Analysis
- max time kernel
120s - max time network
117s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
17/10/2024, 10:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
- Target df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe
- Size 452KB
- Sample241017-l9vk2sshqe
- SHA256 df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15f
- MD5 3dd230d8ebfb75f8f51ce44586b59180
- SHA1 3e2690ea2996372951f3e05d2b760eb96a8711f2
- SHA512 16a75d590875602b77da6c57a87863fcf36dbb6ea623971d6d776602fd5dc4956c655ff18e4661ff803a2e50d86671d4c9deeb5041085ec7dd132e4b0dd3189b
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2576-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-51-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2736-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-53-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2800-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-71-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-202-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-200-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-235-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2080-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-278-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/264-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-391-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-412-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-442-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-507-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-570-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-643-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2956-656-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1876 tnhttb.exe 2456 ppdjv.exe 2892 jvvvd.exe 2996 hbntbb.exe 2868 nbttbb.exe 2736 5pddj.exe 2800 pjppv.exe 2656 pdjvp.exe 2624 xrxlrxr.exe 2228 pjppp.exe 556 7rlxllr.exe 1112 9flfrxx.exe 1072 vpddp.exe 2856 lxfxlrf.exe 1432 tnbbhn.exe 2920 tnhhtb.exe 1688 pdppp.exe 1488 xrffrxl.exe 2220 vpdvj.exe 2332 5dvvd.exe 2544 tnhnhh.exe 2192 5vjjp.exe 2184 tnhnbb.exe 2804 tnnbtt.exe 1900 pdpvj.exe 1452 9lffxff.exe 2080 vvdvd.exe 1364 3jjjp.exe 1552 9frxfxf.exe 2584 1lxffff.exe 972 jdvpd.exe 264 dpdjj.exe 1924 pppdd.exe 2844 rrfrrxx.exe 2836 7hbhnt.exe 1872 7nhttn.exe 2992 jvjpp.exe 2636 flllrxf.exe 1492 bnbbhh.exe 2664 hnhnbb.exe 2656 dpjpv.exe 2612 rllrxfr.exe 2628 fxfxxrr.exe 1988 thnnnb.exe 1636 vpjjp.exe 2700 5jdpv.exe 1072 9xlrxxx.exe 2016 ttnnnh.exe 1592 pjdvd.exe 1176 1dpdp.exe 1564 3lrlllr.exe 316 hbnthn.exe 1688 pjddj.exe 1356 rrrflxr.exe 2340 3rlrrxx.exe 2244 nthbhh.exe 2032 tnhntn.exe 2544 pvvpd.exe 2192 5rffxxf.exe 2224 fxrxffr.exe 2804 nhbbnn.exe 1560 vpddp.exe 1524 9vjdj.exe 1448 9xllxxf.exe -
resource yara_rule behavioral1/memory/2576-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-271-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/264-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-335-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2664-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-440-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2544-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-507-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1448-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-1119-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddj.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1876 2576 df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe 30 PID 2576 wrote to memory of 1876 2576 df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe 30 PID 2576 wrote to memory of 1876 2576 df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe 30 PID 2576 wrote to memory of 1876 2576 df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe 30 PID 1876 wrote to memory of 2456 1876 tnhttb.exe 31 PID 1876 wrote to memory of 2456 1876 tnhttb.exe 31 PID 1876 wrote to memory of 2456 1876 tnhttb.exe 31 PID 1876 wrote to memory of 2456 1876 tnhttb.exe 31 PID 2456 wrote to memory of 2892 2456 ppdjv.exe 32 PID 2456 wrote to memory of 2892 2456 ppdjv.exe 32 PID 2456 wrote to memory of 2892 2456 ppdjv.exe 32 PID 2456 wrote to memory of 2892 2456 ppdjv.exe 32 PID 2892 wrote to memory of 2996 2892 jvvvd.exe 33 PID 2892 wrote to memory of 2996 2892 jvvvd.exe 33 PID 2892 wrote to memory of 2996 2892 jvvvd.exe 33 PID 2892 wrote to memory of 2996 2892 jvvvd.exe 33 PID 2996 wrote to memory of 2868 2996 hbntbb.exe 34 PID 2996 wrote to memory of 2868 2996 hbntbb.exe 34 PID 2996 wrote to memory of 2868 2996 hbntbb.exe 34 PID 2996 wrote to memory of 2868 2996 hbntbb.exe 34 PID 2868 wrote to memory of 2736 2868 nbttbb.exe 35 PID 2868 wrote to memory of 2736 2868 nbttbb.exe 35 PID 2868 wrote to memory of 2736 2868 nbttbb.exe 35 PID 2868 wrote to memory of 2736 2868 nbttbb.exe 35 PID 2736 wrote to memory of 2800 2736 5pddj.exe 36 PID 2736 wrote to memory of 2800 2736 5pddj.exe 36 PID 2736 wrote to memory of 2800 2736 5pddj.exe 36 PID 2736 wrote to memory of 2800 2736 5pddj.exe 36 PID 2800 wrote to memory of 2656 2800 pjppv.exe 37 PID 2800 wrote to memory of 2656 2800 pjppv.exe 37 PID 2800 wrote to memory of 2656 2800 pjppv.exe 37 PID 2800 wrote to memory of 2656 2800 pjppv.exe 37 PID 2656 wrote to memory of 2624 2656 pdjvp.exe 38 PID 2656 wrote to memory of 2624 2656 pdjvp.exe 38 PID 2656 wrote to memory of 2624 2656 pdjvp.exe 38 PID 2656 wrote to memory of 2624 2656 pdjvp.exe 38 PID 2624 wrote to memory of 2228 2624 xrxlrxr.exe 39 PID 2624 wrote to memory of 2228 2624 xrxlrxr.exe 39 PID 2624 wrote to memory of 2228 2624 xrxlrxr.exe 39 PID 2624 wrote to memory of 2228 2624 xrxlrxr.exe 39 PID 2228 wrote to memory of 556 2228 pjppp.exe 40 PID 2228 wrote to memory of 556 2228 pjppp.exe 40 PID 2228 wrote to memory of 556 2228 pjppp.exe 40 PID 2228 wrote to memory of 556 2228 pjppp.exe 40 PID 556 wrote to memory of 1112 556 7rlxllr.exe 41 PID 556 wrote to memory of 1112 556 7rlxllr.exe 41 PID 556 wrote to memory of 1112 556 7rlxllr.exe 41 PID 556 wrote to memory of 1112 556 7rlxllr.exe 41 PID 1112 wrote to memory of 1072 1112 9flfrxx.exe 42 PID 1112 wrote to memory of 1072 1112 9flfrxx.exe 42 PID 1112 wrote to memory of 1072 1112 9flfrxx.exe 42 PID 1112 wrote to memory of 1072 1112 9flfrxx.exe 42 PID 1072 wrote to memory of 2856 1072 vpddp.exe 43 PID 1072 wrote to memory of 2856 1072 vpddp.exe 43 PID 1072 wrote to memory of 2856 1072 vpddp.exe 43 PID 1072 wrote to memory of 2856 1072 vpddp.exe 43 PID 2856 wrote to memory of 1432 2856 lxfxlrf.exe 44 PID 2856 wrote to memory of 1432 2856 lxfxlrf.exe 44 PID 2856 wrote to memory of 1432 2856 lxfxlrf.exe 44 PID 2856 wrote to memory of 1432 2856 lxfxlrf.exe 44 PID 1432 wrote to memory of 2920 1432 tnbbhn.exe 45 PID 1432 wrote to memory of 2920 1432 tnbbhn.exe 45 PID 1432 wrote to memory of 2920 1432 tnbbhn.exe 45 PID 1432 wrote to memory of 2920 1432 tnbbhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe"C:\Users\Admin\AppData\Local\Temp\df0d466a54af4d856a1647a0aa4927774e7cd274ef2b566ee7b2722cb64cd15fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tnhttb.exec:\tnhttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\ppdjv.exec:\ppdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jvvvd.exec:\jvvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hbntbb.exec:\hbntbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\nbttbb.exec:\nbttbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\5pddj.exec:\5pddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pjppv.exec:\pjppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\pdjvp.exec:\pdjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xrxlrxr.exec:\xrxlrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pjppp.exec:\pjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\7rlxllr.exec:\7rlxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\9flfrxx.exec:\9flfrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\vpddp.exec:\vpddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\lxfxlrf.exec:\lxfxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tnbbhn.exec:\tnbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\tnhhtb.exec:\tnhhtb.exe17⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdppp.exec:\pdppp.exe18⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xrffrxl.exec:\xrffrxl.exe19⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vpdvj.exec:\vpdvj.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5dvvd.exec:\5dvvd.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tnhnhh.exec:\tnhnhh.exe22⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5vjjp.exec:\5vjjp.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tnhnbb.exec:\tnhnbb.exe24⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tnnbtt.exec:\tnnbtt.exe25⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pdpvj.exec:\pdpvj.exe26⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9lffxff.exec:\9lffxff.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vvdvd.exec:\vvdvd.exe28⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3jjjp.exec:\3jjjp.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\9frxfxf.exec:\9frxfxf.exe30⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1lxffff.exec:\1lxffff.exe31⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdvpd.exec:\jdvpd.exe32⤵
- Executes dropped EXE
PID:972 -
\??\c:\dpdjj.exec:\dpdjj.exe33⤵
- Executes dropped EXE
PID:264 -
\??\c:\pppdd.exec:\pppdd.exe34⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rrfrrxx.exec:\rrfrrxx.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7hbhnt.exec:\7hbhnt.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7nhttn.exec:\7nhttn.exe37⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jvjpp.exec:\jvjpp.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\flllrxf.exec:\flllrxf.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bnbbhh.exec:\bnbbhh.exe40⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hnhnbb.exec:\hnhnbb.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\dpjpv.exec:\dpjpv.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rllrxfr.exec:\rllrxfr.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\thnnnb.exec:\thnnnb.exe45⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vpjjp.exec:\vpjjp.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5jdpv.exec:\5jdpv.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9xlrxxx.exec:\9xlrxxx.exe48⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ttnnnh.exec:\ttnnnh.exe49⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjdvd.exec:\pjdvd.exe50⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1dpdp.exec:\1dpdp.exe51⤵
- Executes dropped EXE
PID:1176 -
\??\c:\3lrlllr.exec:\3lrlllr.exe52⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hbnthn.exec:\hbnthn.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\pjddj.exec:\pjddj.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rrrflxr.exec:\rrrflxr.exe55⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3rlrrxx.exec:\3rlrrxx.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nthbhh.exec:\nthbhh.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tnhntn.exec:\tnhntn.exe58⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pvvpd.exec:\pvvpd.exe59⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5rffxxf.exec:\5rffxxf.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fxrxffr.exec:\fxrxffr.exe61⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nhbbnn.exec:\nhbbnn.exe62⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vpddp.exec:\vpddp.exe63⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9vjdj.exec:\9vjdj.exe64⤵
- Executes dropped EXE
PID:1524 -
\??\c:\9xllxxf.exec:\9xllxxf.exe65⤵
- Executes dropped EXE
PID:1448 -
\??\c:\htthhh.exec:\htthhh.exe66⤵PID:3000
-
\??\c:\nhbhth.exec:\nhbhth.exe67⤵PID:1640
-
\??\c:\jdppv.exec:\jdppv.exe68⤵PID:1744
-
\??\c:\llllrxl.exec:\llllrxl.exe69⤵PID:1756
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe70⤵PID:1792
-
\??\c:\tnbnbn.exec:\tnbnbn.exe71⤵PID:2004
-
\??\c:\nhthtt.exec:\nhthtt.exe72⤵PID:2424
-
\??\c:\7vpvj.exec:\7vpvj.exe73⤵
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\ffrxflf.exec:\ffrxflf.exe74⤵PID:2572
-
\??\c:\lxlfllr.exec:\lxlfllr.exe75⤵PID:1516
-
\??\c:\hbhnbh.exec:\hbhnbh.exe76⤵PID:2768
-
\??\c:\9jjjv.exec:\9jjjv.exe77⤵PID:2836
-
\??\c:\5vddd.exec:\5vddd.exe78⤵PID:2852
-
\??\c:\xffxfrl.exec:\xffxfrl.exe79⤵PID:2992
-
\??\c:\tnbhhh.exec:\tnbhhh.exe80⤵PID:2792
-
\??\c:\vvjpj.exec:\vvjpj.exe81⤵PID:2880
-
\??\c:\jvvpv.exec:\jvvpv.exe82⤵PID:2640
-
\??\c:\fxrrllr.exec:\fxrrllr.exe83⤵PID:2052
-
\??\c:\bbntbh.exec:\bbntbh.exe84⤵PID:1808
-
\??\c:\tnttbt.exec:\tnttbt.exe85⤵PID:1972
-
\??\c:\jvpjd.exec:\jvpjd.exe86⤵PID:556
-
\??\c:\lllrflx.exec:\lllrflx.exe87⤵PID:2956
-
\??\c:\xxlxrrf.exec:\xxlxrrf.exe88⤵PID:2952
-
\??\c:\nhbbnh.exec:\nhbbnh.exe89⤵PID:1612
-
\??\c:\5jdvd.exec:\5jdvd.exe90⤵PID:2936
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe91⤵
- System Location Discovery: System Language Discovery
PID:1592 -
\??\c:\3xrflxf.exec:\3xrflxf.exe92⤵PID:2924
-
\??\c:\nbnnnh.exec:\nbnnnh.exe93⤵PID:1196
-
\??\c:\jpvdv.exec:\jpvdv.exe94⤵PID:2972
-
\??\c:\dvppd.exec:\dvppd.exe95⤵PID:1752
-
\??\c:\9lxfflr.exec:\9lxfflr.exe96⤵PID:3068
-
\??\c:\lfrrffr.exec:\lfrrffr.exe97⤵PID:1624
-
\??\c:\tthbhn.exec:\tthbhn.exe98⤵PID:2332
-
\??\c:\vpjjv.exec:\vpjjv.exe99⤵PID:1420
-
\??\c:\5pdvp.exec:\5pdvp.exe100⤵PID:1284
-
\??\c:\lfrrffr.exec:\lfrrffr.exe101⤵PID:2184
-
\??\c:\tbnthh.exec:\tbnthh.exe102⤵PID:2192
-
\??\c:\5btbhn.exec:\5btbhn.exe103⤵PID:2204
-
\??\c:\pjvvv.exec:\pjvvv.exe104⤵PID:664
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe105⤵PID:1528
-
\??\c:\hbttbb.exec:\hbttbb.exe106⤵PID:1652
-
\??\c:\5htntb.exec:\5htntb.exe107⤵PID:1448
-
\??\c:\3jppv.exec:\3jppv.exe108⤵PID:2080
-
\??\c:\1jvdd.exec:\1jvdd.exe109⤵PID:1772
-
\??\c:\rfrfflf.exec:\rfrfflf.exe110⤵PID:872
-
\??\c:\5ttthh.exec:\5ttthh.exe111⤵PID:2088
-
\??\c:\dvjpp.exec:\dvjpp.exe112⤵PID:2124
-
\??\c:\jvdvp.exec:\jvdvp.exe113⤵PID:1892
-
\??\c:\lfrfffr.exec:\lfrfffr.exe114⤵PID:2984
-
\??\c:\hhbbnn.exec:\hhbbnn.exe115⤵PID:2892
-
\??\c:\5tnbth.exec:\5tnbth.exe116⤵PID:1924
-
\??\c:\ppjpv.exec:\ppjpv.exe117⤵PID:2756
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe118⤵PID:2764
-
\??\c:\lfrxflx.exec:\lfrxflx.exe119⤵PID:2344
-
\??\c:\5hbbtb.exec:\5hbbtb.exe120⤵PID:2168
-
\??\c:\ddvvp.exec:\ddvvp.exe121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-