Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe
-
Size
453KB
-
MD5
1c9dcc1e0e8aa04b14756c5f15549b00
-
SHA1
fcf52cd8674e3ac1a1acaa7715bc0af86ea3aa41
-
SHA256
88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7
-
SHA512
60bb1fa897b77aac160a4fe21c3e888429ec2d6e53f65b7b8a639f02a8ea8d7d0611688466373e6f7c67906821d86aa7aafa9ada523af64c12a7b989cabe3efc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3056-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-203-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1864-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-283-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-414-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-421-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/444-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-498-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/752-507-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-603-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-722-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2196-735-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2196-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-746-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-871-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-984-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 xrlrlff.exe 1136 ffxlflf.exe 1824 dpjpd.exe 1660 nhntnt.exe 2880 vpjdj.exe 2884 hhbhhn.exe 2292 vpjpv.exe 2976 1jppv.exe 2688 5vdjp.exe 2676 hbnthn.exe 2140 pjppd.exe 2852 1bbnnb.exe 1484 5jjjj.exe 800 5thnbb.exe 2996 jdppv.exe 2844 tnnbhh.exe 1060 dvjjj.exe 2028 hbthnt.exe 1772 xrflxff.exe 2120 jjvvd.exe 1864 rlfxrxl.exe 996 7bthtb.exe 1376 jpjvp.exe 3036 dvddj.exe 828 pppdp.exe 2052 lrlrrff.exe 2248 bntnhn.exe 2512 nhnbnn.exe 2492 bbtbnt.exe 768 nnntbb.exe 2256 ppdjj.exe 2420 nnbnbb.exe 3000 vpdjp.exe 2428 flrrxll.exe 3008 nhbhth.exe 2332 ppdjj.exe 2304 fxfxfxl.exe 2736 btnbtn.exe 3020 1dppv.exe 2932 5fxxffr.exe 2152 rlfxlrf.exe 2796 thttnn.exe 2636 ppjpd.exe 2688 fxrxlrr.exe 2592 3tbtbb.exe 1708 tnbbbh.exe 2140 ddvjp.exe 2212 7frrxxf.exe 1688 lxffllx.exe 3004 bbtbhn.exe 2700 pdjdd.exe 2876 5lxxlrx.exe 2044 1bnnnn.exe 2980 nhbhtt.exe 2020 3ppvp.exe 2196 lrffrxf.exe 2488 tnbbhh.exe 1728 hbnthh.exe 1392 ddpvp.exe 752 3fxxrfr.exe 1352 hbthnt.exe 444 1jddp.exe 916 dvjjp.exe 1348 ffxfrxf.exe -
resource yara_rule behavioral1/memory/3056-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-1202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-1221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-1373-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 3000 3056 88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe 30 PID 3056 wrote to memory of 3000 3056 88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe 30 PID 3056 wrote to memory of 3000 3056 88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe 30 PID 3056 wrote to memory of 3000 3056 88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe 30 PID 3000 wrote to memory of 1136 3000 xrlrlff.exe 31 PID 3000 wrote to memory of 1136 3000 xrlrlff.exe 31 PID 3000 wrote to memory of 1136 3000 xrlrlff.exe 31 PID 3000 wrote to memory of 1136 3000 xrlrlff.exe 31 PID 1136 wrote to memory of 1824 1136 ffxlflf.exe 32 PID 1136 wrote to memory of 1824 1136 ffxlflf.exe 32 PID 1136 wrote to memory of 1824 1136 ffxlflf.exe 32 PID 1136 wrote to memory of 1824 1136 ffxlflf.exe 32 PID 1824 wrote to memory of 1660 1824 dpjpd.exe 33 PID 1824 wrote to memory of 1660 1824 dpjpd.exe 33 PID 1824 wrote to memory of 1660 1824 dpjpd.exe 33 PID 1824 wrote to memory of 1660 1824 dpjpd.exe 33 PID 1660 wrote to memory of 2880 1660 nhntnt.exe 34 PID 1660 wrote to memory of 2880 1660 nhntnt.exe 34 PID 1660 wrote to memory of 2880 1660 nhntnt.exe 34 PID 1660 wrote to memory of 2880 1660 nhntnt.exe 34 PID 2880 wrote to memory of 2884 2880 vpjdj.exe 35 PID 2880 wrote to memory of 2884 2880 vpjdj.exe 35 PID 2880 wrote to memory of 2884 2880 vpjdj.exe 35 PID 2880 wrote to memory of 2884 2880 vpjdj.exe 35 PID 2884 wrote to memory of 2292 2884 hhbhhn.exe 36 PID 2884 wrote to memory of 2292 2884 hhbhhn.exe 36 PID 2884 wrote to memory of 2292 2884 hhbhhn.exe 36 PID 2884 wrote to memory of 2292 2884 hhbhhn.exe 36 PID 2292 wrote to memory of 2976 2292 vpjpv.exe 37 PID 2292 wrote to memory of 2976 2292 vpjpv.exe 37 PID 2292 wrote to memory of 2976 2292 vpjpv.exe 37 PID 2292 wrote to memory of 2976 2292 vpjpv.exe 37 PID 2976 wrote to memory of 2688 2976 1jppv.exe 38 PID 2976 wrote to memory of 2688 2976 1jppv.exe 38 PID 2976 wrote to memory of 2688 2976 1jppv.exe 38 PID 2976 wrote to memory of 2688 2976 1jppv.exe 38 PID 2688 wrote to memory of 2676 2688 5vdjp.exe 39 PID 2688 wrote to memory of 2676 2688 5vdjp.exe 39 PID 2688 wrote to memory of 2676 2688 5vdjp.exe 39 PID 2688 wrote to memory of 2676 2688 5vdjp.exe 39 PID 2676 wrote to memory of 2140 2676 hbnthn.exe 40 PID 2676 wrote to memory of 2140 2676 hbnthn.exe 40 PID 2676 wrote to memory of 2140 2676 hbnthn.exe 40 PID 2676 wrote to memory of 2140 2676 hbnthn.exe 40 PID 2140 wrote to memory of 2852 2140 pjppd.exe 41 PID 2140 wrote to memory of 2852 2140 pjppd.exe 41 PID 2140 wrote to memory of 2852 2140 pjppd.exe 41 PID 2140 wrote to memory of 2852 2140 pjppd.exe 41 PID 2852 wrote to memory of 1484 2852 1bbnnb.exe 42 PID 2852 wrote to memory of 1484 2852 1bbnnb.exe 42 PID 2852 wrote to memory of 1484 2852 1bbnnb.exe 42 PID 2852 wrote to memory of 1484 2852 1bbnnb.exe 42 PID 1484 wrote to memory of 800 1484 5jjjj.exe 43 PID 1484 wrote to memory of 800 1484 5jjjj.exe 43 PID 1484 wrote to memory of 800 1484 5jjjj.exe 43 PID 1484 wrote to memory of 800 1484 5jjjj.exe 43 PID 800 wrote to memory of 2996 800 5thnbb.exe 44 PID 800 wrote to memory of 2996 800 5thnbb.exe 44 PID 800 wrote to memory of 2996 800 5thnbb.exe 44 PID 800 wrote to memory of 2996 800 5thnbb.exe 44 PID 2996 wrote to memory of 2844 2996 jdppv.exe 45 PID 2996 wrote to memory of 2844 2996 jdppv.exe 45 PID 2996 wrote to memory of 2844 2996 jdppv.exe 45 PID 2996 wrote to memory of 2844 2996 jdppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe"C:\Users\Admin\AppData\Local\Temp\88738625851e755d4950e701cf77862ad4525235e9c25656e4007f1de35ba3c7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\xrlrlff.exec:\xrlrlff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ffxlflf.exec:\ffxlflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\dpjpd.exec:\dpjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nhntnt.exec:\nhntnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vpjdj.exec:\vpjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hhbhhn.exec:\hhbhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vpjpv.exec:\vpjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\1jppv.exec:\1jppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\5vdjp.exec:\5vdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hbnthn.exec:\hbnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pjppd.exec:\pjppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\1bbnnb.exec:\1bbnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5jjjj.exec:\5jjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\5thnbb.exec:\5thnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\jdppv.exec:\jdppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tnnbhh.exec:\tnnbhh.exe17⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dvjjj.exec:\dvjjj.exe18⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hbthnt.exec:\hbthnt.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xrflxff.exec:\xrflxff.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
\??\c:\jjvvd.exec:\jjvvd.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rlfxrxl.exec:\rlfxrxl.exe22⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7bthtb.exec:\7bthtb.exe23⤵
- Executes dropped EXE
PID:996 -
\??\c:\jpjvp.exec:\jpjvp.exe24⤵
- Executes dropped EXE
PID:1376 -
\??\c:\dvddj.exec:\dvddj.exe25⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pppdp.exec:\pppdp.exe26⤵
- Executes dropped EXE
PID:828 -
\??\c:\lrlrrff.exec:\lrlrrff.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bntnhn.exec:\bntnhn.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nhnbnn.exec:\nhnbnn.exe29⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bbtbnt.exec:\bbtbnt.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nnntbb.exec:\nnntbb.exe31⤵
- Executes dropped EXE
PID:768 -
\??\c:\ppdjj.exec:\ppdjj.exe32⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nnbnbb.exec:\nnbnbb.exe33⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vpdjp.exec:\vpdjp.exe34⤵
- Executes dropped EXE
PID:3000 -
\??\c:\flrrxll.exec:\flrrxll.exe35⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nhbhth.exec:\nhbhth.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ppdjj.exec:\ppdjj.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fxfxfxl.exec:\fxfxfxl.exe38⤵
- Executes dropped EXE
PID:2304 -
\??\c:\btnbtn.exec:\btnbtn.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1dppv.exec:\1dppv.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5fxxffr.exec:\5fxxffr.exe41⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rlfxlrf.exec:\rlfxlrf.exe42⤵
- Executes dropped EXE
PID:2152 -
\??\c:\thttnn.exec:\thttnn.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ppjpd.exec:\ppjpd.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3tbtbb.exec:\3tbtbb.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnbbbh.exec:\tnbbbh.exe47⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ddvjp.exec:\ddvjp.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7frrxxf.exec:\7frrxxf.exe49⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lxffllx.exec:\lxffllx.exe50⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bbtbhn.exec:\bbtbhn.exe51⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdjdd.exec:\pdjdd.exe52⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5lxxlrx.exec:\5lxxlrx.exe53⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1bnnnn.exec:\1bnnnn.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhbhtt.exec:\nhbhtt.exe55⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3ppvp.exec:\3ppvp.exe56⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lrffrxf.exec:\lrffrxf.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnbbhh.exec:\tnbbhh.exe58⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbnthh.exec:\hbnthh.exe59⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ddpvp.exec:\ddpvp.exe60⤵
- Executes dropped EXE
PID:1392 -
\??\c:\3fxxrfr.exec:\3fxxrfr.exe61⤵
- Executes dropped EXE
PID:752 -
\??\c:\hbthnt.exec:\hbthnt.exe62⤵
- Executes dropped EXE
PID:1352 -
\??\c:\1jddp.exec:\1jddp.exe63⤵
- Executes dropped EXE
PID:444 -
\??\c:\dvjjp.exec:\dvjjp.exe64⤵
- Executes dropped EXE
PID:916 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe65⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ttnbnb.exec:\ttnbnb.exe66⤵PID:2460
-
\??\c:\dvjpd.exec:\dvjpd.exe67⤵PID:2224
-
\??\c:\rflfllr.exec:\rflfllr.exe68⤵PID:884
-
\??\c:\lfrxllr.exec:\lfrxllr.exe69⤵PID:1652
-
\??\c:\hbhnhn.exec:\hbhnhn.exe70⤵PID:2424
-
\??\c:\7vpdp.exec:\7vpdp.exe71⤵PID:2552
-
\??\c:\rrrrffr.exec:\rrrrffr.exe72⤵PID:668
-
\??\c:\rrlrflr.exec:\rrlrflr.exe73⤵PID:2296
-
\??\c:\7tbtnb.exec:\7tbtnb.exe74⤵PID:3052
-
\??\c:\7pdjp.exec:\7pdjp.exe75⤵PID:340
-
\??\c:\3pjpj.exec:\3pjpj.exe76⤵PID:2116
-
\??\c:\5frxffl.exec:\5frxffl.exe77⤵PID:3000
-
\??\c:\nhbbnn.exec:\nhbbnn.exe78⤵PID:544
-
\??\c:\jddvj.exec:\jddvj.exe79⤵PID:1824
-
\??\c:\9rfxflx.exec:\9rfxflx.exe80⤵PID:2780
-
\??\c:\tnhtnt.exec:\tnhtnt.exe81⤵PID:2772
-
\??\c:\vdvjd.exec:\vdvjd.exe82⤵PID:2064
-
\??\c:\vjvvv.exec:\vjvvv.exe83⤵PID:2828
-
\??\c:\3lxfxfr.exec:\3lxfxfr.exe84⤵PID:2668
-
\??\c:\3hnbbh.exec:\3hnbbh.exe85⤵PID:2660
-
\??\c:\dvpjp.exec:\dvpjp.exe86⤵PID:2632
-
\??\c:\5lxfflf.exec:\5lxfflf.exe87⤵PID:2648
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe88⤵PID:2684
-
\??\c:\nhtbnn.exec:\nhtbnn.exe89⤵PID:2060
-
\??\c:\pdvvj.exec:\pdvvj.exe90⤵PID:2592
-
\??\c:\rxxrrll.exec:\rxxrrll.exe91⤵PID:2852
-
\??\c:\nbnttb.exec:\nbnttb.exe92⤵PID:2328
-
\??\c:\7hbbnn.exec:\7hbbnn.exe93⤵PID:2012
-
\??\c:\ddppj.exec:\ddppj.exe94⤵PID:2812
-
\??\c:\lllfxrx.exec:\lllfxrx.exe95⤵PID:2856
-
\??\c:\3ffrrxl.exec:\3ffrrxl.exe96⤵PID:2700
-
\??\c:\tnhnbb.exec:\tnhnbb.exe97⤵PID:2540
-
\??\c:\pvdvv.exec:\pvdvv.exe98⤵PID:2032
-
\??\c:\lxrfffr.exec:\lxrfffr.exe99⤵PID:1564
-
\??\c:\xlffllr.exec:\xlffllr.exe100⤵PID:2088
-
\??\c:\7nttbb.exec:\7nttbb.exe101⤵PID:2196
-
\??\c:\djvjv.exec:\djvjv.exe102⤵PID:656
-
\??\c:\7xlllrr.exec:\7xlllrr.exe103⤵PID:2192
-
\??\c:\bntnnb.exec:\bntnnb.exe104⤵PID:756
-
\??\c:\1vjjv.exec:\1vjjv.exe105⤵PID:404
-
\??\c:\pjjvp.exec:\pjjvp.exe106⤵PID:2612
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe107⤵PID:1980
-
\??\c:\hhtntb.exec:\hhtntb.exe108⤵PID:1340
-
\??\c:\3pdvv.exec:\3pdvv.exe109⤵PID:2320
-
\??\c:\ffrfxlr.exec:\ffrfxlr.exe110⤵PID:1988
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe111⤵PID:2248
-
\??\c:\hhbhhh.exec:\hhbhhh.exe112⤵PID:860
-
\??\c:\pjddv.exec:\pjddv.exe113⤵PID:2352
-
\??\c:\1lrxfrf.exec:\1lrxfrf.exe114⤵PID:1512
-
\??\c:\nhttbb.exec:\nhttbb.exe115⤵PID:3024
-
\??\c:\hhbhnt.exec:\hhbhnt.exe116⤵PID:2520
-
\??\c:\pjppv.exec:\pjppv.exe117⤵PID:2544
-
\??\c:\5rllrll.exec:\5rllrll.exe118⤵PID:3068
-
\??\c:\lfrflrl.exec:\lfrflrl.exe119⤵PID:2416
-
\??\c:\nntbtb.exec:\nntbtb.exe120⤵PID:1136
-
\??\c:\jvppv.exec:\jvppv.exe121⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-