Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-10-2024 06:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe
-
Size
332KB
-
MD5
2aeeefeadf5037a74f1c550df65c73d0
-
SHA1
d9e3d971c406b56a538a79aac5acdc56ebf8b167
-
SHA256
0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4
-
SHA512
7fef9665fa3a3070f37fcead438ad08ee4793c35a5bf2b94750d512e9f9f75cbf5af7240cb8746ffb486cf67ead461fa9fef69d8f4d5c00fd15aee4e01aaeda5
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhQ:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTg
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2276-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-85-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-143-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1276-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2144-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-247-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/848-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-263-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1756-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-378-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2684-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-396-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2592-402-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-411-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2792-410-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-427-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-507-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2760-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-514-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1528-560-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1976-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-685-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-699-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1268 jdppv.exe 1804 lfrfxxl.exe 1440 5fxrxxr.exe 2500 vpdjj.exe 2864 fxlrfxf.exe 2720 bthhtt.exe 2964 5pdpv.exe 2732 xlrffxr.exe 2660 3hbhhn.exe 2796 5lrxrxr.exe 2604 tnbbhh.exe 2616 jvjpp.exe 2116 vpjvj.exe 2016 jvdjp.exe 2032 frllrrr.exe 1276 1rllrrf.exe 1608 tnhthb.exe 1956 frxrxfr.exe 2904 btntbh.exe 3032 xrfrxfl.exe 2228 bbhthh.exe 2144 7jpvd.exe 608 lxffflr.exe 1684 1pjjp.exe 1940 3xlrxfl.exe 848 fxlrxfx.exe 1360 pjjpd.exe 1032 dvpdj.exe 2432 7fflffl.exe 2404 nhbhnb.exe 1756 xxfrlrl.exe 984 frlxlxr.exe 1976 9httbb.exe 1692 pjdvj.exe 2212 lxllxfl.exe 1980 xffrffx.exe 2508 jdpvp.exe 2496 5pdvp.exe 2196 rlffflr.exe 2720 lxrrrll.exe 2704 btnttb.exe 2860 9dddj.exe 2792 rfrxxxf.exe 2684 lxffffl.exe 2592 nhttbh.exe 2584 7jjvd.exe 3048 xlxrxfx.exe 1500 rflflfl.exe 2380 tthhnt.exe 396 jjddj.exe 1204 rlllrfl.exe 1712 lrxllll.exe 1432 3nhtbh.exe 1148 3dpvv.exe 2672 9dddj.exe 1668 frlxffl.exe 3036 bnhtnb.exe 2220 ttbhbb.exe 3040 dvjpd.exe 2760 xxlllff.exe 1356 9xlrfrf.exe 2544 1nhnnt.exe 1684 thtbnh.exe 1940 1pjjj.exe -
resource yara_rule behavioral1/memory/2276-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-85-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2796-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-159-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1276-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-546-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2432-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-607-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2652-614-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2704-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-672-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 1268 2276 0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe 30 PID 2276 wrote to memory of 1268 2276 0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe 30 PID 2276 wrote to memory of 1268 2276 0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe 30 PID 2276 wrote to memory of 1268 2276 0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe 30 PID 1268 wrote to memory of 1804 1268 jdppv.exe 31 PID 1268 wrote to memory of 1804 1268 jdppv.exe 31 PID 1268 wrote to memory of 1804 1268 jdppv.exe 31 PID 1268 wrote to memory of 1804 1268 jdppv.exe 31 PID 1804 wrote to memory of 1440 1804 lfrfxxl.exe 32 PID 1804 wrote to memory of 1440 1804 lfrfxxl.exe 32 PID 1804 wrote to memory of 1440 1804 lfrfxxl.exe 32 PID 1804 wrote to memory of 1440 1804 lfrfxxl.exe 32 PID 1440 wrote to memory of 2500 1440 5fxrxxr.exe 33 PID 1440 wrote to memory of 2500 1440 5fxrxxr.exe 33 PID 1440 wrote to memory of 2500 1440 5fxrxxr.exe 33 PID 1440 wrote to memory of 2500 1440 5fxrxxr.exe 33 PID 2500 wrote to memory of 2864 2500 vpdjj.exe 34 PID 2500 wrote to memory of 2864 2500 vpdjj.exe 34 PID 2500 wrote to memory of 2864 2500 vpdjj.exe 34 PID 2500 wrote to memory of 2864 2500 vpdjj.exe 34 PID 2864 wrote to memory of 2720 2864 fxlrfxf.exe 35 PID 2864 wrote to memory of 2720 2864 fxlrfxf.exe 35 PID 2864 wrote to memory of 2720 2864 fxlrfxf.exe 35 PID 2864 wrote to memory of 2720 2864 fxlrfxf.exe 35 PID 2720 wrote to memory of 2964 2720 bthhtt.exe 36 PID 2720 wrote to memory of 2964 2720 bthhtt.exe 36 PID 2720 wrote to memory of 2964 2720 bthhtt.exe 36 PID 2720 wrote to memory of 2964 2720 bthhtt.exe 36 PID 2964 wrote to memory of 2732 2964 5pdpv.exe 37 PID 2964 wrote to memory of 2732 2964 5pdpv.exe 37 PID 2964 wrote to memory of 2732 2964 5pdpv.exe 37 PID 2964 wrote to memory of 2732 2964 5pdpv.exe 37 PID 2732 wrote to memory of 2660 2732 xlrffxr.exe 38 PID 2732 wrote to memory of 2660 2732 xlrffxr.exe 38 PID 2732 wrote to memory of 2660 2732 xlrffxr.exe 38 PID 2732 wrote to memory of 2660 2732 xlrffxr.exe 38 PID 2660 wrote to memory of 2796 2660 3hbhhn.exe 39 PID 2660 wrote to memory of 2796 2660 3hbhhn.exe 39 PID 2660 wrote to memory of 2796 2660 3hbhhn.exe 39 PID 2660 wrote to memory of 2796 2660 3hbhhn.exe 39 PID 2796 wrote to memory of 2604 2796 5lrxrxr.exe 40 PID 2796 wrote to memory of 2604 2796 5lrxrxr.exe 40 PID 2796 wrote to memory of 2604 2796 5lrxrxr.exe 40 PID 2796 wrote to memory of 2604 2796 5lrxrxr.exe 40 PID 2604 wrote to memory of 2616 2604 tnbbhh.exe 41 PID 2604 wrote to memory of 2616 2604 tnbbhh.exe 41 PID 2604 wrote to memory of 2616 2604 tnbbhh.exe 41 PID 2604 wrote to memory of 2616 2604 tnbbhh.exe 41 PID 2616 wrote to memory of 2116 2616 jvjpp.exe 42 PID 2616 wrote to memory of 2116 2616 jvjpp.exe 42 PID 2616 wrote to memory of 2116 2616 jvjpp.exe 42 PID 2616 wrote to memory of 2116 2616 jvjpp.exe 42 PID 2116 wrote to memory of 2016 2116 vpjvj.exe 43 PID 2116 wrote to memory of 2016 2116 vpjvj.exe 43 PID 2116 wrote to memory of 2016 2116 vpjvj.exe 43 PID 2116 wrote to memory of 2016 2116 vpjvj.exe 43 PID 2016 wrote to memory of 2032 2016 jvdjp.exe 44 PID 2016 wrote to memory of 2032 2016 jvdjp.exe 44 PID 2016 wrote to memory of 2032 2016 jvdjp.exe 44 PID 2016 wrote to memory of 2032 2016 jvdjp.exe 44 PID 2032 wrote to memory of 1276 2032 frllrrr.exe 45 PID 2032 wrote to memory of 1276 2032 frllrrr.exe 45 PID 2032 wrote to memory of 1276 2032 frllrrr.exe 45 PID 2032 wrote to memory of 1276 2032 frllrrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe"C:\Users\Admin\AppData\Local\Temp\0f69373643b345c714492d31904e72a0e3cfb052fa4ae1f8718369d44e1e0ef4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jdppv.exec:\jdppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\lfrfxxl.exec:\lfrfxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\5fxrxxr.exec:\5fxrxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\vpdjj.exec:\vpdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bthhtt.exec:\bthhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\5pdpv.exec:\5pdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xlrffxr.exec:\xlrffxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3hbhhn.exec:\3hbhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\5lrxrxr.exec:\5lrxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tnbbhh.exec:\tnbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jvjpp.exec:\jvjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vpjvj.exec:\vpjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jvdjp.exec:\jvdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\frllrrr.exec:\frllrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\1rllrrf.exec:\1rllrrf.exe17⤵
- Executes dropped EXE
PID:1276 -
\??\c:\tnhthb.exec:\tnhthb.exe18⤵
- Executes dropped EXE
PID:1608 -
\??\c:\frxrxfr.exec:\frxrxfr.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\btntbh.exec:\btntbh.exe20⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe21⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bbhthh.exec:\bbhthh.exe22⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7jpvd.exec:\7jpvd.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lxffflr.exec:\lxffflr.exe24⤵
- Executes dropped EXE
PID:608 -
\??\c:\1pjjp.exec:\1pjjp.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\3xlrxfl.exec:\3xlrxfl.exe26⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe27⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjjpd.exec:\pjjpd.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\dvpdj.exec:\dvpdj.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\7fflffl.exec:\7fflffl.exe30⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nhbhnb.exec:\nhbhnb.exe31⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xxfrlrl.exec:\xxfrlrl.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\frlxlxr.exec:\frlxlxr.exe33⤵
- Executes dropped EXE
PID:984 -
\??\c:\9httbb.exec:\9httbb.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjdvj.exec:\pjdvj.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lxllxfl.exec:\lxllxfl.exe36⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xffrffx.exec:\xffrffx.exe37⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jdpvp.exec:\jdpvp.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5pdvp.exec:\5pdvp.exe39⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rlffflr.exec:\rlffflr.exe40⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lxrrrll.exec:\lxrrrll.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\btnttb.exec:\btnttb.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9dddj.exec:\9dddj.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lxffffl.exec:\lxffffl.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhttbh.exec:\nhttbh.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\7jjvd.exec:\7jjvd.exe47⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xlxrxfx.exec:\xlxrxfx.exe48⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rflflfl.exec:\rflflfl.exe49⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tthhnt.exec:\tthhnt.exe50⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jjddj.exec:\jjddj.exe51⤵
- Executes dropped EXE
PID:396 -
\??\c:\rlllrfl.exec:\rlllrfl.exe52⤵
- Executes dropped EXE
PID:1204 -
\??\c:\lrxllll.exec:\lrxllll.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\3nhtbh.exec:\3nhtbh.exe54⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3dpvv.exec:\3dpvv.exe55⤵
- Executes dropped EXE
PID:1148 -
\??\c:\9dddj.exec:\9dddj.exe56⤵
- Executes dropped EXE
PID:2672 -
\??\c:\frlxffl.exec:\frlxffl.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnhtnb.exec:\bnhtnb.exe58⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ttbhbb.exec:\ttbhbb.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvjpd.exec:\dvjpd.exe60⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xxlllff.exec:\xxlllff.exe61⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9xlrfrf.exec:\9xlrfrf.exe62⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1nhnnt.exec:\1nhnnt.exe63⤵
- Executes dropped EXE
PID:2544 -
\??\c:\thtbnh.exec:\thtbnh.exe64⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1pjjj.exec:\1pjjj.exe65⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5xfrrrx.exec:\5xfrrrx.exe66⤵PID:1528
-
\??\c:\xffrxxx.exec:\xffrxxx.exe67⤵PID:2136
-
\??\c:\thttbb.exec:\thttbb.exe68⤵PID:2176
-
\??\c:\7jvpj.exec:\7jvpj.exe69⤵PID:2352
-
\??\c:\dpdvv.exec:\dpdvv.exe70⤵PID:2432
-
\??\c:\xllrrrf.exec:\xllrrrf.exe71⤵PID:952
-
\??\c:\nbbthb.exec:\nbbthb.exe72⤵PID:2320
-
\??\c:\vddvd.exec:\vddvd.exe73⤵PID:2372
-
\??\c:\vjvvd.exec:\vjvvd.exe74⤵PID:2100
-
\??\c:\9rxrlrr.exec:\9rxrlrr.exe75⤵PID:1976
-
\??\c:\rlxflfl.exec:\rlxflfl.exe76⤵PID:2656
-
\??\c:\7bntbt.exec:\7bntbt.exe77⤵PID:2652
-
\??\c:\jvjjj.exec:\jvjjj.exe78⤵PID:1440
-
\??\c:\9pddd.exec:\9pddd.exe79⤵PID:844
-
\??\c:\frxxrrx.exec:\frxxrrx.exe80⤵PID:2184
-
\??\c:\rfllrxx.exec:\rfllrxx.exe81⤵PID:2780
-
\??\c:\tthnbn.exec:\tthnbn.exe82⤵PID:2956
-
\??\c:\7ntnhb.exec:\7ntnhb.exe83⤵PID:2852
-
\??\c:\5dvjp.exec:\5dvjp.exe84⤵PID:2704
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe85⤵PID:2860
-
\??\c:\nnbhbn.exec:\nnbhbn.exe86⤵PID:2792
-
\??\c:\hnnhtt.exec:\hnnhtt.exe87⤵PID:2596
-
\??\c:\ddpvv.exec:\ddpvv.exe88⤵PID:2364
-
\??\c:\7jvpv.exec:\7jvpv.exe89⤵PID:3064
-
\??\c:\frrrxxx.exec:\frrrxxx.exe90⤵PID:2044
-
\??\c:\xlffrxx.exec:\xlffrxx.exe91⤵PID:1296
-
\??\c:\9hhbbh.exec:\9hhbbh.exe92⤵PID:1500
-
\??\c:\jdvvv.exec:\jdvvv.exe93⤵PID:2384
-
\??\c:\vjvdd.exec:\vjvdd.exe94⤵PID:1992
-
\??\c:\xrfrffl.exec:\xrfrffl.exe95⤵PID:1696
-
\??\c:\frflxrl.exec:\frflxrl.exe96⤵PID:1144
-
\??\c:\7nthhb.exec:\7nthhb.exe97⤵PID:572
-
\??\c:\htbbhn.exec:\htbbhn.exe98⤵PID:2920
-
\??\c:\5vdvv.exec:\5vdvv.exe99⤵PID:2560
-
\??\c:\jdppd.exec:\jdppd.exe100⤵PID:2272
-
\??\c:\lxllllr.exec:\lxllllr.exe101⤵PID:2932
-
\??\c:\hthhbt.exec:\hthhbt.exe102⤵PID:1308
-
\??\c:\nbhhhn.exec:\nbhhhn.exe103⤵PID:1476
-
\??\c:\jdpdv.exec:\jdpdv.exe104⤵PID:1604
-
\??\c:\9vjdj.exec:\9vjdj.exe105⤵PID:1860
-
\??\c:\5xlfxfl.exec:\5xlfxfl.exe106⤵PID:1728
-
\??\c:\rffxxxx.exec:\rffxxxx.exe107⤵PID:908
-
\??\c:\nhtbbt.exec:\nhtbbt.exe108⤵PID:848
-
\??\c:\3pvvv.exec:\3pvvv.exe109⤵PID:1660
-
\??\c:\djppv.exec:\djppv.exe110⤵PID:1896
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe111⤵PID:1636
-
\??\c:\rllflxx.exec:\rllflxx.exe112⤵PID:756
-
\??\c:\hthhnh.exec:\hthhnh.exe113⤵PID:880
-
\??\c:\nhhhbh.exec:\nhhhbh.exe114⤵PID:1960
-
\??\c:\5ppjj.exec:\5ppjj.exe115⤵PID:1268
-
\??\c:\lfrlrlx.exec:\lfrlrlx.exe116⤵PID:2940
-
\??\c:\9rllrxx.exec:\9rllrxx.exe117⤵PID:1700
-
\??\c:\bnhhhh.exec:\bnhhhh.exe118⤵PID:2008
-
\??\c:\7btttn.exec:\7btttn.exe119⤵PID:2112
-
\??\c:\vjpvj.exec:\vjpvj.exe120⤵PID:776
-
\??\c:\xllrlrf.exec:\xllrlrf.exe121⤵PID:2508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-