Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe
-
Size
452KB
-
MD5
62c1d9a088678e1601be87e3a7812ad2
-
SHA1
c9b441abd87a50d43067ce8ba674e5ec29f8dd82
-
SHA256
4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1
-
SHA512
f59ca0e23ae40d9736b31df83161245c6684540259ac8a704c4bec46b228e65ebad1fb5572962b94392af7a992c09f49b5ce52402e0ce023145e168985968f8c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2372-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-36-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/944-34-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-54-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3036-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-76-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2652-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-95-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2300-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-131-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2832-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-264-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1820-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-503-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2400 3jpdv.exe 2152 hhhnht.exe 944 pppdv.exe 2804 9fllffx.exe 2724 7htbhh.exe 3036 djddp.exe 536 7thhnn.exe 2800 3jpdp.exe 2676 3hbhtb.exe 2652 dvpvd.exe 2300 1ttbht.exe 1088 jdjjj.exe 1924 3nnbth.exe 2832 xrrxlrr.exe 1992 9lllfll.exe 1720 btntnn.exe 1896 vvdpv.exe 1512 djdjv.exe 2840 lllxrxl.exe 2140 pvpdp.exe 2276 lrrlfrl.exe 1076 5ntnbh.exe 2816 5ppjv.exe 684 9tnntt.exe 1880 fflrxrr.exe 2284 hnhnhn.exe 980 rllxlxx.exe 1820 nnnnbh.exe 1756 lllxxxr.exe 1160 nhhtnt.exe 2420 frlfrxl.exe 2376 5nhnbn.exe 2524 lffflrl.exe 2080 hbbhtb.exe 944 jjdvd.exe 2268 3xlrxfr.exe 2896 fxfrlxr.exe 2744 hhtttt.exe 2736 vvdpj.exe 536 rrxfrfr.exe 2792 lrlrflx.exe 2668 hhnnhh.exe 2740 vppvp.exe 2172 jjpdp.exe 628 rlrrflr.exe 1068 btntnb.exe 1064 9ttbtb.exe 1364 3vvvp.exe 2160 xxxlxfr.exe 1208 tthtnh.exe 2680 5tnbtt.exe 2044 5dvdd.exe 1328 llxfrfr.exe 2796 9fxfffx.exe 2980 5hnbnb.exe 3012 1pjvp.exe 2212 jvvdv.exe 1524 rlflrrf.exe 1776 7btbhn.exe 1892 hbtnnh.exe 1660 ppddj.exe 2304 flxfrxr.exe 1056 hhbbtb.exe 2228 nntbnn.exe -
resource yara_rule behavioral1/memory/2372-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-264-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1820-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-784-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/880-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-861-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2400 2372 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 30 PID 2372 wrote to memory of 2400 2372 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 30 PID 2372 wrote to memory of 2400 2372 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 30 PID 2372 wrote to memory of 2400 2372 4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe 30 PID 2400 wrote to memory of 2152 2400 3jpdv.exe 31 PID 2400 wrote to memory of 2152 2400 3jpdv.exe 31 PID 2400 wrote to memory of 2152 2400 3jpdv.exe 31 PID 2400 wrote to memory of 2152 2400 3jpdv.exe 31 PID 2152 wrote to memory of 944 2152 hhhnht.exe 32 PID 2152 wrote to memory of 944 2152 hhhnht.exe 32 PID 2152 wrote to memory of 944 2152 hhhnht.exe 32 PID 2152 wrote to memory of 944 2152 hhhnht.exe 32 PID 944 wrote to memory of 2804 944 pppdv.exe 33 PID 944 wrote to memory of 2804 944 pppdv.exe 33 PID 944 wrote to memory of 2804 944 pppdv.exe 33 PID 944 wrote to memory of 2804 944 pppdv.exe 33 PID 2804 wrote to memory of 2724 2804 9fllffx.exe 34 PID 2804 wrote to memory of 2724 2804 9fllffx.exe 34 PID 2804 wrote to memory of 2724 2804 9fllffx.exe 34 PID 2804 wrote to memory of 2724 2804 9fllffx.exe 34 PID 2724 wrote to memory of 3036 2724 7htbhh.exe 35 PID 2724 wrote to memory of 3036 2724 7htbhh.exe 35 PID 2724 wrote to memory of 3036 2724 7htbhh.exe 35 PID 2724 wrote to memory of 3036 2724 7htbhh.exe 35 PID 3036 wrote to memory of 536 3036 djddp.exe 36 PID 3036 wrote to memory of 536 3036 djddp.exe 36 PID 3036 wrote to memory of 536 3036 djddp.exe 36 PID 3036 wrote to memory of 536 3036 djddp.exe 36 PID 536 wrote to memory of 2800 536 7thhnn.exe 37 PID 536 wrote to memory of 2800 536 7thhnn.exe 37 PID 536 wrote to memory of 2800 536 7thhnn.exe 37 PID 536 wrote to memory of 2800 536 7thhnn.exe 37 PID 2800 wrote to memory of 2676 2800 3jpdp.exe 38 PID 2800 wrote to memory of 2676 2800 3jpdp.exe 38 PID 2800 wrote to memory of 2676 2800 3jpdp.exe 38 PID 2800 wrote to memory of 2676 2800 3jpdp.exe 38 PID 2676 wrote to memory of 2652 2676 3hbhtb.exe 39 PID 2676 wrote to memory of 2652 2676 3hbhtb.exe 39 PID 2676 wrote to memory of 2652 2676 3hbhtb.exe 39 PID 2676 wrote to memory of 2652 2676 3hbhtb.exe 39 PID 2652 wrote to memory of 2300 2652 dvpvd.exe 40 PID 2652 wrote to memory of 2300 2652 dvpvd.exe 40 PID 2652 wrote to memory of 2300 2652 dvpvd.exe 40 PID 2652 wrote to memory of 2300 2652 dvpvd.exe 40 PID 2300 wrote to memory of 1088 2300 1ttbht.exe 41 PID 2300 wrote to memory of 1088 2300 1ttbht.exe 41 PID 2300 wrote to memory of 1088 2300 1ttbht.exe 41 PID 2300 wrote to memory of 1088 2300 1ttbht.exe 41 PID 1088 wrote to memory of 1924 1088 jdjjj.exe 42 PID 1088 wrote to memory of 1924 1088 jdjjj.exe 42 PID 1088 wrote to memory of 1924 1088 jdjjj.exe 42 PID 1088 wrote to memory of 1924 1088 jdjjj.exe 42 PID 1924 wrote to memory of 2832 1924 3nnbth.exe 43 PID 1924 wrote to memory of 2832 1924 3nnbth.exe 43 PID 1924 wrote to memory of 2832 1924 3nnbth.exe 43 PID 1924 wrote to memory of 2832 1924 3nnbth.exe 43 PID 2832 wrote to memory of 1992 2832 xrrxlrr.exe 44 PID 2832 wrote to memory of 1992 2832 xrrxlrr.exe 44 PID 2832 wrote to memory of 1992 2832 xrrxlrr.exe 44 PID 2832 wrote to memory of 1992 2832 xrrxlrr.exe 44 PID 1992 wrote to memory of 1720 1992 9lllfll.exe 45 PID 1992 wrote to memory of 1720 1992 9lllfll.exe 45 PID 1992 wrote to memory of 1720 1992 9lllfll.exe 45 PID 1992 wrote to memory of 1720 1992 9lllfll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe"C:\Users\Admin\AppData\Local\Temp\4d593588e1af4e281b5cab102f5621d4c5dfe61aa60a1eed67089612a138ecb1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\3jpdv.exec:\3jpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hhhnht.exec:\hhhnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\pppdv.exec:\pppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\9fllffx.exec:\9fllffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7htbhh.exec:\7htbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\djddp.exec:\djddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7thhnn.exec:\7thhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\3jpdp.exec:\3jpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3hbhtb.exec:\3hbhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dvpvd.exec:\dvpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\1ttbht.exec:\1ttbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jdjjj.exec:\jdjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\3nnbth.exec:\3nnbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\xrrxlrr.exec:\xrrxlrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9lllfll.exec:\9lllfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\btntnn.exec:\btntnn.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vvdpv.exec:\vvdpv.exe18⤵
- Executes dropped EXE
PID:1896 -
\??\c:\djdjv.exec:\djdjv.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lllxrxl.exec:\lllxrxl.exe20⤵
- Executes dropped EXE
PID:2840 -
\??\c:\pvpdp.exec:\pvpdp.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lrrlfrl.exec:\lrrlfrl.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5ntnbh.exec:\5ntnbh.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5ppjv.exec:\5ppjv.exe24⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9tnntt.exec:\9tnntt.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\fflrxrr.exec:\fflrxrr.exe26⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hnhnhn.exec:\hnhnhn.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rllxlxx.exec:\rllxlxx.exe28⤵
- Executes dropped EXE
PID:980 -
\??\c:\nnnnbh.exec:\nnnnbh.exe29⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lllxxxr.exec:\lllxxxr.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nhhtnt.exec:\nhhtnt.exe31⤵
- Executes dropped EXE
PID:1160 -
\??\c:\frlfrxl.exec:\frlfrxl.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5nhnbn.exec:\5nhnbn.exe33⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lffflrl.exec:\lffflrl.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hbbhtb.exec:\hbbhtb.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jjdvd.exec:\jjdvd.exe36⤵
- Executes dropped EXE
PID:944 -
\??\c:\3xlrxfr.exec:\3xlrxfr.exe37⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxfrlxr.exec:\fxfrlxr.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hhtttt.exec:\hhtttt.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvdpj.exec:\vvdpj.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rrxfrfr.exec:\rrxfrfr.exe41⤵
- Executes dropped EXE
PID:536 -
\??\c:\lrlrflx.exec:\lrlrflx.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hhnnhh.exec:\hhnnhh.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vppvp.exec:\vppvp.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjpdp.exec:\jjpdp.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rlrrflr.exec:\rlrrflr.exe46⤵
- Executes dropped EXE
PID:628 -
\??\c:\btntnb.exec:\btntnb.exe47⤵
- Executes dropped EXE
PID:1068 -
\??\c:\9ttbtb.exec:\9ttbtb.exe48⤵
- Executes dropped EXE
PID:1064 -
\??\c:\3vvvp.exec:\3vvvp.exe49⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xxxlxfr.exec:\xxxlxfr.exe50⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tthtnh.exec:\tthtnh.exe51⤵
- Executes dropped EXE
PID:1208 -
\??\c:\5tnbtt.exec:\5tnbtt.exe52⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5dvdd.exec:\5dvdd.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\llxfrfr.exec:\llxfrfr.exe54⤵
- Executes dropped EXE
PID:1328 -
\??\c:\9fxfffx.exec:\9fxfffx.exe55⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5hnbnb.exec:\5hnbnb.exe56⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1pjvp.exec:\1pjvp.exe57⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jvvdv.exec:\jvvdv.exe58⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlflrrf.exec:\rlflrrf.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\7btbhn.exec:\7btbhn.exe60⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hbtnnh.exec:\hbtnnh.exe61⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ppddj.exec:\ppddj.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\flxfrxr.exec:\flxfrxr.exe63⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hhbbtb.exec:\hhbbtb.exe64⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nntbnn.exec:\nntbnn.exe65⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pdvvj.exec:\pdvvj.exe66⤵PID:2248
-
\??\c:\1fxlxfr.exec:\1fxlxfr.exe67⤵PID:2260
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe68⤵PID:1624
-
\??\c:\ttnthh.exec:\ttnthh.exe69⤵PID:1752
-
\??\c:\3jvvd.exec:\3jvvd.exe70⤵PID:2112
-
\??\c:\pjdjp.exec:\pjdjp.exe71⤵PID:2412
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe72⤵PID:1984
-
\??\c:\1hhtnt.exec:\1hhtnt.exe73⤵PID:1596
-
\??\c:\ntttnh.exec:\ntttnh.exe74⤵PID:3016
-
\??\c:\djpjv.exec:\djpjv.exe75⤵PID:2508
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe76⤵PID:2128
-
\??\c:\rllxrxx.exec:\rllxrxx.exe77⤵PID:1936
-
\??\c:\7htbnt.exec:\7htbnt.exe78⤵PID:2764
-
\??\c:\vvvvd.exec:\vvvvd.exe79⤵PID:2772
-
\??\c:\1pddj.exec:\1pddj.exe80⤵PID:2924
-
\??\c:\rxlffrx.exec:\rxlffrx.exe81⤵PID:2836
-
\??\c:\bbtbnt.exec:\bbtbnt.exe82⤵PID:2800
-
\??\c:\btttnt.exec:\btttnt.exe83⤵PID:2616
-
\??\c:\vdvpd.exec:\vdvpd.exe84⤵PID:2676
-
\??\c:\3ffrrff.exec:\3ffrrff.exe85⤵PID:1988
-
\??\c:\3flfrfx.exec:\3flfrfx.exe86⤵PID:2308
-
\??\c:\tbbthb.exec:\tbbthb.exe87⤵PID:2300
-
\??\c:\pjvdp.exec:\pjvdp.exe88⤵PID:1088
-
\??\c:\pjvvp.exec:\pjvvp.exe89⤵PID:2584
-
\??\c:\lllrflf.exec:\lllrflf.exe90⤵PID:1472
-
\??\c:\ttbhbh.exec:\ttbhbh.exe91⤵PID:2428
-
\??\c:\9bnbbh.exec:\9bnbbh.exe92⤵PID:864
-
\??\c:\dvpvj.exec:\dvpvj.exe93⤵PID:1084
-
\??\c:\5xxxfll.exec:\5xxxfll.exe94⤵PID:1536
-
\??\c:\tbbnbh.exec:\tbbnbh.exe95⤵PID:1556
-
\??\c:\5pjvj.exec:\5pjvj.exe96⤵PID:2848
-
\??\c:\9ppdv.exec:\9ppdv.exe97⤵PID:2812
-
\??\c:\7fflrxr.exec:\7fflrxr.exe98⤵PID:2232
-
\??\c:\9lrfrfr.exec:\9lrfrfr.exe99⤵PID:2292
-
\??\c:\btnbnb.exec:\btnbnb.exe100⤵PID:2280
-
\??\c:\pvpdv.exec:\pvpdv.exe101⤵PID:2940
-
\??\c:\xfxfxll.exec:\xfxfxll.exe102⤵PID:1920
-
\??\c:\lffrrxl.exec:\lffrrxl.exe103⤵PID:1368
-
\??\c:\hbhntb.exec:\hbhntb.exe104⤵PID:2368
-
\??\c:\vjjjv.exec:\vjjjv.exe105⤵PID:1584
-
\??\c:\3jjjj.exec:\3jjjj.exe106⤵PID:2284
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe107⤵PID:2512
-
\??\c:\nhthnt.exec:\nhthnt.exe108⤵PID:2060
-
\??\c:\nnbnbn.exec:\nnbnbn.exe109⤵PID:880
-
\??\c:\dvvjv.exec:\dvvjv.exe110⤵PID:3064
-
\??\c:\jdjjp.exec:\jdjjp.exe111⤵PID:1160
-
\??\c:\xxflxxr.exec:\xxflxxr.exe112⤵PID:2404
-
\??\c:\tbtbht.exec:\tbtbht.exe113⤵PID:2420
-
\??\c:\bbbhbh.exec:\bbbhbh.exe114⤵PID:1908
-
\??\c:\dvpvp.exec:\dvpvp.exe115⤵PID:2524
-
\??\c:\jdjpj.exec:\jdjpj.exe116⤵PID:1716
-
\??\c:\fxrxffr.exec:\fxrxffr.exe117⤵PID:2508
-
\??\c:\9ttbht.exec:\9ttbht.exe118⤵PID:2268
-
\??\c:\1vvjv.exec:\1vvjv.exe119⤵PID:2880
-
\??\c:\vddpj.exec:\vddpj.exe120⤵PID:2916
-
\??\c:\xxxllrl.exec:\xxxllrl.exe121⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-