Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe
-
Size
454KB
-
MD5
e3d80e0e9b9b181821b6c6ca021ccdea
-
SHA1
6a317088de51e884965588c39c2b6d5e5e1d338f
-
SHA256
9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3
-
SHA512
028600357e82ba458a4c4be6bea3ce5ec671f18399253176d03194aa2ea5387af3bf35e25f022a936fbb8716d9793d6671d5b09c0633c440b612df871a41d568
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT4:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2056-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-12-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2740-23-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2176-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-43-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2772-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-98-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2860-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-127-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1276-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-335-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2844-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-413-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1772-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1056-508-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2116-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2176 1lxflxf.exe 2740 9htbtt.exe 2540 rfrllfl.exe 2772 vpdvd.exe 2700 flxlrxf.exe 2544 xrffrrx.exe 2992 7tnbbb.exe 588 fxrrflr.exe 2860 1lxxfll.exe 3032 7rrxfff.exe 2256 lxlrxrf.exe 296 frllxxl.exe 2592 hhnbnt.exe 1684 rfrlrxr.exe 2812 jddvj.exe 380 rrflrxf.exe 1752 nhtntb.exe 2756 5fxllll.exe 1928 nbntbh.exe 1920 vddjv.exe 752 httnnb.exe 2396 fflrrrx.exe 1628 lxllxrr.exe 1716 vpvdj.exe 3060 rlrrxfl.exe 1276 dpjjv.exe 1936 lfxxflf.exe 980 dvdjp.exe 1916 rfrxxfr.exe 2280 pdjjj.exe 2676 lxlfllr.exe 2312 5vpvd.exe 2792 rrxxffl.exe 2696 7bhttn.exe 2560 vjvpv.exe 2112 pvvjj.exe 2844 xlxfrxx.exe 2600 nbhttb.exe 3000 1pvdp.exe 2344 xlflrrf.exe 1972 bththn.exe 2984 dvjdj.exe 3024 5vdjp.exe 2572 9lxfrlr.exe 1224 ntnbnh.exe 1892 pdvdv.exe 1240 9jvdd.exe 1700 rlxfrxf.exe 2172 tnbntt.exe 2100 5pvpp.exe 540 pjdjp.exe 900 fxlrlll.exe 624 7nbhtn.exe 1964 pjvdv.exe 2204 5lxflll.exe 1672 7frrrrf.exe 2496 1bhntb.exe 1056 3pvvv.exe 752 lfrxxfx.exe 1772 tnbbhb.exe 1352 5hhhtt.exe 1704 dpdvd.exe 2124 xlfxllx.exe 2116 hbtbnn.exe -
resource yara_rule behavioral1/memory/2056-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-692-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2176 2056 9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe 30 PID 2056 wrote to memory of 2176 2056 9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe 30 PID 2056 wrote to memory of 2176 2056 9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe 30 PID 2056 wrote to memory of 2176 2056 9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe 30 PID 2176 wrote to memory of 2740 2176 1lxflxf.exe 31 PID 2176 wrote to memory of 2740 2176 1lxflxf.exe 31 PID 2176 wrote to memory of 2740 2176 1lxflxf.exe 31 PID 2176 wrote to memory of 2740 2176 1lxflxf.exe 31 PID 2740 wrote to memory of 2540 2740 9htbtt.exe 32 PID 2740 wrote to memory of 2540 2740 9htbtt.exe 32 PID 2740 wrote to memory of 2540 2740 9htbtt.exe 32 PID 2740 wrote to memory of 2540 2740 9htbtt.exe 32 PID 2540 wrote to memory of 2772 2540 rfrllfl.exe 33 PID 2540 wrote to memory of 2772 2540 rfrllfl.exe 33 PID 2540 wrote to memory of 2772 2540 rfrllfl.exe 33 PID 2540 wrote to memory of 2772 2540 rfrllfl.exe 33 PID 2772 wrote to memory of 2700 2772 vpdvd.exe 34 PID 2772 wrote to memory of 2700 2772 vpdvd.exe 34 PID 2772 wrote to memory of 2700 2772 vpdvd.exe 34 PID 2772 wrote to memory of 2700 2772 vpdvd.exe 34 PID 2700 wrote to memory of 2544 2700 flxlrxf.exe 35 PID 2700 wrote to memory of 2544 2700 flxlrxf.exe 35 PID 2700 wrote to memory of 2544 2700 flxlrxf.exe 35 PID 2700 wrote to memory of 2544 2700 flxlrxf.exe 35 PID 2544 wrote to memory of 2992 2544 xrffrrx.exe 36 PID 2544 wrote to memory of 2992 2544 xrffrrx.exe 36 PID 2544 wrote to memory of 2992 2544 xrffrrx.exe 36 PID 2544 wrote to memory of 2992 2544 xrffrrx.exe 36 PID 2992 wrote to memory of 588 2992 7tnbbb.exe 37 PID 2992 wrote to memory of 588 2992 7tnbbb.exe 37 PID 2992 wrote to memory of 588 2992 7tnbbb.exe 37 PID 2992 wrote to memory of 588 2992 7tnbbb.exe 37 PID 588 wrote to memory of 2860 588 fxrrflr.exe 38 PID 588 wrote to memory of 2860 588 fxrrflr.exe 38 PID 588 wrote to memory of 2860 588 fxrrflr.exe 38 PID 588 wrote to memory of 2860 588 fxrrflr.exe 38 PID 2860 wrote to memory of 3032 2860 1lxxfll.exe 39 PID 2860 wrote to memory of 3032 2860 1lxxfll.exe 39 PID 2860 wrote to memory of 3032 2860 1lxxfll.exe 39 PID 2860 wrote to memory of 3032 2860 1lxxfll.exe 39 PID 3032 wrote to memory of 2256 3032 7rrxfff.exe 40 PID 3032 wrote to memory of 2256 3032 7rrxfff.exe 40 PID 3032 wrote to memory of 2256 3032 7rrxfff.exe 40 PID 3032 wrote to memory of 2256 3032 7rrxfff.exe 40 PID 2256 wrote to memory of 296 2256 lxlrxrf.exe 41 PID 2256 wrote to memory of 296 2256 lxlrxrf.exe 41 PID 2256 wrote to memory of 296 2256 lxlrxrf.exe 41 PID 2256 wrote to memory of 296 2256 lxlrxrf.exe 41 PID 296 wrote to memory of 2592 296 frllxxl.exe 42 PID 296 wrote to memory of 2592 296 frllxxl.exe 42 PID 296 wrote to memory of 2592 296 frllxxl.exe 42 PID 296 wrote to memory of 2592 296 frllxxl.exe 42 PID 2592 wrote to memory of 1684 2592 hhnbnt.exe 43 PID 2592 wrote to memory of 1684 2592 hhnbnt.exe 43 PID 2592 wrote to memory of 1684 2592 hhnbnt.exe 43 PID 2592 wrote to memory of 1684 2592 hhnbnt.exe 43 PID 1684 wrote to memory of 2812 1684 rfrlrxr.exe 44 PID 1684 wrote to memory of 2812 1684 rfrlrxr.exe 44 PID 1684 wrote to memory of 2812 1684 rfrlrxr.exe 44 PID 1684 wrote to memory of 2812 1684 rfrlrxr.exe 44 PID 2812 wrote to memory of 380 2812 jddvj.exe 45 PID 2812 wrote to memory of 380 2812 jddvj.exe 45 PID 2812 wrote to memory of 380 2812 jddvj.exe 45 PID 2812 wrote to memory of 380 2812 jddvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe"C:\Users\Admin\AppData\Local\Temp\9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\1lxflxf.exec:\1lxflxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\9htbtt.exec:\9htbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rfrllfl.exec:\rfrllfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vpdvd.exec:\vpdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\flxlrxf.exec:\flxlrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xrffrrx.exec:\xrffrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\7tnbbb.exec:\7tnbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\fxrrflr.exec:\fxrrflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\1lxxfll.exec:\1lxxfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\7rrxfff.exec:\7rrxfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\lxlrxrf.exec:\lxlrxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\frllxxl.exec:\frllxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\hhnbnt.exec:\hhnbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rfrlrxr.exec:\rfrlrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jddvj.exec:\jddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rrflrxf.exec:\rrflrxf.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\nhtntb.exec:\nhtntb.exe18⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5fxllll.exec:\5fxllll.exe19⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nbntbh.exec:\nbntbh.exe20⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vddjv.exec:\vddjv.exe21⤵
- Executes dropped EXE
PID:1920 -
\??\c:\httnnb.exec:\httnnb.exe22⤵
- Executes dropped EXE
PID:752 -
\??\c:\fflrrrx.exec:\fflrrrx.exe23⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lxllxrr.exec:\lxllxrr.exe24⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vpvdj.exec:\vpvdj.exe25⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe26⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dpjjv.exec:\dpjjv.exe27⤵
- Executes dropped EXE
PID:1276 -
\??\c:\lfxxflf.exec:\lfxxflf.exe28⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dvdjp.exec:\dvdjp.exe29⤵
- Executes dropped EXE
PID:980 -
\??\c:\rfrxxfr.exec:\rfrxxfr.exe30⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pdjjj.exec:\pdjjj.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lxlfllr.exec:\lxlfllr.exe32⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5vpvd.exec:\5vpvd.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rrxxffl.exec:\rrxxffl.exe34⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7bhttn.exec:\7bhttn.exe35⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vjvpv.exec:\vjvpv.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pvvjj.exec:\pvvjj.exe37⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xlxfrxx.exec:\xlxfrxx.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nbhttb.exec:\nbhttb.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1pvdp.exec:\1pvdp.exe40⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xlflrrf.exec:\xlflrrf.exe41⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bththn.exec:\bththn.exe42⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dvjdj.exec:\dvjdj.exe43⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5vdjp.exec:\5vdjp.exe44⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9lxfrlr.exec:\9lxfrlr.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ntnbnh.exec:\ntnbnh.exe46⤵
- Executes dropped EXE
PID:1224 -
\??\c:\pdvdv.exec:\pdvdv.exe47⤵
- Executes dropped EXE
PID:1892 -
\??\c:\9jvdd.exec:\9jvdd.exe48⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe49⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tnbntt.exec:\tnbntt.exe50⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5pvpp.exec:\5pvpp.exe51⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjdjp.exec:\pjdjp.exe52⤵
- Executes dropped EXE
PID:540 -
\??\c:\fxlrlll.exec:\fxlrlll.exe53⤵
- Executes dropped EXE
PID:900 -
\??\c:\7nbhtn.exec:\7nbhtn.exe54⤵
- Executes dropped EXE
PID:624 -
\??\c:\pjvdv.exec:\pjvdv.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5lxflll.exec:\5lxflll.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7frrrrf.exec:\7frrrrf.exe57⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1bhntb.exec:\1bhntb.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3pvvv.exec:\3pvvv.exe59⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lfrxxfx.exec:\lfrxxfx.exe60⤵
- Executes dropped EXE
PID:752 -
\??\c:\tnbbhb.exec:\tnbbhb.exe61⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5hhhtt.exec:\5hhhtt.exe62⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dpdvd.exec:\dpdvd.exe63⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xlfxllx.exec:\xlfxllx.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hbtbnn.exec:\hbtbnn.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vjddd.exec:\vjddd.exe66⤵PID:1596
-
\??\c:\rffxxxl.exec:\rffxxxl.exe67⤵PID:992
-
\??\c:\7frrrrx.exec:\7frrrrx.exe68⤵PID:1740
-
\??\c:\bbntbb.exec:\bbntbb.exe69⤵PID:904
-
\??\c:\vvvjp.exec:\vvvjp.exe70⤵PID:284
-
\??\c:\frffxxl.exec:\frffxxl.exe71⤵PID:2236
-
\??\c:\3xrrxrf.exec:\3xrrxrf.exe72⤵PID:1592
-
\??\c:\thhnhb.exec:\thhnhb.exe73⤵PID:2760
-
\??\c:\vvjjv.exec:\vvjjv.exe74⤵PID:2688
-
\??\c:\xrlfllf.exec:\xrlfllf.exe75⤵PID:2692
-
\??\c:\btnbbb.exec:\btnbbb.exe76⤵PID:2776
-
\??\c:\ttnnnn.exec:\ttnnnn.exe77⤵PID:2192
-
\??\c:\vjdpj.exec:\vjdpj.exe78⤵PID:2532
-
\??\c:\1rffffr.exec:\1rffffr.exe79⤵PID:2576
-
\??\c:\7lrrflx.exec:\7lrrflx.exe80⤵PID:2596
-
\??\c:\bthnbh.exec:\bthnbh.exe81⤵PID:2992
-
\??\c:\7pddj.exec:\7pddj.exe82⤵PID:2968
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe83⤵PID:1972
-
\??\c:\5xfxffl.exec:\5xfxffl.exe84⤵PID:3036
-
\??\c:\nhtttb.exec:\nhtttb.exe85⤵PID:3028
-
\??\c:\ppvvd.exec:\ppvvd.exe86⤵PID:2244
-
\??\c:\dpddp.exec:\dpddp.exe87⤵PID:488
-
\??\c:\1rffxlf.exec:\1rffxlf.exe88⤵PID:2328
-
\??\c:\tnbbhn.exec:\tnbbhn.exe89⤵PID:1660
-
\??\c:\7vjpv.exec:\7vjpv.exe90⤵PID:680
-
\??\c:\rfxfllf.exec:\rfxfllf.exe91⤵PID:2172
-
\??\c:\lxlfrrx.exec:\lxlfrrx.exe92⤵PID:400
-
\??\c:\tthtbh.exec:\tthtbh.exe93⤵PID:380
-
\??\c:\5dvvp.exec:\5dvvp.exe94⤵PID:1576
-
\??\c:\rrfrllf.exec:\rrfrllf.exe95⤵PID:2756
-
\??\c:\rrffrrr.exec:\rrffrrr.exe96⤵PID:2196
-
\??\c:\5htnnn.exec:\5htnnn.exe97⤵PID:1980
-
\??\c:\dvdpv.exec:\dvdpv.exe98⤵PID:892
-
\??\c:\7rfxfxf.exec:\7rfxfxf.exe99⤵PID:876
-
\??\c:\3xlfxxx.exec:\3xlfxxx.exe100⤵PID:1056
-
\??\c:\hhbtbt.exec:\hhbtbt.exe101⤵PID:2388
-
\??\c:\ddvdp.exec:\ddvdp.exe102⤵PID:1536
-
\??\c:\5frlflr.exec:\5frlflr.exe103⤵PID:1352
-
\??\c:\xlrxffl.exec:\xlrxffl.exe104⤵PID:2960
-
\??\c:\btnntn.exec:\btnntn.exe105⤵PID:3060
-
\??\c:\5vppv.exec:\5vppv.exe106⤵PID:2308
-
\??\c:\llflxrl.exec:\llflxrl.exe107⤵PID:1988
-
\??\c:\xrllrrx.exec:\xrllrrx.exe108⤵PID:1812
-
\??\c:\tnhbnt.exec:\tnhbnt.exe109⤵PID:2264
-
\??\c:\jdjpv.exec:\jdjpv.exe110⤵PID:2440
-
\??\c:\1ddjd.exec:\1ddjd.exe111⤵
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\lfrfrxf.exec:\lfrfrxf.exe112⤵PID:1560
-
\??\c:\bhthbb.exec:\bhthbb.exe113⤵PID:2732
-
\??\c:\jvjdd.exec:\jvjdd.exe114⤵PID:2788
-
\??\c:\1fxflrx.exec:\1fxflrx.exe115⤵PID:2780
-
\??\c:\hbnnbt.exec:\hbnnbt.exe116⤵PID:2540
-
\??\c:\3ttbtt.exec:\3ttbtt.exe117⤵PID:2784
-
\??\c:\vpdpd.exec:\vpdpd.exe118⤵PID:2708
-
\??\c:\xffrxrf.exec:\xffrxrf.exe119⤵PID:2772
-
\??\c:\vvpjp.exec:\vvpjp.exe120⤵PID:2612
-
\??\c:\xxrlflf.exec:\xxrlflf.exe121⤵PID:2584
-
\??\c:\fllfrlf.exec:\fllfrlf.exe122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-