Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 08:03
Behavioral task
behavioral1
Sample
c0c97b2042bd766208b674622fdb9270N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
c0c97b2042bd766208b674622fdb9270N.exe
-
Size
71KB
-
MD5
c0c97b2042bd766208b674622fdb9270
-
SHA1
499ffdd9ed464e140437d592d5bedb0ce33026a7
-
SHA256
61468abe27804a7969f3e412931ddae8930386559b7857a85fb1c5803a280972
-
SHA512
6070b1a8ae752df5b59826e8ce5b80f6c4a2aeb6c0c66170eb901059abfc73263082301a34f83fb68631f9c3698e71077de52d7b068184b248cb18922b67ce3a
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQldqHiF48u9qll8:khOmTsF93UYfwC6GIoutpYcvldKiF4WI
Malware Config
Signatures
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2664-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-63-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2552-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-83-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1184-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-120-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2852-122-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1948-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-155-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2428-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-209-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1684-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-348-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1624-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/608-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/608-362-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-376-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2448-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1280-416-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1280-418-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-544-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3000-557-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2520-567-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2800-580-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-600-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-621-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2448-672-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1932-720-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1932-722-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1276-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-917-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1924-987-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-994-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1324-1044-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1324-1046-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2440-1205-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 jdjjp.exe 2808 pjdjd.exe 2688 xlfrlxr.exe 2744 thtnbh.exe 2692 rlfffxl.exe 2552 7xlrffl.exe 1624 xrrrfrl.exe 1092 hbbtbb.exe 1184 1ddjd.exe 2196 vjdpp.exe 2448 xrfflrf.exe 2852 btnthh.exe 1948 ppdvv.exe 1028 rrxrrfx.exe 2308 3lllrxl.exe 2428 bhbtth.exe 1988 5jdjp.exe 1432 llffllx.exe 2908 9rfrffl.exe 2920 jpdvp.exe 2208 jjvpd.exe 2124 rxflfrl.exe 1684 nhbhth.exe 1424 tnbhht.exe 836 vpdvj.exe 904 ffxrfrl.exe 564 rflrffr.exe 1636 hthntt.exe 3020 jjvdj.exe 2360 1lxlllr.exe 2504 hnhtbb.exe 3028 jdjvj.exe 2784 jdpvp.exe 2684 1fxrlrr.exe 3048 hbbhbb.exe 1592 1tbnbb.exe 2264 1vpvv.exe 1508 vjddp.exe 2844 xrrxxlr.exe 2600 bbhbtb.exe 1624 thbhtn.exe 608 jvdpj.exe 992 xxrlrrf.exe 1756 xrfxlfl.exe 1040 tbbhhb.exe 1792 dvvdv.exe 2448 jvpdd.exe 2200 lxrrxfl.exe 1628 9hbhnn.exe 1280 nbnbhb.exe 2788 dpjdd.exe 2616 vdpjj.exe 2424 lfrrrxf.exe 1924 ththnt.exe 1912 3nhhtt.exe 784 9pjpj.exe 532 fxxfrrx.exe 2392 3xffxxf.exe 2388 thtbbh.exe 2652 hhnhbt.exe 2748 5vjjj.exe 2540 1vpdp.exe 1768 1frrxxf.exe 1424 htbbnn.exe -
resource yara_rule behavioral1/memory/2216-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000120d6-10.dat upx behavioral1/memory/2664-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016dd5-18.dat upx behavioral1/files/0x0007000000016dd9-28.dat upx behavioral1/memory/2808-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016de9-35.dat upx behavioral1/memory/2744-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016df5-47.dat upx behavioral1/files/0x0007000000016df8-55.dat upx behavioral1/files/0x0009000000016f02-64.dat upx behavioral1/memory/1624-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018be7-75.dat upx behavioral1/memory/1624-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d7b-84.dat upx behavioral1/files/0x0006000000018d83-93.dat upx behavioral1/memory/1184-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018fdf-104.dat upx behavioral1/files/0x0006000000019056-113.dat upx behavioral1/memory/2448-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019203-123.dat upx behavioral1/files/0x0005000000019237-132.dat upx behavioral1/memory/1948-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001924f-140.dat upx behavioral1/files/0x0005000000019261-148.dat upx behavioral1/files/0x0005000000019274-156.dat upx behavioral1/memory/2428-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-166.dat upx behavioral1/files/0x0005000000019299-175.dat upx behavioral1/memory/1432-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a1-185.dat upx behavioral1/files/0x0005000000019354-193.dat upx behavioral1/memory/2920-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019358-202.dat upx behavioral1/files/0x000500000001938e-211.dat upx behavioral1/files/0x000500000001939f-221.dat upx behavioral1/memory/1684-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cc-230.dat upx behavioral1/memory/836-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d0-239.dat upx behavioral1/files/0x00050000000193dc-248.dat upx behavioral1/files/0x00050000000193f9-255.dat upx behavioral1/files/0x0032000000016d68-263.dat upx behavioral1/files/0x0005000000019426-271.dat upx behavioral1/memory/2360-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019428-280.dat upx behavioral1/files/0x00050000000194ad-288.dat upx behavioral1/memory/3028-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/608-363-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-383-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-390-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-397-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2664 2216 c0c97b2042bd766208b674622fdb9270N.exe 30 PID 2216 wrote to memory of 2664 2216 c0c97b2042bd766208b674622fdb9270N.exe 30 PID 2216 wrote to memory of 2664 2216 c0c97b2042bd766208b674622fdb9270N.exe 30 PID 2216 wrote to memory of 2664 2216 c0c97b2042bd766208b674622fdb9270N.exe 30 PID 2664 wrote to memory of 2808 2664 jdjjp.exe 31 PID 2664 wrote to memory of 2808 2664 jdjjp.exe 31 PID 2664 wrote to memory of 2808 2664 jdjjp.exe 31 PID 2664 wrote to memory of 2808 2664 jdjjp.exe 31 PID 2808 wrote to memory of 2688 2808 pjdjd.exe 32 PID 2808 wrote to memory of 2688 2808 pjdjd.exe 32 PID 2808 wrote to memory of 2688 2808 pjdjd.exe 32 PID 2808 wrote to memory of 2688 2808 pjdjd.exe 32 PID 2688 wrote to memory of 2744 2688 xlfrlxr.exe 33 PID 2688 wrote to memory of 2744 2688 xlfrlxr.exe 33 PID 2688 wrote to memory of 2744 2688 xlfrlxr.exe 33 PID 2688 wrote to memory of 2744 2688 xlfrlxr.exe 33 PID 2744 wrote to memory of 2692 2744 thtnbh.exe 34 PID 2744 wrote to memory of 2692 2744 thtnbh.exe 34 PID 2744 wrote to memory of 2692 2744 thtnbh.exe 34 PID 2744 wrote to memory of 2692 2744 thtnbh.exe 34 PID 2692 wrote to memory of 2552 2692 rlfffxl.exe 35 PID 2692 wrote to memory of 2552 2692 rlfffxl.exe 35 PID 2692 wrote to memory of 2552 2692 rlfffxl.exe 35 PID 2692 wrote to memory of 2552 2692 rlfffxl.exe 35 PID 2552 wrote to memory of 1624 2552 7xlrffl.exe 36 PID 2552 wrote to memory of 1624 2552 7xlrffl.exe 36 PID 2552 wrote to memory of 1624 2552 7xlrffl.exe 36 PID 2552 wrote to memory of 1624 2552 7xlrffl.exe 36 PID 1624 wrote to memory of 1092 1624 xrrrfrl.exe 37 PID 1624 wrote to memory of 1092 1624 xrrrfrl.exe 37 PID 1624 wrote to memory of 1092 1624 xrrrfrl.exe 37 PID 1624 wrote to memory of 1092 1624 xrrrfrl.exe 37 PID 1092 wrote to memory of 1184 1092 hbbtbb.exe 38 PID 1092 wrote to memory of 1184 1092 hbbtbb.exe 38 PID 1092 wrote to memory of 1184 1092 hbbtbb.exe 38 PID 1092 wrote to memory of 1184 1092 hbbtbb.exe 38 PID 1184 wrote to memory of 2196 1184 1ddjd.exe 39 PID 1184 wrote to memory of 2196 1184 1ddjd.exe 39 PID 1184 wrote to memory of 2196 1184 1ddjd.exe 39 PID 1184 wrote to memory of 2196 1184 1ddjd.exe 39 PID 2196 wrote to memory of 2448 2196 vjdpp.exe 40 PID 2196 wrote to memory of 2448 2196 vjdpp.exe 40 PID 2196 wrote to memory of 2448 2196 vjdpp.exe 40 PID 2196 wrote to memory of 2448 2196 vjdpp.exe 40 PID 2448 wrote to memory of 2852 2448 xrfflrf.exe 41 PID 2448 wrote to memory of 2852 2448 xrfflrf.exe 41 PID 2448 wrote to memory of 2852 2448 xrfflrf.exe 41 PID 2448 wrote to memory of 2852 2448 xrfflrf.exe 41 PID 2852 wrote to memory of 1948 2852 btnthh.exe 42 PID 2852 wrote to memory of 1948 2852 btnthh.exe 42 PID 2852 wrote to memory of 1948 2852 btnthh.exe 42 PID 2852 wrote to memory of 1948 2852 btnthh.exe 42 PID 1948 wrote to memory of 1028 1948 ppdvv.exe 43 PID 1948 wrote to memory of 1028 1948 ppdvv.exe 43 PID 1948 wrote to memory of 1028 1948 ppdvv.exe 43 PID 1948 wrote to memory of 1028 1948 ppdvv.exe 43 PID 1028 wrote to memory of 2308 1028 rrxrrfx.exe 44 PID 1028 wrote to memory of 2308 1028 rrxrrfx.exe 44 PID 1028 wrote to memory of 2308 1028 rrxrrfx.exe 44 PID 1028 wrote to memory of 2308 1028 rrxrrfx.exe 44 PID 2308 wrote to memory of 2428 2308 3lllrxl.exe 45 PID 2308 wrote to memory of 2428 2308 3lllrxl.exe 45 PID 2308 wrote to memory of 2428 2308 3lllrxl.exe 45 PID 2308 wrote to memory of 2428 2308 3lllrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0c97b2042bd766208b674622fdb9270N.exe"C:\Users\Admin\AppData\Local\Temp\c0c97b2042bd766208b674622fdb9270N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jdjjp.exec:\jdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pjdjd.exec:\pjdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\thtnbh.exec:\thtnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rlfffxl.exec:\rlfffxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7xlrffl.exec:\7xlrffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xrrrfrl.exec:\xrrrfrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\hbbtbb.exec:\hbbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\1ddjd.exec:\1ddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\vjdpp.exec:\vjdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\xrfflrf.exec:\xrfflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\btnthh.exec:\btnthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ppdvv.exec:\ppdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\3lllrxl.exec:\3lllrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\bhbtth.exec:\bhbtth.exe17⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5jdjp.exec:\5jdjp.exe18⤵
- Executes dropped EXE
PID:1988 -
\??\c:\llffllx.exec:\llffllx.exe19⤵
- Executes dropped EXE
PID:1432 -
\??\c:\9rfrffl.exec:\9rfrffl.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jpdvp.exec:\jpdvp.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jjvpd.exec:\jjvpd.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxflfrl.exec:\rxflfrl.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhbhth.exec:\nhbhth.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tnbhht.exec:\tnbhht.exe25⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vpdvj.exec:\vpdvj.exe26⤵
- Executes dropped EXE
PID:836 -
\??\c:\ffxrfrl.exec:\ffxrfrl.exe27⤵
- Executes dropped EXE
PID:904 -
\??\c:\rflrffr.exec:\rflrffr.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\hthntt.exec:\hthntt.exe29⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jjvdj.exec:\jjvdj.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1lxlllr.exec:\1lxlllr.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hnhtbb.exec:\hnhtbb.exe32⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jdjvj.exec:\jdjvj.exe33⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdpvp.exec:\jdpvp.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1fxrlrr.exec:\1fxrlrr.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hbbhbb.exec:\hbbhbb.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1tbnbb.exec:\1tbnbb.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1vpvv.exec:\1vpvv.exe38⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vjddp.exec:\vjddp.exe39⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xrrxxlr.exec:\xrrxxlr.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bbhbtb.exec:\bbhbtb.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\thbhtn.exec:\thbhtn.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jvdpj.exec:\jvdpj.exe43⤵
- Executes dropped EXE
PID:608 -
\??\c:\xxrlrrf.exec:\xxrlrrf.exe44⤵
- Executes dropped EXE
PID:992 -
\??\c:\xrfxlfl.exec:\xrfxlfl.exe45⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tbbhhb.exec:\tbbhhb.exe46⤵
- Executes dropped EXE
PID:1040 -
\??\c:\dvvdv.exec:\dvvdv.exe47⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jvpdd.exec:\jvpdd.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lxrrxfl.exec:\lxrrxfl.exe49⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9hbhnn.exec:\9hbhnn.exe50⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nbnbhb.exec:\nbnbhb.exe51⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dpjdd.exec:\dpjdd.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vdpjj.exec:\vdpjj.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe54⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ththnt.exec:\ththnt.exe55⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3nhhtt.exec:\3nhhtt.exe56⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9pjpj.exec:\9pjpj.exe57⤵
- Executes dropped EXE
PID:784 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe58⤵
- Executes dropped EXE
PID:532 -
\??\c:\3xffxxf.exec:\3xffxxf.exe59⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thtbbh.exec:\thtbbh.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\hhnhbt.exec:\hhnhbt.exe61⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5vjjj.exec:\5vjjj.exe62⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1vpdp.exec:\1vpdp.exe63⤵
- Executes dropped EXE
PID:2540 -
\??\c:\1frrxxf.exec:\1frrxxf.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\htbbnn.exec:\htbbnn.exe65⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bnbnbn.exec:\bnbnbn.exe66⤵PID:964
-
\??\c:\ppppv.exec:\ppppv.exe67⤵PID:2272
-
\??\c:\1vvjv.exec:\1vvjv.exe68⤵PID:1672
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe69⤵PID:3008
-
\??\c:\fxrflfl.exec:\fxrflfl.exe70⤵PID:844
-
\??\c:\tttthh.exec:\tttthh.exe71⤵PID:1636
-
\??\c:\bnbbbh.exec:\bnbbbh.exe72⤵PID:1736
-
\??\c:\jjvdp.exec:\jjvdp.exe73⤵PID:3000
-
\??\c:\pvdvv.exec:\pvdvv.exe74⤵PID:2464
-
\??\c:\vdjdj.exec:\vdjdj.exe75⤵PID:2520
-
\??\c:\lxffxrr.exec:\lxffxrr.exe76⤵PID:2648
-
\??\c:\tttntt.exec:\tttntt.exe77⤵PID:2800
-
\??\c:\dvjdj.exec:\dvjdj.exe78⤵PID:2760
-
\??\c:\pjpvv.exec:\pjpvv.exe79⤵PID:3048
-
\??\c:\5rrxlfr.exec:\5rrxlfr.exe80⤵PID:2796
-
\??\c:\fxrflrr.exec:\fxrflrr.exe81⤵PID:2656
-
\??\c:\bnnntb.exec:\bnnntb.exe82⤵PID:1508
-
\??\c:\jdpjp.exec:\jdpjp.exe83⤵PID:2968
-
\??\c:\fxlrffl.exec:\fxlrffl.exe84⤵PID:2600
-
\??\c:\bbnbbn.exec:\bbnbbn.exe85⤵PID:2632
-
\??\c:\bbtnbt.exec:\bbtnbt.exe86⤵PID:2608
-
\??\c:\dvjvv.exec:\dvjvv.exe87⤵PID:992
-
\??\c:\7vpvd.exec:\7vpvd.exe88⤵PID:1756
-
\??\c:\rfffxrf.exec:\rfffxrf.exe89⤵PID:2140
-
\??\c:\thnthh.exec:\thnthh.exe90⤵PID:2192
-
\??\c:\bnbhnt.exec:\bnbhnt.exe91⤵PID:2448
-
\??\c:\jvppj.exec:\jvppj.exe92⤵PID:1892
-
\??\c:\jvjjp.exec:\jvjjp.exe93⤵PID:1544
-
\??\c:\frfxlll.exec:\frfxlll.exe94⤵PID:2544
-
\??\c:\frllrlx.exec:\frllrlx.exe95⤵PID:2528
-
\??\c:\tnbhnn.exec:\tnbhnn.exe96⤵PID:1960
-
\??\c:\dpddd.exec:\dpddd.exe97⤵PID:2412
-
\??\c:\3vjvd.exec:\3vjvd.exe98⤵PID:1988
-
\??\c:\5dpvv.exec:\5dpvv.exe99⤵PID:1932
-
\??\c:\7rlllrx.exec:\7rlllrx.exe100⤵PID:1432
-
\??\c:\1flrrfx.exec:\1flrrfx.exe101⤵PID:772
-
\??\c:\ttnnbh.exec:\ttnnbh.exe102⤵PID:2472
-
\??\c:\pjppv.exec:\pjppv.exe103⤵PID:1032
-
\??\c:\jdvvj.exec:\jdvvj.exe104⤵PID:2208
-
\??\c:\xlfrrxr.exec:\xlfrrxr.exe105⤵PID:2124
-
\??\c:\xlfrflr.exec:\xlfrflr.exe106⤵PID:1276
-
\??\c:\bnbhhh.exec:\bnbhhh.exe107⤵PID:2112
-
\??\c:\3tthnn.exec:\3tthnn.exe108⤵PID:2288
-
\??\c:\rrlflfl.exec:\rrlflfl.exe109⤵PID:2108
-
\??\c:\bbbtbn.exec:\bbbtbn.exe110⤵PID:916
-
\??\c:\tnbtnh.exec:\tnbtnh.exe111⤵PID:2132
-
\??\c:\pjvdd.exec:\pjvdd.exe112⤵PID:2640
-
\??\c:\rffllrf.exec:\rffllrf.exe113⤵PID:2128
-
\??\c:\xllrfxf.exec:\xllrfxf.exe114⤵PID:2304
-
\??\c:\1bnthn.exec:\1bnthn.exe115⤵PID:1928
-
\??\c:\5nbnnb.exec:\5nbnnb.exe116⤵PID:1264
-
\??\c:\3jdvp.exec:\3jdvp.exe117⤵PID:2660
-
\??\c:\jvjpv.exec:\jvjpv.exe118⤵PID:2664
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe119⤵PID:2268
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe120⤵PID:2776
-
\??\c:\5tnbnb.exec:\5tnbnb.exe121⤵PID:2700
-
\??\c:\bnhnnn.exec:\bnhnnn.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-