Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 05:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe
-
Size
455KB
-
MD5
0c95c2876b8d21d73cf6062d2342d9e5
-
SHA1
e344def4d05e12d2317dbd2ff774aaeb5f0c9a41
-
SHA256
b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9
-
SHA512
4c74ad23edbfcad7604be15fac7c991ad06897d6074609258ce3e38dab57f838a6095792dbe0f5aab3f4ec946cd9e30ec6f4bbee7a6bae34aec7c6d1ddc9a1d7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRlv:q7Tc2NYHUrAwfMp3CDRl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2204-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-193-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1944-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-255-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2144-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-308-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1472-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-494-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/648-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-571-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1972-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-586-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/272-747-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1724-754-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/396-773-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/280-817-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-911-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/284-969-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2176 vvvjj.exe 2652 dvppv.exe 1472 3lxlrrx.exe 2696 pjjpd.exe 3044 vjvvv.exe 2576 7rlflrx.exe 2596 7dppj.exe 2616 xxlfllx.exe 2620 ddjdj.exe 624 rlxxflf.exe 2760 9tntnt.exe 288 vvjjp.exe 2896 xrfxxxl.exe 2464 vvjpd.exe 2120 rxlrlxl.exe 1424 9nbtbh.exe 2996 9lfrflr.exe 1516 3hnnnn.exe 1724 xfrxllf.exe 272 frfllxf.exe 1236 xxlxlrf.exe 1824 5fflrrf.exe 1944 ddvvd.exe 1532 9rlfflr.exe 1032 vvdjp.exe 2512 fxrxflx.exe 568 jpvvv.exe 1708 vvjjp.exe 2144 tnhhnn.exe 2368 jjdjd.exe 2236 9hhbht.exe 2100 pjvvd.exe 3016 xxflflf.exe 2248 5nhhnt.exe 1472 btnhhb.exe 2716 ddjpj.exe 2808 1lxfxfr.exe 3032 nnhtbb.exe 2904 nhtntt.exe 2300 jjvvj.exe 2732 fxfrlfx.exe 2644 hhbtbb.exe 444 djdjp.exe 2636 dddjv.exe 2952 xxrxllr.exe 2756 7tnbnt.exe 2864 9ttthn.exe 2096 vvvvd.exe 1252 rrlxflf.exe 1144 ffxrflx.exe 2120 hbntbh.exe 2984 jppdj.exe 2968 jpdvp.exe 1688 5rlxlxl.exe 1516 bhhhnt.exe 2104 jpdpp.exe 660 vpjvd.exe 1336 xflxxrr.exe 3056 nhbhnt.exe 1984 dvddj.exe 648 pjvvd.exe 2084 1fllrrr.exe 2128 btntbt.exe 280 hbttbt.exe -
resource yara_rule behavioral1/memory/2204-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-571-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1972-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-586-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2616-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-747-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/396-773-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/280-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-911-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2900-950-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-969-0x0000000000340000-0x000000000036A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2176 2204 b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe 31 PID 2204 wrote to memory of 2176 2204 b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe 31 PID 2204 wrote to memory of 2176 2204 b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe 31 PID 2204 wrote to memory of 2176 2204 b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe 31 PID 2176 wrote to memory of 2652 2176 vvvjj.exe 32 PID 2176 wrote to memory of 2652 2176 vvvjj.exe 32 PID 2176 wrote to memory of 2652 2176 vvvjj.exe 32 PID 2176 wrote to memory of 2652 2176 vvvjj.exe 32 PID 2652 wrote to memory of 1472 2652 dvppv.exe 33 PID 2652 wrote to memory of 1472 2652 dvppv.exe 33 PID 2652 wrote to memory of 1472 2652 dvppv.exe 33 PID 2652 wrote to memory of 1472 2652 dvppv.exe 33 PID 1472 wrote to memory of 2696 1472 3lxlrrx.exe 34 PID 1472 wrote to memory of 2696 1472 3lxlrrx.exe 34 PID 1472 wrote to memory of 2696 1472 3lxlrrx.exe 34 PID 1472 wrote to memory of 2696 1472 3lxlrrx.exe 34 PID 2696 wrote to memory of 3044 2696 pjjpd.exe 35 PID 2696 wrote to memory of 3044 2696 pjjpd.exe 35 PID 2696 wrote to memory of 3044 2696 pjjpd.exe 35 PID 2696 wrote to memory of 3044 2696 pjjpd.exe 35 PID 3044 wrote to memory of 2576 3044 vjvvv.exe 36 PID 3044 wrote to memory of 2576 3044 vjvvv.exe 36 PID 3044 wrote to memory of 2576 3044 vjvvv.exe 36 PID 3044 wrote to memory of 2576 3044 vjvvv.exe 36 PID 2576 wrote to memory of 2596 2576 7rlflrx.exe 37 PID 2576 wrote to memory of 2596 2576 7rlflrx.exe 37 PID 2576 wrote to memory of 2596 2576 7rlflrx.exe 37 PID 2576 wrote to memory of 2596 2576 7rlflrx.exe 37 PID 2596 wrote to memory of 2616 2596 7dppj.exe 38 PID 2596 wrote to memory of 2616 2596 7dppj.exe 38 PID 2596 wrote to memory of 2616 2596 7dppj.exe 38 PID 2596 wrote to memory of 2616 2596 7dppj.exe 38 PID 2616 wrote to memory of 2620 2616 xxlfllx.exe 39 PID 2616 wrote to memory of 2620 2616 xxlfllx.exe 39 PID 2616 wrote to memory of 2620 2616 xxlfllx.exe 39 PID 2616 wrote to memory of 2620 2616 xxlfllx.exe 39 PID 2620 wrote to memory of 624 2620 ddjdj.exe 40 PID 2620 wrote to memory of 624 2620 ddjdj.exe 40 PID 2620 wrote to memory of 624 2620 ddjdj.exe 40 PID 2620 wrote to memory of 624 2620 ddjdj.exe 40 PID 624 wrote to memory of 2760 624 rlxxflf.exe 41 PID 624 wrote to memory of 2760 624 rlxxflf.exe 41 PID 624 wrote to memory of 2760 624 rlxxflf.exe 41 PID 624 wrote to memory of 2760 624 rlxxflf.exe 41 PID 2760 wrote to memory of 288 2760 9tntnt.exe 42 PID 2760 wrote to memory of 288 2760 9tntnt.exe 42 PID 2760 wrote to memory of 288 2760 9tntnt.exe 42 PID 2760 wrote to memory of 288 2760 9tntnt.exe 42 PID 288 wrote to memory of 2896 288 vvjjp.exe 43 PID 288 wrote to memory of 2896 288 vvjjp.exe 43 PID 288 wrote to memory of 2896 288 vvjjp.exe 43 PID 288 wrote to memory of 2896 288 vvjjp.exe 43 PID 2896 wrote to memory of 2464 2896 xrfxxxl.exe 44 PID 2896 wrote to memory of 2464 2896 xrfxxxl.exe 44 PID 2896 wrote to memory of 2464 2896 xrfxxxl.exe 44 PID 2896 wrote to memory of 2464 2896 xrfxxxl.exe 44 PID 2464 wrote to memory of 2120 2464 vvjpd.exe 45 PID 2464 wrote to memory of 2120 2464 vvjpd.exe 45 PID 2464 wrote to memory of 2120 2464 vvjpd.exe 45 PID 2464 wrote to memory of 2120 2464 vvjpd.exe 45 PID 2120 wrote to memory of 1424 2120 rxlrlxl.exe 46 PID 2120 wrote to memory of 1424 2120 rxlrlxl.exe 46 PID 2120 wrote to memory of 1424 2120 rxlrlxl.exe 46 PID 2120 wrote to memory of 1424 2120 rxlrlxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe"C:\Users\Admin\AppData\Local\Temp\b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vvvjj.exec:\vvvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\dvppv.exec:\dvppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3lxlrrx.exec:\3lxlrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\pjjpd.exec:\pjjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vjvvv.exec:\vjvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\7rlflrx.exec:\7rlflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7dppj.exec:\7dppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xxlfllx.exec:\xxlfllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ddjdj.exec:\ddjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rlxxflf.exec:\rlxxflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\9tntnt.exec:\9tntnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vvjjp.exec:\vvjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vvjpd.exec:\vvjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\rxlrlxl.exec:\rxlrlxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\9nbtbh.exec:\9nbtbh.exe17⤵
- Executes dropped EXE
PID:1424 -
\??\c:\9lfrflr.exec:\9lfrflr.exe18⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3hnnnn.exec:\3hnnnn.exe19⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xfrxllf.exec:\xfrxllf.exe20⤵
- Executes dropped EXE
PID:1724 -
\??\c:\frfllxf.exec:\frfllxf.exe21⤵
- Executes dropped EXE
PID:272 -
\??\c:\xxlxlrf.exec:\xxlxlrf.exe22⤵
- Executes dropped EXE
PID:1236 -
\??\c:\5fflrrf.exec:\5fflrrf.exe23⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ddvvd.exec:\ddvvd.exe24⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9rlfflr.exec:\9rlfflr.exe25⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvdjp.exec:\vvdjp.exe26⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fxrxflx.exec:\fxrxflx.exe27⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jpvvv.exec:\jpvvv.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\vvjjp.exec:\vvjjp.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tnhhnn.exec:\tnhhnn.exe30⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jjdjd.exec:\jjdjd.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9hhbht.exec:\9hhbht.exe32⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xxflflf.exec:\xxflflf.exe34⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5nhhnt.exec:\5nhhnt.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\btnhhb.exec:\btnhhb.exe36⤵
- Executes dropped EXE
PID:1472 -
\??\c:\ddjpj.exec:\ddjpj.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1lxfxfr.exec:\1lxfxfr.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nnhtbb.exec:\nnhtbb.exe39⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nhtntt.exec:\nhtntt.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jjvvj.exec:\jjvvj.exe41⤵
- Executes dropped EXE
PID:2300 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhbtbb.exec:\hhbtbb.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\djdjp.exec:\djdjp.exe44⤵
- Executes dropped EXE
PID:444 -
\??\c:\dddjv.exec:\dddjv.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xxrxllr.exec:\xxrxllr.exe46⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7tnbnt.exec:\7tnbnt.exe47⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9ttthn.exec:\9ttthn.exe48⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vvvvd.exec:\vvvvd.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rrlxflf.exec:\rrlxflf.exe50⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ffxrflx.exec:\ffxrflx.exe51⤵
- Executes dropped EXE
PID:1144 -
\??\c:\hbntbh.exec:\hbntbh.exe52⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jppdj.exec:\jppdj.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jpdvp.exec:\jpdvp.exe54⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5rlxlxl.exec:\5rlxlxl.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bhhhnt.exec:\bhhhnt.exe56⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jpdpp.exec:\jpdpp.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpjvd.exec:\vpjvd.exe58⤵
- Executes dropped EXE
PID:660 -
\??\c:\xflxxrr.exec:\xflxxrr.exe59⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nhbhnt.exec:\nhbhnt.exe60⤵
- Executes dropped EXE
PID:3056 -
\??\c:\dvddj.exec:\dvddj.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pjvvd.exec:\pjvvd.exe62⤵
- Executes dropped EXE
PID:648 -
\??\c:\1fllrrr.exec:\1fllrrr.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\btntbt.exec:\btntbt.exe64⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbttbt.exec:\hbttbt.exe65⤵
- Executes dropped EXE
PID:280 -
\??\c:\jvpdp.exec:\jvpdp.exe66⤵PID:1728
-
\??\c:\1fffflx.exec:\1fffflx.exe67⤵PID:2492
-
\??\c:\thnntb.exec:\thnntb.exe68⤵PID:1504
-
\??\c:\jvpvd.exec:\jvpvd.exe69⤵PID:2420
-
\??\c:\jdppv.exec:\jdppv.exe70⤵PID:1412
-
\??\c:\xfllfrl.exec:\xfllfrl.exe71⤵PID:2140
-
\??\c:\3htttb.exec:\3htttb.exe72⤵PID:1572
-
\??\c:\thtbhb.exec:\thtbhb.exe73⤵PID:1936
-
\??\c:\vpjvj.exec:\vpjvj.exe74⤵PID:1972
-
\??\c:\9rlrlfl.exec:\9rlrlfl.exe75⤵PID:2844
-
\??\c:\xlxfffl.exec:\xlxfffl.exe76⤵PID:2676
-
\??\c:\hhtthh.exec:\hhtthh.exe77⤵PID:2248
-
\??\c:\9jppv.exec:\9jppv.exe78⤵PID:2712
-
\??\c:\3frrxfr.exec:\3frrxfr.exe79⤵PID:2696
-
\??\c:\lxrfrrf.exec:\lxrfrrf.exe80⤵PID:2808
-
\??\c:\nnbbhh.exec:\nnbbhh.exe81⤵PID:3032
-
\??\c:\pdjjj.exec:\pdjjj.exe82⤵
- System Location Discovery: System Language Discovery
PID:2596 -
\??\c:\pddpv.exec:\pddpv.exe83⤵PID:2736
-
\??\c:\xrfflff.exec:\xrfflff.exe84⤵PID:1700
-
\??\c:\7fxlllx.exec:\7fxlllx.exe85⤵PID:2616
-
\??\c:\9tttbh.exec:\9tttbh.exe86⤵PID:2032
-
\??\c:\dpvvv.exec:\dpvvv.exe87⤵PID:2628
-
\??\c:\pjdjp.exec:\pjdjp.exe88⤵PID:1604
-
\??\c:\lfxlrrl.exec:\lfxlrrl.exe89⤵PID:2888
-
\??\c:\3nbbhn.exec:\3nbbhn.exe90⤵PID:2900
-
\??\c:\jvjdj.exec:\jvjdj.exe91⤵PID:1256
-
\??\c:\pjvvd.exec:\pjvvd.exe92⤵PID:2880
-
\??\c:\9fxllrf.exec:\9fxllrf.exe93⤵PID:2020
-
\??\c:\1xxlrll.exec:\1xxlrll.exe94⤵PID:1372
-
\??\c:\5nhhtb.exec:\5nhhtb.exe95⤵PID:1424
-
\??\c:\1pdjp.exec:\1pdjp.exe96⤵PID:2972
-
\??\c:\5jddv.exec:\5jddv.exe97⤵PID:1304
-
\??\c:\5lfrfrl.exec:\5lfrfrl.exe98⤵PID:1724
-
\??\c:\thtthh.exec:\thtthh.exe99⤵PID:740
-
\??\c:\3btnnn.exec:\3btnnn.exe100⤵PID:272
-
\??\c:\jvjdd.exec:\jvjdd.exe101⤵PID:1236
-
\??\c:\7xrlfll.exec:\7xrlfll.exe102⤵PID:1288
-
\??\c:\hbtbnn.exec:\hbtbnn.exe103⤵PID:1044
-
\??\c:\nbnnbt.exec:\nbnnbt.exe104⤵PID:396
-
\??\c:\pvvpp.exec:\pvvpp.exe105⤵PID:1752
-
\??\c:\5lxxxfl.exec:\5lxxxfl.exe106⤵PID:1564
-
\??\c:\nbntbb.exec:\nbntbb.exe107⤵PID:2272
-
\??\c:\thttbb.exec:\thttbb.exe108⤵PID:280
-
\??\c:\vvpdd.exec:\vvpdd.exe109⤵PID:2304
-
\??\c:\7frrrrf.exec:\7frrrrf.exe110⤵PID:556
-
\??\c:\xlxfllr.exec:\xlxfllr.exe111⤵PID:1708
-
\??\c:\5bthhn.exec:\5bthhn.exe112⤵PID:2144
-
\??\c:\5vjpv.exec:\5vjpv.exe113⤵PID:2256
-
\??\c:\dpvdp.exec:\dpvdp.exe114⤵PID:2184
-
\??\c:\rfrxxrx.exec:\rfrxxrx.exe115⤵PID:2164
-
\??\c:\hthhnn.exec:\hthhnn.exe116⤵PID:2388
-
\??\c:\5bbntt.exec:\5bbntt.exe117⤵PID:3016
-
\??\c:\dpvdp.exec:\dpvdp.exe118⤵PID:1464
-
\??\c:\fxlfflr.exec:\fxlfflr.exe119⤵PID:2676
-
\??\c:\rlflxxl.exec:\rlflxxl.exe120⤵
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\1thnbb.exec:\1thnbb.exe121⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-