Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 02:06
Behavioral task
behavioral1
Sample
95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe
-
Size
3.7MB
-
MD5
abe04a5143418c4bf41fba56344e507d
-
SHA1
3db0daea625c1dcdf860ce7ce079dac7014f954d
-
SHA256
95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a
-
SHA512
d1762e470038fd9b919ed0b817206a10215348f49767db40e5ffb9ba420ba0d7c58ca7ab495bc65ae0d6304362a2f1f05abd69ebfbc06325ab7b4d7f7adb174f
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98q:U6XLq/qPPslzKx/dJg1ErmN3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1964-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-13-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2512-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-71-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2360-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-142-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1116-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-161-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1276-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1372-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1096-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-198-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2036-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-288-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1492-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-436-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2996-486-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2544-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-659-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2364-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-771-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/976-810-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2168-825-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-824-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2516-896-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2260-1134-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/880-1154-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1960-1273-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 1964 2606228.exe 2512 xlllrrf.exe 2056 tnntbt.exe 2492 btbnnb.exe 1036 208868.exe 2808 u822440.exe 2940 c884224.exe 2868 a6684.exe 2360 bnhtnb.exe 2576 bbtttb.exe 2364 ppjjv.exe 3028 jpjjj.exe 1540 9rlfrfr.exe 1772 664624.exe 2336 0484028.exe 1116 c468068.exe 1276 o268028.exe 1372 5nhnbh.exe 1812 5jdjv.exe 2436 vvpjp.exe 2820 88802.exe 1096 hhnbnn.exe 1784 804608.exe 1384 lxrfxxr.exe 2036 fxrffrx.exe 896 q88004.exe 604 0824006.exe 2544 llxfrxl.exe 1028 rxlrxlx.exe 1264 40462.exe 1492 lrrlrll.exe 2156 20806.exe 1792 c666406.exe 2500 262000.exe 2076 24668.exe 2088 1pjjp.exe 2312 fxfffff.exe 2232 w04684.exe 2684 tnhttb.exe 2796 2864204.exe 2704 9hbnhn.exe 2840 0024068.exe 2856 e64068.exe 2740 48808.exe 2596 4802402.exe 2712 vvpvj.exe 3020 648062.exe 1620 rflflrr.exe 2480 208844.exe 1608 vdvjv.exe 2340 c266884.exe 1504 hhhbnh.exe 1508 5hthht.exe 1636 602462.exe 1992 042806.exe 2564 0822442.exe 1664 w48240.exe 2916 dvjdj.exe 2428 5rfrxxf.exe 2672 hbtttn.exe 2996 a8622.exe 1096 ttnhbb.exe 2892 5dpvp.exe 1236 08624.exe -
resource yara_rule behavioral1/memory/2248-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000120d6-5.dat upx behavioral1/memory/1964-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2248-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000018683-18.dat upx behavioral1/files/0x0009000000017570-28.dat upx behavioral1/memory/2512-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018697-38.dat upx behavioral1/memory/1036-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001871c-47.dat upx behavioral1/memory/2492-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018745-54.dat upx behavioral1/memory/1036-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018be7-67.dat upx behavioral1/memory/2808-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018d83-76.dat upx behavioral1/files/0x000500000001939f-84.dat upx behavioral1/files/0x00050000000193cc-94.dat upx behavioral1/memory/2360-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d0-103.dat upx behavioral1/memory/2364-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193dc-112.dat upx behavioral1/memory/3028-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193f9-120.dat upx behavioral1/files/0x0005000000019426-128.dat upx behavioral1/files/0x0005000000019428-138.dat upx behavioral1/memory/1772-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ad-148.dat upx behavioral1/memory/2336-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c3-157.dat upx behavioral1/memory/1116-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1276-161-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000194d5-167.dat upx behavioral1/memory/1372-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1276-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e1-177.dat upx behavioral1/memory/1372-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1812-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019502-186.dat upx behavioral1/files/0x0005000000019508-194.dat upx behavioral1/files/0x0005000000019510-204.dat upx behavioral1/memory/1096-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019518-213.dat upx behavioral1/memory/2820-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-198-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/files/0x0005000000019520-222.dat upx behavioral1/memory/2036-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001952b-230.dat upx behavioral1/memory/2036-235-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001952e-241.dat upx behavioral1/memory/2036-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019535-249.dat upx behavioral1/files/0x0005000000019543-258.dat upx behavioral1/memory/604-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a8-267.dat upx behavioral1/memory/2544-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019645-275.dat upx behavioral1/files/0x0005000000019647-284.dat upx behavioral1/files/0x000500000001964f-294.dat upx behavioral1/memory/1492-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-346-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 602462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2028440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w24022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e62828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8228462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8264864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w08400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86008.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8886088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84646.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 866866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8248880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k82428.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8684248.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0846622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u822440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0862840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2468222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q88004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1964 2248 95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe 30 PID 2248 wrote to memory of 1964 2248 95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe 30 PID 2248 wrote to memory of 1964 2248 95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe 30 PID 2248 wrote to memory of 1964 2248 95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe 30 PID 1964 wrote to memory of 2512 1964 2606228.exe 31 PID 1964 wrote to memory of 2512 1964 2606228.exe 31 PID 1964 wrote to memory of 2512 1964 2606228.exe 31 PID 1964 wrote to memory of 2512 1964 2606228.exe 31 PID 2512 wrote to memory of 2056 2512 xlllrrf.exe 32 PID 2512 wrote to memory of 2056 2512 xlllrrf.exe 32 PID 2512 wrote to memory of 2056 2512 xlllrrf.exe 32 PID 2512 wrote to memory of 2056 2512 xlllrrf.exe 32 PID 2056 wrote to memory of 2492 2056 tnntbt.exe 33 PID 2056 wrote to memory of 2492 2056 tnntbt.exe 33 PID 2056 wrote to memory of 2492 2056 tnntbt.exe 33 PID 2056 wrote to memory of 2492 2056 tnntbt.exe 33 PID 2492 wrote to memory of 1036 2492 btbnnb.exe 35 PID 2492 wrote to memory of 1036 2492 btbnnb.exe 35 PID 2492 wrote to memory of 1036 2492 btbnnb.exe 35 PID 2492 wrote to memory of 1036 2492 btbnnb.exe 35 PID 1036 wrote to memory of 2808 1036 208868.exe 36 PID 1036 wrote to memory of 2808 1036 208868.exe 36 PID 1036 wrote to memory of 2808 1036 208868.exe 36 PID 1036 wrote to memory of 2808 1036 208868.exe 36 PID 2808 wrote to memory of 2940 2808 u822440.exe 37 PID 2808 wrote to memory of 2940 2808 u822440.exe 37 PID 2808 wrote to memory of 2940 2808 u822440.exe 37 PID 2808 wrote to memory of 2940 2808 u822440.exe 37 PID 2940 wrote to memory of 2868 2940 c884224.exe 38 PID 2940 wrote to memory of 2868 2940 c884224.exe 38 PID 2940 wrote to memory of 2868 2940 c884224.exe 38 PID 2940 wrote to memory of 2868 2940 c884224.exe 38 PID 2868 wrote to memory of 2360 2868 a6684.exe 39 PID 2868 wrote to memory of 2360 2868 a6684.exe 39 PID 2868 wrote to memory of 2360 2868 a6684.exe 39 PID 2868 wrote to memory of 2360 2868 a6684.exe 39 PID 2360 wrote to memory of 2576 2360 bnhtnb.exe 40 PID 2360 wrote to memory of 2576 2360 bnhtnb.exe 40 PID 2360 wrote to memory of 2576 2360 bnhtnb.exe 40 PID 2360 wrote to memory of 2576 2360 bnhtnb.exe 40 PID 2576 wrote to memory of 2364 2576 bbtttb.exe 41 PID 2576 wrote to memory of 2364 2576 bbtttb.exe 41 PID 2576 wrote to memory of 2364 2576 bbtttb.exe 41 PID 2576 wrote to memory of 2364 2576 bbtttb.exe 41 PID 2364 wrote to memory of 3028 2364 ppjjv.exe 42 PID 2364 wrote to memory of 3028 2364 ppjjv.exe 42 PID 2364 wrote to memory of 3028 2364 ppjjv.exe 42 PID 2364 wrote to memory of 3028 2364 ppjjv.exe 42 PID 3028 wrote to memory of 1540 3028 jpjjj.exe 43 PID 3028 wrote to memory of 1540 3028 jpjjj.exe 43 PID 3028 wrote to memory of 1540 3028 jpjjj.exe 43 PID 3028 wrote to memory of 1540 3028 jpjjj.exe 43 PID 1540 wrote to memory of 1772 1540 9rlfrfr.exe 44 PID 1540 wrote to memory of 1772 1540 9rlfrfr.exe 44 PID 1540 wrote to memory of 1772 1540 9rlfrfr.exe 44 PID 1540 wrote to memory of 1772 1540 9rlfrfr.exe 44 PID 1772 wrote to memory of 2336 1772 664624.exe 45 PID 1772 wrote to memory of 2336 1772 664624.exe 45 PID 1772 wrote to memory of 2336 1772 664624.exe 45 PID 1772 wrote to memory of 2336 1772 664624.exe 45 PID 2336 wrote to memory of 1116 2336 0484028.exe 46 PID 2336 wrote to memory of 1116 2336 0484028.exe 46 PID 2336 wrote to memory of 1116 2336 0484028.exe 46 PID 2336 wrote to memory of 1116 2336 0484028.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe"C:\Users\Admin\AppData\Local\Temp\95a537854b0be1c3645a102df893e693de29fc0bc028cf9e9634fe8f5d3e3e5a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\2606228.exec:\2606228.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\xlllrrf.exec:\xlllrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\tnntbt.exec:\tnntbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\btbnnb.exec:\btbnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\208868.exec:\208868.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\u822440.exec:\u822440.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\c884224.exec:\c884224.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\a6684.exec:\a6684.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\bnhtnb.exec:\bnhtnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bbtttb.exec:\bbtttb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ppjjv.exec:\ppjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jpjjj.exec:\jpjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\9rlfrfr.exec:\9rlfrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\664624.exec:\664624.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\0484028.exec:\0484028.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\c468068.exec:\c468068.exe17⤵
- Executes dropped EXE
PID:1116 -
\??\c:\o268028.exec:\o268028.exe18⤵
- Executes dropped EXE
PID:1276 -
\??\c:\5nhnbh.exec:\5nhnbh.exe19⤵
- Executes dropped EXE
PID:1372 -
\??\c:\5jdjv.exec:\5jdjv.exe20⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vvpjp.exec:\vvpjp.exe21⤵
- Executes dropped EXE
PID:2436 -
\??\c:\88802.exec:\88802.exe22⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hhnbnn.exec:\hhnbnn.exe23⤵
- Executes dropped EXE
PID:1096 -
\??\c:\804608.exec:\804608.exe24⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lxrfxxr.exec:\lxrfxxr.exe25⤵
- Executes dropped EXE
PID:1384 -
\??\c:\fxrffrx.exec:\fxrffrx.exe26⤵
- Executes dropped EXE
PID:2036 -
\??\c:\q88004.exec:\q88004.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\0824006.exec:\0824006.exe28⤵
- Executes dropped EXE
PID:604 -
\??\c:\llxfrxl.exec:\llxfrxl.exe29⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rxlrxlx.exec:\rxlrxlx.exe30⤵
- Executes dropped EXE
PID:1028 -
\??\c:\40462.exec:\40462.exe31⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lrrlrll.exec:\lrrlrll.exe32⤵
- Executes dropped EXE
PID:1492 -
\??\c:\20806.exec:\20806.exe33⤵
- Executes dropped EXE
PID:2156 -
\??\c:\c666406.exec:\c666406.exe34⤵
- Executes dropped EXE
PID:1792 -
\??\c:\262000.exec:\262000.exe35⤵
- Executes dropped EXE
PID:2500 -
\??\c:\24668.exec:\24668.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1pjjp.exec:\1pjjp.exe37⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fxfffff.exec:\fxfffff.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\w04684.exec:\w04684.exe39⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tnhttb.exec:\tnhttb.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\2864204.exec:\2864204.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9hbnhn.exec:\9hbnhn.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\0024068.exec:\0024068.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\e64068.exec:\e64068.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\48808.exec:\48808.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\4802402.exec:\4802402.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vvpvj.exec:\vvpvj.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\648062.exec:\648062.exe48⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rflflrr.exec:\rflflrr.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\208844.exec:\208844.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vdvjv.exec:\vdvjv.exe51⤵
- Executes dropped EXE
PID:1608 -
\??\c:\c266884.exec:\c266884.exe52⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hhhbnh.exec:\hhhbnh.exe53⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5hthht.exec:\5hthht.exe54⤵
- Executes dropped EXE
PID:1508 -
\??\c:\602462.exec:\602462.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\042806.exec:\042806.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\0822442.exec:\0822442.exe57⤵
- Executes dropped EXE
PID:2564 -
\??\c:\w48240.exec:\w48240.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dvjdj.exec:\dvjdj.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5rfrxxf.exec:\5rfrxxf.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428 -
\??\c:\hbtttn.exec:\hbtttn.exe61⤵
- Executes dropped EXE
PID:2672 -
\??\c:\a8622.exec:\a8622.exe62⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ttnhbb.exec:\ttnhbb.exe63⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5dpvp.exec:\5dpvp.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892 -
\??\c:\08624.exec:\08624.exe65⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xfxrflx.exec:\xfxrflx.exe66⤵PID:1368
-
\??\c:\hhbnbh.exec:\hhbnbh.exe67⤵PID:1796
-
\??\c:\rlxflrf.exec:\rlxflrf.exe68⤵PID:2036
-
\??\c:\7tbnnn.exec:\7tbnnn.exe69⤵PID:1356
-
\??\c:\g6024.exec:\g6024.exe70⤵PID:2904
-
\??\c:\2640280.exec:\2640280.exe71⤵PID:292
-
\??\c:\a4464.exec:\a4464.exe72⤵PID:2544
-
\??\c:\6044620.exec:\6044620.exe73⤵PID:1524
-
\??\c:\2202024.exec:\2202024.exe74⤵PID:760
-
\??\c:\rxlrllr.exec:\rxlrllr.exe75⤵PID:3056
-
\??\c:\ffrrrrf.exec:\ffrrrrf.exe76⤵PID:1492
-
\??\c:\22024.exec:\22024.exe77⤵PID:768
-
\??\c:\486846.exec:\486846.exe78⤵PID:2476
-
\??\c:\4822064.exec:\4822064.exe79⤵PID:2924
-
\??\c:\7nhbnn.exec:\7nhbnn.exe80⤵PID:2204
-
\??\c:\k20246.exec:\k20246.exe81⤵PID:1480
-
\??\c:\042802.exec:\042802.exe82⤵PID:2088
-
\??\c:\hhnbtb.exec:\hhnbtb.exe83⤵PID:2084
-
\??\c:\rxxfrxl.exec:\rxxfrxl.exe84⤵PID:2520
-
\??\c:\k62884.exec:\k62884.exe85⤵PID:2680
-
\??\c:\6640246.exec:\6640246.exe86⤵PID:2732
-
\??\c:\42622.exec:\42622.exe87⤵PID:1908
-
\??\c:\7jdjp.exec:\7jdjp.exe88⤵PID:2212
-
\??\c:\0040680.exec:\0040680.exe89⤵PID:2612
-
\??\c:\480284.exec:\480284.exe90⤵PID:2624
-
\??\c:\042244.exec:\042244.exe91⤵PID:2648
-
\??\c:\7rlrxxx.exec:\7rlrxxx.exe92⤵PID:2576
-
\??\c:\hbhntb.exec:\hbhntb.exe93⤵PID:2364
-
\??\c:\rrxlxff.exec:\rrxlxff.exe94⤵PID:1420
-
\??\c:\pppvj.exec:\pppvj.exe95⤵PID:536
-
\??\c:\pjpvj.exec:\pjpvj.exe96⤵PID:1916
-
\??\c:\frrfxfl.exec:\frrfxfl.exe97⤵PID:1772
-
\??\c:\42462.exec:\42462.exe98⤵PID:2004
-
\??\c:\9frrfll.exec:\9frrfll.exe99⤵PID:2336
-
\??\c:\ffrxrxf.exec:\ffrxrxf.exe100⤵PID:1148
-
\??\c:\48286.exec:\48286.exe101⤵PID:1636
-
\??\c:\frlrxfx.exec:\frlrxfx.exe102⤵PID:2636
-
\??\c:\0800668.exec:\0800668.exe103⤵PID:2876
-
\??\c:\868024.exec:\868024.exe104⤵
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\7ppdj.exec:\7ppdj.exe105⤵PID:2400
-
\??\c:\042024.exec:\042024.exe106⤵PID:884
-
\??\c:\822244.exec:\822244.exe107⤵
- System Location Discovery: System Language Discovery
PID:1124 -
\??\c:\822640.exec:\822640.exe108⤵PID:1716
-
\??\c:\rlfrxrx.exec:\rlfrxrx.exe109⤵PID:1804
-
\??\c:\rflxrlr.exec:\rflxrlr.exe110⤵PID:1852
-
\??\c:\rfxlrxf.exec:\rfxlrxf.exe111⤵PID:492
-
\??\c:\9rflrxl.exec:\9rflrxl.exe112⤵PID:644
-
\??\c:\5hhnbh.exec:\5hhnbh.exe113⤵PID:3040
-
\??\c:\nhhhbh.exec:\nhhhbh.exe114⤵PID:976
-
\??\c:\608084.exec:\608084.exe115⤵PID:1756
-
\??\c:\pjdjv.exec:\pjdjv.exe116⤵PID:1752
-
\??\c:\rfxxfff.exec:\rfxxfff.exe117⤵PID:2168
-
\??\c:\jjjdp.exec:\jjjdp.exe118⤵PID:2532
-
\??\c:\w20640.exec:\w20640.exe119⤵PID:872
-
\??\c:\hntnht.exec:\hntnht.exe120⤵
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\2080228.exec:\2080228.exe121⤵PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-