Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe
-
Size
453KB
-
MD5
fad318d505929d97baf0f6bd0d0e2967
-
SHA1
41290d12401f6c05b5f097131b358751ac0b452b
-
SHA256
0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495
-
SHA512
3f4c768b86a83985a010d9080f1799480e52de6d81b7d19ea8f51d96ec8d7c7e137e59b8ebd49a509eadc8a3334f09a9098bf030a2f904d497b9514164b25ee3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2228-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-126-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1732-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-205-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2424-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/276-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-376-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1800-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-573-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2624-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-638-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2096-679-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1684-699-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1752-838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2260 pvpdp.exe 2816 rllrfrl.exe 2780 ntnbnn.exe 2712 xxlrfll.exe 2688 tnnthh.exe 2564 xllflrl.exe 3056 hbbnhh.exe 1660 7ppdp.exe 2276 rlffxfx.exe 2128 nnnnbh.exe 1664 fxflrxl.exe 2312 7rfxfxf.exe 2868 bbbbnt.exe 1732 pjdjd.exe 2856 nnbtth.exe 1820 xrffrrf.exe 1028 9hthht.exe 3064 pjjvp.exe 1720 9hnnbh.exe 2444 vvjvj.exe 444 bbtnhn.exe 2424 pvdjv.exe 1348 fffxflf.exe 1716 jvjpd.exe 712 xxrxlxl.exe 1796 nhbnhh.exe 2092 3xrxlrx.exe 2388 vvppj.exe 2348 7vppp.exe 1948 hhbbnt.exe 884 pdjjd.exe 2124 xxflffl.exe 2788 1nbhtb.exe 1560 jjdvj.exe 2684 fffxffr.exe 2668 btbbhh.exe 2052 jdppd.exe 2808 dvvjp.exe 2544 xrfflrr.exe 2564 hbhntb.exe 2724 vddpj.exe 2900 lxxlxfx.exe 276 rrllxll.exe 2976 nnhnnt.exe 2104 xffffxr.exe 2128 lxxlfxl.exe 828 5btbnb.exe 344 jjvvp.exe 1684 xflrrlr.exe 484 bnbbhn.exe 2868 5jjvp.exe 2652 rlxfrrf.exe 2644 ffrxrrf.exe 1820 bbnthn.exe 332 jjvvj.exe 1800 fffrfrf.exe 2924 tnhhtb.exe 1264 5pvpd.exe 2472 xrlxrxl.exe 1712 tnbbhn.exe 1084 vvvjv.exe 624 5xxlrxr.exe 2448 xrrxllx.exe 760 jpvjv.exe -
resource yara_rule behavioral1/memory/2228-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-699-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2288-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-905-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rflxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2260 2228 0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe 30 PID 2228 wrote to memory of 2260 2228 0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe 30 PID 2228 wrote to memory of 2260 2228 0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe 30 PID 2228 wrote to memory of 2260 2228 0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe 30 PID 2260 wrote to memory of 2816 2260 pvpdp.exe 31 PID 2260 wrote to memory of 2816 2260 pvpdp.exe 31 PID 2260 wrote to memory of 2816 2260 pvpdp.exe 31 PID 2260 wrote to memory of 2816 2260 pvpdp.exe 31 PID 2816 wrote to memory of 2780 2816 rllrfrl.exe 32 PID 2816 wrote to memory of 2780 2816 rllrfrl.exe 32 PID 2816 wrote to memory of 2780 2816 rllrfrl.exe 32 PID 2816 wrote to memory of 2780 2816 rllrfrl.exe 32 PID 2780 wrote to memory of 2712 2780 ntnbnn.exe 33 PID 2780 wrote to memory of 2712 2780 ntnbnn.exe 33 PID 2780 wrote to memory of 2712 2780 ntnbnn.exe 33 PID 2780 wrote to memory of 2712 2780 ntnbnn.exe 33 PID 2712 wrote to memory of 2688 2712 xxlrfll.exe 34 PID 2712 wrote to memory of 2688 2712 xxlrfll.exe 34 PID 2712 wrote to memory of 2688 2712 xxlrfll.exe 34 PID 2712 wrote to memory of 2688 2712 xxlrfll.exe 34 PID 2688 wrote to memory of 2564 2688 tnnthh.exe 35 PID 2688 wrote to memory of 2564 2688 tnnthh.exe 35 PID 2688 wrote to memory of 2564 2688 tnnthh.exe 35 PID 2688 wrote to memory of 2564 2688 tnnthh.exe 35 PID 2564 wrote to memory of 3056 2564 xllflrl.exe 36 PID 2564 wrote to memory of 3056 2564 xllflrl.exe 36 PID 2564 wrote to memory of 3056 2564 xllflrl.exe 36 PID 2564 wrote to memory of 3056 2564 xllflrl.exe 36 PID 3056 wrote to memory of 1660 3056 hbbnhh.exe 37 PID 3056 wrote to memory of 1660 3056 hbbnhh.exe 37 PID 3056 wrote to memory of 1660 3056 hbbnhh.exe 37 PID 3056 wrote to memory of 1660 3056 hbbnhh.exe 37 PID 1660 wrote to memory of 2276 1660 7ppdp.exe 38 PID 1660 wrote to memory of 2276 1660 7ppdp.exe 38 PID 1660 wrote to memory of 2276 1660 7ppdp.exe 38 PID 1660 wrote to memory of 2276 1660 7ppdp.exe 38 PID 2276 wrote to memory of 2128 2276 rlffxfx.exe 39 PID 2276 wrote to memory of 2128 2276 rlffxfx.exe 39 PID 2276 wrote to memory of 2128 2276 rlffxfx.exe 39 PID 2276 wrote to memory of 2128 2276 rlffxfx.exe 39 PID 2128 wrote to memory of 1664 2128 nnnnbh.exe 40 PID 2128 wrote to memory of 1664 2128 nnnnbh.exe 40 PID 2128 wrote to memory of 1664 2128 nnnnbh.exe 40 PID 2128 wrote to memory of 1664 2128 nnnnbh.exe 40 PID 1664 wrote to memory of 2312 1664 fxflrxl.exe 41 PID 1664 wrote to memory of 2312 1664 fxflrxl.exe 41 PID 1664 wrote to memory of 2312 1664 fxflrxl.exe 41 PID 1664 wrote to memory of 2312 1664 fxflrxl.exe 41 PID 2312 wrote to memory of 2868 2312 7rfxfxf.exe 42 PID 2312 wrote to memory of 2868 2312 7rfxfxf.exe 42 PID 2312 wrote to memory of 2868 2312 7rfxfxf.exe 42 PID 2312 wrote to memory of 2868 2312 7rfxfxf.exe 42 PID 2868 wrote to memory of 1732 2868 bbbbnt.exe 43 PID 2868 wrote to memory of 1732 2868 bbbbnt.exe 43 PID 2868 wrote to memory of 1732 2868 bbbbnt.exe 43 PID 2868 wrote to memory of 1732 2868 bbbbnt.exe 43 PID 1732 wrote to memory of 2856 1732 pjdjd.exe 44 PID 1732 wrote to memory of 2856 1732 pjdjd.exe 44 PID 1732 wrote to memory of 2856 1732 pjdjd.exe 44 PID 1732 wrote to memory of 2856 1732 pjdjd.exe 44 PID 2856 wrote to memory of 1820 2856 nnbtth.exe 45 PID 2856 wrote to memory of 1820 2856 nnbtth.exe 45 PID 2856 wrote to memory of 1820 2856 nnbtth.exe 45 PID 2856 wrote to memory of 1820 2856 nnbtth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe"C:\Users\Admin\AppData\Local\Temp\0f34f40599eb2f2414e6561e5c20289d5211435281ed1d4281276e699de45495.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\pvpdp.exec:\pvpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\rllrfrl.exec:\rllrfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ntnbnn.exec:\ntnbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xxlrfll.exec:\xxlrfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\tnnthh.exec:\tnnthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xllflrl.exec:\xllflrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\hbbnhh.exec:\hbbnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\7ppdp.exec:\7ppdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rlffxfx.exec:\rlffxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\nnnnbh.exec:\nnnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\fxflrxl.exec:\fxflrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\7rfxfxf.exec:\7rfxfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bbbbnt.exec:\bbbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pjdjd.exec:\pjdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\nnbtth.exec:\nnbtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xrffrrf.exec:\xrffrrf.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\9hthht.exec:\9hthht.exe18⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pjjvp.exec:\pjjvp.exe19⤵
- Executes dropped EXE
PID:3064 -
\??\c:\9hnnbh.exec:\9hnnbh.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vvjvj.exec:\vvjvj.exe21⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bbtnhn.exec:\bbtnhn.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\pvdjv.exec:\pvdjv.exe23⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fffxflf.exec:\fffxflf.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jvjpd.exec:\jvjpd.exe25⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe26⤵
- Executes dropped EXE
PID:712 -
\??\c:\nhbnhh.exec:\nhbnhh.exe27⤵
- Executes dropped EXE
PID:1796 -
\??\c:\3xrxlrx.exec:\3xrxlrx.exe28⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vvppj.exec:\vvppj.exe29⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7vppp.exec:\7vppp.exe30⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hhbbnt.exec:\hhbbnt.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pdjjd.exec:\pdjjd.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:884 -
\??\c:\xxflffl.exec:\xxflffl.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1nbhtb.exec:\1nbhtb.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjdvj.exec:\jjdvj.exe35⤵
- Executes dropped EXE
PID:1560 -
\??\c:\fffxffr.exec:\fffxffr.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\btbbhh.exec:\btbbhh.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jdppd.exec:\jdppd.exe38⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dvvjp.exec:\dvvjp.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xrfflrr.exec:\xrfflrr.exe40⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hbhntb.exec:\hbhntb.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vddpj.exec:\vddpj.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lxxlxfx.exec:\lxxlxfx.exe43⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rrllxll.exec:\rrllxll.exe44⤵
- Executes dropped EXE
PID:276 -
\??\c:\nnhnnt.exec:\nnhnnt.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xffffxr.exec:\xffffxr.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lxxlfxl.exec:\lxxlfxl.exe47⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5btbnb.exec:\5btbnb.exe48⤵
- Executes dropped EXE
PID:828 -
\??\c:\jjvvp.exec:\jjvvp.exe49⤵
- Executes dropped EXE
PID:344 -
\??\c:\xflrrlr.exec:\xflrrlr.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bnbbhn.exec:\bnbbhn.exe51⤵
- Executes dropped EXE
PID:484 -
\??\c:\5jjvp.exec:\5jjvp.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe53⤵
- Executes dropped EXE
PID:2652 -
\??\c:\ffrxrrf.exec:\ffrxrrf.exe54⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bbnthn.exec:\bbnthn.exe55⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jjvvj.exec:\jjvvj.exe56⤵
- Executes dropped EXE
PID:332 -
\??\c:\fffrfrf.exec:\fffrfrf.exe57⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tnhhtb.exec:\tnhhtb.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5pvpd.exec:\5pvpd.exe59⤵
- Executes dropped EXE
PID:1264 -
\??\c:\xrlxrxl.exec:\xrlxrxl.exe60⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tnbbhn.exec:\tnbbhn.exe61⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vvvjv.exec:\vvvjv.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5xxlrxr.exec:\5xxlrxr.exe63⤵
- Executes dropped EXE
PID:624 -
\??\c:\xrrxllx.exec:\xrrxllx.exe64⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jpvjv.exec:\jpvjv.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\1vppp.exec:\1vppp.exe66⤵PID:568
-
\??\c:\3llflrx.exec:\3llflrx.exe67⤵PID:2224
-
\??\c:\btthnt.exec:\btthnt.exe68⤵PID:1796
-
\??\c:\9pdvp.exec:\9pdvp.exe69⤵PID:280
-
\??\c:\5rflrxx.exec:\5rflrxx.exe70⤵PID:2984
-
\??\c:\xfxrffx.exec:\xfxrffx.exe71⤵PID:1964
-
\??\c:\tnnthn.exec:\tnnthn.exe72⤵PID:2464
-
\??\c:\jdvdd.exec:\jdvdd.exe73⤵PID:2412
-
\??\c:\1lffllr.exec:\1lffllr.exe74⤵PID:3040
-
\??\c:\5nnhtt.exec:\5nnhtt.exe75⤵PID:2792
-
\??\c:\jdjvv.exec:\jdjvv.exe76⤵PID:2660
-
\??\c:\9jpjd.exec:\9jpjd.exe77⤵PID:1588
-
\??\c:\rrrrrrf.exec:\rrrrrrf.exe78⤵PID:2832
-
\??\c:\btnhth.exec:\btnhth.exe79⤵PID:2756
-
\??\c:\ppjvp.exec:\ppjvp.exe80⤵PID:2752
-
\??\c:\frrlfxx.exec:\frrlfxx.exe81⤵PID:3036
-
\??\c:\hbtbnt.exec:\hbtbnt.exe82⤵PID:2560
-
\??\c:\nnhtht.exec:\nnhtht.exe83⤵PID:2624
-
\??\c:\pppjp.exec:\pppjp.exe84⤵PID:3008
-
\??\c:\lfrrffl.exec:\lfrrffl.exe85⤵PID:800
-
\??\c:\hhbnbb.exec:\hhbnbb.exe86⤵PID:2900
-
\??\c:\9jjjv.exec:\9jjjv.exe87⤵PID:2096
-
\??\c:\pdjdj.exec:\pdjdj.exe88⤵PID:2276
-
\??\c:\ffxllxx.exec:\ffxllxx.exe89⤵PID:2356
-
\??\c:\3tthnt.exec:\3tthnt.exe90⤵PID:2060
-
\??\c:\vvvdj.exec:\vvvdj.exe91⤵PID:828
-
\??\c:\xxfxlxl.exec:\xxfxlxl.exe92⤵PID:1376
-
\??\c:\hhbhtb.exec:\hhbhtb.exe93⤵PID:1684
-
\??\c:\hbtnhn.exec:\hbtnhn.exe94⤵PID:1732
-
\??\c:\jddjp.exec:\jddjp.exe95⤵PID:1708
-
\??\c:\xrfrfrf.exec:\xrfrfrf.exe96⤵PID:536
-
\??\c:\btnbhn.exec:\btnbhn.exe97⤵PID:2352
-
\??\c:\vjjjv.exec:\vjjjv.exe98⤵PID:2032
-
\??\c:\fxrflrf.exec:\fxrflrf.exe99⤵PID:332
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe100⤵PID:1800
-
\??\c:\httnht.exec:\httnht.exe101⤵PID:2344
-
\??\c:\dpdpd.exec:\dpdpd.exe102⤵PID:2320
-
\??\c:\fllxrff.exec:\fllxrff.exe103⤵PID:2108
-
\??\c:\tbhhnn.exec:\tbhhnn.exe104⤵PID:1968
-
\??\c:\bnbbnh.exec:\bnbbnh.exe105⤵PID:2424
-
\??\c:\pppdp.exec:\pppdp.exe106⤵PID:1868
-
\??\c:\rxxlxlf.exec:\rxxlxlf.exe107⤵PID:1500
-
\??\c:\hbtntn.exec:\hbtntn.exe108⤵PID:1804
-
\??\c:\3bbthn.exec:\3bbthn.exe109⤵PID:1656
-
\??\c:\vddpp.exec:\vddpp.exe110⤵PID:3028
-
\??\c:\xfllrll.exec:\xfllrll.exe111⤵PID:1048
-
\??\c:\nnhbhb.exec:\nnhbhb.exe112⤵PID:1796
-
\??\c:\vjjjv.exec:\vjjjv.exe113⤵PID:2288
-
\??\c:\7llxlxr.exec:\7llxlxr.exe114⤵PID:2240
-
\??\c:\hnnnhb.exec:\hnnnhb.exe115⤵PID:1752
-
\??\c:\lfxfxxf.exec:\lfxfxxf.exe116⤵PID:2232
-
\??\c:\nnhttn.exec:\nnhttn.exe117⤵PID:2120
-
\??\c:\pjddp.exec:\pjddp.exe118⤵PID:2708
-
\??\c:\jjvdp.exec:\jjvdp.exe119⤵PID:2704
-
\??\c:\fxrxlll.exec:\fxrxlll.exe120⤵PID:2824
-
\??\c:\ttnnhn.exec:\ttnnhn.exe121⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-