Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 05:37
Behavioral task
behavioral1
Sample
8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe
-
Size
332KB
-
MD5
ebaec7b68d5c44db39bbe1bb2fb62c80
-
SHA1
f0b9c0c0ab704c2b87736911785193b6dc4c5511
-
SHA256
8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376c
-
SHA512
75f7e101ba67fc4e662c546453a0c14901e112b4d9545fe243e1a9757f2c674cd450f91cb116fc232ae37cc1da1912be1aba4a7bbbb36bb79030ca9a3afa10ff
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tl:94wFHoStJdSjylh2b77BoTMA9gX59sTd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2504-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-31-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-66-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2960-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-147-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/308-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-203-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2152-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-364-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3044-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1848-732-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-6837-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon behavioral1/memory/1932-12526-0x0000000076B40000-0x0000000076C3A000-memory.dmp family_blackmoon behavioral1/memory/1932-17209-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 flrxrfl.exe 2316 bbhhnn.exe 1920 3btbhh.exe 2792 pddvd.exe 2080 9xxfxxr.exe 2864 tnnnnn.exe 2960 vvppv.exe 2956 lrfllfr.exe 2620 7nnbtn.exe 2868 3xrrxff.exe 2648 bbbnht.exe 2176 jjdpv.exe 656 xxlfxlr.exe 1976 jdvpd.exe 776 rfxlrrf.exe 2584 pvdjj.exe 308 nhhhhb.exe 2780 djjvp.exe 2040 xxxxrfl.exe 1160 tbtnbn.exe 2124 djjpj.exe 2692 ntttnt.exe 2376 ddjjv.exe 2152 hthhnb.exe 408 pvjjj.exe 296 nnbnth.exe 1736 pppvp.exe 892 5xfxlrf.exe 2160 vjpdp.exe 864 xxxxxrx.exe 2204 thtbbn.exe 2524 rfrlxlx.exe 2180 tthbbt.exe 1632 jvvpv.exe 1600 3vvdj.exe 2272 rfxlffr.exe 2256 3fxlrlx.exe 2316 bnbbhn.exe 2948 dvpjp.exe 2284 rxrfrxf.exe 2440 rxrllfx.exe 2080 hntbhh.exe 2800 vjvpd.exe 2728 xlrrffl.exe 2604 9flfxlx.exe 2244 bttbhn.exe 2812 vdvpd.exe 1356 pdppd.exe 2600 rlxxxxl.exe 2616 1hthhb.exe 1256 btnbbh.exe 3044 ppjjv.exe 560 lxlxxxr.exe 3060 llrfrxl.exe 288 hbntnb.exe 1648 9vjdd.exe 2896 7rlxlfx.exe 2940 hbnbbt.exe 2340 btbthh.exe 756 djpjp.exe 2496 llllrrf.exe 1380 thbttt.exe 852 djpdj.exe 2088 rfffrlx.exe -
resource yara_rule behavioral1/memory/2504-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012119-5.dat upx behavioral1/memory/3004-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d41-15.dat upx behavioral1/memory/3004-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2316-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d59-24.dat upx behavioral1/memory/2316-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d81-34.dat upx behavioral1/memory/1920-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ec9-41.dat upx behavioral1/memory/2080-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f71-50.dat upx behavioral1/files/0x0007000000015ff5-59.dat upx behavioral1/memory/2864-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016241-67.dat upx behavioral1/memory/2960-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d3f-75.dat upx behavioral1/memory/2620-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d47-84.dat upx behavioral1/memory/2620-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4f-96.dat upx behavioral1/memory/2648-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d63-103.dat upx behavioral1/memory/2648-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d69-112.dat upx behavioral1/memory/2176-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1976-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6d-122.dat upx behavioral1/files/0x0006000000016d72-131.dat upx behavioral1/memory/776-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd9-139.dat upx behavioral1/files/0x0006000000016de0-148.dat upx behavioral1/files/0x0008000000015d0e-157.dat upx behavioral1/memory/308-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dea-163.dat upx behavioral1/files/0x0006000000016eb4-171.dat upx behavioral1/memory/2040-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017047-179.dat upx behavioral1/memory/2124-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001743a-187.dat upx behavioral1/files/0x000600000001747d-196.dat upx behavioral1/memory/2692-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017491-204.dat upx behavioral1/memory/2152-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175e7-213.dat upx behavioral1/memory/2152-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018669-220.dat upx behavioral1/files/0x001400000001866f-227.dat upx behavioral1/memory/296-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/892-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0011000000018682-238.dat upx behavioral1/memory/1736-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001868b-245.dat upx behavioral1/memory/864-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f2-253.dat upx behavioral1/memory/2204-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f8-260.dat upx behavioral1/memory/2204-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018731-271.dat upx behavioral1/memory/1632-289-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 3004 2504 8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe 30 PID 2504 wrote to memory of 3004 2504 8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe 30 PID 2504 wrote to memory of 3004 2504 8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe 30 PID 2504 wrote to memory of 3004 2504 8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe 30 PID 3004 wrote to memory of 2316 3004 flrxrfl.exe 31 PID 3004 wrote to memory of 2316 3004 flrxrfl.exe 31 PID 3004 wrote to memory of 2316 3004 flrxrfl.exe 31 PID 3004 wrote to memory of 2316 3004 flrxrfl.exe 31 PID 2316 wrote to memory of 1920 2316 bbhhnn.exe 32 PID 2316 wrote to memory of 1920 2316 bbhhnn.exe 32 PID 2316 wrote to memory of 1920 2316 bbhhnn.exe 32 PID 2316 wrote to memory of 1920 2316 bbhhnn.exe 32 PID 1920 wrote to memory of 2792 1920 3btbhh.exe 33 PID 1920 wrote to memory of 2792 1920 3btbhh.exe 33 PID 1920 wrote to memory of 2792 1920 3btbhh.exe 33 PID 1920 wrote to memory of 2792 1920 3btbhh.exe 33 PID 2792 wrote to memory of 2080 2792 pddvd.exe 34 PID 2792 wrote to memory of 2080 2792 pddvd.exe 34 PID 2792 wrote to memory of 2080 2792 pddvd.exe 34 PID 2792 wrote to memory of 2080 2792 pddvd.exe 34 PID 2080 wrote to memory of 2864 2080 9xxfxxr.exe 35 PID 2080 wrote to memory of 2864 2080 9xxfxxr.exe 35 PID 2080 wrote to memory of 2864 2080 9xxfxxr.exe 35 PID 2080 wrote to memory of 2864 2080 9xxfxxr.exe 35 PID 2864 wrote to memory of 2960 2864 tnnnnn.exe 36 PID 2864 wrote to memory of 2960 2864 tnnnnn.exe 36 PID 2864 wrote to memory of 2960 2864 tnnnnn.exe 36 PID 2864 wrote to memory of 2960 2864 tnnnnn.exe 36 PID 2960 wrote to memory of 2956 2960 vvppv.exe 37 PID 2960 wrote to memory of 2956 2960 vvppv.exe 37 PID 2960 wrote to memory of 2956 2960 vvppv.exe 37 PID 2960 wrote to memory of 2956 2960 vvppv.exe 37 PID 2956 wrote to memory of 2620 2956 lrfllfr.exe 38 PID 2956 wrote to memory of 2620 2956 lrfllfr.exe 38 PID 2956 wrote to memory of 2620 2956 lrfllfr.exe 38 PID 2956 wrote to memory of 2620 2956 lrfllfr.exe 38 PID 2620 wrote to memory of 2868 2620 7nnbtn.exe 39 PID 2620 wrote to memory of 2868 2620 7nnbtn.exe 39 PID 2620 wrote to memory of 2868 2620 7nnbtn.exe 39 PID 2620 wrote to memory of 2868 2620 7nnbtn.exe 39 PID 2868 wrote to memory of 2648 2868 3xrrxff.exe 40 PID 2868 wrote to memory of 2648 2868 3xrrxff.exe 40 PID 2868 wrote to memory of 2648 2868 3xrrxff.exe 40 PID 2868 wrote to memory of 2648 2868 3xrrxff.exe 40 PID 2648 wrote to memory of 2176 2648 bbbnht.exe 41 PID 2648 wrote to memory of 2176 2648 bbbnht.exe 41 PID 2648 wrote to memory of 2176 2648 bbbnht.exe 41 PID 2648 wrote to memory of 2176 2648 bbbnht.exe 41 PID 2176 wrote to memory of 656 2176 jjdpv.exe 42 PID 2176 wrote to memory of 656 2176 jjdpv.exe 42 PID 2176 wrote to memory of 656 2176 jjdpv.exe 42 PID 2176 wrote to memory of 656 2176 jjdpv.exe 42 PID 656 wrote to memory of 1976 656 xxlfxlr.exe 43 PID 656 wrote to memory of 1976 656 xxlfxlr.exe 43 PID 656 wrote to memory of 1976 656 xxlfxlr.exe 43 PID 656 wrote to memory of 1976 656 xxlfxlr.exe 43 PID 1976 wrote to memory of 776 1976 jdvpd.exe 44 PID 1976 wrote to memory of 776 1976 jdvpd.exe 44 PID 1976 wrote to memory of 776 1976 jdvpd.exe 44 PID 1976 wrote to memory of 776 1976 jdvpd.exe 44 PID 776 wrote to memory of 2584 776 rfxlrrf.exe 45 PID 776 wrote to memory of 2584 776 rfxlrrf.exe 45 PID 776 wrote to memory of 2584 776 rfxlrrf.exe 45 PID 776 wrote to memory of 2584 776 rfxlrrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe"C:\Users\Admin\AppData\Local\Temp\8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\flrxrfl.exec:\flrxrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bbhhnn.exec:\bbhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\3btbhh.exec:\3btbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\pddvd.exec:\pddvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9xxfxxr.exec:\9xxfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\tnnnnn.exec:\tnnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vvppv.exec:\vvppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lrfllfr.exec:\lrfllfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\7nnbtn.exec:\7nnbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3xrrxff.exec:\3xrrxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\bbbnht.exec:\bbbnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jjdpv.exec:\jjdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\xxlfxlr.exec:\xxlfxlr.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\jdvpd.exec:\jdvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rfxlrrf.exec:\rfxlrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\pvdjj.exec:\pvdjj.exe17⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhhhhb.exec:\nhhhhb.exe18⤵
- Executes dropped EXE
PID:308 -
\??\c:\djjvp.exec:\djjvp.exe19⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xxxxrfl.exec:\xxxxrfl.exe20⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tbtnbn.exec:\tbtnbn.exe21⤵
- Executes dropped EXE
PID:1160 -
\??\c:\djjpj.exec:\djjpj.exe22⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ntttnt.exec:\ntttnt.exe23⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ddjjv.exec:\ddjjv.exe24⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hthhnb.exec:\hthhnb.exe25⤵
- Executes dropped EXE
PID:2152 -
\??\c:\pvjjj.exec:\pvjjj.exe26⤵
- Executes dropped EXE
PID:408 -
\??\c:\nnbnth.exec:\nnbnth.exe27⤵
- Executes dropped EXE
PID:296 -
\??\c:\pppvp.exec:\pppvp.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5xfxlrf.exec:\5xfxlrf.exe29⤵
- Executes dropped EXE
PID:892 -
\??\c:\vjpdp.exec:\vjpdp.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xxxxxrx.exec:\xxxxxrx.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\thtbbn.exec:\thtbbn.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rfrlxlx.exec:\rfrlxlx.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tthbbt.exec:\tthbbt.exe34⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jvvpv.exec:\jvvpv.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3vvdj.exec:\3vvdj.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rfxlffr.exec:\rfxlffr.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3fxlrlx.exec:\3fxlrlx.exe38⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bnbbhn.exec:\bnbbhn.exe39⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dvpjp.exec:\dvpjp.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rxrfrxf.exec:\rxrfrxf.exe41⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rxrllfx.exec:\rxrllfx.exe42⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hntbhh.exec:\hntbhh.exe43⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vjvpd.exec:\vjvpd.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xlrrffl.exec:\xlrrffl.exe45⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9flfxlx.exec:\9flfxlx.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bttbhn.exec:\bttbhn.exe47⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vdvpd.exec:\vdvpd.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pdppd.exec:\pdppd.exe49⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rlxxxxl.exec:\rlxxxxl.exe50⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1hthhb.exec:\1hthhb.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\btnbbh.exec:\btnbbh.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\ppjjv.exec:\ppjjv.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lxlxxxr.exec:\lxlxxxr.exe54⤵
- Executes dropped EXE
PID:560 -
\??\c:\llrfrxl.exec:\llrfrxl.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbntnb.exec:\hbntnb.exe56⤵
- Executes dropped EXE
PID:288 -
\??\c:\9vjdd.exec:\9vjdd.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7rlxlfx.exec:\7rlxlfx.exe58⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbnbbt.exec:\hbnbbt.exe59⤵
- Executes dropped EXE
PID:2940 -
\??\c:\btbthh.exec:\btbthh.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\djpjp.exec:\djpjp.exe61⤵
- Executes dropped EXE
PID:756 -
\??\c:\llllrrf.exec:\llllrrf.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\thbttt.exec:\thbttt.exe63⤵
- Executes dropped EXE
PID:1380 -
\??\c:\djpdj.exec:\djpdj.exe64⤵
- Executes dropped EXE
PID:852 -
\??\c:\rfffrlx.exec:\rfffrlx.exe65⤵
- Executes dropped EXE
PID:2088 -
\??\c:\flxrfff.exec:\flxrfff.exe66⤵PID:2064
-
\??\c:\ttthhn.exec:\ttthhn.exe67⤵PID:1280
-
\??\c:\nttntt.exec:\nttntt.exe68⤵PID:2108
-
\??\c:\vjdjd.exec:\vjdjd.exe69⤵PID:2112
-
\??\c:\fxfrxfx.exec:\fxfrxfx.exe70⤵PID:1056
-
\??\c:\xxllrxl.exec:\xxllrxl.exe71⤵PID:1820
-
\??\c:\bhntnt.exec:\bhntnt.exe72⤵PID:1912
-
\??\c:\vppvd.exec:\vppvd.exe73⤵PID:2976
-
\??\c:\vpvdp.exec:\vpvdp.exe74⤵PID:1696
-
\??\c:\rrrflff.exec:\rrrflff.exe75⤵PID:892
-
\??\c:\hhbnhn.exec:\hhbnhn.exe76⤵PID:2072
-
\??\c:\jvppv.exec:\jvppv.exe77⤵PID:1188
-
\??\c:\jpppj.exec:\jpppj.exe78⤵PID:864
-
\??\c:\xrfxlrl.exec:\xrfxlrl.exe79⤵PID:888
-
\??\c:\xxrflrf.exec:\xxrflrf.exe80⤵PID:1944
-
\??\c:\bhhbtb.exec:\bhhbtb.exe81⤵PID:2368
-
\??\c:\nntnbb.exec:\nntnbb.exe82⤵PID:2180
-
\??\c:\vjdjp.exec:\vjdjp.exe83⤵PID:1708
-
\??\c:\fxxfrlf.exec:\fxxfrlf.exe84⤵PID:1600
-
\??\c:\hbbbhb.exec:\hbbbhb.exe85⤵PID:2508
-
\??\c:\5hnbnh.exec:\5hnbnh.exe86⤵PID:2256
-
\??\c:\jdvdj.exec:\jdvdj.exe87⤵PID:2068
-
\??\c:\rxlrlfl.exec:\rxlrlfl.exe88⤵PID:2948
-
\??\c:\bnhtnh.exec:\bnhtnh.exe89⤵PID:2304
-
\??\c:\thbthb.exec:\thbthb.exe90⤵PID:2168
-
\??\c:\vvpvv.exec:\vvpvv.exe91⤵PID:2720
-
\??\c:\rrlrlxr.exec:\rrlrlxr.exe92⤵PID:2796
-
\??\c:\bhntbb.exec:\bhntbb.exe93⤵PID:2240
-
\??\c:\tbbtth.exec:\tbbtth.exe94⤵PID:2604
-
\??\c:\jddvd.exec:\jddvd.exe95⤵PID:2916
-
\??\c:\xxxfxrx.exec:\xxxfxrx.exe96⤵PID:3068
-
\??\c:\bnbnth.exec:\bnbnth.exe97⤵PID:2084
-
\??\c:\jdddv.exec:\jdddv.exe98⤵PID:2648
-
\??\c:\frxfxlf.exec:\frxfxlf.exe99⤵PID:3056
-
\??\c:\hnhnbb.exec:\hnhnbb.exe100⤵PID:1256
-
\??\c:\hhhtht.exec:\hhhtht.exe101⤵PID:1740
-
\??\c:\pjjpv.exec:\pjjpv.exe102⤵PID:1972
-
\??\c:\pjdpj.exec:\pjdpj.exe103⤵PID:2696
-
\??\c:\lrrrxrl.exec:\lrrrxrl.exe104⤵PID:2928
-
\??\c:\hnnhbb.exec:\hnnhbb.exe105⤵PID:1588
-
\??\c:\vvjpj.exec:\vvjpj.exe106⤵PID:908
-
\??\c:\dvvdv.exec:\dvvdv.exe107⤵PID:2936
-
\??\c:\lrlffrl.exec:\lrlffrl.exe108⤵PID:596
-
\??\c:\hhbthn.exec:\hhbthn.exe109⤵PID:1792
-
\??\c:\btnttb.exec:\btnttb.exe110⤵PID:756
-
\??\c:\ppjjv.exec:\ppjjv.exe111⤵PID:2252
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe112⤵PID:2280
-
\??\c:\frlrlfx.exec:\frlrlfx.exe113⤵PID:2288
-
\??\c:\nnbhnt.exec:\nnbhnt.exe114⤵PID:2056
-
\??\c:\djjpd.exec:\djjpd.exe115⤵
- System Location Discovery: System Language Discovery
PID:352 -
\??\c:\vvdjd.exec:\vvdjd.exe116⤵PID:1848
-
\??\c:\9xlfflr.exec:\9xlfflr.exe117⤵PID:3028
-
\??\c:\5btbnt.exec:\5btbnt.exe118⤵PID:2112
-
\??\c:\djjjd.exec:\djjjd.exe119⤵PID:1132
-
\??\c:\rlrrfff.exec:\rlrrfff.exe120⤵PID:1820
-
\??\c:\lflfxff.exec:\lflfxff.exe121⤵PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-