Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe
-
Size
455KB
-
MD5
6914a1848857524a5438d099196890a0
-
SHA1
657f13c3da848c5db678479ace772869098045fd
-
SHA256
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666
-
SHA512
baff3a48b023035a909c7aeb75350bdeecfb53d55d13b8ce3a5f600793eb432fbb117570f33d756bad8ca5b5768fff6e4c04628b218b2adc69c10bfe0496a577
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRG:q7Tc2NYHUrAwfMp3CDRG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1724-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-93-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1784-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2428-168-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2428-169-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1248-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-189-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1788-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-224-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2888-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-504-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2204-518-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2284-538-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2392-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-559-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1656-582-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2628-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-630-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2740-644-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/336-651-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2652-677-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1724 xffxrfx.exe 2524 rrrxfxr.exe 2848 9frflrx.exe 2808 frxrrrf.exe 2868 rfrfllr.exe 2920 ddpvj.exe 2288 xflfxxr.exe 2836 vvpjd.exe 2676 jdvdd.exe 1784 tnnhht.exe 2504 1vpdp.exe 884 1thhnb.exe 2976 hhhthh.exe 948 xrxlflf.exe 1720 tnhntb.exe 2980 1rrrffr.exe 2428 7fxrllx.exe 1248 htnbnt.exe 3000 dvjpp.exe 1788 rfrxlrf.exe 1296 tnhthn.exe 1872 ffrfxfr.exe 2888 3ttntb.exe 1932 btbbbh.exe 732 jpjvp.exe 2116 5pjpp.exe 2180 fxfxxfx.exe 1472 tnnhbh.exe 1712 hnhtht.exe 2168 rxxlfrl.exe 1592 5hbhbt.exe 1200 flfxlxx.exe 2956 thbtnb.exe 2452 pddjv.exe 2552 7fxxflr.exe 2140 7lfrxxr.exe 2884 tnnnnt.exe 2796 1djjv.exe 3040 vppdj.exe 3032 7fxxrfr.exe 2908 nhhtbb.exe 2728 djvvv.exe 2512 djdjd.exe 2496 fflfrfr.exe 1852 1nhtbh.exe 1964 dvjpv.exe 784 3vvvd.exe 1644 rxfrfff.exe 2852 hhtbnn.exe 236 bbnbbb.exe 2560 vvjvp.exe 568 xxxlxll.exe 1620 7fxlflx.exe 1440 nnbnhh.exe 3036 1pjvp.exe 2120 1xrrxxl.exe 2760 xxrrxxr.exe 1408 bbhtbh.exe 1928 9pppd.exe 1140 jdpdp.exe 3060 flxxlll.exe 984 bhbthb.exe 2056 dvpvj.exe 1820 dvppd.exe -
resource yara_rule behavioral1/memory/1724-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-151-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1720-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-199-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1872-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/732-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-987-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1724 1388 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe 30 PID 1388 wrote to memory of 1724 1388 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe 30 PID 1388 wrote to memory of 1724 1388 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe 30 PID 1388 wrote to memory of 1724 1388 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe 30 PID 1724 wrote to memory of 2524 1724 xffxrfx.exe 31 PID 1724 wrote to memory of 2524 1724 xffxrfx.exe 31 PID 1724 wrote to memory of 2524 1724 xffxrfx.exe 31 PID 1724 wrote to memory of 2524 1724 xffxrfx.exe 31 PID 2524 wrote to memory of 2848 2524 rrrxfxr.exe 32 PID 2524 wrote to memory of 2848 2524 rrrxfxr.exe 32 PID 2524 wrote to memory of 2848 2524 rrrxfxr.exe 32 PID 2524 wrote to memory of 2848 2524 rrrxfxr.exe 32 PID 2848 wrote to memory of 2808 2848 9frflrx.exe 33 PID 2848 wrote to memory of 2808 2848 9frflrx.exe 33 PID 2848 wrote to memory of 2808 2848 9frflrx.exe 33 PID 2848 wrote to memory of 2808 2848 9frflrx.exe 33 PID 2808 wrote to memory of 2868 2808 frxrrrf.exe 34 PID 2808 wrote to memory of 2868 2808 frxrrrf.exe 34 PID 2808 wrote to memory of 2868 2808 frxrrrf.exe 34 PID 2808 wrote to memory of 2868 2808 frxrrrf.exe 34 PID 2868 wrote to memory of 2920 2868 rfrfllr.exe 35 PID 2868 wrote to memory of 2920 2868 rfrfllr.exe 35 PID 2868 wrote to memory of 2920 2868 rfrfllr.exe 35 PID 2868 wrote to memory of 2920 2868 rfrfllr.exe 35 PID 2920 wrote to memory of 2288 2920 ddpvj.exe 36 PID 2920 wrote to memory of 2288 2920 ddpvj.exe 36 PID 2920 wrote to memory of 2288 2920 ddpvj.exe 36 PID 2920 wrote to memory of 2288 2920 ddpvj.exe 36 PID 2288 wrote to memory of 2836 2288 xflfxxr.exe 37 PID 2288 wrote to memory of 2836 2288 xflfxxr.exe 37 PID 2288 wrote to memory of 2836 2288 xflfxxr.exe 37 PID 2288 wrote to memory of 2836 2288 xflfxxr.exe 37 PID 2836 wrote to memory of 2676 2836 vvpjd.exe 38 PID 2836 wrote to memory of 2676 2836 vvpjd.exe 38 PID 2836 wrote to memory of 2676 2836 vvpjd.exe 38 PID 2836 wrote to memory of 2676 2836 vvpjd.exe 38 PID 2676 wrote to memory of 1784 2676 jdvdd.exe 39 PID 2676 wrote to memory of 1784 2676 jdvdd.exe 39 PID 2676 wrote to memory of 1784 2676 jdvdd.exe 39 PID 2676 wrote to memory of 1784 2676 jdvdd.exe 39 PID 1784 wrote to memory of 2504 1784 tnnhht.exe 40 PID 1784 wrote to memory of 2504 1784 tnnhht.exe 40 PID 1784 wrote to memory of 2504 1784 tnnhht.exe 40 PID 1784 wrote to memory of 2504 1784 tnnhht.exe 40 PID 2504 wrote to memory of 884 2504 1vpdp.exe 41 PID 2504 wrote to memory of 884 2504 1vpdp.exe 41 PID 2504 wrote to memory of 884 2504 1vpdp.exe 41 PID 2504 wrote to memory of 884 2504 1vpdp.exe 41 PID 884 wrote to memory of 2976 884 1thhnb.exe 42 PID 884 wrote to memory of 2976 884 1thhnb.exe 42 PID 884 wrote to memory of 2976 884 1thhnb.exe 42 PID 884 wrote to memory of 2976 884 1thhnb.exe 42 PID 2976 wrote to memory of 948 2976 hhhthh.exe 43 PID 2976 wrote to memory of 948 2976 hhhthh.exe 43 PID 2976 wrote to memory of 948 2976 hhhthh.exe 43 PID 2976 wrote to memory of 948 2976 hhhthh.exe 43 PID 948 wrote to memory of 1720 948 xrxlflf.exe 44 PID 948 wrote to memory of 1720 948 xrxlflf.exe 44 PID 948 wrote to memory of 1720 948 xrxlflf.exe 44 PID 948 wrote to memory of 1720 948 xrxlflf.exe 44 PID 1720 wrote to memory of 2980 1720 tnhntb.exe 45 PID 1720 wrote to memory of 2980 1720 tnhntb.exe 45 PID 1720 wrote to memory of 2980 1720 tnhntb.exe 45 PID 1720 wrote to memory of 2980 1720 tnhntb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe"C:\Users\Admin\AppData\Local\Temp\400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\xffxrfx.exec:\xffxrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\rrrxfxr.exec:\rrrxfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\9frflrx.exec:\9frflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\frxrrrf.exec:\frxrrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rfrfllr.exec:\rfrfllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\ddpvj.exec:\ddpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xflfxxr.exec:\xflfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\vvpjd.exec:\vvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jdvdd.exec:\jdvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnnhht.exec:\tnnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\1vpdp.exec:\1vpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\1thhnb.exec:\1thhnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\hhhthh.exec:\hhhthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xrxlflf.exec:\xrxlflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\tnhntb.exec:\tnhntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\1rrrffr.exec:\1rrrffr.exe17⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7fxrllx.exec:\7fxrllx.exe18⤵
- Executes dropped EXE
PID:2428 -
\??\c:\htnbnt.exec:\htnbnt.exe19⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dvjpp.exec:\dvjpp.exe20⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe21⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tnhthn.exec:\tnhthn.exe22⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ffrfxfr.exec:\ffrfxfr.exe23⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3ttntb.exec:\3ttntb.exe24⤵
- Executes dropped EXE
PID:2888 -
\??\c:\btbbbh.exec:\btbbbh.exe25⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jpjvp.exec:\jpjvp.exe26⤵
- Executes dropped EXE
PID:732 -
\??\c:\5pjpp.exec:\5pjpp.exe27⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxfxxfx.exec:\fxfxxfx.exe28⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tnnhbh.exec:\tnnhbh.exe29⤵
- Executes dropped EXE
PID:1472 -
\??\c:\hnhtht.exec:\hnhtht.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rxxlfrl.exec:\rxxlfrl.exe31⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5hbhbt.exec:\5hbhbt.exe32⤵
- Executes dropped EXE
PID:1592 -
\??\c:\flfxlxx.exec:\flfxlxx.exe33⤵
- Executes dropped EXE
PID:1200 -
\??\c:\thbtnb.exec:\thbtnb.exe34⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pddjv.exec:\pddjv.exe35⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7fxxflr.exec:\7fxxflr.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7lfrxxr.exec:\7lfrxxr.exe37⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tnnnnt.exec:\tnnnnt.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1djjv.exec:\1djjv.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vppdj.exec:\vppdj.exe40⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7fxxrfr.exec:\7fxxrfr.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nhhtbb.exec:\nhhtbb.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\djvvv.exec:\djvvv.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\djdjd.exec:\djdjd.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\fflfrfr.exec:\fflfrfr.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1nhtbh.exec:\1nhtbh.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\dvjpv.exec:\dvjpv.exe47⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3vvvd.exec:\3vvvd.exe48⤵
- Executes dropped EXE
PID:784 -
\??\c:\rxfrfff.exec:\rxfrfff.exe49⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhtbnn.exec:\hhtbnn.exe50⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bbnbbb.exec:\bbnbbb.exe51⤵
- Executes dropped EXE
PID:236 -
\??\c:\vvjvp.exec:\vvjvp.exe52⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xxxlxll.exec:\xxxlxll.exe53⤵
- Executes dropped EXE
PID:568 -
\??\c:\7fxlflx.exec:\7fxlflx.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nnbnhh.exec:\nnbnhh.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1pjvp.exec:\1pjvp.exe56⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1xrrxxl.exec:\1xrrxxl.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xxrrxxr.exec:\xxrrxxr.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbhtbh.exec:\bbhtbh.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408 -
\??\c:\9pppd.exec:\9pppd.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdpdp.exec:\jdpdp.exe61⤵
- Executes dropped EXE
PID:1140 -
\??\c:\flxxlll.exec:\flxxlll.exe62⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhbthb.exec:\bhbthb.exe63⤵
- Executes dropped EXE
PID:984 -
\??\c:\dvpvj.exec:\dvpvj.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvppd.exec:\dvppd.exe65⤵
- Executes dropped EXE
PID:1820 -
\??\c:\llxxrrx.exec:\llxxrrx.exe66⤵PID:2204
-
\??\c:\ttthth.exec:\ttthth.exe67⤵PID:1652
-
\??\c:\bbbnbt.exec:\bbbnbt.exe68⤵PID:2060
-
\??\c:\ddvjv.exec:\ddvjv.exe69⤵PID:2284
-
\??\c:\lrllxfr.exec:\lrllxfr.exe70⤵PID:2392
-
\??\c:\1nnnbb.exec:\1nnnbb.exe71⤵PID:1388
-
\??\c:\hbtbhh.exec:\hbtbhh.exe72⤵PID:2088
-
\??\c:\djdjp.exec:\djdjp.exe73⤵PID:2312
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe74⤵PID:1200
-
\??\c:\lfrrxll.exec:\lfrrxll.exe75⤵PID:2748
-
\??\c:\tbtnhn.exec:\tbtnhn.exe76⤵PID:1656
-
\??\c:\9dvdj.exec:\9dvdj.exe77⤵PID:2904
-
\??\c:\lrrrlrf.exec:\lrrrlrf.exe78⤵PID:2916
-
\??\c:\bntntt.exec:\bntntt.exe79⤵PID:2948
-
\??\c:\htbhtn.exec:\htbhtn.exe80⤵PID:2628
-
\??\c:\vvjvp.exec:\vvjvp.exe81⤵PID:2912
-
\??\c:\xrfflrx.exec:\xrfflrx.exe82⤵PID:760
-
\??\c:\hhhnbh.exec:\hhhnbh.exe83⤵PID:2684
-
\??\c:\hnhnbb.exec:\hnhnbb.exe84⤵PID:2500
-
\??\c:\dppvv.exec:\dppvv.exe85⤵PID:2740
-
\??\c:\ffxfrrr.exec:\ffxfrrr.exe86⤵PID:336
-
\??\c:\3thnht.exec:\3thnht.exe87⤵PID:1764
-
\??\c:\pvpvj.exec:\pvpvj.exe88⤵PID:276
-
\??\c:\jdppj.exec:\jdppj.exe89⤵PID:1000
-
\??\c:\lxrxxff.exec:\lxrxxff.exe90⤵PID:2652
-
\??\c:\7hhthn.exec:\7hhthn.exe91⤵PID:2032
-
\??\c:\vvvjd.exec:\vvvjd.exe92⤵PID:3016
-
\??\c:\9vvdv.exec:\9vvdv.exe93⤵PID:2024
-
\??\c:\lffrflx.exec:\lffrflx.exe94⤵PID:568
-
\??\c:\rllxlxl.exec:\rllxlxl.exe95⤵PID:2752
-
\??\c:\7hbnht.exec:\7hbnht.exe96⤵
- System Location Discovery: System Language Discovery
PID:1440 -
\??\c:\dvpjv.exec:\dvpjv.exe97⤵PID:3052
-
\??\c:\dvpjj.exec:\dvpjj.exe98⤵PID:2856
-
\??\c:\lrlxlxl.exec:\lrlxlxl.exe99⤵PID:2636
-
\??\c:\nbnntt.exec:\nbnntt.exe100⤵PID:1408
-
\??\c:\jdjjv.exec:\jdjjv.exe101⤵PID:912
-
\??\c:\vvvjd.exec:\vvvjd.exe102⤵PID:408
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe103⤵PID:2348
-
\??\c:\hbtthn.exec:\hbtthn.exe104⤵PID:2960
-
\??\c:\bbhtnt.exec:\bbhtnt.exe105⤵PID:2292
-
\??\c:\ppdvj.exec:\ppdvj.exe106⤵PID:1668
-
\??\c:\3xrxfrx.exec:\3xrxfrx.exe107⤵PID:1252
-
\??\c:\5hbnbn.exec:\5hbnbn.exe108⤵PID:2544
-
\??\c:\3tnhhh.exec:\3tnhhh.exe109⤵PID:1728
-
\??\c:\pppdp.exec:\pppdp.exe110⤵PID:1944
-
\??\c:\rrrxlrf.exec:\rrrxlrf.exe111⤵PID:1876
-
\??\c:\ffxrfrf.exec:\ffxrfrf.exe112⤵PID:1596
-
\??\c:\bbtbth.exec:\bbtbth.exe113⤵PID:2484
-
\??\c:\ppjjd.exec:\ppjjd.exe114⤵PID:2320
-
\??\c:\1dvvp.exec:\1dvvp.exe115⤵PID:2316
-
\??\c:\rxrxflx.exec:\rxrxflx.exe116⤵PID:2956
-
\??\c:\1btbht.exec:\1btbht.exe117⤵PID:2792
-
\??\c:\btntbh.exec:\btntbh.exe118⤵PID:1288
-
\??\c:\ppjpp.exec:\ppjpp.exe119⤵PID:2900
-
\??\c:\llfrxlf.exec:\llfrxlf.exe120⤵PID:2884
-
\??\c:\1rxxflf.exec:\1rxxflf.exe121⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-