Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 19:44
Behavioral task
behavioral1
Sample
a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe
-
Size
70KB
-
MD5
f680f03a3be21eb9f63ddc567dc0d5e0
-
SHA1
3d9eaade8b7dbe2d4aebd42c506783dc50787647
-
SHA256
a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792
-
SHA512
bd948ec5223275d69ff101b8678426ab5a7128f4c924b96de4c1b7fe536b84a91af8fb3add611b0582b7c2ea460a1c2626ac04b93d0aa1420a9873d31278f08e
-
SSDEEP
1536:0vQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7qQhtr+mCaWVzi:0hOmTsF93UYfwC6GIoutX8hUDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1924-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-137-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1736-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-228-0x0000000001B50000-0x0000000001B77000-memory.dmp family_blackmoon behavioral1/memory/1684-242-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/888-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-274-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2984-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-443-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1792-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/748-504-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1684-514-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1684-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-546-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1460-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-561-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1576-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-684-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1744-733-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/668-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/668-763-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/748-1048-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2632-1246-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2332-1283-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1944 3pddp.exe 2764 dvjpd.exe 2820 3ffrflr.exe 2576 xrffllx.exe 2716 5tthhb.exe 2560 rxrfrll.exe 3040 lfllrlr.exe 2780 1pddj.exe 568 dvppd.exe 3056 fxrflrf.exe 1776 nhbhhh.exe 1836 dvjjv.exe 808 5ddjj.exe 2876 fllxrrx.exe 1736 fxxlflx.exe 1780 hbhthh.exe 352 ddppj.exe 2108 lflrxfl.exe 2960 1xxxfxf.exe 2788 tntnhh.exe 2504 pjppv.exe 2144 7jddp.exe 544 rlllrrf.exe 1852 btnbnn.exe 1592 9hhtnt.exe 1684 vvjvv.exe 888 jdvvd.exe 2424 bthntt.exe 2984 tnhhtt.exe 980 ppdjp.exe 1508 3dvvd.exe 2036 ffrfxfx.exe 1944 bbbhtb.exe 2764 dvdpd.exe 2756 pjvvj.exe 2892 llllxfx.exe 1584 xrflffr.exe 2568 1httbn.exe 2588 nhhhbt.exe 2552 jjjjv.exe 2572 ppjpp.exe 2664 5xlllrx.exe 2592 xrffxfr.exe 640 rlxfllx.exe 2992 hbbnhn.exe 2152 3bnhtt.exe 3056 vpdjj.exe 2212 pdddp.exe 1836 xrlfllr.exe 2784 3rrxllr.exe 2900 tththn.exe 2868 5nbhhh.exe 2848 vdpdv.exe 2916 pppvd.exe 1772 fffllrx.exe 1424 fxrlrxl.exe 1792 fxrrffl.exe 2332 nnnbhh.exe 2272 nhttnn.exe 2248 vvpvp.exe 2124 vpjvj.exe 668 fxllxxf.exe 1080 xlrxlrx.exe 344 5ttbtt.exe -
resource yara_rule behavioral1/memory/1924-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012116-5.dat upx behavioral1/memory/1944-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1924-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ca2-20.dat upx behavioral1/memory/1944-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cd3-29.dat upx behavioral1/memory/2764-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cfe-39.dat upx behavioral1/memory/2820-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d0b-48.dat upx behavioral1/memory/2716-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d13-59.dat upx behavioral1/memory/2716-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1b-67.dat upx behavioral1/files/0x0007000000016d24-77.dat upx behavioral1/memory/3040-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d36-84.dat upx behavioral1/files/0x000600000001747b-91.dat upx behavioral1/memory/568-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001748f-102.dat upx behavioral1/files/0x00060000000174ac-111.dat upx behavioral1/memory/1776-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001752f-119.dat upx behavioral1/memory/808-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001500000001866d-127.dat upx behavioral1/memory/808-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018678-138.dat upx behavioral1/files/0x0005000000018690-147.dat upx behavioral1/memory/1780-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001879b-158.dat upx behavioral1/memory/1780-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190cd-165.dat upx behavioral1/files/0x00060000000190d6-175.dat upx behavioral1/files/0x00050000000191f3-182.dat upx behavioral1/files/0x00050000000191f7-191.dat upx behavioral1/files/0x0005000000019218-199.dat upx behavioral1/files/0x0005000000019229-207.dat upx behavioral1/files/0x0005000000019234-214.dat upx behavioral1/memory/544-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001924c-224.dat upx behavioral1/files/0x000500000001926b-235.dat upx behavioral1/memory/1592-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019271-243.dat upx behavioral1/files/0x0005000000019273-252.dat upx behavioral1/memory/888-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019277-260.dat upx behavioral1/files/0x0005000000019382-271.dat upx behavioral1/memory/2984-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019389-279.dat upx behavioral1/memory/2036-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0035000000016c3d-289.dat upx behavioral1/memory/1508-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2152-380-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-417-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-424-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1944 1924 a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe 30 PID 1924 wrote to memory of 1944 1924 a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe 30 PID 1924 wrote to memory of 1944 1924 a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe 30 PID 1924 wrote to memory of 1944 1924 a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe 30 PID 1944 wrote to memory of 2764 1944 3pddp.exe 31 PID 1944 wrote to memory of 2764 1944 3pddp.exe 31 PID 1944 wrote to memory of 2764 1944 3pddp.exe 31 PID 1944 wrote to memory of 2764 1944 3pddp.exe 31 PID 2764 wrote to memory of 2820 2764 dvjpd.exe 32 PID 2764 wrote to memory of 2820 2764 dvjpd.exe 32 PID 2764 wrote to memory of 2820 2764 dvjpd.exe 32 PID 2764 wrote to memory of 2820 2764 dvjpd.exe 32 PID 2820 wrote to memory of 2576 2820 3ffrflr.exe 33 PID 2820 wrote to memory of 2576 2820 3ffrflr.exe 33 PID 2820 wrote to memory of 2576 2820 3ffrflr.exe 33 PID 2820 wrote to memory of 2576 2820 3ffrflr.exe 33 PID 2576 wrote to memory of 2716 2576 xrffllx.exe 34 PID 2576 wrote to memory of 2716 2576 xrffllx.exe 34 PID 2576 wrote to memory of 2716 2576 xrffllx.exe 34 PID 2576 wrote to memory of 2716 2576 xrffllx.exe 34 PID 2716 wrote to memory of 2560 2716 5tthhb.exe 35 PID 2716 wrote to memory of 2560 2716 5tthhb.exe 35 PID 2716 wrote to memory of 2560 2716 5tthhb.exe 35 PID 2716 wrote to memory of 2560 2716 5tthhb.exe 35 PID 2560 wrote to memory of 3040 2560 rxrfrll.exe 36 PID 2560 wrote to memory of 3040 2560 rxrfrll.exe 36 PID 2560 wrote to memory of 3040 2560 rxrfrll.exe 36 PID 2560 wrote to memory of 3040 2560 rxrfrll.exe 36 PID 3040 wrote to memory of 2780 3040 lfllrlr.exe 37 PID 3040 wrote to memory of 2780 3040 lfllrlr.exe 37 PID 3040 wrote to memory of 2780 3040 lfllrlr.exe 37 PID 3040 wrote to memory of 2780 3040 lfllrlr.exe 37 PID 2780 wrote to memory of 568 2780 1pddj.exe 38 PID 2780 wrote to memory of 568 2780 1pddj.exe 38 PID 2780 wrote to memory of 568 2780 1pddj.exe 38 PID 2780 wrote to memory of 568 2780 1pddj.exe 38 PID 568 wrote to memory of 3056 568 dvppd.exe 39 PID 568 wrote to memory of 3056 568 dvppd.exe 39 PID 568 wrote to memory of 3056 568 dvppd.exe 39 PID 568 wrote to memory of 3056 568 dvppd.exe 39 PID 3056 wrote to memory of 1776 3056 fxrflrf.exe 40 PID 3056 wrote to memory of 1776 3056 fxrflrf.exe 40 PID 3056 wrote to memory of 1776 3056 fxrflrf.exe 40 PID 3056 wrote to memory of 1776 3056 fxrflrf.exe 40 PID 1776 wrote to memory of 1836 1776 nhbhhh.exe 41 PID 1776 wrote to memory of 1836 1776 nhbhhh.exe 41 PID 1776 wrote to memory of 1836 1776 nhbhhh.exe 41 PID 1776 wrote to memory of 1836 1776 nhbhhh.exe 41 PID 1836 wrote to memory of 808 1836 dvjjv.exe 42 PID 1836 wrote to memory of 808 1836 dvjjv.exe 42 PID 1836 wrote to memory of 808 1836 dvjjv.exe 42 PID 1836 wrote to memory of 808 1836 dvjjv.exe 42 PID 808 wrote to memory of 2876 808 5ddjj.exe 43 PID 808 wrote to memory of 2876 808 5ddjj.exe 43 PID 808 wrote to memory of 2876 808 5ddjj.exe 43 PID 808 wrote to memory of 2876 808 5ddjj.exe 43 PID 2876 wrote to memory of 1736 2876 fllxrrx.exe 44 PID 2876 wrote to memory of 1736 2876 fllxrrx.exe 44 PID 2876 wrote to memory of 1736 2876 fllxrrx.exe 44 PID 2876 wrote to memory of 1736 2876 fllxrrx.exe 44 PID 1736 wrote to memory of 1780 1736 fxxlflx.exe 45 PID 1736 wrote to memory of 1780 1736 fxxlflx.exe 45 PID 1736 wrote to memory of 1780 1736 fxxlflx.exe 45 PID 1736 wrote to memory of 1780 1736 fxxlflx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe"C:\Users\Admin\AppData\Local\Temp\a0e58c8d2d148f598a300889e549f1645f12864aa5e4775876bf109724386792N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\3pddp.exec:\3pddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\dvjpd.exec:\dvjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3ffrflr.exec:\3ffrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xrffllx.exec:\xrffllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5tthhb.exec:\5tthhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rxrfrll.exec:\rxrfrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\lfllrlr.exec:\lfllrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\1pddj.exec:\1pddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\dvppd.exec:\dvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\fxrflrf.exec:\fxrflrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nhbhhh.exec:\nhbhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\dvjjv.exec:\dvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\5ddjj.exec:\5ddjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\fllxrrx.exec:\fllxrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fxxlflx.exec:\fxxlflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\hbhthh.exec:\hbhthh.exe17⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddppj.exec:\ddppj.exe18⤵
- Executes dropped EXE
PID:352 -
\??\c:\lflrxfl.exec:\lflrxfl.exe19⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1xxxfxf.exec:\1xxxfxf.exe20⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tntnhh.exec:\tntnhh.exe21⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pjppv.exec:\pjppv.exe22⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7jddp.exec:\7jddp.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlllrrf.exec:\rlllrrf.exe24⤵
- Executes dropped EXE
PID:544 -
\??\c:\btnbnn.exec:\btnbnn.exe25⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9hhtnt.exec:\9hhtnt.exe26⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vvjvv.exec:\vvjvv.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jdvvd.exec:\jdvvd.exe28⤵
- Executes dropped EXE
PID:888 -
\??\c:\bthntt.exec:\bthntt.exe29⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tnhhtt.exec:\tnhhtt.exe30⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ppdjp.exec:\ppdjp.exe31⤵
- Executes dropped EXE
PID:980 -
\??\c:\3dvvd.exec:\3dvvd.exe32⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ffrfxfx.exec:\ffrfxfx.exe33⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bbbhtb.exec:\bbbhtb.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvdpd.exec:\dvdpd.exe35⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjvvj.exec:\pjvvj.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\llllxfx.exec:\llllxfx.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xrflffr.exec:\xrflffr.exe38⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1httbn.exec:\1httbn.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhhhbt.exec:\nhhhbt.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jjjjv.exec:\jjjjv.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ppjpp.exec:\ppjpp.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5xlllrx.exec:\5xlllrx.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xrffxfr.exec:\xrffxfr.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rlxfllx.exec:\rlxfllx.exe45⤵
- Executes dropped EXE
PID:640 -
\??\c:\hbbnhn.exec:\hbbnhn.exe46⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3bnhtt.exec:\3bnhtt.exe47⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vpdjj.exec:\vpdjj.exe48⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pdddp.exec:\pdddp.exe49⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xrlfllr.exec:\xrlfllr.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3rrxllr.exec:\3rrxllr.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tththn.exec:\tththn.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5nbhhh.exec:\5nbhhh.exe53⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vdpdv.exec:\vdpdv.exe54⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pppvd.exec:\pppvd.exe55⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fffllrx.exec:\fffllrx.exe56⤵
- Executes dropped EXE
PID:1772 -
\??\c:\fxrlrxl.exec:\fxrlrxl.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\fxrrffl.exec:\fxrrffl.exe58⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nnnbhh.exec:\nnnbhh.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\nhttnn.exec:\nhttnn.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vvpvp.exec:\vvpvp.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vpjvj.exec:\vpjvj.exe62⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxllxxf.exec:\fxllxxf.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\xlrxlrx.exec:\xlrxlrx.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\5ttbtt.exec:\5ttbtt.exe65⤵
- Executes dropped EXE
PID:344 -
\??\c:\nhtntt.exec:\nhtntt.exe66⤵PID:748
-
\??\c:\jvdjp.exec:\jvdjp.exe67⤵PID:2404
-
\??\c:\ppjpj.exec:\ppjpj.exe68⤵PID:1684
-
\??\c:\1flrxfl.exec:\1flrxfl.exe69⤵PID:856
-
\??\c:\rlxrflx.exec:\rlxrflx.exe70⤵PID:888
-
\??\c:\hbtttb.exec:\hbtttb.exe71⤵PID:2464
-
\??\c:\jdvdj.exec:\jdvdj.exe72⤵PID:1460
-
\??\c:\xllffff.exec:\xllffff.exe73⤵PID:2068
-
\??\c:\rrflrxf.exec:\rrflrxf.exe74⤵PID:2456
-
\??\c:\thtttn.exec:\thtttn.exe75⤵PID:2392
-
\??\c:\3thbbh.exec:\3thbbh.exe76⤵PID:2672
-
\??\c:\pjddj.exec:\pjddj.exe77⤵PID:2012
-
\??\c:\vvppv.exec:\vvppv.exe78⤵PID:2668
-
\??\c:\frflrxx.exec:\frflrxx.exe79⤵PID:2688
-
\??\c:\7nhnnt.exec:\7nhnnt.exe80⤵PID:1576
-
\??\c:\1ttthh.exec:\1ttthh.exe81⤵PID:1580
-
\??\c:\7dddv.exec:\7dddv.exe82⤵PID:2084
-
\??\c:\vpvdj.exec:\vpvdj.exe83⤵PID:2768
-
\??\c:\dvjdd.exec:\dvjdd.exe84⤵PID:2608
-
\??\c:\rlxrxfr.exec:\rlxrxfr.exe85⤵PID:2388
-
\??\c:\xrrxfff.exec:\xrrxfff.exe86⤵PID:1136
-
\??\c:\tnbtbb.exec:\tnbtbb.exe87⤵PID:588
-
\??\c:\1thnnh.exec:\1thnnh.exe88⤵PID:776
-
\??\c:\djdjp.exec:\djdjp.exe89⤵PID:2092
-
\??\c:\3dpjj.exec:\3dpjj.exe90⤵PID:2128
-
\??\c:\rxllxlf.exec:\rxllxlf.exe91⤵PID:2016
-
\??\c:\tthnbn.exec:\tthnbn.exe92⤵PID:3056
-
\??\c:\nhbbbh.exec:\nhbbbh.exe93⤵
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\7vjjp.exec:\7vjjp.exe94⤵PID:2864
-
\??\c:\1dddp.exec:\1dddp.exe95⤵PID:2080
-
\??\c:\fxxrfxf.exec:\fxxrfxf.exe96⤵PID:624
-
\??\c:\xlffllr.exec:\xlffllr.exe97⤵PID:556
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe98⤵PID:2800
-
\??\c:\hhnthn.exec:\hhnthn.exe99⤵PID:1112
-
\??\c:\nnbtnb.exec:\nnbtnb.exe100⤵PID:352
-
\??\c:\pjppv.exec:\pjppv.exe101⤵PID:1760
-
\??\c:\pjpvd.exec:\pjpvd.exe102⤵PID:1744
-
\??\c:\lfxxflx.exec:\lfxxflx.exe103⤵PID:2332
-
\??\c:\bbhnhn.exec:\bbhnhn.exe104⤵PID:2156
-
\??\c:\hhhthn.exec:\hhhthn.exe105⤵PID:2248
-
\??\c:\dvpvv.exec:\dvpvv.exe106⤵PID:2512
-
\??\c:\jjddp.exec:\jjddp.exe107⤵PID:668
-
\??\c:\rlrllxl.exec:\rlrllxl.exe108⤵PID:2524
-
\??\c:\xlxfxxl.exec:\xlxfxxl.exe109⤵PID:1120
-
\??\c:\hnnnth.exec:\hnnnth.exe110⤵PID:2404
-
\??\c:\pppdj.exec:\pppdj.exe111⤵PID:692
-
\??\c:\1vdvj.exec:\1vdvj.exe112⤵PID:700
-
\??\c:\xrxflrl.exec:\xrxflrl.exe113⤵PID:288
-
\??\c:\7lxfffl.exec:\7lxfffl.exe114⤵PID:2136
-
\??\c:\7hhnbh.exec:\7hhnbh.exe115⤵PID:1240
-
\??\c:\tnbhhb.exec:\tnbhhb.exe116⤵PID:2284
-
\??\c:\jvddd.exec:\jvddd.exe117⤵PID:2068
-
\??\c:\dpjpp.exec:\dpjpp.exe118⤵PID:980
-
\??\c:\fxxxllx.exec:\fxxxllx.exe119⤵PID:1924
-
\??\c:\lfxlxfl.exec:\lfxlxfl.exe120⤵PID:2776
-
\??\c:\nbttbh.exec:\nbttbh.exe121⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-