Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe
-
Size
454KB
-
MD5
1472acf169ed83db510b24fa6cfaa28b
-
SHA1
e9f4ea9cccce6c1b88c5fd1d00f4a7f45442c11c
-
SHA256
a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd
-
SHA512
5d786ae551dfc57c612d4a91e586693c78d193b68da42cf03578a0cde794c2069be94452182e1645581ce3614d807b00197909f91543d54bfdda7173e28e4eee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/316-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-242-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2060-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-561-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1476-568-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-635-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1108-692-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-730-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1612-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-784-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/372-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-907-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 316 rxxlflx.exe 3036 7tnhnn.exe 2536 bnbbbn.exe 2548 xfrfxfx.exe 2600 nnhnbb.exe 2656 pjdvv.exe 2468 ffrxfxf.exe 2500 nnnhbt.exe 2364 xrlflxf.exe 2440 nhbtnn.exe 1756 5vppv.exe 2504 fxxfffl.exe 2780 9bbntb.exe 1488 vjvdj.exe 1180 7bbhnt.exe 2416 jpvjv.exe 1828 ttthnn.exe 2372 nhhhth.exe 1412 rxxxlrf.exe 1572 thbhtb.exe 1580 xfrflrl.exe 2220 1tntnt.exe 2424 jvvdv.exe 1308 rxffrxf.exe 1816 1bhnbb.exe 2060 vjddp.exe 1484 llxfllx.exe 2152 nhhbhn.exe 2212 ffxrflf.exe 352 xxrfrlr.exe 1424 7pjpd.exe 1672 lrllfrr.exe 2524 3ntthn.exe 2844 jvvjp.exe 1524 rlxfrxf.exe 3028 frrrxrf.exe 2588 nhtbhh.exe 2584 7ddjp.exe 2660 xfxllxr.exe 2756 flfrlfx.exe 3024 hnbhbb.exe 2616 pdppv.exe 2456 vjvpv.exe 2824 flrrxfx.exe 2932 tnbhnt.exe 2356 3ntbht.exe 1108 3dvdj.exe 2044 lffflrf.exe 2348 xlxfffl.exe 2504 tthhnt.exe 2744 3btnnt.exe 668 dpdjp.exe 1488 xxrrrlr.exe 2200 1nbbnn.exe 2416 jdppd.exe 1780 vjjpp.exe 2004 xlxfllx.exe 536 hbhnnn.exe 2028 5bntbb.exe 2108 1jddv.exe 1088 5llxxrf.exe 2912 fxrrllx.exe 920 9btbbh.exe 1700 pppvj.exe -
resource yara_rule behavioral1/memory/316-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-561-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2064-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-660-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2564-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-784-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/372-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-907-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2088-918-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 316 1876 a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe 28 PID 1876 wrote to memory of 316 1876 a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe 28 PID 1876 wrote to memory of 316 1876 a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe 28 PID 1876 wrote to memory of 316 1876 a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe 28 PID 316 wrote to memory of 3036 316 rxxlflx.exe 29 PID 316 wrote to memory of 3036 316 rxxlflx.exe 29 PID 316 wrote to memory of 3036 316 rxxlflx.exe 29 PID 316 wrote to memory of 3036 316 rxxlflx.exe 29 PID 3036 wrote to memory of 2536 3036 7tnhnn.exe 30 PID 3036 wrote to memory of 2536 3036 7tnhnn.exe 30 PID 3036 wrote to memory of 2536 3036 7tnhnn.exe 30 PID 3036 wrote to memory of 2536 3036 7tnhnn.exe 30 PID 2536 wrote to memory of 2548 2536 bnbbbn.exe 31 PID 2536 wrote to memory of 2548 2536 bnbbbn.exe 31 PID 2536 wrote to memory of 2548 2536 bnbbbn.exe 31 PID 2536 wrote to memory of 2548 2536 bnbbbn.exe 31 PID 2548 wrote to memory of 2600 2548 xfrfxfx.exe 32 PID 2548 wrote to memory of 2600 2548 xfrfxfx.exe 32 PID 2548 wrote to memory of 2600 2548 xfrfxfx.exe 32 PID 2548 wrote to memory of 2600 2548 xfrfxfx.exe 32 PID 2600 wrote to memory of 2656 2600 nnhnbb.exe 33 PID 2600 wrote to memory of 2656 2600 nnhnbb.exe 33 PID 2600 wrote to memory of 2656 2600 nnhnbb.exe 33 PID 2600 wrote to memory of 2656 2600 nnhnbb.exe 33 PID 2656 wrote to memory of 2468 2656 pjdvv.exe 34 PID 2656 wrote to memory of 2468 2656 pjdvv.exe 34 PID 2656 wrote to memory of 2468 2656 pjdvv.exe 34 PID 2656 wrote to memory of 2468 2656 pjdvv.exe 34 PID 2468 wrote to memory of 2500 2468 ffrxfxf.exe 35 PID 2468 wrote to memory of 2500 2468 ffrxfxf.exe 35 PID 2468 wrote to memory of 2500 2468 ffrxfxf.exe 35 PID 2468 wrote to memory of 2500 2468 ffrxfxf.exe 35 PID 2500 wrote to memory of 2364 2500 nnnhbt.exe 36 PID 2500 wrote to memory of 2364 2500 nnnhbt.exe 36 PID 2500 wrote to memory of 2364 2500 nnnhbt.exe 36 PID 2500 wrote to memory of 2364 2500 nnnhbt.exe 36 PID 2364 wrote to memory of 2440 2364 xrlflxf.exe 37 PID 2364 wrote to memory of 2440 2364 xrlflxf.exe 37 PID 2364 wrote to memory of 2440 2364 xrlflxf.exe 37 PID 2364 wrote to memory of 2440 2364 xrlflxf.exe 37 PID 2440 wrote to memory of 1756 2440 nhbtnn.exe 38 PID 2440 wrote to memory of 1756 2440 nhbtnn.exe 38 PID 2440 wrote to memory of 1756 2440 nhbtnn.exe 38 PID 2440 wrote to memory of 1756 2440 nhbtnn.exe 38 PID 1756 wrote to memory of 2504 1756 5vppv.exe 77 PID 1756 wrote to memory of 2504 1756 5vppv.exe 77 PID 1756 wrote to memory of 2504 1756 5vppv.exe 77 PID 1756 wrote to memory of 2504 1756 5vppv.exe 77 PID 2504 wrote to memory of 2780 2504 fxxfffl.exe 40 PID 2504 wrote to memory of 2780 2504 fxxfffl.exe 40 PID 2504 wrote to memory of 2780 2504 fxxfffl.exe 40 PID 2504 wrote to memory of 2780 2504 fxxfffl.exe 40 PID 2780 wrote to memory of 1488 2780 9bbntb.exe 80 PID 2780 wrote to memory of 1488 2780 9bbntb.exe 80 PID 2780 wrote to memory of 1488 2780 9bbntb.exe 80 PID 2780 wrote to memory of 1488 2780 9bbntb.exe 80 PID 1488 wrote to memory of 1180 1488 vjvdj.exe 42 PID 1488 wrote to memory of 1180 1488 vjvdj.exe 42 PID 1488 wrote to memory of 1180 1488 vjvdj.exe 42 PID 1488 wrote to memory of 1180 1488 vjvdj.exe 42 PID 1180 wrote to memory of 2416 1180 7bbhnt.exe 82 PID 1180 wrote to memory of 2416 1180 7bbhnt.exe 82 PID 1180 wrote to memory of 2416 1180 7bbhnt.exe 82 PID 1180 wrote to memory of 2416 1180 7bbhnt.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe"C:\Users\Admin\AppData\Local\Temp\a3a49d9c4e62e738941471f03e9adad6b4e63a26b32d940dd5c0dd95ffaddbcd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rxxlflx.exec:\rxxlflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\7tnhnn.exec:\7tnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bnbbbn.exec:\bnbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xfrfxfx.exec:\xfrfxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\nnhnbb.exec:\nnhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pjdvv.exec:\pjdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ffrxfxf.exec:\ffrxfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nnnhbt.exec:\nnnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xrlflxf.exec:\xrlflxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\nhbtnn.exec:\nhbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\5vppv.exec:\5vppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\fxxfffl.exec:\fxxfffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9bbntb.exec:\9bbntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vjvdj.exec:\vjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\7bbhnt.exec:\7bbhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\jpvjv.exec:\jpvjv.exe17⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ttthnn.exec:\ttthnn.exe18⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nhhhth.exec:\nhhhth.exe19⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rxxxlrf.exec:\rxxxlrf.exe20⤵
- Executes dropped EXE
PID:1412 -
\??\c:\thbhtb.exec:\thbhtb.exe21⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xfrflrl.exec:\xfrflrl.exe22⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1tntnt.exec:\1tntnt.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jvvdv.exec:\jvvdv.exe24⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rxffrxf.exec:\rxffrxf.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\1bhnbb.exec:\1bhnbb.exe26⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vjddp.exec:\vjddp.exe27⤵
- Executes dropped EXE
PID:2060 -
\??\c:\llxfllx.exec:\llxfllx.exe28⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhhbhn.exec:\nhhbhn.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ffxrflf.exec:\ffxrflf.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxrfrlr.exec:\xxrfrlr.exe31⤵
- Executes dropped EXE
PID:352 -
\??\c:\7pjpd.exec:\7pjpd.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lrllfrr.exec:\lrllfrr.exe33⤵
- Executes dropped EXE
PID:1672 -
\??\c:\3ntthn.exec:\3ntthn.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jvvjp.exec:\jvvjp.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\frrrxrf.exec:\frrrxrf.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhtbhh.exec:\nhtbhh.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7ddjp.exec:\7ddjp.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xfxllxr.exec:\xfxllxr.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\flfrlfx.exec:\flfrlfx.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hnbhbb.exec:\hnbhbb.exe42⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pdppv.exec:\pdppv.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vjvpv.exec:\vjvpv.exe44⤵
- Executes dropped EXE
PID:2456 -
\??\c:\flrrxfx.exec:\flrrxfx.exe45⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tnbhnt.exec:\tnbhnt.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3ntbht.exec:\3ntbht.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3dvdj.exec:\3dvdj.exe48⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lffflrf.exec:\lffflrf.exe49⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xlxfffl.exec:\xlxfffl.exe50⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tthhnt.exec:\tthhnt.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3btnnt.exec:\3btnnt.exe52⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dpdjp.exec:\dpdjp.exe53⤵
- Executes dropped EXE
PID:668 -
\??\c:\xxrrrlr.exec:\xxrrrlr.exe54⤵
- Executes dropped EXE
PID:1488 -
\??\c:\1nbbnn.exec:\1nbbnn.exe55⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdppd.exec:\jdppd.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vjjpp.exec:\vjjpp.exe57⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xlxfllx.exec:\xlxfllx.exe58⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbhnnn.exec:\hbhnnn.exe59⤵
- Executes dropped EXE
PID:536 -
\??\c:\5bntbb.exec:\5bntbb.exe60⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1jddv.exec:\1jddv.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5llxxrf.exec:\5llxxrf.exe62⤵
- Executes dropped EXE
PID:1088 -
\??\c:\fxrrllx.exec:\fxrrllx.exe63⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9btbbh.exec:\9btbbh.exe64⤵
- Executes dropped EXE
PID:920 -
\??\c:\pppvj.exec:\pppvj.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lllrffr.exec:\lllrffr.exe66⤵PID:820
-
\??\c:\bbtbhb.exec:\bbtbhb.exe67⤵PID:1308
-
\??\c:\7jvvv.exec:\7jvvv.exe68⤵PID:320
-
\??\c:\lfllrlr.exec:\lfllrlr.exe69⤵PID:3008
-
\??\c:\jvjjv.exec:\jvjjv.exe70⤵PID:1476
-
\??\c:\lffllxr.exec:\lffllxr.exe71⤵PID:896
-
\??\c:\hhbnth.exec:\hhbnth.exe72⤵PID:1480
-
\??\c:\7vvjv.exec:\7vvjv.exe73⤵PID:2892
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe74⤵PID:2296
-
\??\c:\btnthh.exec:\btnthh.exe75⤵PID:2376
-
\??\c:\thbnnt.exec:\thbnnt.exe76⤵PID:1796
-
\??\c:\vvdjd.exec:\vvdjd.exe77⤵PID:1548
-
\??\c:\lfllrxx.exec:\lfllrxx.exe78⤵PID:2064
-
\??\c:\rfrxffl.exec:\rfrxffl.exe79⤵PID:1632
-
\??\c:\bnntbb.exec:\bnntbb.exe80⤵PID:1536
-
\??\c:\vpdjp.exec:\vpdjp.exe81⤵PID:2184
-
\??\c:\rlffrrx.exec:\rlffrrx.exe82⤵
- System Location Discovery: System Language Discovery
PID:2132 -
\??\c:\xrfrxff.exec:\xrfrxff.exe83⤵PID:2548
-
\??\c:\btnhnn.exec:\btnhnn.exe84⤵PID:2584
-
\??\c:\nnbbhh.exec:\nnbbhh.exe85⤵PID:2652
-
\??\c:\9pvvj.exec:\9pvvj.exe86⤵PID:2852
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe87⤵PID:2560
-
\??\c:\hbtnbb.exec:\hbtnbb.exe88⤵PID:2612
-
\??\c:\pjppd.exec:\pjppd.exe89⤵PID:2216
-
\??\c:\frrfffl.exec:\frrfffl.exe90⤵PID:2564
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe91⤵PID:2932
-
\??\c:\hthhhh.exec:\hthhhh.exe92⤵PID:2356
-
\??\c:\pdvvv.exec:\pdvvv.exe93⤵PID:1108
-
\??\c:\ffffrrx.exec:\ffffrrx.exe94⤵PID:2044
-
\??\c:\9frrflr.exec:\9frrflr.exe95⤵PID:2680
-
\??\c:\tbnhbb.exec:\tbnhbb.exe96⤵PID:2504
-
\??\c:\djvjp.exec:\djvjp.exe97⤵PID:2744
-
\??\c:\llflrrf.exec:\llflrrf.exe98⤵PID:2752
-
\??\c:\nhbhhh.exec:\nhbhhh.exe99⤵PID:1208
-
\??\c:\nhbhnt.exec:\nhbhnt.exe100⤵PID:1612
-
\??\c:\vdvdd.exec:\vdvdd.exe101⤵PID:1792
-
\??\c:\lxrllrx.exec:\lxrllrx.exe102⤵PID:1780
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe103⤵PID:1056
-
\??\c:\7thbhh.exec:\7thbhh.exe104⤵PID:1412
-
\??\c:\jjjpp.exec:\jjjpp.exe105⤵PID:1560
-
\??\c:\frfrxxx.exec:\frfrxxx.exe106⤵PID:2340
-
\??\c:\tnbbtt.exec:\tnbbtt.exe107⤵PID:1652
-
\??\c:\pjdvp.exec:\pjdvp.exe108⤵PID:1152
-
\??\c:\jvdjv.exec:\jvdjv.exe109⤵PID:772
-
\??\c:\btnttt.exec:\btnttt.exe110⤵PID:372
-
\??\c:\tbhbth.exec:\tbhbth.exe111⤵PID:2868
-
\??\c:\5vpvj.exec:\5vpvj.exe112⤵PID:1708
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe113⤵PID:2192
-
\??\c:\bnhnht.exec:\bnhnht.exe114⤵PID:2384
-
\??\c:\xxxlxfx.exec:\xxxlxfx.exe115⤵PID:1640
-
\??\c:\bhbnbn.exec:\bhbnbn.exe116⤵PID:2140
-
\??\c:\jpjjv.exec:\jpjjv.exe117⤵PID:2280
-
\??\c:\xrrxrxl.exec:\xrrxrxl.exe118⤵PID:2256
-
\??\c:\tbnhnn.exec:\tbnhnn.exe119⤵PID:2996
-
\??\c:\vpvjp.exec:\vpvjp.exe120⤵PID:2992
-
\??\c:\5djpj.exec:\5djpj.exe121⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-