Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe
-
Size
455KB
-
MD5
4a95c4737c3d2d34c68cdbe7e841e547
-
SHA1
708ed77fef0fa022195701f9ef380b1abcfc727e
-
SHA256
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7
-
SHA512
db0b439d24847574c9d2dca6c2c8011402d1fc3848c4924ecaf4fe02b9229668bc7b5026a6b3c84950baf4e4dc1b47fcab9dbc67aedeaf8c68aead663fcc5fe9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRc:q7Tc2NYHUrAwfMp3CDRc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2852-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-36-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2648-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-134-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2780-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-154-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2236-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-171-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2436-173-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2472-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1840-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-211-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1764-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-232-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1848-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-288-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3060-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-882-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 7tbnnn.exe 2984 jdvjv.exe 2920 lfrxffr.exe 2308 xlxxffr.exe 2648 htntbt.exe 2256 3dppj.exe 608 bbhntt.exe 1832 3pdjv.exe 2292 tnhnnb.exe 1928 5dvjp.exe 1904 lllxlrf.exe 1596 rlllrxf.exe 2924 1nhhbb.exe 1648 jvvdj.exe 2780 xxrfxxr.exe 1604 nnhbth.exe 2436 ffxrxxr.exe 2236 3xrxrfx.exe 2472 3vdjv.exe 2432 xrxxrrf.exe 1840 dvjpp.exe 2360 lfxlxfx.exe 1764 pvpdp.exe 1936 3tthnn.exe 1848 3vjvj.exe 2372 lfffrrf.exe 3040 tnhthh.exe 1220 pjvjp.exe 1744 7vjjv.exe 2408 hhbhbh.exe 2396 7vvdd.exe 2620 5vddd.exe 1656 pjvdj.exe 2720 nhtttt.exe 2052 1hbntb.exe 2308 vpjjp.exe 3060 1rrrffl.exe 2140 3tthnt.exe 320 7tnnnt.exe 764 pjjjp.exe 1288 1lrrrrr.exe 2480 bthntt.exe 548 5thhnt.exe 2512 vjddp.exe 2340 1lflrff.exe 2572 bbtbhh.exe 2672 7vpvd.exe 2332 pjvvj.exe 2792 7xrrlxx.exe 2960 tnbbbh.exe 2968 vvjvd.exe 2780 7dppj.exe 1340 lxxfxfr.exe 1768 nhnnnn.exe 3008 7vppv.exe 2484 lrlfrxr.exe 2252 ttthbh.exe 552 vpdjj.exe 1508 rllxlrl.exe 1840 rrlxrxl.exe 908 nhbnhb.exe 2376 vpvvv.exe 1580 3xlrxfr.exe 840 tthnbh.exe -
resource yara_rule behavioral1/memory/2852-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-510-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1580-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-882-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 3000 2852 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 31 PID 2852 wrote to memory of 3000 2852 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 31 PID 2852 wrote to memory of 3000 2852 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 31 PID 2852 wrote to memory of 3000 2852 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 31 PID 3000 wrote to memory of 2984 3000 7tbnnn.exe 32 PID 3000 wrote to memory of 2984 3000 7tbnnn.exe 32 PID 3000 wrote to memory of 2984 3000 7tbnnn.exe 32 PID 3000 wrote to memory of 2984 3000 7tbnnn.exe 32 PID 2984 wrote to memory of 2920 2984 jdvjv.exe 33 PID 2984 wrote to memory of 2920 2984 jdvjv.exe 33 PID 2984 wrote to memory of 2920 2984 jdvjv.exe 33 PID 2984 wrote to memory of 2920 2984 jdvjv.exe 33 PID 2920 wrote to memory of 2308 2920 lfrxffr.exe 34 PID 2920 wrote to memory of 2308 2920 lfrxffr.exe 34 PID 2920 wrote to memory of 2308 2920 lfrxffr.exe 34 PID 2920 wrote to memory of 2308 2920 lfrxffr.exe 34 PID 2308 wrote to memory of 2648 2308 xlxxffr.exe 35 PID 2308 wrote to memory of 2648 2308 xlxxffr.exe 35 PID 2308 wrote to memory of 2648 2308 xlxxffr.exe 35 PID 2308 wrote to memory of 2648 2308 xlxxffr.exe 35 PID 2648 wrote to memory of 2256 2648 htntbt.exe 36 PID 2648 wrote to memory of 2256 2648 htntbt.exe 36 PID 2648 wrote to memory of 2256 2648 htntbt.exe 36 PID 2648 wrote to memory of 2256 2648 htntbt.exe 36 PID 2256 wrote to memory of 608 2256 3dppj.exe 37 PID 2256 wrote to memory of 608 2256 3dppj.exe 37 PID 2256 wrote to memory of 608 2256 3dppj.exe 37 PID 2256 wrote to memory of 608 2256 3dppj.exe 37 PID 608 wrote to memory of 1832 608 bbhntt.exe 38 PID 608 wrote to memory of 1832 608 bbhntt.exe 38 PID 608 wrote to memory of 1832 608 bbhntt.exe 38 PID 608 wrote to memory of 1832 608 bbhntt.exe 38 PID 1832 wrote to memory of 2292 1832 3pdjv.exe 39 PID 1832 wrote to memory of 2292 1832 3pdjv.exe 39 PID 1832 wrote to memory of 2292 1832 3pdjv.exe 39 PID 1832 wrote to memory of 2292 1832 3pdjv.exe 39 PID 2292 wrote to memory of 1928 2292 tnhnnb.exe 40 PID 2292 wrote to memory of 1928 2292 tnhnnb.exe 40 PID 2292 wrote to memory of 1928 2292 tnhnnb.exe 40 PID 2292 wrote to memory of 1928 2292 tnhnnb.exe 40 PID 1928 wrote to memory of 1904 1928 5dvjp.exe 41 PID 1928 wrote to memory of 1904 1928 5dvjp.exe 41 PID 1928 wrote to memory of 1904 1928 5dvjp.exe 41 PID 1928 wrote to memory of 1904 1928 5dvjp.exe 41 PID 1904 wrote to memory of 1596 1904 lllxlrf.exe 42 PID 1904 wrote to memory of 1596 1904 lllxlrf.exe 42 PID 1904 wrote to memory of 1596 1904 lllxlrf.exe 42 PID 1904 wrote to memory of 1596 1904 lllxlrf.exe 42 PID 1596 wrote to memory of 2924 1596 rlllrxf.exe 43 PID 1596 wrote to memory of 2924 1596 rlllrxf.exe 43 PID 1596 wrote to memory of 2924 1596 rlllrxf.exe 43 PID 1596 wrote to memory of 2924 1596 rlllrxf.exe 43 PID 2924 wrote to memory of 1648 2924 1nhhbb.exe 44 PID 2924 wrote to memory of 1648 2924 1nhhbb.exe 44 PID 2924 wrote to memory of 1648 2924 1nhhbb.exe 44 PID 2924 wrote to memory of 1648 2924 1nhhbb.exe 44 PID 1648 wrote to memory of 2780 1648 jvvdj.exe 45 PID 1648 wrote to memory of 2780 1648 jvvdj.exe 45 PID 1648 wrote to memory of 2780 1648 jvvdj.exe 45 PID 1648 wrote to memory of 2780 1648 jvvdj.exe 45 PID 2780 wrote to memory of 1604 2780 xxrfxxr.exe 46 PID 2780 wrote to memory of 1604 2780 xxrfxxr.exe 46 PID 2780 wrote to memory of 1604 2780 xxrfxxr.exe 46 PID 2780 wrote to memory of 1604 2780 xxrfxxr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe"C:\Users\Admin\AppData\Local\Temp\b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7tbnnn.exec:\7tbnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jdvjv.exec:\jdvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\lfrxffr.exec:\lfrxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xlxxffr.exec:\xlxxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\htntbt.exec:\htntbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\3dppj.exec:\3dppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\bbhntt.exec:\bbhntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\3pdjv.exec:\3pdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\tnhnnb.exec:\tnhnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\5dvjp.exec:\5dvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\lllxlrf.exec:\lllxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\rlllrxf.exec:\rlllrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\1nhhbb.exec:\1nhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\jvvdj.exec:\jvvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\xxrfxxr.exec:\xxrfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nnhbth.exec:\nnhbth.exe17⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ffxrxxr.exec:\ffxrxxr.exe18⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3xrxrfx.exec:\3xrxrfx.exe19⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3vdjv.exec:\3vdjv.exe20⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe21⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvjpp.exec:\dvjpp.exe22⤵
- Executes dropped EXE
PID:1840 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe23⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pvpdp.exec:\pvpdp.exe24⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3tthnn.exec:\3tthnn.exe25⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3vjvj.exec:\3vjvj.exe26⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lfffrrf.exec:\lfffrrf.exe27⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tnhthh.exec:\tnhthh.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pjvjp.exec:\pjvjp.exe29⤵
- Executes dropped EXE
PID:1220 -
\??\c:\7vjjv.exec:\7vjjv.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hhbhbh.exec:\hhbhbh.exe31⤵
- Executes dropped EXE
PID:2408 -
\??\c:\7vvdd.exec:\7vvdd.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5vddd.exec:\5vddd.exe33⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pjvdj.exec:\pjvdj.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhtttt.exec:\nhtttt.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1hbntb.exec:\1hbntb.exe36⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vpjjp.exec:\vpjjp.exe37⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1rrrffl.exec:\1rrrffl.exe38⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3tthnt.exec:\3tthnt.exe39⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7tnnnt.exec:\7tnnnt.exe40⤵
- Executes dropped EXE
PID:320 -
\??\c:\pjjjp.exec:\pjjjp.exe41⤵
- Executes dropped EXE
PID:764 -
\??\c:\1lrrrrr.exec:\1lrrrrr.exe42⤵
- Executes dropped EXE
PID:1288 -
\??\c:\bthntt.exec:\bthntt.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5thhnt.exec:\5thhnt.exe44⤵
- Executes dropped EXE
PID:548 -
\??\c:\vjddp.exec:\vjddp.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1lflrff.exec:\1lflrff.exe46⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bbtbhh.exec:\bbtbhh.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7vpvd.exec:\7vpvd.exe48⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pjvvj.exec:\pjvvj.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7xrrlxx.exec:\7xrrlxx.exe50⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tnbbbh.exec:\tnbbbh.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvjvd.exec:\vvjvd.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7dppj.exec:\7dppj.exe53⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lxxfxfr.exec:\lxxfxfr.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nhnnnn.exec:\nhnnnn.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7vppv.exec:\7vppv.exe56⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lrlfrxr.exec:\lrlfrxr.exe57⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ttthbh.exec:\ttthbh.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vpdjj.exec:\vpdjj.exe59⤵
- Executes dropped EXE
PID:552 -
\??\c:\rllxlrl.exec:\rllxlrl.exe60⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhbnhb.exec:\nhbnhb.exe62⤵
- Executes dropped EXE
PID:908 -
\??\c:\vpvvv.exec:\vpvvv.exe63⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3xlrxfr.exec:\3xlrxfr.exe64⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tthnbh.exec:\tthnbh.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhbhbt.exec:\nhbhbt.exe66⤵PID:1848
-
\??\c:\pdvvv.exec:\pdvvv.exe67⤵PID:2388
-
\??\c:\xxlfllf.exec:\xxlfllf.exe68⤵PID:2528
-
\??\c:\ttnnhn.exec:\ttnnhn.exe69⤵PID:3040
-
\??\c:\9dppp.exec:\9dppp.exe70⤵PID:2092
-
\??\c:\ffxxflf.exec:\ffxxflf.exe71⤵PID:1036
-
\??\c:\1lxflxl.exec:\1lxflxl.exe72⤵PID:2852
-
\??\c:\htbttt.exec:\htbttt.exe73⤵PID:2836
-
\??\c:\jdvjv.exec:\jdvjv.exe74⤵PID:2136
-
\??\c:\pdddv.exec:\pdddv.exe75⤵PID:2700
-
\??\c:\1xrxxxx.exec:\1xrxxxx.exe76⤵PID:2916
-
\??\c:\hbbnbb.exec:\hbbnbb.exe77⤵PID:2812
-
\??\c:\7tnnnb.exec:\7tnnnb.exe78⤵PID:2752
-
\??\c:\vvvpj.exec:\vvvpj.exe79⤵PID:2704
-
\??\c:\fxrrxlr.exec:\fxrrxlr.exe80⤵PID:2320
-
\??\c:\nbhbnt.exec:\nbhbnt.exe81⤵PID:2176
-
\??\c:\bthtbh.exec:\bthtbh.exe82⤵PID:1020
-
\??\c:\ppjdj.exec:\ppjdj.exe83⤵PID:1588
-
\??\c:\xrlrflx.exec:\xrlrflx.exe84⤵PID:2624
-
\??\c:\nnbbbh.exec:\nnbbbh.exe85⤵PID:2204
-
\??\c:\9bnhhh.exec:\9bnhhh.exe86⤵PID:2192
-
\??\c:\7jvvd.exec:\7jvvd.exe87⤵PID:2344
-
\??\c:\llrllxr.exec:\llrllxr.exe88⤵PID:2776
-
\??\c:\ffxflrf.exec:\ffxflrf.exe89⤵PID:2880
-
\??\c:\hthbhn.exec:\hthbhn.exe90⤵PID:1596
-
\??\c:\jvpvj.exec:\jvpvj.exe91⤵PID:2784
-
\??\c:\lllxfll.exec:\lllxfll.exe92⤵PID:1956
-
\??\c:\tthntb.exec:\tthntb.exe93⤵PID:1076
-
\??\c:\btntbh.exec:\btntbh.exe94⤵PID:2056
-
\??\c:\3pjvj.exec:\3pjvj.exe95⤵PID:1624
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe96⤵PID:1796
-
\??\c:\hnbhnn.exec:\hnbhnn.exe97⤵PID:1660
-
\??\c:\hnhthn.exec:\hnhthn.exe98⤵PID:2224
-
\??\c:\dpjvp.exec:\dpjvp.exe99⤵PID:1772
-
\??\c:\5xlxflx.exec:\5xlxflx.exe100⤵PID:1756
-
\??\c:\frxffrx.exec:\frxffrx.exe101⤵PID:1048
-
\??\c:\1nbhnn.exec:\1nbhnn.exe102⤵PID:1912
-
\??\c:\vvpvj.exec:\vvpvj.exe103⤵PID:448
-
\??\c:\pdvjd.exec:\pdvjd.exe104⤵PID:3024
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe105⤵PID:908
-
\??\c:\bbhhtt.exec:\bbhhtt.exe106⤵PID:1732
-
\??\c:\jjddp.exec:\jjddp.exe107⤵PID:1740
-
\??\c:\jjvdj.exec:\jjvdj.exe108⤵PID:840
-
\??\c:\lrllxxf.exec:\lrllxxf.exe109⤵PID:2104
-
\??\c:\hbbhnn.exec:\hbbhnn.exe110⤵PID:1200
-
\??\c:\bbnntb.exec:\bbnntb.exe111⤵PID:2552
-
\??\c:\pvvpv.exec:\pvvpv.exe112⤵PID:376
-
\??\c:\xxxxffx.exec:\xxxxffx.exe113⤵PID:1576
-
\??\c:\hnhnth.exec:\hnhnth.exe114⤵PID:1616
-
\??\c:\tnhhnn.exec:\tnhhnn.exe115⤵PID:2716
-
\??\c:\5lffrrf.exec:\5lffrrf.exe116⤵PID:2708
-
\??\c:\nhttbb.exec:\nhttbb.exe117⤵PID:2984
-
\??\c:\7dpvp.exec:\7dpvp.exe118⤵PID:1560
-
\??\c:\llfrrxr.exec:\llfrrxr.exe119⤵PID:2036
-
\??\c:\1xxlxxl.exec:\1xxlxxl.exe120⤵PID:2584
-
\??\c:\nhtbnn.exec:\nhtbnn.exe121⤵PID:2052
-
\??\c:\dvjjd.exec:\dvjjd.exe122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-