Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 02:22
Behavioral task
behavioral1
Sample
7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe
-
Size
332KB
-
MD5
fac546db22fedbc7d6c456f54247da80
-
SHA1
56b941b3e06472faad476bd0573620e7b7d83615
-
SHA256
7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6
-
SHA512
9a23e184233a2a00dbc925d395f6533d8e5f6989e350e142bb1237d98c849ccf9e5dc1d805d463a0c0b75cbfc09f7656caf773139c852393a5bcccc14b5ea321
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeU:R4wFHoSHYHUrAwfMp3CDU
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2584-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1384-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/576-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-115-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1332-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-204-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/852-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-233-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1624-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-278-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1640-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-392-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-447-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1764-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-508-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-587-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2968-595-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-625-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1800-676-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2720-684-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/636-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-746-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2156-748-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-7360-0x0000000077AA0000-0x0000000077BBF000-memory.dmp family_blackmoon behavioral1/memory/1728-9384-0x0000000077AA0000-0x0000000077BBF000-memory.dmp family_blackmoon behavioral1/memory/1728-17294-0x0000000077AA0000-0x0000000077BBF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1836 hbbhtb.exe 1384 vvjjv.exe 2372 ffrrxrf.exe 2968 ntbhhn.exe 576 7rflrfl.exe 2824 9htbbh.exe 2724 vpdjp.exe 2832 5xrrxfl.exe 2640 lfrxllx.exe 2784 djvvj.exe 2644 ffxrfrf.exe 3060 jdpvv.exe 1332 9lxxxxf.exe 1304 htbbnn.exe 1224 pjdpv.exe 2872 xlxfflx.exe 2920 btnthh.exe 1716 vvvdd.exe 1732 5rxrrfl.exe 2124 nnbbnn.exe 1804 3vvpv.exe 2560 lfrrlfl.exe 2952 5bnnhb.exe 1328 xxxxfxf.exe 852 nhtbhh.exe 1928 lfrlrrf.exe 2040 xlxlrrx.exe 560 7thhhb.exe 324 1vjjp.exe 2060 1nhnth.exe 2328 btnhnh.exe 1624 9fxxffr.exe 2472 xrxxfxf.exe 1640 bnbhtt.exe 2348 5pvpj.exe 2108 frllrrl.exe 1588 xxxfxfx.exe 1620 bthhtt.exe 2552 pdppj.exe 2372 dvpjj.exe 2520 rlfrxfl.exe 2748 nbhbbn.exe 576 nhbnbn.exe 2988 dvjpv.exe 2620 3jdpd.exe 2780 rxfrflx.exe 2864 tnthnn.exe 2220 tbhbht.exe 2608 dvdjp.exe 2784 flrlxxf.exe 1172 frflrrx.exe 3068 tbtnhh.exe 2840 pdjvd.exe 1792 3jdvv.exe 2716 rllxlxr.exe 872 3ffffll.exe 988 7nbhnt.exe 2796 5nbthb.exe 2916 vpdvp.exe 2432 rlfllrx.exe 1212 llfxlxr.exe 1076 7bhhtt.exe 2200 tnbbhb.exe 2496 vpddv.exe -
resource yara_rule behavioral1/memory/2584-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012119-5.dat upx behavioral1/memory/1836-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1384-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d41-16.dat upx behavioral1/memory/1836-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d59-24.dat upx behavioral1/memory/2968-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d81-31.dat upx behavioral1/files/0x0007000000015f71-39.dat upx behavioral1/files/0x0007000000015ff5-46.dat upx behavioral1/memory/576-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016101-56.dat upx behavioral1/memory/2824-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016241-66.dat upx behavioral1/files/0x0006000000016d36-74.dat upx behavioral1/memory/2832-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3f-82.dat upx behavioral1/memory/2640-81-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2640-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d47-91.dat upx behavioral1/memory/2644-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4f-99.dat upx behavioral1/files/0x0006000000016d63-108.dat upx behavioral1/memory/3060-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d69-116.dat upx behavioral1/memory/1304-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6d-126.dat upx behavioral1/memory/1304-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d72-134.dat upx behavioral1/memory/2872-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1224-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd9-144.dat upx behavioral1/memory/2872-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1716-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016de0-154.dat upx behavioral1/files/0x0006000000016dea-161.dat upx behavioral1/memory/1732-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016eb4-170.dat upx behavioral1/memory/2124-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017047-179.dat upx behavioral1/memory/2124-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d0e-186.dat upx behavioral1/memory/2560-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001743a-195.dat upx behavioral1/memory/2952-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-194-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000600000001747d-205.dat upx behavioral1/files/0x0006000000017491-212.dat upx behavioral1/memory/852-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175e7-220.dat upx behavioral1/files/0x0006000000018669-228.dat upx behavioral1/files/0x001400000001866f-236.dat upx behavioral1/files/0x0011000000018682-243.dat upx behavioral1/files/0x000500000001868b-250.dat upx behavioral1/files/0x00050000000186f2-258.dat upx behavioral1/files/0x00050000000186f8-265.dat upx behavioral1/memory/1624-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-297-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnthn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1836 2584 7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe 30 PID 2584 wrote to memory of 1836 2584 7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe 30 PID 2584 wrote to memory of 1836 2584 7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe 30 PID 2584 wrote to memory of 1836 2584 7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe 30 PID 1836 wrote to memory of 1384 1836 hbbhtb.exe 31 PID 1836 wrote to memory of 1384 1836 hbbhtb.exe 31 PID 1836 wrote to memory of 1384 1836 hbbhtb.exe 31 PID 1836 wrote to memory of 1384 1836 hbbhtb.exe 31 PID 1384 wrote to memory of 2372 1384 vvjjv.exe 32 PID 1384 wrote to memory of 2372 1384 vvjjv.exe 32 PID 1384 wrote to memory of 2372 1384 vvjjv.exe 32 PID 1384 wrote to memory of 2372 1384 vvjjv.exe 32 PID 2372 wrote to memory of 2968 2372 ffrrxrf.exe 33 PID 2372 wrote to memory of 2968 2372 ffrrxrf.exe 33 PID 2372 wrote to memory of 2968 2372 ffrrxrf.exe 33 PID 2372 wrote to memory of 2968 2372 ffrrxrf.exe 33 PID 2968 wrote to memory of 576 2968 ntbhhn.exe 34 PID 2968 wrote to memory of 576 2968 ntbhhn.exe 34 PID 2968 wrote to memory of 576 2968 ntbhhn.exe 34 PID 2968 wrote to memory of 576 2968 ntbhhn.exe 34 PID 576 wrote to memory of 2824 576 7rflrfl.exe 35 PID 576 wrote to memory of 2824 576 7rflrfl.exe 35 PID 576 wrote to memory of 2824 576 7rflrfl.exe 35 PID 576 wrote to memory of 2824 576 7rflrfl.exe 35 PID 2824 wrote to memory of 2724 2824 9htbbh.exe 36 PID 2824 wrote to memory of 2724 2824 9htbbh.exe 36 PID 2824 wrote to memory of 2724 2824 9htbbh.exe 36 PID 2824 wrote to memory of 2724 2824 9htbbh.exe 36 PID 2724 wrote to memory of 2832 2724 vpdjp.exe 37 PID 2724 wrote to memory of 2832 2724 vpdjp.exe 37 PID 2724 wrote to memory of 2832 2724 vpdjp.exe 37 PID 2724 wrote to memory of 2832 2724 vpdjp.exe 37 PID 2832 wrote to memory of 2640 2832 5xrrxfl.exe 38 PID 2832 wrote to memory of 2640 2832 5xrrxfl.exe 38 PID 2832 wrote to memory of 2640 2832 5xrrxfl.exe 38 PID 2832 wrote to memory of 2640 2832 5xrrxfl.exe 38 PID 2640 wrote to memory of 2784 2640 lfrxllx.exe 39 PID 2640 wrote to memory of 2784 2640 lfrxllx.exe 39 PID 2640 wrote to memory of 2784 2640 lfrxllx.exe 39 PID 2640 wrote to memory of 2784 2640 lfrxllx.exe 39 PID 2784 wrote to memory of 2644 2784 djvvj.exe 40 PID 2784 wrote to memory of 2644 2784 djvvj.exe 40 PID 2784 wrote to memory of 2644 2784 djvvj.exe 40 PID 2784 wrote to memory of 2644 2784 djvvj.exe 40 PID 2644 wrote to memory of 3060 2644 ffxrfrf.exe 41 PID 2644 wrote to memory of 3060 2644 ffxrfrf.exe 41 PID 2644 wrote to memory of 3060 2644 ffxrfrf.exe 41 PID 2644 wrote to memory of 3060 2644 ffxrfrf.exe 41 PID 3060 wrote to memory of 1332 3060 jdpvv.exe 42 PID 3060 wrote to memory of 1332 3060 jdpvv.exe 42 PID 3060 wrote to memory of 1332 3060 jdpvv.exe 42 PID 3060 wrote to memory of 1332 3060 jdpvv.exe 42 PID 1332 wrote to memory of 1304 1332 9lxxxxf.exe 43 PID 1332 wrote to memory of 1304 1332 9lxxxxf.exe 43 PID 1332 wrote to memory of 1304 1332 9lxxxxf.exe 43 PID 1332 wrote to memory of 1304 1332 9lxxxxf.exe 43 PID 1304 wrote to memory of 1224 1304 htbbnn.exe 44 PID 1304 wrote to memory of 1224 1304 htbbnn.exe 44 PID 1304 wrote to memory of 1224 1304 htbbnn.exe 44 PID 1304 wrote to memory of 1224 1304 htbbnn.exe 44 PID 1224 wrote to memory of 2872 1224 pjdpv.exe 45 PID 1224 wrote to memory of 2872 1224 pjdpv.exe 45 PID 1224 wrote to memory of 2872 1224 pjdpv.exe 45 PID 1224 wrote to memory of 2872 1224 pjdpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe"C:\Users\Admin\AppData\Local\Temp\7d0e5df23039eeca9f7e87011593f8ff7cdb2d98ad30c724e586ed35c6918fe6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hbbhtb.exec:\hbbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\vvjjv.exec:\vvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\ffrrxrf.exec:\ffrrxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\ntbhhn.exec:\ntbhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\7rflrfl.exec:\7rflrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\9htbbh.exec:\9htbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vpdjp.exec:\vpdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5xrrxfl.exec:\5xrrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lfrxllx.exec:\lfrxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\djvvj.exec:\djvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\ffxrfrf.exec:\ffxrfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jdpvv.exec:\jdpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\9lxxxxf.exec:\9lxxxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\htbbnn.exec:\htbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\pjdpv.exec:\pjdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\xlxfflx.exec:\xlxfflx.exe17⤵
- Executes dropped EXE
PID:2872 -
\??\c:\btnthh.exec:\btnthh.exe18⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vvvdd.exec:\vvvdd.exe19⤵
- Executes dropped EXE
PID:1716 -
\??\c:\5rxrrfl.exec:\5rxrrfl.exe20⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnbbnn.exec:\nnbbnn.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3vvpv.exec:\3vvpv.exe22⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lfrrlfl.exec:\lfrrlfl.exe23⤵
- Executes dropped EXE
PID:2560 -
\??\c:\5bnnhb.exec:\5bnnhb.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xxxxfxf.exec:\xxxxfxf.exe25⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nhtbhh.exec:\nhtbhh.exe26⤵
- Executes dropped EXE
PID:852 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe27⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xlxlrrx.exec:\xlxlrrx.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7thhhb.exec:\7thhhb.exe29⤵
- Executes dropped EXE
PID:560 -
\??\c:\1vjjp.exec:\1vjjp.exe30⤵
- Executes dropped EXE
PID:324 -
\??\c:\1nhnth.exec:\1nhnth.exe31⤵
- Executes dropped EXE
PID:2060 -
\??\c:\btnhnh.exec:\btnhnh.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9fxxffr.exec:\9fxxffr.exe33⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrxxfxf.exec:\xrxxfxf.exe34⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bnbhtt.exec:\bnbhtt.exe35⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5pvpj.exec:\5pvpj.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\frllrrl.exec:\frllrrl.exe37⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bthhtt.exec:\bthhtt.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pdppj.exec:\pdppj.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvpjj.exec:\dvpjj.exe41⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nbhbbn.exec:\nbhbbn.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\nhbnbn.exec:\nhbnbn.exe44⤵
- Executes dropped EXE
PID:576 -
\??\c:\dvjpv.exec:\dvjpv.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3jdpd.exec:\3jdpd.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rxfrflx.exec:\rxfrflx.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnthnn.exec:\tnthnn.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\tbhbht.exec:\tbhbht.exe49⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvdjp.exec:\dvdjp.exe50⤵
- Executes dropped EXE
PID:2608 -
\??\c:\flrlxxf.exec:\flrlxxf.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\frflrrx.exec:\frflrrx.exe52⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tbtnhh.exec:\tbtnhh.exe53⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pdjvd.exec:\pdjvd.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3jdvv.exec:\3jdvv.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rllxlxr.exec:\rllxlxr.exe56⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3ffffll.exec:\3ffffll.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\7nbhnt.exec:\7nbhnt.exe58⤵
- Executes dropped EXE
PID:988 -
\??\c:\5nbthb.exec:\5nbthb.exe59⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpdvp.exec:\vpdvp.exe60⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlfllrx.exec:\rlfllrx.exe61⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llfxlxr.exec:\llfxlxr.exe62⤵
- Executes dropped EXE
PID:1212 -
\??\c:\7bhhtt.exec:\7bhhtt.exe63⤵
- Executes dropped EXE
PID:1076 -
\??\c:\tnbbhb.exec:\tnbbhb.exe64⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vpddv.exec:\vpddv.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vdjpp.exec:\vdjpp.exe66⤵PID:2120
-
\??\c:\7lfxxfl.exec:\7lfxxfl.exe67⤵PID:2548
-
\??\c:\hbthnn.exec:\hbthnn.exe68⤵PID:2160
-
\??\c:\ppjvj.exec:\ppjvj.exe69⤵PID:776
-
\??\c:\pvvjp.exec:\pvvjp.exe70⤵PID:956
-
\??\c:\rrrlffx.exec:\rrrlffx.exe71⤵PID:704
-
\??\c:\5lxxrrf.exec:\5lxxrrf.exe72⤵PID:1820
-
\??\c:\bbnnbn.exec:\bbnnbn.exe73⤵PID:2376
-
\??\c:\hbhhbb.exec:\hbhhbb.exe74⤵PID:1388
-
\??\c:\dvjjj.exec:\dvjjj.exe75⤵PID:1764
-
\??\c:\xrflrrf.exec:\xrflrrf.exe76⤵PID:2040
-
\??\c:\xrlrffr.exec:\xrlrffr.exe77⤵PID:1936
-
\??\c:\thtntt.exec:\thtntt.exe78⤵PID:2352
-
\??\c:\5pdjd.exec:\5pdjd.exe79⤵PID:2060
-
\??\c:\3djdj.exec:\3djdj.exe80⤵PID:1276
-
\??\c:\ffxllxl.exec:\ffxllxl.exe81⤵PID:1632
-
\??\c:\9rflrrx.exec:\9rflrrx.exe82⤵PID:1736
-
\??\c:\1thbbb.exec:\1thbbb.exe83⤵PID:2472
-
\??\c:\pjvvj.exec:\pjvvj.exe84⤵PID:1596
-
\??\c:\5dppv.exec:\5dppv.exe85⤵PID:2404
-
\??\c:\xfxfrff.exec:\xfxfrff.exe86⤵PID:1592
-
\??\c:\xxrxxfl.exec:\xxrxxfl.exe87⤵PID:1280
-
\??\c:\tnbttt.exec:\tnbttt.exe88⤵PID:1384
-
\??\c:\ppddd.exec:\ppddd.exe89⤵PID:1696
-
\??\c:\pjvjd.exec:\pjvjd.exe90⤵PID:2900
-
\??\c:\ffrffxf.exec:\ffrffxf.exe91⤵PID:2968
-
\??\c:\rfrrrlx.exec:\rfrrrlx.exe92⤵PID:2860
-
\??\c:\tnhhnt.exec:\tnhhnt.exe93⤵PID:2824
-
\??\c:\vjjjj.exec:\vjjjj.exe94⤵PID:2776
-
\??\c:\5vpdp.exec:\5vpdp.exe95⤵PID:2736
-
\??\c:\llllxfl.exec:\llllxfl.exe96⤵PID:2844
-
\??\c:\llflxfr.exec:\llflxfr.exe97⤵PID:2792
-
\??\c:\5nbnnh.exec:\5nbnnh.exe98⤵PID:2640
-
\??\c:\jdjjv.exec:\jdjjv.exe99⤵PID:2608
-
\??\c:\dvddj.exec:\dvddj.exe100⤵PID:2680
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe101⤵PID:2884
-
\??\c:\rlffrlx.exec:\rlffrlx.exe102⤵PID:1084
-
\??\c:\bnhhnn.exec:\bnhhnn.exe103⤵PID:2324
-
\??\c:\vpjjj.exec:\vpjjj.exe104⤵PID:1260
-
\??\c:\pjpvj.exec:\pjpvj.exe105⤵PID:1800
-
\??\c:\rfxfrrf.exec:\rfxfrrf.exe106⤵PID:900
-
\??\c:\nhtbnh.exec:\nhtbnh.exe107⤵PID:2720
-
\??\c:\9htntb.exec:\9htntb.exe108⤵PID:636
-
\??\c:\jvddj.exec:\jvddj.exe109⤵PID:340
-
\??\c:\pjpvj.exec:\pjpvj.exe110⤵PID:2136
-
\??\c:\lfxrxfr.exec:\lfxrxfr.exe111⤵PID:2204
-
\??\c:\1rxxlrf.exec:\1rxxlrf.exe112⤵PID:2260
-
\??\c:\bbtbnh.exec:\bbtbnh.exe113⤵PID:2272
-
\??\c:\vpvvv.exec:\vpvvv.exe114⤵PID:2492
-
\??\c:\pdvdj.exec:\pdvdj.exe115⤵PID:2156
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe116⤵PID:1508
-
\??\c:\xlrlxfl.exec:\xlrlxfl.exe117⤵PID:1528
-
\??\c:\nnbhhh.exec:\nnbhhh.exe118⤵PID:2952
-
\??\c:\htbhhn.exec:\htbhhn.exe119⤵PID:2448
-
\??\c:\vvppd.exec:\vvppd.exe120⤵PID:2096
-
\??\c:\ffllllr.exec:\ffllllr.exe121⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-