Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 00:18
Static task
static1
Behavioral task
behavioral1
Sample
7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe
Resource
win7-20240903-en
General
-
Target
7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe
-
Size
337KB
-
MD5
9683d6b6ddec7aaa057b6d3cc71d5389
-
SHA1
61037c955f1a09903996301c53bce96d50a38703
-
SHA256
7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4
-
SHA512
ea82797f27e131be12eed6ee64acb71218b6382e9b4116c6e41dfe0ec341b5c44b74f28038dbd90909db11ea958aac88a3b9a6add029629952e1304d5105d49f
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhb:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-24-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-62-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1776-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1316-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/356-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-473-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1076-475-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/624-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-514-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1092-517-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2096-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-616-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-640-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-679-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1680-783-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-809-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1872-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-873-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-915-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/752-966-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 rrflxrf.exe 2780 7fxlrrl.exe 2560 hhthbh.exe 2800 1rlxrff.exe 2728 bbnntb.exe 2568 ppjvd.exe 1776 5tbhhn.exe 2184 pdvjv.exe 1316 tnttnt.exe 2652 dvddv.exe 752 5hbtbn.exe 2428 7btbnn.exe 2324 fxrfrxf.exe 2616 bbnbhn.exe 332 djdpj.exe 2124 tbnntt.exe 1668 1dpjp.exe 2948 xfxlrfr.exe 1784 ddppd.exe 3044 rrlxrrf.exe 2996 nhbnbb.exe 1620 pppvp.exe 356 flfrlrf.exe 1848 1bthnt.exe 1648 ffxlflr.exe 1960 jjdpj.exe 2380 ffflflf.exe 2368 pjppj.exe 1720 xrlffrf.exe 864 3thnhn.exe 876 jddvp.exe 2264 xfflfrf.exe 2160 tnbhtb.exe 2660 jjvdv.exe 2804 llflrrx.exe 2680 hhnbnb.exe 2796 9dvdp.exe 2880 xxrxlfr.exe 2872 llxxlxf.exe 2548 9thnht.exe 2628 jpddj.exe 3008 rlrrxxl.exe 1776 ffrxllr.exe 2120 bbntbb.exe 2200 1vdjv.exe 2460 3rfrxxl.exe 2076 tbhhnh.exe 640 ddpvd.exe 1276 rrlrxfl.exe 3048 bhbhbb.exe 2840 tbttbn.exe 2616 jjpdj.exe 1756 rxlrrxr.exe 2348 thttbh.exe 3060 bbthnh.exe 840 jjvvd.exe 3064 fxxxlxf.exe 1076 bbbhhn.exe 3028 ntnbbh.exe 1404 jjjvj.exe 1856 xfrlxxl.exe 848 bbnthh.exe 624 dvjpd.exe 1740 pjvvd.exe -
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-581-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2196-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-682-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1680-783-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1872-824-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2664 2364 7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe 30 PID 2364 wrote to memory of 2664 2364 7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe 30 PID 2364 wrote to memory of 2664 2364 7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe 30 PID 2364 wrote to memory of 2664 2364 7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe 30 PID 2664 wrote to memory of 2780 2664 rrflxrf.exe 31 PID 2664 wrote to memory of 2780 2664 rrflxrf.exe 31 PID 2664 wrote to memory of 2780 2664 rrflxrf.exe 31 PID 2664 wrote to memory of 2780 2664 rrflxrf.exe 31 PID 2780 wrote to memory of 2560 2780 7fxlrrl.exe 32 PID 2780 wrote to memory of 2560 2780 7fxlrrl.exe 32 PID 2780 wrote to memory of 2560 2780 7fxlrrl.exe 32 PID 2780 wrote to memory of 2560 2780 7fxlrrl.exe 32 PID 2560 wrote to memory of 2800 2560 hhthbh.exe 33 PID 2560 wrote to memory of 2800 2560 hhthbh.exe 33 PID 2560 wrote to memory of 2800 2560 hhthbh.exe 33 PID 2560 wrote to memory of 2800 2560 hhthbh.exe 33 PID 2800 wrote to memory of 2728 2800 1rlxrff.exe 34 PID 2800 wrote to memory of 2728 2800 1rlxrff.exe 34 PID 2800 wrote to memory of 2728 2800 1rlxrff.exe 34 PID 2800 wrote to memory of 2728 2800 1rlxrff.exe 34 PID 2728 wrote to memory of 2568 2728 bbnntb.exe 35 PID 2728 wrote to memory of 2568 2728 bbnntb.exe 35 PID 2728 wrote to memory of 2568 2728 bbnntb.exe 35 PID 2728 wrote to memory of 2568 2728 bbnntb.exe 35 PID 2568 wrote to memory of 1776 2568 ppjvd.exe 36 PID 2568 wrote to memory of 1776 2568 ppjvd.exe 36 PID 2568 wrote to memory of 1776 2568 ppjvd.exe 36 PID 2568 wrote to memory of 1776 2568 ppjvd.exe 36 PID 1776 wrote to memory of 2184 1776 5tbhhn.exe 37 PID 1776 wrote to memory of 2184 1776 5tbhhn.exe 37 PID 1776 wrote to memory of 2184 1776 5tbhhn.exe 37 PID 1776 wrote to memory of 2184 1776 5tbhhn.exe 37 PID 2184 wrote to memory of 1316 2184 pdvjv.exe 38 PID 2184 wrote to memory of 1316 2184 pdvjv.exe 38 PID 2184 wrote to memory of 1316 2184 pdvjv.exe 38 PID 2184 wrote to memory of 1316 2184 pdvjv.exe 38 PID 1316 wrote to memory of 2652 1316 tnttnt.exe 39 PID 1316 wrote to memory of 2652 1316 tnttnt.exe 39 PID 1316 wrote to memory of 2652 1316 tnttnt.exe 39 PID 1316 wrote to memory of 2652 1316 tnttnt.exe 39 PID 2652 wrote to memory of 752 2652 dvddv.exe 40 PID 2652 wrote to memory of 752 2652 dvddv.exe 40 PID 2652 wrote to memory of 752 2652 dvddv.exe 40 PID 2652 wrote to memory of 752 2652 dvddv.exe 40 PID 752 wrote to memory of 2428 752 5hbtbn.exe 41 PID 752 wrote to memory of 2428 752 5hbtbn.exe 41 PID 752 wrote to memory of 2428 752 5hbtbn.exe 41 PID 752 wrote to memory of 2428 752 5hbtbn.exe 41 PID 2428 wrote to memory of 2324 2428 7btbnn.exe 42 PID 2428 wrote to memory of 2324 2428 7btbnn.exe 42 PID 2428 wrote to memory of 2324 2428 7btbnn.exe 42 PID 2428 wrote to memory of 2324 2428 7btbnn.exe 42 PID 2324 wrote to memory of 2616 2324 fxrfrxf.exe 43 PID 2324 wrote to memory of 2616 2324 fxrfrxf.exe 43 PID 2324 wrote to memory of 2616 2324 fxrfrxf.exe 43 PID 2324 wrote to memory of 2616 2324 fxrfrxf.exe 43 PID 2616 wrote to memory of 332 2616 bbnbhn.exe 44 PID 2616 wrote to memory of 332 2616 bbnbhn.exe 44 PID 2616 wrote to memory of 332 2616 bbnbhn.exe 44 PID 2616 wrote to memory of 332 2616 bbnbhn.exe 44 PID 332 wrote to memory of 2124 332 djdpj.exe 45 PID 332 wrote to memory of 2124 332 djdpj.exe 45 PID 332 wrote to memory of 2124 332 djdpj.exe 45 PID 332 wrote to memory of 2124 332 djdpj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe"C:\Users\Admin\AppData\Local\Temp\7c70183eee233b1bbae85f2ad89084630b32e9ef762dbf07a52fa4999e5791b4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rrflxrf.exec:\rrflxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7fxlrrl.exec:\7fxlrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hhthbh.exec:\hhthbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1rlxrff.exec:\1rlxrff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bbnntb.exec:\bbnntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ppjvd.exec:\ppjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\5tbhhn.exec:\5tbhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\pdvjv.exec:\pdvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tnttnt.exec:\tnttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\dvddv.exec:\dvddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5hbtbn.exec:\5hbtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\7btbnn.exec:\7btbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\bbnbhn.exec:\bbnbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\djdpj.exec:\djdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\tbnntt.exec:\tbnntt.exe17⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1dpjp.exec:\1dpjp.exe18⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xfxlrfr.exec:\xfxlrfr.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ddppd.exec:\ddppd.exe20⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rrlxrrf.exec:\rrlxrrf.exe21⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nhbnbb.exec:\nhbnbb.exe22⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pppvp.exec:\pppvp.exe23⤵
- Executes dropped EXE
PID:1620 -
\??\c:\flfrlrf.exec:\flfrlrf.exe24⤵
- Executes dropped EXE
PID:356 -
\??\c:\1bthnt.exec:\1bthnt.exe25⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ffxlflr.exec:\ffxlflr.exe26⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jjdpj.exec:\jjdpj.exe27⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ffflflf.exec:\ffflflf.exe28⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pjppj.exec:\pjppj.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xrlffrf.exec:\xrlffrf.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3thnhn.exec:\3thnhn.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\jddvp.exec:\jddvp.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\xfflfrf.exec:\xfflfrf.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tnbhtb.exec:\tnbhtb.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jjvdv.exec:\jjvdv.exe35⤵
- Executes dropped EXE
PID:2660 -
\??\c:\llflrrx.exec:\llflrrx.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hhnbnb.exec:\hhnbnb.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9dvdp.exec:\9dvdp.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xxrxlfr.exec:\xxrxlfr.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\llxxlxf.exec:\llxxlxf.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9thnht.exec:\9thnht.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jpddj.exec:\jpddj.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ffrxllr.exec:\ffrxllr.exe44⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bbntbb.exec:\bbntbb.exe45⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1vdjv.exec:\1vdjv.exe46⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3rfrxxl.exec:\3rfrxxl.exe47⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tbhhnh.exec:\tbhhnh.exe48⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ddpvd.exec:\ddpvd.exe49⤵
- Executes dropped EXE
PID:640 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bhbhbb.exec:\bhbhbb.exe51⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tbttbn.exec:\tbttbn.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jjpdj.exec:\jjpdj.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rxlrrxr.exec:\rxlrrxr.exe54⤵
- Executes dropped EXE
PID:1756 -
\??\c:\thttbh.exec:\thttbh.exe55⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bbthnh.exec:\bbthnh.exe56⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jjvvd.exec:\jjvvd.exe57⤵
- Executes dropped EXE
PID:840 -
\??\c:\fxxxlxf.exec:\fxxxlxf.exe58⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bbbhhn.exec:\bbbhhn.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\ntnbbh.exec:\ntnbbh.exe60⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jjjvj.exec:\jjjvj.exe61⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xfrlxxl.exec:\xfrlxxl.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bbnthh.exec:\bbnthh.exe63⤵
- Executes dropped EXE
PID:848 -
\??\c:\dvjpd.exec:\dvjpd.exe64⤵
- Executes dropped EXE
PID:624 -
\??\c:\pjvvd.exec:\pjvvd.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\llrfrxl.exec:\llrfrxl.exe66⤵PID:1092
-
\??\c:\3bnnbn.exec:\3bnnbn.exe67⤵PID:1968
-
\??\c:\5djpp.exec:\5djpp.exe68⤵PID:1496
-
\??\c:\3lflrrx.exec:\3lflrrx.exe69⤵PID:2096
-
\??\c:\7fllffl.exec:\7fllffl.exe70⤵PID:3068
-
\??\c:\nhhnbn.exec:\nhhnbn.exe71⤵PID:2504
-
\??\c:\5jvpv.exec:\5jvpv.exe72⤵PID:2128
-
\??\c:\ffxfflx.exec:\ffxfflx.exe73⤵PID:2920
-
\??\c:\1rllxfr.exec:\1rllxfr.exe74⤵
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\nnntbn.exec:\nnntbn.exe75⤵PID:1320
-
\??\c:\9ddjp.exec:\9ddjp.exe76⤵PID:2236
-
\??\c:\fxrxllx.exec:\fxrxllx.exe77⤵PID:2364
-
\??\c:\rllxlrf.exec:\rllxlrf.exe78⤵PID:2912
-
\??\c:\tthhtb.exec:\tthhtb.exe79⤵PID:2664
-
\??\c:\djjvp.exec:\djjvp.exe80⤵PID:2672
-
\??\c:\rrrfffl.exec:\rrrfffl.exe81⤵PID:2108
-
\??\c:\llfrrxl.exec:\llfrrxl.exe82⤵PID:2744
-
\??\c:\9htbhh.exec:\9htbhh.exe83⤵PID:1056
-
\??\c:\vvpvd.exec:\vvpvd.exe84⤵PID:2720
-
\??\c:\7fxfrfr.exec:\7fxfrfr.exe85⤵PID:2548
-
\??\c:\9xrxffr.exec:\9xrxffr.exe86⤵PID:2628
-
\??\c:\nhbhnh.exec:\nhbhnh.exe87⤵PID:2612
-
\??\c:\ppjvv.exec:\ppjvv.exe88⤵PID:2196
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe89⤵PID:2204
-
\??\c:\5lfffrr.exec:\5lfffrr.exe90⤵PID:2192
-
\??\c:\bbntnn.exec:\bbntnn.exe91⤵PID:2868
-
\??\c:\dvddj.exec:\dvddj.exe92⤵PID:1616
-
\??\c:\lrrrflx.exec:\lrrrflx.exe93⤵PID:2440
-
\??\c:\5rxfllx.exec:\5rxfllx.exe94⤵PID:2432
-
\??\c:\ntnhbt.exec:\ntnhbt.exe95⤵PID:2324
-
\??\c:\pdppd.exec:\pdppd.exe96⤵PID:2336
-
\??\c:\llxxlrf.exec:\llxxlrf.exe97⤵PID:1908
-
\??\c:\7lrxlrx.exec:\7lrxlrx.exe98⤵PID:2320
-
\??\c:\bbbntt.exec:\bbbntt.exe99⤵PID:2052
-
\??\c:\jdppp.exec:\jdppp.exe100⤵PID:1944
-
\??\c:\lfflffr.exec:\lfflffr.exe101⤵PID:632
-
\??\c:\tntttt.exec:\tntttt.exe102⤵PID:2248
-
\??\c:\1bbhbn.exec:\1bbhbn.exe103⤵PID:2988
-
\??\c:\vjdpp.exec:\vjdpp.exe104⤵PID:2732
-
\??\c:\7fllllx.exec:\7fllllx.exe105⤵PID:1600
-
\??\c:\btthnn.exec:\btthnn.exe106⤵PID:1852
-
\??\c:\hhttbh.exec:\hhttbh.exe107⤵PID:1680
-
\??\c:\ppvvj.exec:\ppvvj.exe108⤵PID:2084
-
\??\c:\1lflrrr.exec:\1lflrrr.exe109⤵PID:1336
-
\??\c:\rlfrlxl.exec:\rlfrlxl.exe110⤵PID:2472
-
\??\c:\bbthtb.exec:\bbthtb.exe111⤵PID:604
-
\??\c:\1ppdv.exec:\1ppdv.exe112⤵PID:1948
-
\??\c:\lrrfxfl.exec:\lrrfxfl.exe113⤵PID:1872
-
\??\c:\rlxxffr.exec:\rlxxffr.exe114⤵PID:1956
-
\??\c:\ttnthn.exec:\ttnthn.exe115⤵PID:772
-
\??\c:\djdvp.exec:\djdvp.exe116⤵PID:1720
-
\??\c:\xxxfrxf.exec:\xxxfrxf.exe117⤵PID:864
-
\??\c:\tbbhnt.exec:\tbbhnt.exe118⤵PID:1820
-
\??\c:\dvjpj.exec:\dvjpj.exe119⤵PID:2004
-
\??\c:\llrxxff.exec:\llrxxff.exe120⤵PID:1584
-
\??\c:\5fxxflx.exec:\5fxxflx.exe121⤵PID:2700
-
\??\c:\bbtbtb.exec:\bbtbtb.exe122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-