Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe
-
Size
454KB
-
MD5
df831ba99c8fc23ee2f73ecd4f8c77d0
-
SHA1
af02e6c8c8cdb88692268a27274610cab6a0164c
-
SHA256
6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98
-
SHA512
9908c823edb8cc170bfb4f9f19720224c0963c87682e05aad5f2197770e651add995de1cab1a359148d0f2dc413bfc03b0766bf61e6f8949f7dbaa718dfdca62
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1524-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-74-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2704-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-113-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/692-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-151-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2648-152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-487-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-637-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2908-647-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2724-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-665-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2432-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-684-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1524 pjjjd.exe 1740 7fxrxfr.exe 2532 btntbh.exe 2356 1dvvd.exe 2424 tbnthn.exe 2860 fxrrxfl.exe 2720 ffxfrxr.exe 2704 dvpvj.exe 2724 9vpvp.exe 2592 9vjjp.exe 2144 pppdp.exe 692 xfxlxfx.exe 2840 ppdjj.exe 664 lrxrxlf.exe 2648 3nbhhn.exe 980 xrflrxl.exe 1068 htnnbn.exe 1160 vpddp.exe 2976 fxlrxfx.exe 2152 dvjjp.exe 2104 xrxfxff.exe 2360 ntntbt.exe 652 1dppv.exe 1448 xlflrrf.exe 1084 hbbbhh.exe 2480 5vppv.exe 2264 rrflrfr.exe 796 5jdjp.exe 1824 5xxfxxf.exe 2460 btnntt.exe 2340 3vppd.exe 1872 lfrxflx.exe 1044 tthbbn.exe 2332 5vpvj.exe 2372 rrrrxxr.exe 1644 xxrfrfx.exe 2732 3nbhnn.exe 1636 vvpvd.exe 2856 jddjd.exe 2552 3lxrrrx.exe 2748 9bbhnb.exe 2784 pddjv.exe 2612 jdvvv.exe 2876 rrfllrx.exe 2456 htntht.exe 784 5dvdd.exe 1676 jjdjd.exe 2688 ntnnbh.exe 576 htnbth.exe 2816 dddjj.exe 272 3xlfrxl.exe 1184 lrlxlxr.exe 2948 9htthh.exe 1548 pvpdj.exe 1160 vjddj.exe 2916 7xrrxfl.exe 1980 hnhnhh.exe 2284 dvppd.exe 1204 jvppv.exe 2988 lfflffl.exe 1712 btnthn.exe 2004 nhhhtt.exe 2252 7vpvj.exe 1532 rxfxlfx.exe -
resource yara_rule behavioral1/memory/1524-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-487-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2004-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-637-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2724-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-742-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1524 2200 6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe 30 PID 2200 wrote to memory of 1524 2200 6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe 30 PID 2200 wrote to memory of 1524 2200 6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe 30 PID 2200 wrote to memory of 1524 2200 6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe 30 PID 1524 wrote to memory of 1740 1524 pjjjd.exe 31 PID 1524 wrote to memory of 1740 1524 pjjjd.exe 31 PID 1524 wrote to memory of 1740 1524 pjjjd.exe 31 PID 1524 wrote to memory of 1740 1524 pjjjd.exe 31 PID 1740 wrote to memory of 2532 1740 7fxrxfr.exe 32 PID 1740 wrote to memory of 2532 1740 7fxrxfr.exe 32 PID 1740 wrote to memory of 2532 1740 7fxrxfr.exe 32 PID 1740 wrote to memory of 2532 1740 7fxrxfr.exe 32 PID 2532 wrote to memory of 2356 2532 btntbh.exe 33 PID 2532 wrote to memory of 2356 2532 btntbh.exe 33 PID 2532 wrote to memory of 2356 2532 btntbh.exe 33 PID 2532 wrote to memory of 2356 2532 btntbh.exe 33 PID 2356 wrote to memory of 2424 2356 1dvvd.exe 34 PID 2356 wrote to memory of 2424 2356 1dvvd.exe 34 PID 2356 wrote to memory of 2424 2356 1dvvd.exe 34 PID 2356 wrote to memory of 2424 2356 1dvvd.exe 34 PID 2424 wrote to memory of 2860 2424 tbnthn.exe 35 PID 2424 wrote to memory of 2860 2424 tbnthn.exe 35 PID 2424 wrote to memory of 2860 2424 tbnthn.exe 35 PID 2424 wrote to memory of 2860 2424 tbnthn.exe 35 PID 2860 wrote to memory of 2720 2860 fxrrxfl.exe 36 PID 2860 wrote to memory of 2720 2860 fxrrxfl.exe 36 PID 2860 wrote to memory of 2720 2860 fxrrxfl.exe 36 PID 2860 wrote to memory of 2720 2860 fxrrxfl.exe 36 PID 2720 wrote to memory of 2704 2720 ffxfrxr.exe 37 PID 2720 wrote to memory of 2704 2720 ffxfrxr.exe 37 PID 2720 wrote to memory of 2704 2720 ffxfrxr.exe 37 PID 2720 wrote to memory of 2704 2720 ffxfrxr.exe 37 PID 2704 wrote to memory of 2724 2704 dvpvj.exe 38 PID 2704 wrote to memory of 2724 2704 dvpvj.exe 38 PID 2704 wrote to memory of 2724 2704 dvpvj.exe 38 PID 2704 wrote to memory of 2724 2704 dvpvj.exe 38 PID 2724 wrote to memory of 2592 2724 9vpvp.exe 39 PID 2724 wrote to memory of 2592 2724 9vpvp.exe 39 PID 2724 wrote to memory of 2592 2724 9vpvp.exe 39 PID 2724 wrote to memory of 2592 2724 9vpvp.exe 39 PID 2592 wrote to memory of 2144 2592 9vjjp.exe 40 PID 2592 wrote to memory of 2144 2592 9vjjp.exe 40 PID 2592 wrote to memory of 2144 2592 9vjjp.exe 40 PID 2592 wrote to memory of 2144 2592 9vjjp.exe 40 PID 2144 wrote to memory of 692 2144 pppdp.exe 41 PID 2144 wrote to memory of 692 2144 pppdp.exe 41 PID 2144 wrote to memory of 692 2144 pppdp.exe 41 PID 2144 wrote to memory of 692 2144 pppdp.exe 41 PID 692 wrote to memory of 2840 692 xfxlxfx.exe 42 PID 692 wrote to memory of 2840 692 xfxlxfx.exe 42 PID 692 wrote to memory of 2840 692 xfxlxfx.exe 42 PID 692 wrote to memory of 2840 692 xfxlxfx.exe 42 PID 2840 wrote to memory of 664 2840 ppdjj.exe 43 PID 2840 wrote to memory of 664 2840 ppdjj.exe 43 PID 2840 wrote to memory of 664 2840 ppdjj.exe 43 PID 2840 wrote to memory of 664 2840 ppdjj.exe 43 PID 664 wrote to memory of 2648 664 lrxrxlf.exe 44 PID 664 wrote to memory of 2648 664 lrxrxlf.exe 44 PID 664 wrote to memory of 2648 664 lrxrxlf.exe 44 PID 664 wrote to memory of 2648 664 lrxrxlf.exe 44 PID 2648 wrote to memory of 980 2648 3nbhhn.exe 45 PID 2648 wrote to memory of 980 2648 3nbhhn.exe 45 PID 2648 wrote to memory of 980 2648 3nbhhn.exe 45 PID 2648 wrote to memory of 980 2648 3nbhhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe"C:\Users\Admin\AppData\Local\Temp\6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pjjjd.exec:\pjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\7fxrxfr.exec:\7fxrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\btntbh.exec:\btntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1dvvd.exec:\1dvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\tbnthn.exec:\tbnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\dvpvj.exec:\dvpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\9vpvp.exec:\9vpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9vjjp.exec:\9vjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\pppdp.exec:\pppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xfxlxfx.exec:\xfxlxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\ppdjj.exec:\ppdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\lrxrxlf.exec:\lrxrxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\3nbhhn.exec:\3nbhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xrflrxl.exec:\xrflrxl.exe17⤵
- Executes dropped EXE
PID:980 -
\??\c:\htnnbn.exec:\htnnbn.exe18⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vpddp.exec:\vpddp.exe19⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dvjjp.exec:\dvjjp.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrxfxff.exec:\xrxfxff.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ntntbt.exec:\ntntbt.exe23⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1dppv.exec:\1dppv.exe24⤵
- Executes dropped EXE
PID:652 -
\??\c:\xlflrrf.exec:\xlflrrf.exe25⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbbbhh.exec:\hbbbhh.exe26⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5vppv.exec:\5vppv.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrflrfr.exec:\rrflrfr.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5jdjp.exec:\5jdjp.exe29⤵
- Executes dropped EXE
PID:796 -
\??\c:\5xxfxxf.exec:\5xxfxxf.exe30⤵
- Executes dropped EXE
PID:1824 -
\??\c:\btnntt.exec:\btnntt.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3vppd.exec:\3vppd.exe32⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lfrxflx.exec:\lfrxflx.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tthbbn.exec:\tthbbn.exe34⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5vpvj.exec:\5vpvj.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rrrrxxr.exec:\rrrrxxr.exe36⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xxrfrfx.exec:\xxrfrfx.exe37⤵
- Executes dropped EXE
PID:1644 -
\??\c:\3nbhnn.exec:\3nbhnn.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vvpvd.exec:\vvpvd.exe39⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jddjd.exec:\jddjd.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3lxrrrx.exec:\3lxrrrx.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\9bbhnb.exec:\9bbhnb.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pddjv.exec:\pddjv.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jdvvv.exec:\jdvvv.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rrfllrx.exec:\rrfllrx.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\htntht.exec:\htntht.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5dvdd.exec:\5dvdd.exe47⤵
- Executes dropped EXE
PID:784 -
\??\c:\jjdjd.exec:\jjdjd.exe48⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ntnnbh.exec:\ntnnbh.exe49⤵
- Executes dropped EXE
PID:2688 -
\??\c:\htnbth.exec:\htnbth.exe50⤵
- Executes dropped EXE
PID:576 -
\??\c:\dddjj.exec:\dddjj.exe51⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3xlfrxl.exec:\3xlfrxl.exe52⤵
- Executes dropped EXE
PID:272 -
\??\c:\lrlxlxr.exec:\lrlxlxr.exe53⤵
- Executes dropped EXE
PID:1184 -
\??\c:\9htthh.exec:\9htthh.exe54⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pvpdj.exec:\pvpdj.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vjddj.exec:\vjddj.exe56⤵
- Executes dropped EXE
PID:1160 -
\??\c:\7xrrxfl.exec:\7xrrxfl.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hnhnhh.exec:\hnhnhh.exe58⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dvppd.exec:\dvppd.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jvppv.exec:\jvppv.exe60⤵
- Executes dropped EXE
PID:1204 -
\??\c:\lfflffl.exec:\lfflffl.exe61⤵
- Executes dropped EXE
PID:2988 -
\??\c:\btnthn.exec:\btnthn.exe62⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhhhtt.exec:\nhhhtt.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2004 -
\??\c:\7vpvj.exec:\7vpvj.exe64⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1nthnn.exec:\1nthnn.exe66⤵PID:2480
-
\??\c:\hhttth.exec:\hhttth.exe67⤵PID:2468
-
\??\c:\jdppv.exec:\jdppv.exe68⤵PID:2256
-
\??\c:\3lfrffr.exec:\3lfrffr.exe69⤵PID:1348
-
\??\c:\lrfxflf.exec:\lrfxflf.exe70⤵PID:1060
-
\??\c:\1hbbhb.exec:\1hbbhb.exe71⤵PID:2208
-
\??\c:\dvdvd.exec:\dvdvd.exe72⤵PID:2280
-
\??\c:\pjdjv.exec:\pjdjv.exe73⤵PID:1588
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe74⤵PID:1996
-
\??\c:\btntbh.exec:\btntbh.exe75⤵PID:3064
-
\??\c:\thttbt.exec:\thttbt.exe76⤵PID:2332
-
\??\c:\9dpvp.exec:\9dpvp.exe77⤵PID:3000
-
\??\c:\1xrxflr.exec:\1xrxflr.exe78⤵PID:2728
-
\??\c:\1lflxxx.exec:\1lflxxx.exe79⤵PID:2852
-
\??\c:\htbhbb.exec:\htbhbb.exe80⤵PID:2692
-
\??\c:\vpjvp.exec:\vpjvp.exe81⤵PID:2860
-
\??\c:\1jvdj.exec:\1jvdj.exe82⤵PID:2552
-
\??\c:\frllrxl.exec:\frllrxl.exe83⤵PID:2704
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe84⤵PID:2940
-
\??\c:\nntbnb.exec:\nntbnb.exe85⤵PID:2908
-
\??\c:\vvvpd.exec:\vvvpd.exe86⤵PID:2724
-
\??\c:\xrlrflx.exec:\xrlrflx.exe87⤵PID:2144
-
\??\c:\7fxxflf.exec:\7fxxflf.exe88⤵PID:2432
-
\??\c:\bbntnn.exec:\bbntnn.exe89⤵PID:2804
-
\??\c:\1pddj.exec:\1pddj.exe90⤵PID:1096
-
\??\c:\rxfrrfr.exec:\rxfrrfr.exe91⤵PID:1488
-
\??\c:\rxrxflr.exec:\rxrxflr.exe92⤵PID:2816
-
\??\c:\nhhnbh.exec:\nhhnbh.exe93⤵PID:980
-
\??\c:\5ttthh.exec:\5ttthh.exe94⤵PID:984
-
\??\c:\5dvdp.exec:\5dvdp.exe95⤵PID:2948
-
\??\c:\3xrrxfl.exec:\3xrrxfl.exe96⤵PID:1200
-
\??\c:\7nnhbb.exec:\7nnhbb.exe97⤵PID:2320
-
\??\c:\btbbbh.exec:\btbbbh.exe98⤵PID:2544
-
\??\c:\vvdpd.exec:\vvdpd.exe99⤵PID:1940
-
\??\c:\jvjdv.exec:\jvjdv.exe100⤵PID:860
-
\??\c:\rlflrlx.exec:\rlflrlx.exe101⤵PID:1860
-
\??\c:\hbtbbh.exec:\hbtbbh.exe102⤵PID:652
-
\??\c:\7vvdj.exec:\7vvdj.exe103⤵PID:1608
-
\??\c:\7pjpv.exec:\7pjpv.exe104⤵PID:848
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe105⤵PID:2252
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe106⤵PID:1788
-
\??\c:\9htttb.exec:\9htttb.exe107⤵PID:872
-
\??\c:\ddppv.exec:\ddppv.exe108⤵PID:1800
-
\??\c:\pjdjp.exec:\pjdjp.exe109⤵PID:2240
-
\??\c:\rxrfxlf.exec:\rxrfxlf.exe110⤵PID:2352
-
\??\c:\hbtbnn.exec:\hbtbnn.exe111⤵PID:1060
-
\??\c:\nhtbnt.exec:\nhtbnt.exe112⤵PID:1524
-
\??\c:\pjvvd.exec:\pjvvd.exe113⤵PID:1716
-
\??\c:\dvpvd.exec:\dvpvd.exe114⤵PID:1560
-
\??\c:\rxlxfrf.exec:\rxlxfrf.exe115⤵PID:1996
-
\??\c:\lrlflxf.exec:\lrlflxf.exe116⤵PID:2316
-
\??\c:\tthtbb.exec:\tthtbb.exe117⤵PID:3008
-
\??\c:\pjdpd.exec:\pjdpd.exe118⤵PID:2736
-
\??\c:\rlxxflx.exec:\rlxxflx.exe119⤵PID:2880
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe120⤵PID:2052
-
\??\c:\3ttntb.exec:\3ttntb.exe121⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-