Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-08-2024 09:50
Behavioral task
behavioral1
Sample
9493d1dcc93493e7c4cbe614d3e2b530N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
9493d1dcc93493e7c4cbe614d3e2b530N.exe
-
Size
45KB
-
MD5
9493d1dcc93493e7c4cbe614d3e2b530
-
SHA1
6b0d1917c71434951dbf8ef4293c063a94413fc8
-
SHA256
65a6dca3bfba3b8ecdd180f48e6ced08ba168294ead22ee932a05dae89fe2e62
-
SHA512
3609a04a2b6ab9a67105641d323573b2f3cd6bc3dea223c33cf59cee8db13c02cabe59899cee69c206b3d28b27845285037dac1f036b20305030cb36dfee56e2
-
SSDEEP
768:+vQB0ESOGg1UrYShBbgrrMo98l4yOoBDqANhhY/4El6BhGUVTnbcuyD7UNZuVClE:+vQBeOGtrYS3srx93UBWfwC6Ggnouy8+
Malware Config
Signatures
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/408-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-54-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2896-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-74-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1324-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-128-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3000-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-209-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2484-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-288-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2316-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-380-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2552-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-435-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2856-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-472-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2064-471-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-499-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/940-517-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-597-0x00000000002F0000-0x0000000000317000-memory.dmp family_blackmoon behavioral1/memory/2824-611-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2296-657-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2296-656-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-664-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1260-907-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1260-906-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/452-914-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/3052-940-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-942-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1168-962-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1508 ddvjp.exe 2756 9xfxfrr.exe 2952 7bbntb.exe 2780 hhbtnb.exe 2536 7jjvd.exe 2896 frfxffr.exe 2652 3fxrfxl.exe 452 pvvdp.exe 1324 dddvj.exe 1920 7rfxrlx.exe 992 ttbnbn.exe 2148 bthbnt.exe 2120 1vdvj.exe 3000 rrrxlrf.exe 552 3tnntb.exe 1692 ttntbn.exe 2840 vvvdp.exe 2748 1lrfrlx.exe 1256 7xxlflr.exe 3048 bbtbbh.exe 2508 7nnbnt.exe 2468 ppjpp.exe 1180 dvpjv.exe 2484 rrrffrl.exe 1716 bthnbb.exe 2040 9tbnbt.exe 2244 vvpdv.exe 2408 9xxlrxf.exe 1512 rrflrfx.exe 1240 bbhhbb.exe 2412 3tthnt.exe 1828 5vjdd.exe 2316 pppvj.exe 2788 jjpdp.exe 2920 rrfrlxf.exe 2936 flrlffx.exe 2928 llxlxfx.exe 2676 1bthtt.exe 2940 ttbhtb.exe 2672 jjppv.exe 2704 5dpjd.exe 2140 lrxrlrf.exe 1112 xxxrxxf.exe 1072 nntnbh.exe 2552 vpppp.exe 2744 7llxfrf.exe 1900 7hbntb.exe 2632 vpjpj.exe 2564 vvvdp.exe 1272 fxlxfll.exe 1076 7xxxrxl.exe 1620 djpjj.exe 1692 jddpd.exe 2856 xlllllr.exe 2988 rrxllfr.exe 956 hnnthh.exe 2284 tbbtbh.exe 2064 ddddp.exe 2456 3dvdp.exe 1096 rrflrfx.exe 2236 9nttht.exe 2208 bnhthh.exe 844 pddvj.exe 2872 9ppjv.exe -
resource yara_rule behavioral1/memory/408-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/408-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000120fe-5.dat upx behavioral1/files/0x0007000000016d6b-19.dat upx behavioral1/memory/2756-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d7c-28.dat upx behavioral1/memory/2756-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dbf-37.dat upx behavioral1/files/0x0007000000016dcb-45.dat upx behavioral1/memory/2536-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dff-57.dat upx behavioral1/memory/2536-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016e98-65.dat upx behavioral1/memory/2896-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001955f-83.dat upx behavioral1/files/0x0008000000018b5c-76.dat upx behavioral1/memory/1324-91-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019565-95.dat upx behavioral1/memory/1920-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1324-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/992-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019597-104.dat upx behavioral1/memory/1920-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195cc-114.dat upx behavioral1/files/0x00050000000195f7-121.dat upx behavioral1/memory/2120-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195f9-130.dat upx behavioral1/memory/3000-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195fb-140.dat upx behavioral1/files/0x00050000000195ff-158.dat upx behavioral1/memory/1692-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195fd-150.dat upx behavioral1/memory/552-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-166-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019601-169.dat upx behavioral1/memory/2840-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019603-177.dat upx behavioral1/files/0x0005000000019615-186.dat upx behavioral1/files/0x0005000000019616-193.dat upx behavioral1/files/0x0005000000019693-200.dat upx behavioral1/files/0x0005000000019695-210.dat upx behavioral1/files/0x0005000000019950-219.dat upx behavioral1/memory/2484-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1716-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c2e-229.dat upx behavioral1/files/0x0005000000019c30-246.dat upx behavioral1/memory/2040-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c2f-238.dat upx behavioral1/memory/2040-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c4a-254.dat upx behavioral1/files/0x0005000000019cba-263.dat upx behavioral1/memory/2408-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019ce4-272.dat upx behavioral1/memory/1240-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d9d-281.dat upx behavioral1/files/0x0005000000019db1-291.dat upx behavioral1/memory/2316-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1112-368-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1072-375-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffrxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 408 wrote to memory of 1508 408 9493d1dcc93493e7c4cbe614d3e2b530N.exe 29 PID 408 wrote to memory of 1508 408 9493d1dcc93493e7c4cbe614d3e2b530N.exe 29 PID 408 wrote to memory of 1508 408 9493d1dcc93493e7c4cbe614d3e2b530N.exe 29 PID 408 wrote to memory of 1508 408 9493d1dcc93493e7c4cbe614d3e2b530N.exe 29 PID 1508 wrote to memory of 2756 1508 ddvjp.exe 30 PID 1508 wrote to memory of 2756 1508 ddvjp.exe 30 PID 1508 wrote to memory of 2756 1508 ddvjp.exe 30 PID 1508 wrote to memory of 2756 1508 ddvjp.exe 30 PID 2756 wrote to memory of 2952 2756 9xfxfrr.exe 31 PID 2756 wrote to memory of 2952 2756 9xfxfrr.exe 31 PID 2756 wrote to memory of 2952 2756 9xfxfrr.exe 31 PID 2756 wrote to memory of 2952 2756 9xfxfrr.exe 31 PID 2952 wrote to memory of 2780 2952 7bbntb.exe 32 PID 2952 wrote to memory of 2780 2952 7bbntb.exe 32 PID 2952 wrote to memory of 2780 2952 7bbntb.exe 32 PID 2952 wrote to memory of 2780 2952 7bbntb.exe 32 PID 2780 wrote to memory of 2536 2780 hhbtnb.exe 33 PID 2780 wrote to memory of 2536 2780 hhbtnb.exe 33 PID 2780 wrote to memory of 2536 2780 hhbtnb.exe 33 PID 2780 wrote to memory of 2536 2780 hhbtnb.exe 33 PID 2536 wrote to memory of 2896 2536 7jjvd.exe 34 PID 2536 wrote to memory of 2896 2536 7jjvd.exe 34 PID 2536 wrote to memory of 2896 2536 7jjvd.exe 34 PID 2536 wrote to memory of 2896 2536 7jjvd.exe 34 PID 2896 wrote to memory of 2652 2896 frfxffr.exe 35 PID 2896 wrote to memory of 2652 2896 frfxffr.exe 35 PID 2896 wrote to memory of 2652 2896 frfxffr.exe 35 PID 2896 wrote to memory of 2652 2896 frfxffr.exe 35 PID 2652 wrote to memory of 452 2652 3fxrfxl.exe 36 PID 2652 wrote to memory of 452 2652 3fxrfxl.exe 36 PID 2652 wrote to memory of 452 2652 3fxrfxl.exe 36 PID 2652 wrote to memory of 452 2652 3fxrfxl.exe 36 PID 452 wrote to memory of 1324 452 pvvdp.exe 37 PID 452 wrote to memory of 1324 452 pvvdp.exe 37 PID 452 wrote to memory of 1324 452 pvvdp.exe 37 PID 452 wrote to memory of 1324 452 pvvdp.exe 37 PID 1324 wrote to memory of 1920 1324 dddvj.exe 38 PID 1324 wrote to memory of 1920 1324 dddvj.exe 38 PID 1324 wrote to memory of 1920 1324 dddvj.exe 38 PID 1324 wrote to memory of 1920 1324 dddvj.exe 38 PID 1920 wrote to memory of 992 1920 7rfxrlx.exe 39 PID 1920 wrote to memory of 992 1920 7rfxrlx.exe 39 PID 1920 wrote to memory of 992 1920 7rfxrlx.exe 39 PID 1920 wrote to memory of 992 1920 7rfxrlx.exe 39 PID 992 wrote to memory of 2148 992 ttbnbn.exe 40 PID 992 wrote to memory of 2148 992 ttbnbn.exe 40 PID 992 wrote to memory of 2148 992 ttbnbn.exe 40 PID 992 wrote to memory of 2148 992 ttbnbn.exe 40 PID 2148 wrote to memory of 2120 2148 bthbnt.exe 41 PID 2148 wrote to memory of 2120 2148 bthbnt.exe 41 PID 2148 wrote to memory of 2120 2148 bthbnt.exe 41 PID 2148 wrote to memory of 2120 2148 bthbnt.exe 41 PID 2120 wrote to memory of 3000 2120 1vdvj.exe 42 PID 2120 wrote to memory of 3000 2120 1vdvj.exe 42 PID 2120 wrote to memory of 3000 2120 1vdvj.exe 42 PID 2120 wrote to memory of 3000 2120 1vdvj.exe 42 PID 3000 wrote to memory of 552 3000 rrrxlrf.exe 43 PID 3000 wrote to memory of 552 3000 rrrxlrf.exe 43 PID 3000 wrote to memory of 552 3000 rrrxlrf.exe 43 PID 3000 wrote to memory of 552 3000 rrrxlrf.exe 43 PID 552 wrote to memory of 1692 552 3tnntb.exe 44 PID 552 wrote to memory of 1692 552 3tnntb.exe 44 PID 552 wrote to memory of 1692 552 3tnntb.exe 44 PID 552 wrote to memory of 1692 552 3tnntb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\9493d1dcc93493e7c4cbe614d3e2b530N.exe"C:\Users\Admin\AppData\Local\Temp\9493d1dcc93493e7c4cbe614d3e2b530N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\ddvjp.exec:\ddvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\9xfxfrr.exec:\9xfxfrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7bbntb.exec:\7bbntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hhbtnb.exec:\hhbtnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7jjvd.exec:\7jjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\frfxffr.exec:\frfxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3fxrfxl.exec:\3fxrfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pvvdp.exec:\pvvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\dddvj.exec:\dddvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\7rfxrlx.exec:\7rfxrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\ttbnbn.exec:\ttbnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\bthbnt.exec:\bthbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\1vdvj.exec:\1vdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3tnntb.exec:\3tnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\ttntbn.exec:\ttntbn.exe17⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vvvdp.exec:\vvvdp.exe18⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1lrfrlx.exec:\1lrfrlx.exe19⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7xxlflr.exec:\7xxlflr.exe20⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bbtbbh.exec:\bbtbbh.exe21⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7nnbnt.exec:\7nnbnt.exe22⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ppjpp.exec:\ppjpp.exe23⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dvpjv.exec:\dvpjv.exe24⤵
- Executes dropped EXE
PID:1180 -
\??\c:\rrrffrl.exec:\rrrffrl.exe25⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bthnbb.exec:\bthnbb.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9tbnbt.exec:\9tbnbt.exe27⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvpdv.exec:\vvpdv.exe28⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9xxlrxf.exec:\9xxlrxf.exe29⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rrflrfx.exec:\rrflrfx.exe30⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bbhhbb.exec:\bbhhbb.exe31⤵
- Executes dropped EXE
PID:1240 -
\??\c:\3tthnt.exec:\3tthnt.exe32⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5vjdd.exec:\5vjdd.exe33⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pppvj.exec:\pppvj.exe34⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jjpdp.exec:\jjpdp.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrfrlxf.exec:\rrfrlxf.exe36⤵
- Executes dropped EXE
PID:2920 -
\??\c:\flrlffx.exec:\flrlffx.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\llxlxfx.exec:\llxlxfx.exe38⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1bthtt.exec:\1bthtt.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ttbhtb.exec:\ttbhtb.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jjppv.exec:\jjppv.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5dpjd.exec:\5dpjd.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lrxrlrf.exec:\lrxrlrf.exe43⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe44⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nntnbh.exec:\nntnbh.exe45⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vpppp.exec:\vpppp.exe46⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7llxfrf.exec:\7llxfrf.exe47⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7hbntb.exec:\7hbntb.exe48⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vpjpj.exec:\vpjpj.exe49⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vvvdp.exec:\vvvdp.exe50⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fxlxfll.exec:\fxlxfll.exe51⤵
- Executes dropped EXE
PID:1272 -
\??\c:\7xxxrxl.exec:\7xxxrxl.exe52⤵
- Executes dropped EXE
PID:1076 -
\??\c:\djpjj.exec:\djpjj.exe53⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jddpd.exec:\jddpd.exe54⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xlllllr.exec:\xlllllr.exe55⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rrxllfr.exec:\rrxllfr.exe56⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hnnthh.exec:\hnnthh.exe57⤵
- Executes dropped EXE
PID:956 -
\??\c:\tbbtbh.exec:\tbbtbh.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ddddp.exec:\ddddp.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3dvdp.exec:\3dvdp.exe60⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rrflrfx.exec:\rrflrfx.exe61⤵
- Executes dropped EXE
PID:1096 -
\??\c:\9nttht.exec:\9nttht.exe62⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bnhthh.exec:\bnhthh.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pddvj.exec:\pddvj.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\9ppjv.exec:\9ppjv.exe65⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rrlxfrr.exec:\rrlxfrr.exe66⤵PID:940
-
\??\c:\xxfrflf.exec:\xxfrflf.exe67⤵PID:1872
-
\??\c:\hhhthb.exec:\hhhthb.exe68⤵PID:1788
-
\??\c:\dpvdd.exec:\dpvdd.exe69⤵PID:1908
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe70⤵PID:1512
-
\??\c:\1bhbtb.exec:\1bhbtb.exe71⤵PID:688
-
\??\c:\tbtnbn.exec:\tbtnbn.exe72⤵PID:1508
-
\??\c:\jddvd.exec:\jddvd.exe73⤵PID:2740
-
\??\c:\jpvpj.exec:\jpvpj.exe74⤵PID:1568
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe75⤵
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\xfxrfrl.exec:\xfxrfrl.exe76⤵PID:2912
-
\??\c:\nbhnht.exec:\nbhnht.exe77⤵PID:2396
-
\??\c:\bnbbhb.exec:\bnbbhb.exe78⤵PID:2924
-
\??\c:\jdvjp.exec:\jdvjp.exe79⤵PID:2844
-
\??\c:\djppd.exec:\djppd.exe80⤵PID:2824
-
\??\c:\9ffflxl.exec:\9ffflxl.exe81⤵PID:2816
-
\??\c:\fllrrxf.exec:\fllrrxf.exe82⤵PID:1264
-
\??\c:\bbntnb.exec:\bbntnb.exe83⤵PID:2652
-
\??\c:\hhhbnt.exec:\hhhbnt.exe84⤵PID:1660
-
\??\c:\vvpvd.exec:\vvpvd.exe85⤵PID:452
-
\??\c:\vppdj.exec:\vppdj.exe86⤵PID:2204
-
\??\c:\3llrxxx.exec:\3llrxxx.exe87⤵PID:2296
-
\??\c:\7lxffll.exec:\7lxffll.exe88⤵PID:2128
-
\??\c:\hhhbhb.exec:\hhhbhb.exe89⤵PID:2172
-
\??\c:\nnbhtb.exec:\nnbhtb.exe90⤵PID:2136
-
\??\c:\jjdpv.exec:\jjdpv.exe91⤵PID:2880
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe92⤵PID:3000
-
\??\c:\rlxlxlr.exec:\rlxlxlr.exe93⤵PID:2560
-
\??\c:\bbbbtt.exec:\bbbbtt.exe94⤵PID:552
-
\??\c:\nnbnth.exec:\nnbnth.exe95⤵PID:1552
-
\??\c:\1ddvp.exec:\1ddvp.exe96⤵PID:3012
-
\??\c:\jjvdp.exec:\jjvdp.exe97⤵PID:3064
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe98⤵PID:2988
-
\??\c:\xxfxrfx.exec:\xxfxrfx.exe99⤵PID:1684
-
\??\c:\tbbtnh.exec:\tbbtnh.exe100⤵PID:1708
-
\??\c:\hhhtnh.exec:\hhhtnh.exe101⤵PID:2452
-
\??\c:\vpdjp.exec:\vpdjp.exe102⤵PID:2272
-
\??\c:\ddvjp.exec:\ddvjp.exe103⤵PID:1096
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe104⤵PID:1180
-
\??\c:\rrrfrlf.exec:\rrrfrlf.exe105⤵PID:1276
-
\??\c:\hbnthn.exec:\hbnthn.exe106⤵PID:876
-
\??\c:\ntbhnt.exec:\ntbhnt.exe107⤵
- System Location Discovery: System Language Discovery
PID:1040 -
\??\c:\3dvjv.exec:\3dvjv.exe108⤵PID:636
-
\??\c:\vdpjj.exec:\vdpjj.exe109⤵PID:1852
-
\??\c:\9xfxrfx.exec:\9xfxrfx.exe110⤵PID:2408
-
\??\c:\rrrlxlx.exec:\rrrlxlx.exe111⤵PID:1788
-
\??\c:\nnnbnb.exec:\nnnbnb.exe112⤵PID:2312
-
\??\c:\nnthth.exec:\nnthth.exe113⤵PID:1352
-
\??\c:\jpppd.exec:\jpppd.exe114⤵PID:1600
-
\??\c:\vpjjj.exec:\vpjjj.exe115⤵PID:1448
-
\??\c:\vpjpv.exec:\vpjpv.exe116⤵PID:1668
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe117⤵PID:2804
-
\??\c:\ffxlflx.exec:\ffxlflx.exe118⤵PID:3040
-
\??\c:\5ttnbh.exec:\5ttnbh.exe119⤵PID:2968
-
\??\c:\1tthbn.exec:\1tthbn.exe120⤵PID:2780
-
\??\c:\jpjjj.exec:\jpjjj.exe121⤵PID:2684
-
\??\c:\flrfxlf.exec:\flrfxlf.exe122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-