 2844 rlxlrxr.exe 2796 1bhntt.exe 2856 jdjjp.exe 2640 3vvjv.exe 2780 1lffrxr.exe 2632 xrffxfl.exe 2612 hbhntt.exe 2688 vpddp.exe 2348 pjddv.exe 2600 lfrlrrf.exe 2276 fxrxllx.exe 1800 nnbnhb.exe 1712 3nnbtt.exe 1808 1pjpv.exe 1228 lfrrxxr.exe 2700 ffxflrf.exe 2916 ttbnbh.exe 2920 ntnhbn.exe 3004 vvpjj.exe 300 rrlrffl.exe 2240 lfrxlrf.exe 2980 hbttbn.exe 2224 dddvd.exe -
resource yara_rule behavioral1/memory/2360-1-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000012119-7.dat upx behavioral1/memory/2056-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2176-21-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000015d8b-19.dat upx behavioral1/memory/2056-18-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2392-39-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000015db5-37.dat upx behavioral1/memory/2124-30-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000015d9e-28.dat upx behavioral1/memory/2720-57-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000015e21-55.dat upx behavioral1/memory/2144-48-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000015dbf-46.dat upx behavioral1/files/0x0008000000016d3e-80.dat upx behavioral1/memory/2884-66-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0009000000015e87-64.dat upx behavioral1/files/0x0008000000015f8b-73.dat upx behavioral1/memory/2336-92-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d46-91.dat upx behavioral1/memory/2772-90-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d5a-99.dat upx behavioral1/files/0x0006000000016d9e-109.dat upx behavioral1/memory/2684-111-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016ddb-135.dat upx behavioral1/files/0x0006000000016dc7-127.dat upx behavioral1/memory/2572-119-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016db0-118.dat upx behavioral1/files/0x0006000000016eb4-152.dat upx behavioral1/files/0x0006000000016ddf-145.dat upx behavioral1/memory/2104-142-0x00000000002B0000-0x00000000002E5000-memory.dmp upx behavioral1/files/0x0006000000016ed2-162.dat upx behavioral1/files/0x0006000000017073-170.dat upx behavioral1/memory/1788-169-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000173e4-181.dat upx behavioral1/memory/2868-180-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000017400-188.dat upx behavioral1/memory/1952-179-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000017406-196.dat upx behavioral1/memory/2244-198-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000017409-205.dat upx behavioral1/files/0x000600000001747a-216.dat upx behavioral1/memory/2264-215-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0009000000015d72-225.dat upx behavioral1/memory/2264-224-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/684-235-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000600000001748d-234.dat upx behavioral1/memory/1128-232-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000174ab-242.dat upx behavioral1/memory/552-250-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000600000001752e-252.dat upx behavioral1/files/0x000900000001866c-260.dat upx behavioral1/memory/2072-259-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1096-268-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0011000000018676-270.dat upx behavioral1/files/0x00050000000186c8-277.dat upx behavioral1/memory/1532-279-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0005000000018798-286.dat upx behavioral1/memory/2360-294-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2348-404-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2700-448-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3004-461-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2240-480-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2980-481-0x0000000000400000-0x0000000000435000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2056 2360 97070f456d6acb0eca7fe28c8f39b0d0N.exe 30 PID 2360 wrote to memory of 2056 2360 97070f456d6acb0eca7fe28c8f39b0d0N.exe 30 PID 2360 wrote to memory of 2056 2360 97070f456d6acb0eca7fe28c8f39b0d0N.exe 30 PID 2360 wrote to memory of 2056 2360 97070f456d6acb0eca7fe28c8f39b0d0N.exe 30 PID 2056 wrote to memory of 2176 2056 jpvdv.exe 31 PID 2056 wrote to memory of 2176 2056 jpvdv.exe 31 PID 2056 wrote to memory of 2176 2056 jpvdv.exe 31 PID 2056 wrote to memory of 2176 2056 jpvdv.exe 31 PID 2176 wrote to memory of 2124 2176 rxrfxxl.exe 32 PID 2176 wrote to memory of 2124 2176 rxrfxxl.exe 32 PID 2176 wrote to memory of 2124 2176 rxrfxxl.exe 32 PID 2176 wrote to memory of 2124 2176 rxrfxxl.exe 32 PID 2124 wrote to memory of 2392 2124 hhbnnt.exe 33 PID 2124 wrote to memory of 2392 2124 hhbnnt.exe 33 PID 2124 wrote to memory of 2392 2124 hhbnnt.exe 33 PID 2124 wrote to memory of 2392 2124 hhbnnt.exe 33 PID 2392 wrote to memory of 2144 2392 bhhthn.exe 34 PID 2392 wrote to memory of 2144 2392 bhhthn.exe 34 PID 2392 wrote to memory of 2144 2392 bhhthn.exe 34 PID 2392 wrote to memory of 2144 2392 bhhthn.exe 34 PID 2144 wrote to memory of 2720 2144 vvjpv.exe 35 PID 2144 wrote to memory of 2720 2144 vvjpv.exe 35 PID 2144 wrote to memory of 2720 2144 vvjpv.exe 35 PID 2144 wrote to memory of 2720 2144 vvjpv.exe 35 PID 2720 wrote to memory of 2884 2720 3jvdd.exe 36 PID 2720 wrote to memory of 2884 2720 3jvdd.exe 36 PID 2720 wrote to memory of 2884 2720 3jvdd.exe 36 PID 2720 wrote to memory of 2884 2720 3jvdd.exe 36 PID 2884 wrote to memory of 2836 2884 lfxflxr.exe 37 PID 2884 wrote to memory of 2836 2884 lfxflxr.exe 37 PID 2884 wrote to memory of 2836 2884 lfxflxr.exe 37 PID 2884 wrote to memory of 2836 2884 lfxflxr.exe 37 PID 2836 wrote to memory of 2772 2836 bbbbbt.exe 38 PID 2836 wrote to memory of 2772 2836 bbbbbt.exe 38 PID 2836 wrote to memory of 2772 2836 bbbbbt.exe 38 PID 2836 wrote to memory of 2772 2836 bbbbbt.exe 38 PID 2772 wrote to memory of 2336 2772 dpdvv.exe 39 PID 2772 wrote to memory of 2336 2772 dpdvv.exe 39 PID 2772 wrote to memory of 2336 2772 dpdvv.exe 39 PID 2772 wrote to memory of 2336 2772 dpdvv.exe 39 PID 2336 wrote to memory of 1304 2336 7bthnb.exe 40 PID 2336 wrote to memory of 1304 2336 7bthnb.exe 40 PID 2336 wrote to memory of 1304 2336 7bthnb.exe 40 PID 2336 wrote to memory of 1304 2336 7bthnb.exe 40 PID 1304 wrote to memory of 2684 1304 vpddj.exe 41 PID 1304 wrote to memory of 2684 1304 vpddj.exe 41 PID 1304 wrote to memory of 2684 1304 vpddj.exe 41 PID 1304 wrote to memory of 2684 1304 vpddj.exe 41 PID 2684 wrote to memory of 2572 2684 btnbnb.exe 42 PID 2684 wrote to memory of 2572 2684 btnbnb.exe 42 PID 2684 wrote to memory of 2572 2684 btnbnb.exe 42 PID 2684 wrote to memory of 2572 2684 btnbnb.exe 42 PID 2572 wrote to memory of 316 2572 djvdd.exe 43 PID 2572 wrote to memory of 316 2572 djvdd.exe 43 PID 2572 wrote to memory of 316 2572 djvdd.exe 43 PID 2572 wrote to memory of 316 2572 djvdd.exe 43 PID 316 wrote to memory of 2104 316 fxrxrfx.exe 44 PID 316 wrote to memory of 2104 316 fxrxrfx.exe 44 PID 316 wrote to memory of 2104 316 fxrxrfx.exe 44 PID 316 wrote to memory of 2104 316 fxrxrfx.exe 44 PID 2104 wrote to memory of 1972 2104 rrrrffl.exe 45 PID 2104 wrote to memory of 1972 2104 rrrrffl.exe 45 PID 2104 wrote to memory of 1972 2104 rrrrffl.exe 45 PID 2104 wrote to memory of 1972 2104 rrrrffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\97070f456d6acb0eca7fe28c8f39b0d0N.exe"C:\Users\Admin\AppData\Local\Temp\97070f456d6acb0eca7fe28c8f39b0d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jpvdv.exec:\jpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rxrfxxl.exec:\rxrfxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\hhbnnt.exec:\hhbnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\bhhthn.exec:\bhhthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\vvjpv.exec:\vvjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\3jvdd.exec:\3jvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lfxflxr.exec:\lfxflxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\bbbbbt.exec:\bbbbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dpdvv.exec:\dpdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\7bthnb.exec:\7bthnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\vpddj.exec:\vpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\btnbnb.exec:\btnbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\djvdd.exec:\djvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\fxrxrfx.exec:\fxrxrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\rrrrffl.exec:\rrrrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pjvdp.exec:\pjvdp.exe17⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dvpvv.exec:\dvpvv.exe18⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bttbbb.exec:\bttbbb.exe19⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ppjjv.exec:\ppjjv.exe20⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe21⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xrrrffr.exec:\xrrrffr.exe22⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbttbh.exec:\hbttbh.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7vpjd.exec:\7vpjd.exe24⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xxrfxfl.exec:\xxrfxfl.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9tnbtt.exec:\9tnbtt.exe26⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1jddv.exec:\1jddv.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\7xxxlfr.exec:\7xxxlfr.exe28⤵
- Executes dropped EXE
PID:552 -
\??\c:\dvjdp.exec:\dvjdp.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xrlfflx.exec:\xrlfflx.exe30⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5nhnth.exec:\5nhnth.exe31⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1pddj.exec:\1pddj.exe32⤵
- Executes dropped EXE
PID:1532 -
\??\c:\fxrrrxl.exec:\fxrrrxl.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\thntbh.exec:\thntbh.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bthhtb.exec:\bthhtb.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vpddp.exec:\vpddp.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lfffrxr.exec:\lfffrxr.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rrflrrx.exec:\rrflrrx.exe38⤵
- Executes dropped EXE
PID:2060 -
\??\c:\htnbhh.exec:\htnbhh.exe39⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jdjdv.exec:\jdjdv.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jjdpv.exec:\jjdpv.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5rffrrl.exec:\5rffrrl.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rlxlrxr.exec:\rlxlrxr.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1bhntt.exec:\1bhntt.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jdjjp.exec:\jdjjp.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3vvjv.exec:\3vvjv.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1lffrxr.exec:\1lffrxr.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrffxfl.exec:\xrffxfl.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbhntt.exec:\hbhntt.exe49⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vpddp.exec:\vpddp.exe50⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjddv.exec:\pjddv.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe52⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fxrxllx.exec:\fxrxllx.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nnbnhb.exec:\nnbnhb.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3nnbtt.exec:\3nnbtt.exe55⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1pjpv.exec:\1pjpv.exe56⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe57⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ffxflrf.exec:\ffxflrf.exe58⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ttbnbh.exec:\ttbnbh.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ntnhbn.exec:\ntnhbn.exe60⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vvpjj.exec:\vvpjj.exe61⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrlrffl.exec:\rrlrffl.exe62⤵
- Executes dropped EXE
PID:300 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe63⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hbttbn.exec:\hbttbn.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\dddvd.exec:\dddvd.exe65⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dpjvj.exec:\dpjvj.exe66⤵PID:444
-
\??\c:\fflrllf.exec:\fflrllf.exe67⤵PID:1128
-
\??\c:\fxffffl.exec:\fxffffl.exe68⤵PID:1544
-
\??\c:\9thnbb.exec:\9thnbb.exe69⤵PID:1680
-
\??\c:\dvppd.exec:\dvppd.exe70⤵PID:2120
-
\??\c:\7xrxlxf.exec:\7xrxlxf.exe71⤵PID:1568
-
\??\c:\xrxfllx.exec:\xrxfllx.exe72⤵
- System Location Discovery: System Language Discovery
PID:1372 -
\??\c:\1nbnhh.exec:\1nbnhh.exe73⤵PID:2788
-
\??\c:\1tnbtb.exec:\1tnbtb.exe74⤵PID:1516
-
\??\c:\5vdjv.exec:\5vdjv.exe75⤵PID:480
-
\??\c:\7jvdj.exec:\7jvdj.exe76⤵PID:2360
-
\??\c:\7rrlxfx.exec:\7rrlxfx.exe77⤵PID:2184
-
\??\c:\btnbhn.exec:\btnbhn.exe78⤵PID:2376
-
\??\c:\nhbhtb.exec:\nhbhtb.exe79⤵PID:2544
-
\??\c:\pjjjd.exec:\pjjjd.exe80⤵PID:2392
-
\??\c:\ppjpv.exec:\ppjpv.exe81⤵PID:2288
-
\??\c:\rxxlfrf.exec:\rxxlfrf.exe82⤵PID:2160
-
\??\c:\7xrrflr.exec:\7xrrflr.exe83⤵PID:2840
-
\??\c:\nnhthn.exec:\nnhthn.exe84⤵PID:2884
-
\??\c:\1btttb.exec:\1btttb.exe85⤵PID:2620
-
\??\c:\jjvpj.exec:\jjvpj.exe86⤵PID:2900
-
\??\c:\dvdjv.exec:\dvdjv.exe87⤵PID:1356
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe88⤵PID:264
-
\??\c:\nhntth.exec:\nhntth.exe89⤵PID:2956
-
\??\c:\tthntn.exec:\tthntn.exe90⤵PID:2668
-
\??\c:\ppvdd.exec:\ppvdd.exe91⤵PID:2644
-
\??\c:\vpvdd.exec:\vpvdd.exe92⤵PID:2140
-
\??\c:\lfxxrfl.exec:\lfxxrfl.exe93⤵PID:2672
-
\??\c:\5xllfrf.exec:\5xllfrf.exe94⤵PID:1756
-
\??\c:\nhbhtn.exec:\nhbhtn.exe95⤵PID:2656
-
\??\c:\nnthbh.exec:\nnthbh.exe96⤵PID:2104
-
\??\c:\ppjpd.exec:\ppjpd.exe97⤵PID:2432
-
\??\c:\7vpvp.exec:\7vpvp.exe98⤵PID:872
-
\??\c:\rrrxlrf.exec:\rrrxlrf.exe99⤵PID:1148
-
\??\c:\hhthtt.exec:\hhthtt.exe100⤵PID:1348
-
\??\c:\btbbhh.exec:\btbbhh.exe101⤵PID:1592
-
\??\c:\pjvpv.exec:\pjvpv.exe102⤵PID:2876
-
\??\c:\jjdjv.exec:\jjdjv.exe103⤵PID:2968
-
\??\c:\1lfflrx.exec:\1lfflrx.exe104⤵PID:2232
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe105⤵PID:892
-
\??\c:\9thhtt.exec:\9thhtt.exe106⤵PID:1496
-
\??\c:\9nhtth.exec:\9nhtth.exe107⤵PID:292
-
\??\c:\vpjpp.exec:\vpjpp.exe108⤵PID:1636
-
\??\c:\llfrllr.exec:\llfrllr.exe109⤵PID:620
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe110⤵PID:2420
-
\??\c:\hhbtht.exec:\hhbtht.exe111⤵PID:2576
-
\??\c:\bttttb.exec:\bttttb.exe112⤵PID:948
-
\??\c:\dddvd.exec:\dddvd.exe113⤵PID:1968
-
\??\c:\vpjvv.exec:\vpjvv.exe114⤵PID:2120
-
\??\c:\fxllxxx.exec:\fxllxxx.exe115⤵PID:676
-
\??\c:\rlrxxff.exec:\rlrxxff.exe116⤵PID:1372
-
\??\c:\bthhtb.exec:\bthhtb.exe117⤵PID:2236
-
\??\c:\3tbntt.exec:\3tbntt.exe118⤵PID:1516
-
\??\c:\pdjpd.exec:\pdjpd.exe119⤵PID:2156
-
\??\c:\jjvdv.exec:\jjvdv.exe120⤵PID:2516
-
\??\c:\5frllrx.exec:\5frllrx.exe121⤵PID:2124
-
\??\c:\tbbntn.exec:\tbbntn.exe122⤵PID:2404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-