Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 23:47
Behavioral task
behavioral1
Sample
a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe
Resource
win7-20240903-en
9 signatures
120 seconds
General
-
Target
a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe
-
Size
3.7MB
-
MD5
c0242e57adb242ebd34b2cd1860e34e0
-
SHA1
3ce6786047bfcbcf514fb01aa9b22a24020a6cde
-
SHA256
a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0
-
SHA512
15fe53ebe5082b377502b109239b7530427c8a57f0d3a3743d756bf51caeee858b05e52c11e807c88751d0505a803bbfa5217b3549405fd0b2a29b7fecf8b3b5
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98m:U6XLq/qPPslzKx/dJg1ErmNt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-33-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1272-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-80-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1908-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-119-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-131-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3020-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-185-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2556-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1016-199-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1016-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-209-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1944-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-241-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/912-246-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/912-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-261-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/780-278-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/892-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-361-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2440-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/644-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1420-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-429-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/556-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-549-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1740-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-575-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/884-589-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1584-603-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2360-611-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2464-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-688-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2904-702-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-729-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-742-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/912-822-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1588-861-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 816 5pjdd.exe 2104 xlrlxxr.exe 2276 rllxllr.exe 1272 xrfxlrx.exe 2792 pjpjj.exe 2700 lfflxxf.exe 2924 dpjpv.exe 1908 rfrlxlr.exe 2640 xrlrrrx.exe 940 7nhhnh.exe 2464 frrrfrx.exe 2064 xxfxrrx.exe 1432 5rxfxlx.exe 1604 vvvjp.exe 3020 fffflrx.exe 3012 9vpdj.exe 3060 1vvdj.exe 2236 vpdjp.exe 2388 7fxrflr.exe 2556 ttnnbt.exe 1016 jdjpp.exe 2480 thnnht.exe 1944 fflfxlr.exe 1600 hnbhhb.exe 2200 bthnhn.exe 912 tnbnth.exe 1532 5rfllrf.exe 1064 7fxlrxf.exe 780 vppdp.exe 2356 vpjdv.exe 892 ffrlfxl.exe 2508 7pjvp.exe 332 vpjjv.exe 816 ffrflrx.exe 2404 jvjjp.exe 2380 1dpvd.exe 1648 hhbhtt.exe 2744 7tbhbn.exe 2840 9lxrlrx.exe 2440 1pvpv.exe 2620 dddjd.exe 2856 ntbhnb.exe 2608 hbhbnt.exe 2304 rlfrxfr.exe 644 xxxlxfx.exe 2884 jjdvp.exe 1920 tbbnth.exe 1420 fxxlrfr.exe 2776 lrrrlxf.exe 2584 3jdpd.exe 1596 jjvpj.exe 2476 hnhbbt.exe 1308 tnhtbn.exe 2260 7xxlrll.exe 3060 vpdjv.exe 2188 9jvjv.exe 556 hhbnbn.exe 1160 flrfflx.exe 1660 3llrrfl.exe 1032 jdvdp.exe 2504 ppdvj.exe 1888 nhttbh.exe 2456 3xrllfx.exe 1868 fxxrfrf.exe -
resource yara_rule behavioral1/memory/2244-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-5.dat upx behavioral1/memory/2244-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2104-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ab9-17.dat upx behavioral1/files/0x0008000000016c56-29.dat upx behavioral1/memory/2104-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c73-38.dat upx behavioral1/memory/1272-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000165a7-47.dat upx behavioral1/files/0x0007000000016cc5-57.dat upx behavioral1/memory/2792-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1d-65.dat upx behavioral1/memory/2924-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-70-0x00000000002E0000-0x0000000000307000-memory.dmp upx behavioral1/files/0x0008000000016d2e-76.dat upx behavioral1/memory/2924-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d36-86.dat upx behavioral1/memory/1908-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175e7-96.dat upx behavioral1/memory/2640-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018669-105.dat upx behavioral1/files/0x001400000001866f-112.dat upx behavioral1/memory/2064-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-111-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2464-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0011000000018682-124.dat upx behavioral1/files/0x000500000001868b-134.dat upx behavioral1/files/0x00050000000186f2-143.dat upx behavioral1/memory/3020-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f8-151.dat upx behavioral1/memory/3012-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018731-161.dat upx behavioral1/files/0x0005000000018742-169.dat upx behavioral1/files/0x0005000000018781-177.dat upx behavioral1/memory/2388-185-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001878c-186.dat upx behavioral1/files/0x0006000000018bf3-195.dat upx behavioral1/memory/2556-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1016-199-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019227-205.dat upx behavioral1/memory/1016-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001922c-214.dat upx behavioral1/files/0x000500000001925e-223.dat upx behavioral1/memory/1944-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-233.dat upx behavioral1/memory/1600-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926a-242.dat upx behavioral1/files/0x0005000000019279-252.dat upx behavioral1/memory/912-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1532-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019284-263.dat upx behavioral1/files/0x00050000000192a9-270.dat upx behavioral1/files/0x0005000000019379-279.dat upx behavioral1/files/0x000500000001939d-286.dat upx behavioral1/files/0x00050000000193a4-296.dat upx behavioral1/memory/892-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/332-312-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/332-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/816-314-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 816 2244 a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe 30 PID 2244 wrote to memory of 816 2244 a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe 30 PID 2244 wrote to memory of 816 2244 a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe 30 PID 2244 wrote to memory of 816 2244 a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe 30 PID 816 wrote to memory of 2104 816 5pjdd.exe 31 PID 816 wrote to memory of 2104 816 5pjdd.exe 31 PID 816 wrote to memory of 2104 816 5pjdd.exe 31 PID 816 wrote to memory of 2104 816 5pjdd.exe 31 PID 2104 wrote to memory of 2276 2104 xlrlxxr.exe 32 PID 2104 wrote to memory of 2276 2104 xlrlxxr.exe 32 PID 2104 wrote to memory of 2276 2104 xlrlxxr.exe 32 PID 2104 wrote to memory of 2276 2104 xlrlxxr.exe 32 PID 2276 wrote to memory of 1272 2276 rllxllr.exe 33 PID 2276 wrote to memory of 1272 2276 rllxllr.exe 33 PID 2276 wrote to memory of 1272 2276 rllxllr.exe 33 PID 2276 wrote to memory of 1272 2276 rllxllr.exe 33 PID 1272 wrote to memory of 2792 1272 xrfxlrx.exe 34 PID 1272 wrote to memory of 2792 1272 xrfxlrx.exe 34 PID 1272 wrote to memory of 2792 1272 xrfxlrx.exe 34 PID 1272 wrote to memory of 2792 1272 xrfxlrx.exe 34 PID 2792 wrote to memory of 2700 2792 pjpjj.exe 35 PID 2792 wrote to memory of 2700 2792 pjpjj.exe 35 PID 2792 wrote to memory of 2700 2792 pjpjj.exe 35 PID 2792 wrote to memory of 2700 2792 pjpjj.exe 35 PID 2700 wrote to memory of 2924 2700 lfflxxf.exe 37 PID 2700 wrote to memory of 2924 2700 lfflxxf.exe 37 PID 2700 wrote to memory of 2924 2700 lfflxxf.exe 37 PID 2700 wrote to memory of 2924 2700 lfflxxf.exe 37 PID 2924 wrote to memory of 1908 2924 dpjpv.exe 38 PID 2924 wrote to memory of 1908 2924 dpjpv.exe 38 PID 2924 wrote to memory of 1908 2924 dpjpv.exe 38 PID 2924 wrote to memory of 1908 2924 dpjpv.exe 38 PID 1908 wrote to memory of 2640 1908 rfrlxlr.exe 39 PID 1908 wrote to memory of 2640 1908 rfrlxlr.exe 39 PID 1908 wrote to memory of 2640 1908 rfrlxlr.exe 39 PID 1908 wrote to memory of 2640 1908 rfrlxlr.exe 39 PID 2640 wrote to memory of 940 2640 xrlrrrx.exe 40 PID 2640 wrote to memory of 940 2640 xrlrrrx.exe 40 PID 2640 wrote to memory of 940 2640 xrlrrrx.exe 40 PID 2640 wrote to memory of 940 2640 xrlrrrx.exe 40 PID 940 wrote to memory of 2464 940 7nhhnh.exe 41 PID 940 wrote to memory of 2464 940 7nhhnh.exe 41 PID 940 wrote to memory of 2464 940 7nhhnh.exe 41 PID 940 wrote to memory of 2464 940 7nhhnh.exe 41 PID 2464 wrote to memory of 2064 2464 frrrfrx.exe 42 PID 2464 wrote to memory of 2064 2464 frrrfrx.exe 42 PID 2464 wrote to memory of 2064 2464 frrrfrx.exe 42 PID 2464 wrote to memory of 2064 2464 frrrfrx.exe 42 PID 2064 wrote to memory of 1432 2064 xxfxrrx.exe 43 PID 2064 wrote to memory of 1432 2064 xxfxrrx.exe 43 PID 2064 wrote to memory of 1432 2064 xxfxrrx.exe 43 PID 2064 wrote to memory of 1432 2064 xxfxrrx.exe 43 PID 1432 wrote to memory of 1604 1432 5rxfxlx.exe 44 PID 1432 wrote to memory of 1604 1432 5rxfxlx.exe 44 PID 1432 wrote to memory of 1604 1432 5rxfxlx.exe 44 PID 1432 wrote to memory of 1604 1432 5rxfxlx.exe 44 PID 1604 wrote to memory of 3020 1604 vvvjp.exe 45 PID 1604 wrote to memory of 3020 1604 vvvjp.exe 45 PID 1604 wrote to memory of 3020 1604 vvvjp.exe 45 PID 1604 wrote to memory of 3020 1604 vvvjp.exe 45 PID 3020 wrote to memory of 3012 3020 fffflrx.exe 46 PID 3020 wrote to memory of 3012 3020 fffflrx.exe 46 PID 3020 wrote to memory of 3012 3020 fffflrx.exe 46 PID 3020 wrote to memory of 3012 3020 fffflrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe"C:\Users\Admin\AppData\Local\Temp\a572002f055b6353b4dd9b7c0254e984a92ba73779b0bd7f3b998984c3608fa0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\5pjdd.exec:\5pjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\rllxllr.exec:\rllxllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\xrfxlrx.exec:\xrfxlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\pjpjj.exec:\pjpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lfflxxf.exec:\lfflxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dpjpv.exec:\dpjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rfrlxlr.exec:\rfrlxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\xrlrrrx.exec:\xrlrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7nhhnh.exec:\7nhhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\frrrfrx.exec:\frrrfrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\xxfxrrx.exec:\xxfxrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\5rxfxlx.exec:\5rxfxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\vvvjp.exec:\vvvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\fffflrx.exec:\fffflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\9vpdj.exec:\9vpdj.exe17⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1vvdj.exec:\1vvdj.exe18⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vpdjp.exec:\vpdjp.exe19⤵
- Executes dropped EXE
PID:2236 -
\??\c:\7fxrflr.exec:\7fxrflr.exe20⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ttnnbt.exec:\ttnnbt.exe21⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdjpp.exec:\jdjpp.exe22⤵
- Executes dropped EXE
PID:1016 -
\??\c:\thnnht.exec:\thnnht.exe23⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fflfxlr.exec:\fflfxlr.exe24⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hnbhhb.exec:\hnbhhb.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1600 -
\??\c:\bthnhn.exec:\bthnhn.exe26⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tnbnth.exec:\tnbnth.exe27⤵
- Executes dropped EXE
PID:912 -
\??\c:\5rfllrf.exec:\5rfllrf.exe28⤵
- Executes dropped EXE
PID:1532 -
\??\c:\7fxlrxf.exec:\7fxlrxf.exe29⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vppdp.exec:\vppdp.exe30⤵
- Executes dropped EXE
PID:780 -
\??\c:\vpjdv.exec:\vpjdv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\ffrlfxl.exec:\ffrlfxl.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\7pjvp.exec:\7pjvp.exe33⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpjjv.exec:\vpjjv.exe34⤵
- Executes dropped EXE
PID:332 -
\??\c:\ffrflrx.exec:\ffrflrx.exe35⤵
- Executes dropped EXE
PID:816 -
\??\c:\jvjjp.exec:\jvjjp.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1dpvd.exec:\1dpvd.exe37⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hhbhtt.exec:\hhbhtt.exe38⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7tbhbn.exec:\7tbhbn.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9lxrlrx.exec:\9lxrlrx.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\1pvpv.exec:\1pvpv.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dddjd.exec:\dddjd.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ntbhnb.exec:\ntbhnb.exe43⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hbhbnt.exec:\hbhbnt.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe45⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xxxlxfx.exec:\xxxlxfx.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:644 -
\??\c:\jjdvp.exec:\jjdvp.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tbbnth.exec:\tbbnth.exe48⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fxxlrfr.exec:\fxxlrfr.exe49⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lrrrlxf.exec:\lrrrlxf.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3jdpd.exec:\3jdpd.exe51⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jjvpj.exec:\jjvpj.exe52⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hnhbbt.exec:\hnhbbt.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tnhtbn.exec:\tnhtbn.exe54⤵
- Executes dropped EXE
PID:1308 -
\??\c:\7xxlrll.exec:\7xxlrll.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpdjv.exec:\vpdjv.exe56⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9jvjv.exec:\9jvjv.exe57⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hhbnbn.exec:\hhbnbn.exe58⤵
- Executes dropped EXE
PID:556 -
\??\c:\flrfflx.exec:\flrfflx.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3llrrfl.exec:\3llrrfl.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdvdp.exec:\jdvdp.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ppdvj.exec:\ppdvj.exe62⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nhttbh.exec:\nhttbh.exe63⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3xrllfx.exec:\3xrllfx.exe64⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fxxrfrf.exec:\fxxrfrf.exe65⤵
- Executes dropped EXE
PID:1868 -
\??\c:\djjjv.exec:\djjjv.exe66⤵PID:1680
-
\??\c:\hhthth.exec:\hhthth.exe67⤵PID:1924
-
\??\c:\3tbtnb.exec:\3tbtnb.exe68⤵PID:912
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe69⤵PID:1528
-
\??\c:\xrrflrl.exec:\xrrflrl.exe70⤵PID:2520
-
\??\c:\dvppv.exec:\dvppv.exe71⤵PID:2424
-
\??\c:\9jdvd.exec:\9jdvd.exe72⤵PID:780
-
\??\c:\hhbhnt.exec:\hhbhnt.exe73⤵PID:884
-
\??\c:\ffffrlx.exec:\ffffrlx.exe74⤵PID:1740
-
\??\c:\3xfllfl.exec:\3xfllfl.exe75⤵PID:1584
-
\??\c:\vpvpp.exec:\vpvpp.exe76⤵PID:2184
-
\??\c:\5pdpv.exec:\5pdpv.exe77⤵PID:2096
-
\??\c:\nhttht.exec:\nhttht.exe78⤵PID:2372
-
\??\c:\7hhntb.exec:\7hhntb.exe79⤵PID:2360
-
\??\c:\7nttbn.exec:\7nttbn.exe80⤵PID:2380
-
\??\c:\fxrllxr.exec:\fxrllxr.exe81⤵PID:2276
-
\??\c:\vjjpd.exec:\vjjpd.exe82⤵PID:2800
-
\??\c:\vvppj.exec:\vvppj.exe83⤵PID:2848
-
\??\c:\1nhbht.exec:\1nhbht.exe84⤵PID:2900
-
\??\c:\flfrxlr.exec:\flfrxlr.exe85⤵PID:2816
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe86⤵PID:2596
-
\??\c:\vdjjj.exec:\vdjjj.exe87⤵PID:2660
-
\??\c:\1bthhb.exec:\1bthhb.exe88⤵PID:3036
-
\??\c:\tbbnbh.exec:\tbbnbh.exe89⤵PID:2304
-
\??\c:\xxrlfrf.exec:\xxrlfrf.exe90⤵PID:1324
-
\??\c:\fxfflfx.exec:\fxfflfx.exe91⤵PID:2464
-
\??\c:\lrlxxlx.exec:\lrlxxlx.exe92⤵
- System Location Discovery: System Language Discovery
PID:1756 -
\??\c:\1pvvp.exec:\1pvvp.exe93⤵PID:2320
-
\??\c:\jdpvj.exec:\jdpvj.exe94⤵PID:2904
-
\??\c:\bththn.exec:\bththn.exe95⤵PID:1288
-
\??\c:\1ffrflx.exec:\1ffrflx.exe96⤵PID:896
-
\??\c:\flfxffl.exec:\flfxffl.exe97⤵PID:540
-
\??\c:\vpjvv.exec:\vpjvv.exe98⤵PID:3028
-
\??\c:\jvppp.exec:\jvppp.exe99⤵PID:2132
-
\??\c:\bthnht.exec:\bthnht.exe100⤵PID:2400
-
\??\c:\btnntb.exec:\btnntb.exe101⤵PID:2388
-
\??\c:\xxrfxlr.exec:\xxrfxlr.exe102⤵PID:352
-
\??\c:\lfxxxff.exec:\lfxxxff.exe103⤵
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\3jjdp.exec:\3jjdp.exe104⤵
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\ttbthn.exec:\ttbthn.exe105⤵PID:1616
-
\??\c:\nhhtht.exec:\nhhtht.exe106⤵PID:1888
-
\??\c:\3llxlxx.exec:\3llxlxx.exe107⤵PID:2456
-
\??\c:\7rrxlxf.exec:\7rrxlxf.exe108⤵PID:1692
-
\??\c:\ppvpj.exec:\ppvpj.exe109⤵PID:968
-
\??\c:\ddvjv.exec:\ddvjv.exe110⤵
- System Location Discovery: System Language Discovery
PID:320 -
\??\c:\tnhnht.exec:\tnhnht.exe111⤵
- System Location Discovery: System Language Discovery
PID:912 -
\??\c:\3bbnbh.exec:\3bbnbh.exe112⤵PID:1784
-
\??\c:\xxrlxfx.exec:\xxrlxfx.exe113⤵PID:2512
-
\??\c:\3jjvd.exec:\3jjvd.exe114⤵PID:2428
-
\??\c:\pjvjj.exec:\pjvjj.exe115⤵PID:2488
-
\??\c:\hnbntb.exec:\hnbntb.exe116⤵PID:2492
-
\??\c:\5lrfflr.exec:\5lrfflr.exe117⤵PID:1588
-
\??\c:\lffffrf.exec:\lffffrf.exe118⤵PID:2244
-
\??\c:\jvpdd.exec:\jvpdd.exe119⤵PID:2548
-
\??\c:\vvjvj.exec:\vvjvj.exe120⤵PID:2096
-
\??\c:\3htntb.exec:\3htntb.exe121⤵
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\7rllrrf.exec:\7rllrrf.exe122⤵PID:1488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-