Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe
-
Size
456KB
-
MD5
40c6f98489d9475490e87702b7b6da72
-
SHA1
2a5d09692a8b578a9742c9de74eddc616da84c57
-
SHA256
9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275
-
SHA512
9bbbd816bad0466e4f294a3546d5298551600f89329ebe1279739a69c75b959953858b8205ca1d281c5ec2b0dc23fcde9b394e68a61e0f8cd9c57b68f8207d75
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRr:q7Tc2NYHUrAwfMp3CDRr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-17-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2556-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-44-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2604-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-157-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/332-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-344-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1160-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-393-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2876-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-552-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1996-573-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1712-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-705-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2100-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 jjjpv.exe 2556 bthnbb.exe 2732 7pjpv.exe 2604 nnnthh.exe 2600 1dvdp.exe 2096 rlflxxl.exe 2212 ppdpj.exe 1276 llxfxxr.exe 2960 hthbtb.exe 2640 rxflxxr.exe 2844 hbthnt.exe 824 pdddj.exe 2956 xxrxrlx.exe 660 jdjjp.exe 332 xfxrrrf.exe 2384 nnbhnt.exe 2208 dvppd.exe 2164 xrllffx.exe 444 tnnntn.exe 2332 rllrffr.exe 1028 tntbnn.exe 1884 9rllxxf.exe 1616 5lxrxrl.exe 884 jdpvd.exe 1800 1dvvj.exe 2328 nhttnt.exe 1004 vvppp.exe 2436 3tbbbb.exe 1976 3bnnhn.exe 2452 9fxfflx.exe 2820 fxllflf.exe 2812 jvvvj.exe 2832 5lffflr.exe 2720 9bnhnt.exe 2728 tbnntt.exe 2596 dpddj.exe 2672 7lllxfl.exe 2052 tnbhbt.exe 2880 dpvvj.exe 1160 xxrrrxl.exe 2412 xlfxlff.exe 2916 btbnhn.exe 1388 jdppj.exe 2864 rlflrxl.exe 2640 bbttbn.exe 2876 dpddd.exe 1588 frlxxll.exe 1352 bthbnh.exe 600 dvppv.exe 588 9rlxllx.exe 596 bhnhhh.exe 332 hnhtbn.exe 2384 9vpdp.exe 1432 lfxrlxx.exe 2392 hnttnn.exe 408 jvdvv.exe 2244 fxrflrf.exe 2284 hbbbhh.exe 852 bbthtb.exe 1044 9jjjp.exe 2500 lfxxrxl.exe 2496 nhtbnb.exe 3016 ttnbhh.exe 1792 jjdjj.exe -
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-17-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2732-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-552-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1712-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-771-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 3004 2772 9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe 30 PID 2772 wrote to memory of 3004 2772 9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe 30 PID 2772 wrote to memory of 3004 2772 9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe 30 PID 2772 wrote to memory of 3004 2772 9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe 30 PID 3004 wrote to memory of 2556 3004 jjjpv.exe 31 PID 3004 wrote to memory of 2556 3004 jjjpv.exe 31 PID 3004 wrote to memory of 2556 3004 jjjpv.exe 31 PID 3004 wrote to memory of 2556 3004 jjjpv.exe 31 PID 2556 wrote to memory of 2732 2556 bthnbb.exe 32 PID 2556 wrote to memory of 2732 2556 bthnbb.exe 32 PID 2556 wrote to memory of 2732 2556 bthnbb.exe 32 PID 2556 wrote to memory of 2732 2556 bthnbb.exe 32 PID 2732 wrote to memory of 2604 2732 7pjpv.exe 33 PID 2732 wrote to memory of 2604 2732 7pjpv.exe 33 PID 2732 wrote to memory of 2604 2732 7pjpv.exe 33 PID 2732 wrote to memory of 2604 2732 7pjpv.exe 33 PID 2604 wrote to memory of 2600 2604 nnnthh.exe 34 PID 2604 wrote to memory of 2600 2604 nnnthh.exe 34 PID 2604 wrote to memory of 2600 2604 nnnthh.exe 34 PID 2604 wrote to memory of 2600 2604 nnnthh.exe 34 PID 2600 wrote to memory of 2096 2600 1dvdp.exe 35 PID 2600 wrote to memory of 2096 2600 1dvdp.exe 35 PID 2600 wrote to memory of 2096 2600 1dvdp.exe 35 PID 2600 wrote to memory of 2096 2600 1dvdp.exe 35 PID 2096 wrote to memory of 2212 2096 rlflxxl.exe 36 PID 2096 wrote to memory of 2212 2096 rlflxxl.exe 36 PID 2096 wrote to memory of 2212 2096 rlflxxl.exe 36 PID 2096 wrote to memory of 2212 2096 rlflxxl.exe 36 PID 2212 wrote to memory of 1276 2212 ppdpj.exe 37 PID 2212 wrote to memory of 1276 2212 ppdpj.exe 37 PID 2212 wrote to memory of 1276 2212 ppdpj.exe 37 PID 2212 wrote to memory of 1276 2212 ppdpj.exe 37 PID 1276 wrote to memory of 2960 1276 llxfxxr.exe 38 PID 1276 wrote to memory of 2960 1276 llxfxxr.exe 38 PID 1276 wrote to memory of 2960 1276 llxfxxr.exe 38 PID 1276 wrote to memory of 2960 1276 llxfxxr.exe 38 PID 2960 wrote to memory of 2640 2960 hthbtb.exe 39 PID 2960 wrote to memory of 2640 2960 hthbtb.exe 39 PID 2960 wrote to memory of 2640 2960 hthbtb.exe 39 PID 2960 wrote to memory of 2640 2960 hthbtb.exe 39 PID 2640 wrote to memory of 2844 2640 rxflxxr.exe 40 PID 2640 wrote to memory of 2844 2640 rxflxxr.exe 40 PID 2640 wrote to memory of 2844 2640 rxflxxr.exe 40 PID 2640 wrote to memory of 2844 2640 rxflxxr.exe 40 PID 2844 wrote to memory of 824 2844 hbthnt.exe 41 PID 2844 wrote to memory of 824 2844 hbthnt.exe 41 PID 2844 wrote to memory of 824 2844 hbthnt.exe 41 PID 2844 wrote to memory of 824 2844 hbthnt.exe 41 PID 824 wrote to memory of 2956 824 pdddj.exe 42 PID 824 wrote to memory of 2956 824 pdddj.exe 42 PID 824 wrote to memory of 2956 824 pdddj.exe 42 PID 824 wrote to memory of 2956 824 pdddj.exe 42 PID 2956 wrote to memory of 660 2956 xxrxrlx.exe 43 PID 2956 wrote to memory of 660 2956 xxrxrlx.exe 43 PID 2956 wrote to memory of 660 2956 xxrxrlx.exe 43 PID 2956 wrote to memory of 660 2956 xxrxrlx.exe 43 PID 660 wrote to memory of 332 660 jdjjp.exe 44 PID 660 wrote to memory of 332 660 jdjjp.exe 44 PID 660 wrote to memory of 332 660 jdjjp.exe 44 PID 660 wrote to memory of 332 660 jdjjp.exe 44 PID 332 wrote to memory of 2384 332 xfxrrrf.exe 45 PID 332 wrote to memory of 2384 332 xfxrrrf.exe 45 PID 332 wrote to memory of 2384 332 xfxrrrf.exe 45 PID 332 wrote to memory of 2384 332 xfxrrrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe"C:\Users\Admin\AppData\Local\Temp\9f48fa7bc50559c6ab05957248fe59794c67b4711a55b6d0a24ba2699a5fc275.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jjjpv.exec:\jjjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bthnbb.exec:\bthnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\7pjpv.exec:\7pjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nnnthh.exec:\nnnthh.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\1dvdp.exec:\1dvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rlflxxl.exec:\rlflxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\ppdpj.exec:\ppdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\llxfxxr.exec:\llxfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\hthbtb.exec:\hthbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rxflxxr.exec:\rxflxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbthnt.exec:\hbthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pdddj.exec:\pdddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\xxrxrlx.exec:\xxrxrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jdjjp.exec:\jdjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\xfxrrrf.exec:\xfxrrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\nnbhnt.exec:\nnbhnt.exe17⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dvppd.exec:\dvppd.exe18⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrllffx.exec:\xrllffx.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tnnntn.exec:\tnnntn.exe20⤵
- Executes dropped EXE
PID:444 -
\??\c:\rllrffr.exec:\rllrffr.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tntbnn.exec:\tntbnn.exe22⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9rllxxf.exec:\9rllxxf.exe23⤵
- Executes dropped EXE
PID:1884 -
\??\c:\5lxrxrl.exec:\5lxrxrl.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jdpvd.exec:\jdpvd.exe25⤵
- Executes dropped EXE
PID:884 -
\??\c:\1dvvj.exec:\1dvvj.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhttnt.exec:\nhttnt.exe27⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvppp.exec:\vvppp.exe28⤵
- Executes dropped EXE
PID:1004 -
\??\c:\3tbbbb.exec:\3tbbbb.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3bnnhn.exec:\3bnnhn.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9fxfflx.exec:\9fxfflx.exe31⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxllflf.exec:\fxllflf.exe32⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jvvvj.exec:\jvvvj.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5lffflr.exec:\5lffflr.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9bnhnt.exec:\9bnhnt.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tbnntt.exec:\tbnntt.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dpddj.exec:\dpddj.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\7lllxfl.exec:\7lllxfl.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnbhbt.exec:\tnbhbt.exe39⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dpvvj.exec:\dpvvj.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\xxrrrxl.exec:\xxrrrxl.exe41⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xlfxlff.exec:\xlfxlff.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btbnhn.exec:\btbnhn.exe43⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jdppj.exec:\jdppj.exe44⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rlflrxl.exec:\rlflrxl.exe45⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbttbn.exec:\bbttbn.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dpddd.exec:\dpddd.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\frlxxll.exec:\frlxxll.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\bthbnh.exec:\bthbnh.exe49⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dvppv.exec:\dvppv.exe50⤵
- Executes dropped EXE
PID:600 -
\??\c:\9rlxllx.exec:\9rlxllx.exe51⤵
- Executes dropped EXE
PID:588 -
\??\c:\bhnhhh.exec:\bhnhhh.exe52⤵
- Executes dropped EXE
PID:596 -
\??\c:\hnhtbn.exec:\hnhtbn.exe53⤵
- Executes dropped EXE
PID:332 -
\??\c:\9vpdp.exec:\9vpdp.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lfxrlxx.exec:\lfxrlxx.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hnttnn.exec:\hnttnn.exe56⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jvdvv.exec:\jvdvv.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\fxrflrf.exec:\fxrflrf.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hbbbhh.exec:\hbbbhh.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bbthtb.exec:\bbthtb.exe60⤵
- Executes dropped EXE
PID:852 -
\??\c:\9jjjp.exec:\9jjjp.exe61⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lfxxrxl.exec:\lfxxrxl.exe62⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhtbnb.exec:\nhtbnb.exe63⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ttnbhh.exec:\ttnbhh.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jjdjj.exec:\jjdjj.exe65⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fxrxxrx.exec:\fxrxxrx.exe66⤵PID:2300
-
\??\c:\nhhttb.exec:\nhhttb.exe67⤵PID:1652
-
\??\c:\bbbthh.exec:\bbbthh.exe68⤵PID:1004
-
\??\c:\vjjvd.exec:\vjjvd.exe69⤵PID:1996
-
\??\c:\rxlxrrf.exec:\rxlxrrf.exe70⤵PID:908
-
\??\c:\hhbbbt.exec:\hhbbbt.exe71⤵PID:2468
-
\??\c:\vdjpd.exec:\vdjpd.exe72⤵PID:1712
-
\??\c:\9dpvd.exec:\9dpvd.exe73⤵PID:2820
-
\??\c:\5xxxflx.exec:\5xxxflx.exe74⤵PID:2836
-
\??\c:\5btbnt.exec:\5btbnt.exe75⤵PID:2676
-
\??\c:\vvpvd.exec:\vvpvd.exe76⤵PID:2720
-
\??\c:\ppdpp.exec:\ppdpp.exe77⤵PID:2732
-
\??\c:\7rrxrxl.exec:\7rrxrxl.exe78⤵PID:2560
-
\??\c:\hnhtbh.exec:\hnhtbh.exe79⤵PID:2368
-
\??\c:\9thtnt.exec:\9thtnt.exe80⤵PID:2612
-
\??\c:\7jjdd.exec:\7jjdd.exe81⤵PID:2872
-
\??\c:\rlfflrf.exec:\rlfflrf.exe82⤵PID:2184
-
\??\c:\bthhtt.exec:\bthhtt.exe83⤵
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\7htbnt.exec:\7htbnt.exe84⤵PID:1276
-
\??\c:\9vppd.exec:\9vppd.exe85⤵PID:584
-
\??\c:\llfrrll.exec:\llfrrll.exe86⤵PID:2888
-
\??\c:\rlrxllx.exec:\rlrxllx.exe87⤵PID:2944
-
\??\c:\hbtbnt.exec:\hbtbnt.exe88⤵PID:2924
-
\??\c:\dvppd.exec:\dvppd.exe89⤵PID:2984
-
\??\c:\jdvpd.exec:\jdvpd.exe90⤵PID:1588
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe91⤵PID:1108
-
\??\c:\thnthn.exec:\thnthn.exe92⤵PID:660
-
\??\c:\1ddpp.exec:\1ddpp.exe93⤵PID:2068
-
\??\c:\7pjjv.exec:\7pjjv.exe94⤵PID:2372
-
\??\c:\flxfxfr.exec:\flxfxfr.exe95⤵PID:1808
-
\??\c:\1bnnbh.exec:\1bnnbh.exe96⤵PID:2076
-
\??\c:\7htbhn.exec:\7htbhn.exe97⤵PID:2100
-
\??\c:\vvpvj.exec:\vvpvj.exe98⤵PID:1088
-
\??\c:\lfxflrl.exec:\lfxflrl.exe99⤵PID:1992
-
\??\c:\rrfrlxl.exec:\rrfrlxl.exe100⤵PID:1956
-
\??\c:\5nhntb.exec:\5nhntb.exe101⤵PID:2524
-
\??\c:\vpddp.exec:\vpddp.exe102⤵PID:1464
-
\??\c:\xfxfrfr.exec:\xfxfrfr.exe103⤵PID:928
-
\??\c:\rfxrffx.exec:\rfxrffx.exe104⤵PID:3008
-
\??\c:\bhhhhn.exec:\bhhhhn.exe105⤵PID:1616
-
\??\c:\vjvvd.exec:\vjvvd.exe106⤵PID:1096
-
\??\c:\pjdjv.exec:\pjdjv.exe107⤵PID:2328
-
\??\c:\xxlxrlr.exec:\xxlxrlr.exe108⤵PID:2304
-
\??\c:\hbnnbt.exec:\hbnnbt.exe109⤵PID:2276
-
\??\c:\jdvvp.exec:\jdvvp.exe110⤵PID:2280
-
\??\c:\5jjdv.exec:\5jjdv.exe111⤵PID:1996
-
\??\c:\7xllxxf.exec:\7xllxxf.exe112⤵PID:2480
-
\??\c:\nbhbhh.exec:\nbhbhh.exe113⤵PID:1776
-
\??\c:\htnntt.exec:\htnntt.exe114⤵PID:1604
-
\??\c:\vpjjp.exec:\vpjjp.exe115⤵PID:2812
-
\??\c:\pdvpp.exec:\pdvpp.exe116⤵PID:2768
-
\??\c:\rfffxfr.exec:\rfffxfr.exe117⤵PID:2064
-
\??\c:\hnbbnt.exec:\hnbbnt.exe118⤵PID:2716
-
\??\c:\ddvpd.exec:\ddvpd.exe119⤵PID:2592
-
\??\c:\5dpvj.exec:\5dpvj.exe120⤵PID:2628
-
\??\c:\llllrxr.exec:\llllrxr.exe121⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-