Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 01:05
Behavioral task
behavioral1
Sample
f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe
-
Size
3.7MB
-
MD5
2264fd608f92fe3d4cbc2a0bd62a8ed0
-
SHA1
3d91956f1745ce2042a509e7fe38be8807ccd0d9
-
SHA256
f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576
-
SHA512
cae5a52602a9f73e8495dc4dccac0abc1fdee4fb1737bfb2d85348c5d7984ecd6bdeed408fbcdee012b4f03614954f6ca314a2b6060313e7cc01ad6e6f25b09f
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF985:U6XLq/qPPslzKx/dJg1ErmNI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2108-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1412-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-449-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/444-484-0x0000000001F10000-0x0000000001F37000-memory.dmp family_blackmoon behavioral1/memory/2468-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-506-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2488-556-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2108-573-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-636-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-643-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1476-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-802-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2356-803-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-856-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/3068-891-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2728-897-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3012-912-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2528 vjvdd.exe 2040 nhttbh.exe 2344 9llrlfr.exe 1668 7nhthn.exe 3012 ffffrxr.exe 3000 pjdvj.exe 2792 jdvjj.exe 2676 nnhhtt.exe 2652 xlrxxlx.exe 1412 3dpjj.exe 568 rlflxrf.exe 1532 pjjpv.exe 1964 ppjpv.exe 2520 7dvdp.exe 1512 3pvdj.exe 292 jdpvj.exe 1204 rlrxllr.exe 2484 xxllllx.exe 2448 hbttbn.exe 2508 bbbbnb.exe 2256 nnhtnt.exe 3032 vvdpd.exe 1684 1dpvd.exe 864 9bhthh.exe 288 nntnnt.exe 1764 3jjpd.exe 884 jjjvj.exe 2464 ttbntn.exe 3008 3thnbh.exe 2500 bthhtn.exe 1644 ppjvj.exe 892 tthnhb.exe 2056 hbtnbn.exe 1724 ffxxrlr.exe 3056 lfrfrrx.exe 2168 jdpvd.exe 2040 pjjpv.exe 1480 vjjpv.exe 2872 hhtbnn.exe 3004 1nhntb.exe 2744 xrxfrxf.exe 3000 pjdjv.exe 2784 7vpjv.exe 2632 9dvvd.exe 2740 nnnnbh.exe 2544 hbhhnt.exe 2372 rllrllr.exe 2860 3fxlrxl.exe 1104 vpjjv.exe 1476 9bbtht.exe 672 bhnnbb.exe 1688 hhhthn.exe 292 xxrfxxf.exe 1204 xrffrrx.exe 2976 3ddjd.exe 2448 vpjpj.exe 2856 nnbnhb.exe 2960 hbthbh.exe 832 ffxlrrf.exe 2800 7vjpd.exe 444 vjddj.exe 1140 bbhbtb.exe 2468 bbbnbh.exe 2604 lllxrrf.exe -
resource yara_rule behavioral1/memory/2108-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-8.dat upx behavioral1/memory/2108-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173fb-16.dat upx behavioral1/memory/2040-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017403-27.dat upx behavioral1/memory/1668-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001747b-36.dat upx behavioral1/files/0x000900000001739c-44.dat upx behavioral1/memory/3012-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001748f-53.dat upx behavioral1/memory/3000-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174ac-62.dat upx behavioral1/memory/2676-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001700000001866d-72.dat upx behavioral1/files/0x0006000000019271-80.dat upx behavioral1/memory/2652-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019273-89.dat upx behavioral1/files/0x0005000000019277-98.dat upx behavioral1/memory/1412-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/568-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1532-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019382-108.dat upx behavioral1/files/0x0005000000019389-117.dat upx behavioral1/files/0x00050000000193be-125.dat upx behavioral1/files/0x00050000000193c4-132.dat upx behavioral1/memory/1512-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cc-141.dat upx behavioral1/memory/292-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1204-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d9-151.dat upx behavioral1/memory/2484-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019401-169.dat upx behavioral1/files/0x0005000000019403-176.dat upx behavioral1/files/0x00050000000193df-160.dat upx behavioral1/files/0x000500000001942f-184.dat upx behavioral1/files/0x000500000001947e-193.dat upx behavioral1/memory/2256-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d8-201.dat upx behavioral1/files/0x0005000000019539-210.dat upx behavioral1/memory/864-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195e4-219.dat upx behavioral1/files/0x000500000001961b-226.dat upx behavioral1/memory/1764-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/884-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-236.dat upx behavioral1/files/0x000500000001961f-245.dat upx behavioral1/files/0x0005000000019620-252.dat upx behavioral1/files/0x0005000000019621-260.dat upx behavioral1/memory/2500-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-269.dat upx behavioral1/files/0x0005000000019625-277.dat upx behavioral1/memory/892-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3056-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1480-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3004-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3004-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-359-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-366-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2528 2108 f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe 30 PID 2108 wrote to memory of 2528 2108 f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe 30 PID 2108 wrote to memory of 2528 2108 f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe 30 PID 2108 wrote to memory of 2528 2108 f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe 30 PID 2528 wrote to memory of 2040 2528 vjvdd.exe 31 PID 2528 wrote to memory of 2040 2528 vjvdd.exe 31 PID 2528 wrote to memory of 2040 2528 vjvdd.exe 31 PID 2528 wrote to memory of 2040 2528 vjvdd.exe 31 PID 2040 wrote to memory of 2344 2040 nhttbh.exe 32 PID 2040 wrote to memory of 2344 2040 nhttbh.exe 32 PID 2040 wrote to memory of 2344 2040 nhttbh.exe 32 PID 2040 wrote to memory of 2344 2040 nhttbh.exe 32 PID 2344 wrote to memory of 1668 2344 9llrlfr.exe 33 PID 2344 wrote to memory of 1668 2344 9llrlfr.exe 33 PID 2344 wrote to memory of 1668 2344 9llrlfr.exe 33 PID 2344 wrote to memory of 1668 2344 9llrlfr.exe 33 PID 1668 wrote to memory of 3012 1668 7nhthn.exe 34 PID 1668 wrote to memory of 3012 1668 7nhthn.exe 34 PID 1668 wrote to memory of 3012 1668 7nhthn.exe 34 PID 1668 wrote to memory of 3012 1668 7nhthn.exe 34 PID 3012 wrote to memory of 3000 3012 ffffrxr.exe 35 PID 3012 wrote to memory of 3000 3012 ffffrxr.exe 35 PID 3012 wrote to memory of 3000 3012 ffffrxr.exe 35 PID 3012 wrote to memory of 3000 3012 ffffrxr.exe 35 PID 3000 wrote to memory of 2792 3000 pjdvj.exe 36 PID 3000 wrote to memory of 2792 3000 pjdvj.exe 36 PID 3000 wrote to memory of 2792 3000 pjdvj.exe 36 PID 3000 wrote to memory of 2792 3000 pjdvj.exe 36 PID 2792 wrote to memory of 2676 2792 jdvjj.exe 37 PID 2792 wrote to memory of 2676 2792 jdvjj.exe 37 PID 2792 wrote to memory of 2676 2792 jdvjj.exe 37 PID 2792 wrote to memory of 2676 2792 jdvjj.exe 37 PID 2676 wrote to memory of 2652 2676 nnhhtt.exe 38 PID 2676 wrote to memory of 2652 2676 nnhhtt.exe 38 PID 2676 wrote to memory of 2652 2676 nnhhtt.exe 38 PID 2676 wrote to memory of 2652 2676 nnhhtt.exe 38 PID 2652 wrote to memory of 1412 2652 xlrxxlx.exe 39 PID 2652 wrote to memory of 1412 2652 xlrxxlx.exe 39 PID 2652 wrote to memory of 1412 2652 xlrxxlx.exe 39 PID 2652 wrote to memory of 1412 2652 xlrxxlx.exe 39 PID 1412 wrote to memory of 568 1412 3dpjj.exe 40 PID 1412 wrote to memory of 568 1412 3dpjj.exe 40 PID 1412 wrote to memory of 568 1412 3dpjj.exe 40 PID 1412 wrote to memory of 568 1412 3dpjj.exe 40 PID 568 wrote to memory of 1532 568 rlflxrf.exe 41 PID 568 wrote to memory of 1532 568 rlflxrf.exe 41 PID 568 wrote to memory of 1532 568 rlflxrf.exe 41 PID 568 wrote to memory of 1532 568 rlflxrf.exe 41 PID 1532 wrote to memory of 1964 1532 pjjpv.exe 42 PID 1532 wrote to memory of 1964 1532 pjjpv.exe 42 PID 1532 wrote to memory of 1964 1532 pjjpv.exe 42 PID 1532 wrote to memory of 1964 1532 pjjpv.exe 42 PID 1964 wrote to memory of 2520 1964 ppjpv.exe 43 PID 1964 wrote to memory of 2520 1964 ppjpv.exe 43 PID 1964 wrote to memory of 2520 1964 ppjpv.exe 43 PID 1964 wrote to memory of 2520 1964 ppjpv.exe 43 PID 2520 wrote to memory of 1512 2520 7dvdp.exe 44 PID 2520 wrote to memory of 1512 2520 7dvdp.exe 44 PID 2520 wrote to memory of 1512 2520 7dvdp.exe 44 PID 2520 wrote to memory of 1512 2520 7dvdp.exe 44 PID 1512 wrote to memory of 292 1512 3pvdj.exe 46 PID 1512 wrote to memory of 292 1512 3pvdj.exe 46 PID 1512 wrote to memory of 292 1512 3pvdj.exe 46 PID 1512 wrote to memory of 292 1512 3pvdj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe"C:\Users\Admin\AppData\Local\Temp\f46733db81b7cace690a167c4ebb78221e99772de1631fddacccf59595ffb576N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vjvdd.exec:\vjvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nhttbh.exec:\nhttbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\9llrlfr.exec:\9llrlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\7nhthn.exec:\7nhthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ffffrxr.exec:\ffffrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\pjdvj.exec:\pjdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jdvjj.exec:\jdvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\nnhhtt.exec:\nnhhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xlrxxlx.exec:\xlrxxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3dpjj.exec:\3dpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\rlflxrf.exec:\rlflxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\pjjpv.exec:\pjjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\ppjpv.exec:\ppjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\7dvdp.exec:\7dvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3pvdj.exec:\3pvdj.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:292 -
\??\c:\rlrxllr.exec:\rlrxllr.exe18⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xxllllx.exec:\xxllllx.exe19⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbttbn.exec:\hbttbn.exe20⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbbbnb.exec:\bbbbnb.exe21⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nnhtnt.exec:\nnhtnt.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vvdpd.exec:\vvdpd.exe23⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1dpvd.exec:\1dpvd.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9bhthh.exec:\9bhthh.exe25⤵
- Executes dropped EXE
PID:864 -
\??\c:\nntnnt.exec:\nntnnt.exe26⤵
- Executes dropped EXE
PID:288 -
\??\c:\3jjpd.exec:\3jjpd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\jjjvj.exec:\jjjvj.exe28⤵
- Executes dropped EXE
PID:884 -
\??\c:\ttbntn.exec:\ttbntn.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3thnbh.exec:\3thnbh.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bthhtn.exec:\bthhtn.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ppjvj.exec:\ppjvj.exe32⤵
- Executes dropped EXE
PID:1644 -
\??\c:\tthnhb.exec:\tthnhb.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\hbtnbn.exec:\hbtnbn.exe34⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ffxxrlr.exec:\ffxxrlr.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lfrfrrx.exec:\lfrfrrx.exe36⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jdpvd.exec:\jdpvd.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pjjpv.exec:\pjjpv.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vjjpv.exec:\vjjpv.exe39⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hhtbnn.exec:\hhtbnn.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1nhntb.exec:\1nhntb.exe41⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrxfrxf.exec:\xrxfrxf.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pjdjv.exec:\pjdjv.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7vpjv.exec:\7vpjv.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9dvvd.exec:\9dvvd.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nnnnbh.exec:\nnnnbh.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\hbhhnt.exec:\hbhhnt.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rllrllr.exec:\rllrllr.exe48⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3fxlrxl.exec:\3fxlrxl.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vpjjv.exec:\vpjjv.exe50⤵
- Executes dropped EXE
PID:1104 -
\??\c:\9bbtht.exec:\9bbtht.exe51⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bhnnbb.exec:\bhnnbb.exe52⤵
- Executes dropped EXE
PID:672 -
\??\c:\hhhthn.exec:\hhhthn.exe53⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxrfxxf.exec:\xxrfxxf.exe54⤵
- Executes dropped EXE
PID:292 -
\??\c:\xrffrrx.exec:\xrffrrx.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3ddjd.exec:\3ddjd.exe56⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vpjpj.exec:\vpjpj.exe57⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nnbnhb.exec:\nnbnhb.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hbthbh.exec:\hbthbh.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\ffxlrrf.exec:\ffxlrrf.exe60⤵
- Executes dropped EXE
PID:832 -
\??\c:\7vjpd.exec:\7vjpd.exe61⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vjddj.exec:\vjddj.exe62⤵
- Executes dropped EXE
PID:444 -
\??\c:\bbhbtb.exec:\bbhbtb.exe63⤵
- Executes dropped EXE
PID:1140 -
\??\c:\bbbnbh.exec:\bbbnbh.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lllxrrf.exec:\lllxrrf.exe65⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lllfxfr.exec:\lllfxfr.exe66⤵PID:1708
-
\??\c:\vdpjd.exec:\vdpjd.exe67⤵PID:1564
-
\??\c:\9djdp.exec:\9djdp.exe68⤵PID:2276
-
\??\c:\ttntnn.exec:\ttntnn.exe69⤵PID:3040
-
\??\c:\thtnnn.exec:\thtnnn.exe70⤵PID:1544
-
\??\c:\xllllrx.exec:\xllllrx.exe71⤵PID:2288
-
\??\c:\3fxrrrf.exec:\3fxrrrf.exe72⤵PID:300
-
\??\c:\pdvvv.exec:\pdvvv.exe73⤵PID:2304
-
\??\c:\ddjpj.exec:\ddjpj.exe74⤵PID:2488
-
\??\c:\nnnbnt.exec:\nnnbnt.exe75⤵PID:1592
-
\??\c:\xrrxlrx.exec:\xrrxlrx.exe76⤵PID:2108
-
\??\c:\5rflllr.exec:\5rflllr.exe77⤵PID:2172
-
\??\c:\jjddd.exec:\jjddd.exe78⤵PID:3068
-
\??\c:\tttntb.exec:\tttntb.exe79⤵PID:2424
-
\??\c:\bbnntt.exec:\bbnntt.exe80⤵PID:2360
-
\??\c:\ffxrlxf.exec:\ffxrlxf.exe81⤵PID:2936
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe82⤵PID:2728
-
\??\c:\dvjvj.exec:\dvjvj.exe83⤵PID:2532
-
\??\c:\1thhbn.exec:\1thhbn.exe84⤵PID:3012
-
\??\c:\nhtbht.exec:\nhtbht.exe85⤵PID:2648
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe86⤵PID:2784
-
\??\c:\vvvdv.exec:\vvvdv.exe87⤵PID:2632
-
\??\c:\jddjv.exec:\jddjv.exe88⤵PID:1412
-
\??\c:\nnnbnb.exec:\nnnbnb.exe89⤵PID:568
-
\??\c:\frlxxfl.exec:\frlxxfl.exe90⤵PID:1632
-
\??\c:\fffflfr.exec:\fffflfr.exe91⤵PID:2152
-
\??\c:\jdppd.exec:\jdppd.exe92⤵PID:1980
-
\??\c:\7bnntb.exec:\7bnntb.exe93⤵PID:1476
-
\??\c:\nnhnbn.exec:\nnhnbn.exe94⤵
- System Location Discovery: System Language Discovery
PID:672 -
\??\c:\rlrxflx.exec:\rlrxflx.exe95⤵PID:1688
-
\??\c:\5jvdj.exec:\5jvdj.exe96⤵PID:2708
-
\??\c:\ddjjv.exec:\ddjjv.exe97⤵PID:2816
-
\??\c:\tnnthn.exec:\tnnthn.exe98⤵PID:3060
-
\??\c:\nbbthn.exec:\nbbthn.exe99⤵PID:1808
-
\??\c:\llllrlr.exec:\llllrlr.exe100⤵PID:1944
-
\??\c:\lxlrlff.exec:\lxlrlff.exe101⤵PID:1884
-
\??\c:\ppvdv.exec:\ppvdv.exe102⤵PID:2128
-
\??\c:\nnhnbb.exec:\nnhnbb.exe103⤵PID:2240
-
\??\c:\nnnbnh.exec:\nnnbnh.exe104⤵
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\frflxfr.exec:\frflxfr.exe105⤵
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\lfxflfx.exec:\lfxflfx.exe106⤵PID:1620
-
\??\c:\5ppdp.exec:\5ppdp.exe107⤵PID:2248
-
\??\c:\bbthtt.exec:\bbthtt.exe108⤵PID:1764
-
\??\c:\3nbbnt.exec:\3nbbnt.exe109⤵PID:1444
-
\??\c:\rrrxrrf.exec:\rrrxrrf.exe110⤵PID:808
-
\??\c:\dvvdp.exec:\dvvdp.exe111⤵PID:2356
-
\??\c:\3jvjp.exec:\3jvjp.exe112⤵PID:2300
-
\??\c:\bttbnn.exec:\bttbnn.exe113⤵PID:308
-
\??\c:\hbbbnt.exec:\hbbbnt.exe114⤵PID:2328
-
\??\c:\rlflxfx.exec:\rlflxfx.exe115⤵PID:2212
-
\??\c:\vpddp.exec:\vpddp.exe116⤵PID:2488
-
\??\c:\hhhhbt.exec:\hhhhbt.exe117⤵PID:1576
-
\??\c:\9bbbtt.exec:\9bbbtt.exe118⤵PID:3048
-
\??\c:\frlxlrx.exec:\frlxlrx.exe119⤵PID:2700
-
\??\c:\ppdjv.exec:\ppdjv.exe120⤵PID:3068
-
\??\c:\jdvjp.exec:\jdvjp.exe121⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-