Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 19:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe
-
Size
454KB
-
MD5
15e0738c63c63c3d97a016d15e07b9de
-
SHA1
8bc1099b7d7ba23e93bad718978588d7ec667e61
-
SHA256
05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd
-
SHA512
563bc0243556d77e60e8a521443c7d35d3aaf7699066d7ea96fe01497405ea766adbb1643c503cff3c6c3c6135311d08ed0440f457b3f2c7594e0ea8bf8ff3a2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-55-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2852-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-394-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/268-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-873-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-985-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-1031-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-1160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-1192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1644-1331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1860 lxffxrf.exe 1736 pvpdd.exe 2328 ffxrllr.exe 2168 htnbbb.exe 2852 ppjpd.exe 2904 jpjpd.exe 2896 9jjpd.exe 2884 9rxrfrf.exe 2612 dvjjp.exe 1876 jpjdj.exe 2104 fxrrllf.exe 1944 tnnhhb.exe 2952 bbhhhh.exe 2840 jpjdp.exe 2792 lrxrfxf.exe 1308 9nnbbt.exe 1544 jdvvj.exe 1500 xfrxfrf.exe 1196 9rrfrxf.exe 2396 5bthnt.exe 576 ddvdj.exe 1404 dpppj.exe 1512 1llxrfx.exe 1952 bttbht.exe 324 ttthbb.exe 1776 bnttbt.exe 2196 jjdpv.exe 2152 xlrlxlf.exe 1496 7btnnh.exe 2036 vjvjj.exe 1692 rllfxrl.exe 292 thtbnt.exe 2520 9pvpv.exe 1720 vvpjd.exe 1860 xrllllr.exe 1864 hthttb.exe 1144 djjvj.exe 2708 lllffxl.exe 2328 xffrfxx.exe 2876 tbbnhh.exe 2860 ppjdv.exe 2904 rxxfxlx.exe 2716 hthhbb.exe 2900 vvdpj.exe 1876 7xrxflx.exe 2212 3xfxrff.exe 1444 hhhtnn.exe 828 dpvjp.exe 2592 rxffllr.exe 2828 hnnbbn.exe 2968 pdppp.exe 2940 9xrxflx.exe 2984 bhhbnh.exe 1176 xlrlrfl.exe 268 xfrlrxr.exe 2720 nbthbh.exe 2084 9jjpv.exe 536 tthnht.exe 1632 xrfrlxr.exe 2964 tthtbh.exe 2104 ppppd.exe 448 xlrrrlx.exe 324 hbnhtb.exe 1780 vjdjv.exe -
resource yara_rule behavioral1/memory/1860-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-55-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2852-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-390-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-873-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-985-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-1012-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-1160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-1213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-1372-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1860 2508 05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe 30 PID 2508 wrote to memory of 1860 2508 05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe 30 PID 2508 wrote to memory of 1860 2508 05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe 30 PID 2508 wrote to memory of 1860 2508 05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe 30 PID 1860 wrote to memory of 1736 1860 lxffxrf.exe 31 PID 1860 wrote to memory of 1736 1860 lxffxrf.exe 31 PID 1860 wrote to memory of 1736 1860 lxffxrf.exe 31 PID 1860 wrote to memory of 1736 1860 lxffxrf.exe 31 PID 1736 wrote to memory of 2328 1736 pvpdd.exe 32 PID 1736 wrote to memory of 2328 1736 pvpdd.exe 32 PID 1736 wrote to memory of 2328 1736 pvpdd.exe 32 PID 1736 wrote to memory of 2328 1736 pvpdd.exe 32 PID 2328 wrote to memory of 2168 2328 ffxrllr.exe 33 PID 2328 wrote to memory of 2168 2328 ffxrllr.exe 33 PID 2328 wrote to memory of 2168 2328 ffxrllr.exe 33 PID 2328 wrote to memory of 2168 2328 ffxrllr.exe 33 PID 2168 wrote to memory of 2852 2168 htnbbb.exe 34 PID 2168 wrote to memory of 2852 2168 htnbbb.exe 34 PID 2168 wrote to memory of 2852 2168 htnbbb.exe 34 PID 2168 wrote to memory of 2852 2168 htnbbb.exe 34 PID 2852 wrote to memory of 2904 2852 ppjpd.exe 35 PID 2852 wrote to memory of 2904 2852 ppjpd.exe 35 PID 2852 wrote to memory of 2904 2852 ppjpd.exe 35 PID 2852 wrote to memory of 2904 2852 ppjpd.exe 35 PID 2904 wrote to memory of 2896 2904 jpjpd.exe 36 PID 2904 wrote to memory of 2896 2904 jpjpd.exe 36 PID 2904 wrote to memory of 2896 2904 jpjpd.exe 36 PID 2904 wrote to memory of 2896 2904 jpjpd.exe 36 PID 2896 wrote to memory of 2884 2896 9jjpd.exe 37 PID 2896 wrote to memory of 2884 2896 9jjpd.exe 37 PID 2896 wrote to memory of 2884 2896 9jjpd.exe 37 PID 2896 wrote to memory of 2884 2896 9jjpd.exe 37 PID 2884 wrote to memory of 2612 2884 9rxrfrf.exe 38 PID 2884 wrote to memory of 2612 2884 9rxrfrf.exe 38 PID 2884 wrote to memory of 2612 2884 9rxrfrf.exe 38 PID 2884 wrote to memory of 2612 2884 9rxrfrf.exe 38 PID 2612 wrote to memory of 1876 2612 dvjjp.exe 39 PID 2612 wrote to memory of 1876 2612 dvjjp.exe 39 PID 2612 wrote to memory of 1876 2612 dvjjp.exe 39 PID 2612 wrote to memory of 1876 2612 dvjjp.exe 39 PID 1876 wrote to memory of 2104 1876 jpjdj.exe 40 PID 1876 wrote to memory of 2104 1876 jpjdj.exe 40 PID 1876 wrote to memory of 2104 1876 jpjdj.exe 40 PID 1876 wrote to memory of 2104 1876 jpjdj.exe 40 PID 2104 wrote to memory of 1944 2104 fxrrllf.exe 41 PID 2104 wrote to memory of 1944 2104 fxrrllf.exe 41 PID 2104 wrote to memory of 1944 2104 fxrrllf.exe 41 PID 2104 wrote to memory of 1944 2104 fxrrllf.exe 41 PID 1944 wrote to memory of 2952 1944 tnnhhb.exe 42 PID 1944 wrote to memory of 2952 1944 tnnhhb.exe 42 PID 1944 wrote to memory of 2952 1944 tnnhhb.exe 42 PID 1944 wrote to memory of 2952 1944 tnnhhb.exe 42 PID 2952 wrote to memory of 2840 2952 bbhhhh.exe 43 PID 2952 wrote to memory of 2840 2952 bbhhhh.exe 43 PID 2952 wrote to memory of 2840 2952 bbhhhh.exe 43 PID 2952 wrote to memory of 2840 2952 bbhhhh.exe 43 PID 2840 wrote to memory of 2792 2840 jpjdp.exe 44 PID 2840 wrote to memory of 2792 2840 jpjdp.exe 44 PID 2840 wrote to memory of 2792 2840 jpjdp.exe 44 PID 2840 wrote to memory of 2792 2840 jpjdp.exe 44 PID 2792 wrote to memory of 1308 2792 lrxrfxf.exe 45 PID 2792 wrote to memory of 1308 2792 lrxrfxf.exe 45 PID 2792 wrote to memory of 1308 2792 lrxrfxf.exe 45 PID 2792 wrote to memory of 1308 2792 lrxrfxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe"C:\Users\Admin\AppData\Local\Temp\05ecc7abf8c65e7048032f1bd30110b0473e4685a6ef771ced933a375cf0cbdd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\lxffxrf.exec:\lxffxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\pvpdd.exec:\pvpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\ffxrllr.exec:\ffxrllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\htnbbb.exec:\htnbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ppjpd.exec:\ppjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jpjpd.exec:\jpjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9jjpd.exec:\9jjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\9rxrfrf.exec:\9rxrfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dvjjp.exec:\dvjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jpjdj.exec:\jpjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\fxrrllf.exec:\fxrrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\tnnhhb.exec:\tnnhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\bbhhhh.exec:\bbhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jpjdp.exec:\jpjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\lrxrfxf.exec:\lrxrfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9nnbbt.exec:\9nnbbt.exe17⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jdvvj.exec:\jdvvj.exe18⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xfrxfrf.exec:\xfrxfrf.exe19⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9rrfrxf.exec:\9rrfrxf.exe20⤵
- Executes dropped EXE
PID:1196 -
\??\c:\5bthnt.exec:\5bthnt.exe21⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ddvdj.exec:\ddvdj.exe22⤵
- Executes dropped EXE
PID:576 -
\??\c:\dpppj.exec:\dpppj.exe23⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1llxrfx.exec:\1llxrfx.exe24⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bttbht.exec:\bttbht.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ttthbb.exec:\ttthbb.exe26⤵
- Executes dropped EXE
PID:324 -
\??\c:\bnttbt.exec:\bnttbt.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jjdpv.exec:\jjdpv.exe28⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xlrlxlf.exec:\xlrlxlf.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7btnnh.exec:\7btnnh.exe30⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vjvjj.exec:\vjvjj.exe31⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rllfxrl.exec:\rllfxrl.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thtbnt.exec:\thtbnt.exe33⤵
- Executes dropped EXE
PID:292 -
\??\c:\9pvpv.exec:\9pvpv.exe34⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vvpjd.exec:\vvpjd.exe35⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xrllllr.exec:\xrllllr.exe36⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hthttb.exec:\hthttb.exe37⤵
- Executes dropped EXE
PID:1864 -
\??\c:\djjvj.exec:\djjvj.exe38⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lllffxl.exec:\lllffxl.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xffrfxx.exec:\xffrfxx.exe40⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tbbnhh.exec:\tbbnhh.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ppjdv.exec:\ppjdv.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rxxfxlx.exec:\rxxfxlx.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904 -
\??\c:\hthhbb.exec:\hthhbb.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vvdpj.exec:\vvdpj.exe45⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7xrxflx.exec:\7xrxflx.exe46⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3xfxrff.exec:\3xfxrff.exe47⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hhhtnn.exec:\hhhtnn.exe48⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dpvjp.exec:\dpvjp.exe49⤵
- Executes dropped EXE
PID:828 -
\??\c:\rxffllr.exec:\rxffllr.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hnnbbn.exec:\hnnbbn.exe51⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pdppp.exec:\pdppp.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9xrxflx.exec:\9xrxflx.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bhhbnh.exec:\bhhbnh.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xlrlrfl.exec:\xlrlrfl.exe55⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xfrlrxr.exec:\xfrlrxr.exe56⤵
- Executes dropped EXE
PID:268 -
\??\c:\nbthbh.exec:\nbthbh.exe57⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9jjpv.exec:\9jjpv.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tthnht.exec:\tthnht.exe59⤵
- Executes dropped EXE
PID:536 -
\??\c:\xrfrlxr.exec:\xrfrlxr.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tthtbh.exec:\tthtbh.exe61⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ppppd.exec:\ppppd.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xlrrrlx.exec:\xlrrrlx.exe63⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbnhtb.exec:\hbnhtb.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\vjdjv.exec:\vjdjv.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3ffrfxr.exec:\3ffrfxr.exe66⤵PID:1784
-
\??\c:\vvdjd.exec:\vvdjd.exe67⤵PID:2004
-
\??\c:\pddpv.exec:\pddpv.exe68⤵PID:2188
-
\??\c:\lrfrxff.exec:\lrfrxff.exe69⤵PID:344
-
\??\c:\hhhntb.exec:\hhhntb.exe70⤵PID:2636
-
\??\c:\jjppv.exec:\jjppv.exe71⤵PID:2684
-
\??\c:\vvvjp.exec:\vvvjp.exe72⤵PID:1416
-
\??\c:\rflfllx.exec:\rflfllx.exe73⤵PID:2520
-
\??\c:\ttntbn.exec:\ttntbn.exe74⤵PID:1592
-
\??\c:\3jjpd.exec:\3jjpd.exe75⤵PID:1588
-
\??\c:\vvdvj.exec:\vvdvj.exe76⤵PID:2528
-
\??\c:\9fffrxr.exec:\9fffrxr.exe77⤵PID:1144
-
\??\c:\tnthth.exec:\tnthth.exe78⤵PID:1812
-
\??\c:\pppjv.exec:\pppjv.exe79⤵PID:2704
-
\??\c:\xxrlfll.exec:\xxrlfll.exe80⤵PID:2284
-
\??\c:\xrrrflx.exec:\xrrrflx.exe81⤵PID:2740
-
\??\c:\jvjvp.exec:\jvjvp.exe82⤵PID:2016
-
\??\c:\vpjpd.exec:\vpjpd.exe83⤵PID:772
-
\??\c:\rffrrlx.exec:\rffrrlx.exe84⤵PID:2888
-
\??\c:\hhbtbh.exec:\hhbtbh.exe85⤵PID:2732
-
\??\c:\vvpjv.exec:\vvpjv.exe86⤵PID:2736
-
\??\c:\vjjvv.exec:\vjjvv.exe87⤵PID:2296
-
\??\c:\fflrfxl.exec:\fflrfxl.exe88⤵PID:2204
-
\??\c:\hnnbtb.exec:\hnnbtb.exe89⤵PID:2160
-
\??\c:\jpjvp.exec:\jpjvp.exe90⤵PID:756
-
\??\c:\7fxllrx.exec:\7fxllrx.exe91⤵PID:1944
-
\??\c:\7rfxffl.exec:\7rfxffl.exe92⤵PID:3048
-
\??\c:\pvvjd.exec:\pvvjd.exe93⤵PID:2432
-
\??\c:\djvvd.exec:\djvvd.exe94⤵PID:2208
-
\??\c:\llxlrrx.exec:\llxlrrx.exe95⤵PID:1272
-
\??\c:\hbbthn.exec:\hbbthn.exe96⤵PID:2968
-
\??\c:\jjjpj.exec:\jjjpj.exe97⤵PID:2440
-
\??\c:\ddvjp.exec:\ddvjp.exe98⤵PID:2120
-
\??\c:\llrfxll.exec:\llrfxll.exe99⤵PID:1432
-
\??\c:\bhnhbn.exec:\bhnhbn.exe100⤵PID:624
-
\??\c:\vddjp.exec:\vddjp.exe101⤵PID:2720
-
\??\c:\7jvdp.exec:\7jvdp.exe102⤵PID:2824
-
\??\c:\lxrllxl.exec:\lxrllxl.exe103⤵PID:2980
-
\??\c:\bbbnht.exec:\bbbnht.exe104⤵PID:2576
-
\??\c:\jvppp.exec:\jvppp.exe105⤵PID:1512
-
\??\c:\9frffrl.exec:\9frffrl.exe106⤵PID:1952
-
\??\c:\3thtnt.exec:\3thtnt.exe107⤵PID:1364
-
\??\c:\bnnbnt.exec:\bnnbnt.exe108⤵PID:1636
-
\??\c:\vvdvd.exec:\vvdvd.exe109⤵PID:1540
-
\??\c:\xlffrxf.exec:\xlffrxf.exe110⤵PID:1796
-
\??\c:\tttbbb.exec:\tttbbb.exe111⤵PID:2436
-
\??\c:\5vpdp.exec:\5vpdp.exe112⤵PID:1844
-
\??\c:\rxlrrrr.exec:\rxlrrrr.exe113⤵PID:2248
-
\??\c:\ntnhnn.exec:\ntnhnn.exe114⤵PID:292
-
\??\c:\pjpjp.exec:\pjpjp.exe115⤵PID:1828
-
\??\c:\xlxfxxf.exec:\xlxfxxf.exe116⤵PID:876
-
\??\c:\bbbnhh.exec:\bbbnhh.exe117⤵PID:1584
-
\??\c:\9vpdv.exec:\9vpdv.exe118⤵PID:2352
-
\??\c:\vjvpp.exec:\vjvpp.exe119⤵PID:2404
-
\??\c:\fflrflr.exec:\fflrflr.exe120⤵PID:2264
-
\??\c:\htnntt.exec:\htnntt.exe121⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-