Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe
-
Size
454KB
-
MD5
2ead9362f78325ac9d76078961857d83
-
SHA1
3519bf3329eab134dcd4a474e56032914af2b2ff
-
SHA256
8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be
-
SHA512
02739b5a699c51a3aef45bb7b1f3aec92b3000700296dc092a33805396c7f5600872ab1cdf696d15e50321c46bd7b5b9131700ecd6c35ac1ce036df544254d23
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1856-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-352-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1840-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-739-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/648-772-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2364-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-167-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/236-162-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1428-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-148-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/560-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-985-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2496-1037-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-1075-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2264 9nbnnb.exe 2384 nhhbhb.exe 2356 9tbtht.exe 2920 vvdjj.exe 2700 ppjjv.exe 2844 hthhhh.exe 2216 vpvdd.exe 2616 rxfxffx.exe 2796 ntthtb.exe 2812 htbnhb.exe 2620 jjjvp.exe 3048 lxfxrfx.exe 1944 xxffxfr.exe 560 jvvjj.exe 284 frxrlxr.exe 1428 hthbbt.exe 236 jppdv.exe 568 lxlrrlr.exe 1936 lfflllf.exe 2676 hhhttb.exe 2288 jvvpp.exe 2456 bbnbth.exe 952 hnnhbh.exe 1720 vvddv.exe 1456 hhhnbh.exe 2184 1vpjj.exe 2520 lllxrxx.exe 2916 nttnbn.exe 1000 1bbhtb.exe 1992 ffflxfr.exe 1412 hbhbbn.exe 1704 dvvpv.exe 2120 rffxxrr.exe 2380 fllrfxl.exe 2580 hbhtnn.exe 2432 7jjjj.exe 992 fxrllrr.exe 2716 5bbnht.exe 2832 bhhnth.exe 3056 rfrfrxl.exe 2752 fllflxf.exe 2500 ttntnn.exe 2816 3ttnhb.exe 2820 jdpjj.exe 2684 xxxffrx.exe 484 5lfrrll.exe 1552 tntntt.exe 1504 pdjdd.exe 3004 vjddp.exe 1740 rrffflr.exe 1712 rrxfrxr.exe 2540 bbtnhn.exe 1840 bhhbhh.exe 1460 dpvpv.exe 2992 rxrlflf.exe 1976 5rxrrfx.exe 760 htbbbt.exe 2116 1dpjj.exe 2648 jvvpj.exe 2456 xlfxffl.exe 2668 1bbttt.exe 1040 nnntnt.exe 2364 pdddd.exe 1556 lrxrlxr.exe -
resource yara_rule behavioral1/memory/1856-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-973-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-985-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2436-999-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2496-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-1125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-1135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-1148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-1258-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1360-1282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-1295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-1334-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2264 1856 8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe 30 PID 1856 wrote to memory of 2264 1856 8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe 30 PID 1856 wrote to memory of 2264 1856 8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe 30 PID 1856 wrote to memory of 2264 1856 8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe 30 PID 2264 wrote to memory of 2384 2264 9nbnnb.exe 31 PID 2264 wrote to memory of 2384 2264 9nbnnb.exe 31 PID 2264 wrote to memory of 2384 2264 9nbnnb.exe 31 PID 2264 wrote to memory of 2384 2264 9nbnnb.exe 31 PID 2384 wrote to memory of 2356 2384 nhhbhb.exe 32 PID 2384 wrote to memory of 2356 2384 nhhbhb.exe 32 PID 2384 wrote to memory of 2356 2384 nhhbhb.exe 32 PID 2384 wrote to memory of 2356 2384 nhhbhb.exe 32 PID 2356 wrote to memory of 2920 2356 9tbtht.exe 33 PID 2356 wrote to memory of 2920 2356 9tbtht.exe 33 PID 2356 wrote to memory of 2920 2356 9tbtht.exe 33 PID 2356 wrote to memory of 2920 2356 9tbtht.exe 33 PID 2920 wrote to memory of 2700 2920 vvdjj.exe 34 PID 2920 wrote to memory of 2700 2920 vvdjj.exe 34 PID 2920 wrote to memory of 2700 2920 vvdjj.exe 34 PID 2920 wrote to memory of 2700 2920 vvdjj.exe 34 PID 2700 wrote to memory of 2844 2700 ppjjv.exe 35 PID 2700 wrote to memory of 2844 2700 ppjjv.exe 35 PID 2700 wrote to memory of 2844 2700 ppjjv.exe 35 PID 2700 wrote to memory of 2844 2700 ppjjv.exe 35 PID 2844 wrote to memory of 2216 2844 hthhhh.exe 36 PID 2844 wrote to memory of 2216 2844 hthhhh.exe 36 PID 2844 wrote to memory of 2216 2844 hthhhh.exe 36 PID 2844 wrote to memory of 2216 2844 hthhhh.exe 36 PID 2216 wrote to memory of 2616 2216 vpvdd.exe 37 PID 2216 wrote to memory of 2616 2216 vpvdd.exe 37 PID 2216 wrote to memory of 2616 2216 vpvdd.exe 37 PID 2216 wrote to memory of 2616 2216 vpvdd.exe 37 PID 2616 wrote to memory of 2796 2616 rxfxffx.exe 38 PID 2616 wrote to memory of 2796 2616 rxfxffx.exe 38 PID 2616 wrote to memory of 2796 2616 rxfxffx.exe 38 PID 2616 wrote to memory of 2796 2616 rxfxffx.exe 38 PID 2796 wrote to memory of 2812 2796 ntthtb.exe 39 PID 2796 wrote to memory of 2812 2796 ntthtb.exe 39 PID 2796 wrote to memory of 2812 2796 ntthtb.exe 39 PID 2796 wrote to memory of 2812 2796 ntthtb.exe 39 PID 2812 wrote to memory of 2620 2812 htbnhb.exe 40 PID 2812 wrote to memory of 2620 2812 htbnhb.exe 40 PID 2812 wrote to memory of 2620 2812 htbnhb.exe 40 PID 2812 wrote to memory of 2620 2812 htbnhb.exe 40 PID 2620 wrote to memory of 3048 2620 jjjvp.exe 41 PID 2620 wrote to memory of 3048 2620 jjjvp.exe 41 PID 2620 wrote to memory of 3048 2620 jjjvp.exe 41 PID 2620 wrote to memory of 3048 2620 jjjvp.exe 41 PID 3048 wrote to memory of 1944 3048 lxfxrfx.exe 42 PID 3048 wrote to memory of 1944 3048 lxfxrfx.exe 42 PID 3048 wrote to memory of 1944 3048 lxfxrfx.exe 42 PID 3048 wrote to memory of 1944 3048 lxfxrfx.exe 42 PID 1944 wrote to memory of 560 1944 xxffxfr.exe 121 PID 1944 wrote to memory of 560 1944 xxffxfr.exe 121 PID 1944 wrote to memory of 560 1944 xxffxfr.exe 121 PID 1944 wrote to memory of 560 1944 xxffxfr.exe 121 PID 560 wrote to memory of 284 560 jvvjj.exe 44 PID 560 wrote to memory of 284 560 jvvjj.exe 44 PID 560 wrote to memory of 284 560 jvvjj.exe 44 PID 560 wrote to memory of 284 560 jvvjj.exe 44 PID 284 wrote to memory of 1428 284 frxrlxr.exe 45 PID 284 wrote to memory of 1428 284 frxrlxr.exe 45 PID 284 wrote to memory of 1428 284 frxrlxr.exe 45 PID 284 wrote to memory of 1428 284 frxrlxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe"C:\Users\Admin\AppData\Local\Temp\8e024154f71481cf7e674012754362178903ac682f3ca721dad1998a267725be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\9nbnnb.exec:\9nbnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\nhhbhb.exec:\nhhbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\9tbtht.exec:\9tbtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\vvdjj.exec:\vvdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ppjjv.exec:\ppjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hthhhh.exec:\hthhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\vpvdd.exec:\vpvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rxfxffx.exec:\rxfxffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ntthtb.exec:\ntthtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\htbnhb.exec:\htbnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jjjvp.exec:\jjjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lxfxrfx.exec:\lxfxrfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xxffxfr.exec:\xxffxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\jvvjj.exec:\jvvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\frxrlxr.exec:\frxrlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\hthbbt.exec:\hthbbt.exe17⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jppdv.exec:\jppdv.exe18⤵
- Executes dropped EXE
PID:236 -
\??\c:\lxlrrlr.exec:\lxlrrlr.exe19⤵
- Executes dropped EXE
PID:568 -
\??\c:\lfflllf.exec:\lfflllf.exe20⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hhhttb.exec:\hhhttb.exe21⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jvvpp.exec:\jvvpp.exe22⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bbnbth.exec:\bbnbth.exe23⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hnnhbh.exec:\hnnhbh.exe24⤵
- Executes dropped EXE
PID:952 -
\??\c:\vvddv.exec:\vvddv.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hhhnbh.exec:\hhhnbh.exe26⤵
- Executes dropped EXE
PID:1456 -
\??\c:\1vpjj.exec:\1vpjj.exe27⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lllxrxx.exec:\lllxrxx.exe28⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nttnbn.exec:\nttnbn.exe29⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1bbhtb.exec:\1bbhtb.exe30⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ffflxfr.exec:\ffflxfr.exe31⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hbhbbn.exec:\hbhbbn.exe32⤵
- Executes dropped EXE
PID:1412 -
\??\c:\dvvpv.exec:\dvvpv.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rffxxrr.exec:\rffxxrr.exe34⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fllrfxl.exec:\fllrfxl.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hbhtnn.exec:\hbhtnn.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7jjjj.exec:\7jjjj.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fxrllrr.exec:\fxrllrr.exe38⤵
- Executes dropped EXE
PID:992 -
\??\c:\5bbnht.exec:\5bbnht.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bhhnth.exec:\bhhnth.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rfrfrxl.exec:\rfrfrxl.exe41⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fllflxf.exec:\fllflxf.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ttntnn.exec:\ttntnn.exe43⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3ttnhb.exec:\3ttnhb.exe44⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jdpjj.exec:\jdpjj.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xxxffrx.exec:\xxxffrx.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5lfrrll.exec:\5lfrrll.exe47⤵
- Executes dropped EXE
PID:484 -
\??\c:\tntntt.exec:\tntntt.exe48⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pdjdd.exec:\pdjdd.exe49⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vjddp.exec:\vjddp.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrffflr.exec:\rrffflr.exe51⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rrxfrxr.exec:\rrxfrxr.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bbtnhn.exec:\bbtnhn.exe53⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bhhbhh.exec:\bhhbhh.exe54⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dpvpv.exec:\dpvpv.exe55⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rxrlflf.exec:\rxrlflf.exe56⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5rxrrfx.exec:\5rxrrfx.exe57⤵
- Executes dropped EXE
PID:1976 -
\??\c:\htbbbt.exec:\htbbbt.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\1dpjj.exec:\1dpjj.exe59⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jvvpj.exec:\jvvpj.exe60⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xlfxffl.exec:\xlfxffl.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1bbttt.exec:\1bbttt.exe62⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nnntnt.exec:\nnntnt.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pdddd.exec:\pdddd.exe64⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lrxrlxr.exec:\lrxrlxr.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lllxrlx.exec:\lllxrlx.exe66⤵PID:2428
-
\??\c:\bnbhnh.exec:\bnbhnh.exe67⤵PID:2184
-
\??\c:\vdjpj.exec:\vdjpj.exe68⤵PID:2520
-
\??\c:\xrxrfrr.exec:\xrxrfrr.exe69⤵PID:2916
-
\??\c:\9frllfx.exec:\9frllfx.exe70⤵PID:3060
-
\??\c:\tnbttn.exec:\tnbttn.exe71⤵PID:2448
-
\??\c:\dpdpd.exec:\dpdpd.exe72⤵PID:1856
-
\??\c:\9jvpp.exec:\9jvpp.exe73⤵PID:564
-
\??\c:\rxfxrll.exec:\rxfxrll.exe74⤵PID:1700
-
\??\c:\1xxlfrl.exec:\1xxlfrl.exe75⤵PID:2424
-
\??\c:\ttbthb.exec:\ttbthb.exe76⤵PID:2396
-
\??\c:\vdjdp.exec:\vdjdp.exe77⤵PID:2580
-
\??\c:\jjvjj.exec:\jjvjj.exe78⤵PID:2188
-
\??\c:\fllrfrf.exec:\fllrfrf.exe79⤵PID:1348
-
\??\c:\lffxlrr.exec:\lffxlrr.exe80⤵PID:2824
-
\??\c:\nnhthn.exec:\nnhthn.exe81⤵PID:2936
-
\??\c:\dpdvd.exec:\dpdvd.exe82⤵PID:2852
-
\??\c:\pjvvd.exec:\pjvvd.exe83⤵PID:3044
-
\??\c:\fffxlfl.exec:\fffxlfl.exe84⤵PID:2324
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe85⤵PID:2632
-
\??\c:\9bntbb.exec:\9bntbb.exe86⤵PID:2744
-
\??\c:\ppjpj.exec:\ppjpj.exe87⤵PID:2892
-
\??\c:\vdjvp.exec:\vdjvp.exe88⤵PID:2776
-
\??\c:\rrrxfrf.exec:\rrrxfrf.exe89⤵PID:2876
-
\??\c:\lfrllxx.exec:\lfrllxx.exe90⤵PID:1984
-
\??\c:\nhnhnh.exec:\nhnhnh.exe91⤵PID:544
-
\??\c:\9jdpp.exec:\9jdpp.exe92⤵PID:1876
-
\??\c:\3dvjv.exec:\3dvjv.exe93⤵PID:560
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe94⤵PID:1772
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe95⤵PID:1204
-
\??\c:\hbnhhb.exec:\hbnhhb.exe96⤵PID:1428
-
\??\c:\dvvpp.exec:\dvvpp.exe97⤵PID:2556
-
\??\c:\pdjvd.exec:\pdjvd.exe98⤵PID:568
-
\??\c:\frfxrrr.exec:\frfxrrr.exe99⤵PID:1436
-
\??\c:\btbttb.exec:\btbttb.exe100⤵PID:536
-
\??\c:\ttbbbt.exec:\ttbbbt.exe101⤵PID:2804
-
\??\c:\jvjdj.exec:\jvjdj.exe102⤵PID:1184
-
\??\c:\jvvpj.exec:\jvvpj.exe103⤵PID:1240
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe104⤵PID:2456
-
\??\c:\bnbnnh.exec:\bnbnnh.exe105⤵PID:348
-
\??\c:\nnbnbn.exec:\nnbnbn.exe106⤵PID:2044
-
\??\c:\5vvdp.exec:\5vvdp.exe107⤵PID:2364
-
\??\c:\jpjpv.exec:\jpjpv.exe108⤵PID:648
-
\??\c:\lllllff.exec:\lllllff.exe109⤵PID:1052
-
\??\c:\llrfrxx.exec:\llrfrxx.exe110⤵PID:376
-
\??\c:\9bnbhh.exec:\9bnbhh.exe111⤵PID:2596
-
\??\c:\jpppp.exec:\jpppp.exe112⤵PID:2304
-
\??\c:\djjvp.exec:\djjvp.exe113⤵PID:1576
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe114⤵PID:1468
-
\??\c:\bnhbnn.exec:\bnhbnn.exe115⤵PID:1704
-
\??\c:\ttntnt.exec:\ttntnt.exe116⤵PID:2572
-
\??\c:\1vpjp.exec:\1vpjp.exe117⤵PID:1700
-
\??\c:\ntnnht.exec:\ntnnht.exe118⤵PID:2424
-
\??\c:\hbthbh.exec:\hbthbh.exe119⤵PID:2396
-
\??\c:\7ddpv.exec:\7ddpv.exe120⤵PID:2580
-
\??\c:\lfxffrl.exec:\lfxffrl.exe121⤵PID:2180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-