Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:13
Behavioral task
behavioral1
Sample
1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe
-
Size
345KB
-
MD5
40c5794c0c34e8a9ea2f5836a729cf10
-
SHA1
55fe43f99ae35c6e5758b5ab8e95b49981dcaa38
-
SHA256
1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110
-
SHA512
de433faec03c0a857ebe1e4e76dd387e80fd6177db2d40acf22d6b57c32a185a14deb4cf45812e60ac76ab245c4579625911b4a7213115a475fecd3a3864045d
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYAi:R4wFHoS3WXZshJX2VGdi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2644-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1376-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/484-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-282-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-318-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2756-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-327-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2592-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-379-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-508-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-524-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2252-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-531-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1748-547-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 jpppv.exe 2812 rrlrlfl.exe 2676 1dvdd.exe 2916 1ttthb.exe 2872 pjvvd.exe 2548 lffxlxf.exe 2624 1dvdp.exe 2196 tnhhtb.exe 1096 pvvjv.exe 2220 3rlffrx.exe 2128 tbhhhh.exe 1664 7lxfflr.exe 2060 hhbhtb.exe 1376 7jjvp.exe 484 xrfxflr.exe 1480 5ddjp.exe 896 dddjj.exe 604 hbbhhh.exe 2492 jjdpd.exe 2172 hbnbhb.exe 1444 vdpdv.exe 1984 nhbhbb.exe 2036 vvvdv.exe 2168 bbhnth.exe 952 jddjv.exe 1536 xxrrflx.exe 1036 hhhthn.exe 1656 lfxlrxl.exe 1784 tnttbh.exe 2428 xrfrflr.exe 2984 tthtbh.exe 1008 1pvjv.exe 892 5xlrfrf.exe 2144 tnbtnn.exe 2120 1vjvv.exe 2796 rrlrxll.exe 2812 5lrflrf.exe 1588 ttntbb.exe 2756 7jjvp.exe 2052 3xrflrr.exe 2776 xxxrrfx.exe 3036 pjjjp.exe 2592 ddvjv.exe 3000 xrfflll.exe 3020 btthth.exe 2988 jvppp.exe 2588 1lffflr.exe 2360 fxflxxl.exe 2356 tbntnn.exe 2128 vpdpj.exe 1724 jdvvp.exe 1580 rlrlrlr.exe 2868 1bbhnn.exe 2076 dvvdv.exe 324 xrflrxf.exe 2856 rfflrlr.exe 2848 bbntbh.exe 540 dvdjp.exe 1028 dpddd.exe 604 5lrlffl.exe 2492 hbtbhb.exe 2328 pjpjd.exe 1264 pjppv.exe 408 rflflff.exe -
resource yara_rule behavioral1/memory/2644-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0003000000012000-5.dat upx behavioral1/memory/2644-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d89-15.dat upx behavioral1/memory/2120-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017079-23.dat upx behavioral1/files/0x00070000000173a7-31.dat upx behavioral1/memory/2916-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173a9-41.dat upx behavioral1/memory/2872-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017488-50.dat upx behavioral1/files/0x000a000000017492-59.dat upx behavioral1/files/0x00090000000174cc-67.dat upx behavioral1/memory/2196-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019282-76.dat upx behavioral1/files/0x0005000000019334-83.dat upx behavioral1/files/0x0005000000019350-91.dat upx behavioral1/files/0x00050000000193b4-99.dat upx behavioral1/memory/1664-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c2-108.dat upx behavioral1/files/0x00050000000193e1-118.dat upx behavioral1/memory/2060-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941e-125.dat upx behavioral1/memory/484-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1376-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019427-133.dat upx behavioral1/memory/1480-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/484-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019431-142.dat upx behavioral1/memory/896-149-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0034000000016d64-150.dat upx behavioral1/memory/896-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/604-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019441-159.dat upx behavioral1/memory/2492-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2172-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001944f-170.dat upx behavioral1/files/0x0005000000019461-179.dat upx behavioral1/memory/2172-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950c-187.dat upx behavioral1/memory/1984-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1444-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019582-197.dat upx behavioral1/files/0x00050000000195c5-206.dat upx behavioral1/memory/2168-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019609-214.dat upx behavioral1/files/0x000500000001960b-221.dat upx behavioral1/memory/1536-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960d-229.dat upx behavioral1/files/0x000500000001960f-237.dat upx behavioral1/memory/1656-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019611-246.dat upx behavioral1/files/0x0005000000019613-253.dat upx behavioral1/files/0x0005000000019615-261.dat upx behavioral1/files/0x0005000000019617-268.dat upx behavioral1/memory/2984-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/892-282-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2144-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-300-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2120 2644 1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe 30 PID 2644 wrote to memory of 2120 2644 1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe 30 PID 2644 wrote to memory of 2120 2644 1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe 30 PID 2644 wrote to memory of 2120 2644 1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe 30 PID 2120 wrote to memory of 2812 2120 jpppv.exe 31 PID 2120 wrote to memory of 2812 2120 jpppv.exe 31 PID 2120 wrote to memory of 2812 2120 jpppv.exe 31 PID 2120 wrote to memory of 2812 2120 jpppv.exe 31 PID 2812 wrote to memory of 2676 2812 rrlrlfl.exe 32 PID 2812 wrote to memory of 2676 2812 rrlrlfl.exe 32 PID 2812 wrote to memory of 2676 2812 rrlrlfl.exe 32 PID 2812 wrote to memory of 2676 2812 rrlrlfl.exe 32 PID 2676 wrote to memory of 2916 2676 1dvdd.exe 33 PID 2676 wrote to memory of 2916 2676 1dvdd.exe 33 PID 2676 wrote to memory of 2916 2676 1dvdd.exe 33 PID 2676 wrote to memory of 2916 2676 1dvdd.exe 33 PID 2916 wrote to memory of 2872 2916 1ttthb.exe 34 PID 2916 wrote to memory of 2872 2916 1ttthb.exe 34 PID 2916 wrote to memory of 2872 2916 1ttthb.exe 34 PID 2916 wrote to memory of 2872 2916 1ttthb.exe 34 PID 2872 wrote to memory of 2548 2872 pjvvd.exe 35 PID 2872 wrote to memory of 2548 2872 pjvvd.exe 35 PID 2872 wrote to memory of 2548 2872 pjvvd.exe 35 PID 2872 wrote to memory of 2548 2872 pjvvd.exe 35 PID 2548 wrote to memory of 2624 2548 lffxlxf.exe 36 PID 2548 wrote to memory of 2624 2548 lffxlxf.exe 36 PID 2548 wrote to memory of 2624 2548 lffxlxf.exe 36 PID 2548 wrote to memory of 2624 2548 lffxlxf.exe 36 PID 2624 wrote to memory of 2196 2624 1dvdp.exe 37 PID 2624 wrote to memory of 2196 2624 1dvdp.exe 37 PID 2624 wrote to memory of 2196 2624 1dvdp.exe 37 PID 2624 wrote to memory of 2196 2624 1dvdp.exe 37 PID 2196 wrote to memory of 1096 2196 tnhhtb.exe 38 PID 2196 wrote to memory of 1096 2196 tnhhtb.exe 38 PID 2196 wrote to memory of 1096 2196 tnhhtb.exe 38 PID 2196 wrote to memory of 1096 2196 tnhhtb.exe 38 PID 1096 wrote to memory of 2220 1096 pvvjv.exe 39 PID 1096 wrote to memory of 2220 1096 pvvjv.exe 39 PID 1096 wrote to memory of 2220 1096 pvvjv.exe 39 PID 1096 wrote to memory of 2220 1096 pvvjv.exe 39 PID 2220 wrote to memory of 2128 2220 3rlffrx.exe 40 PID 2220 wrote to memory of 2128 2220 3rlffrx.exe 40 PID 2220 wrote to memory of 2128 2220 3rlffrx.exe 40 PID 2220 wrote to memory of 2128 2220 3rlffrx.exe 40 PID 2128 wrote to memory of 1664 2128 tbhhhh.exe 41 PID 2128 wrote to memory of 1664 2128 tbhhhh.exe 41 PID 2128 wrote to memory of 1664 2128 tbhhhh.exe 41 PID 2128 wrote to memory of 1664 2128 tbhhhh.exe 41 PID 1664 wrote to memory of 2060 1664 7lxfflr.exe 42 PID 1664 wrote to memory of 2060 1664 7lxfflr.exe 42 PID 1664 wrote to memory of 2060 1664 7lxfflr.exe 42 PID 1664 wrote to memory of 2060 1664 7lxfflr.exe 42 PID 2060 wrote to memory of 1376 2060 hhbhtb.exe 43 PID 2060 wrote to memory of 1376 2060 hhbhtb.exe 43 PID 2060 wrote to memory of 1376 2060 hhbhtb.exe 43 PID 2060 wrote to memory of 1376 2060 hhbhtb.exe 43 PID 1376 wrote to memory of 484 1376 7jjvp.exe 44 PID 1376 wrote to memory of 484 1376 7jjvp.exe 44 PID 1376 wrote to memory of 484 1376 7jjvp.exe 44 PID 1376 wrote to memory of 484 1376 7jjvp.exe 44 PID 484 wrote to memory of 1480 484 xrfxflr.exe 45 PID 484 wrote to memory of 1480 484 xrfxflr.exe 45 PID 484 wrote to memory of 1480 484 xrfxflr.exe 45 PID 484 wrote to memory of 1480 484 xrfxflr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe"C:\Users\Admin\AppData\Local\Temp\1e8bee5220906b2ff8c01eeaa81e03eac5d9e8facf3476cce8ef96a0c3ddb110N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jpppv.exec:\jpppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rrlrlfl.exec:\rrlrlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\1dvdd.exec:\1dvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1ttthb.exec:\1ttthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pjvvd.exec:\pjvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\lffxlxf.exec:\lffxlxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\1dvdp.exec:\1dvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\tnhhtb.exec:\tnhhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\pvvjv.exec:\pvvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\3rlffrx.exec:\3rlffrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\tbhhhh.exec:\tbhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\7lxfflr.exec:\7lxfflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\hhbhtb.exec:\hhbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\7jjvp.exec:\7jjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\xrfxflr.exec:\xrfxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\5ddjp.exec:\5ddjp.exe17⤵
- Executes dropped EXE
PID:1480 -
\??\c:\dddjj.exec:\dddjj.exe18⤵
- Executes dropped EXE
PID:896 -
\??\c:\hbbhhh.exec:\hbbhhh.exe19⤵
- Executes dropped EXE
PID:604 -
\??\c:\jjdpd.exec:\jjdpd.exe20⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hbnbhb.exec:\hbnbhb.exe21⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vdpdv.exec:\vdpdv.exe22⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nhbhbb.exec:\nhbhbb.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvvdv.exec:\vvvdv.exe24⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bbhnth.exec:\bbhnth.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jddjv.exec:\jddjv.exe26⤵
- Executes dropped EXE
PID:952 -
\??\c:\xxrrflx.exec:\xxrrflx.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hhhthn.exec:\hhhthn.exe28⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnttbh.exec:\tnttbh.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrfrflr.exec:\xrfrflr.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tthtbh.exec:\tthtbh.exe32⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1pvjv.exec:\1pvjv.exe33⤵
- Executes dropped EXE
PID:1008 -
\??\c:\5xlrfrf.exec:\5xlrfrf.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\tnbtnn.exec:\tnbtnn.exe35⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1vjvv.exec:\1vjvv.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rrlrxll.exec:\rrlrxll.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5lrflrf.exec:\5lrflrf.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ttntbb.exec:\ttntbb.exe39⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7jjvp.exec:\7jjvp.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3xrflrr.exec:\3xrflrr.exe41⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xxxrrfx.exec:\xxxrrfx.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjjjp.exec:\pjjjp.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ddvjv.exec:\ddvjv.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrfflll.exec:\xrfflll.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\btthth.exec:\btthth.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jvppp.exec:\jvppp.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\1lffflr.exec:\1lffflr.exe48⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxflxxl.exec:\fxflxxl.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tbntnn.exec:\tbntnn.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vpdpj.exec:\vpdpj.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdvvp.exec:\jdvvp.exe52⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe53⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1bbhnn.exec:\1bbhnn.exe54⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dvvdv.exec:\dvvdv.exe55⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xrflrxf.exec:\xrflrxf.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\rfflrlr.exec:\rfflrlr.exe57⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bbntbh.exec:\bbntbh.exe58⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dvdjp.exec:\dvdjp.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\dpddd.exec:\dpddd.exe60⤵
- Executes dropped EXE
PID:1028 -
\??\c:\5lrlffl.exec:\5lrlffl.exe61⤵
- Executes dropped EXE
PID:604 -
\??\c:\hbtbhb.exec:\hbtbhb.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjpjd.exec:\pjpjd.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pjppv.exec:\pjppv.exe64⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rflflff.exec:\rflflff.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\nbhhnt.exec:\nbhhnt.exe66⤵PID:2116
-
\??\c:\pjdpv.exec:\pjdpv.exe67⤵PID:1968
-
\??\c:\ppjvj.exec:\ppjvj.exe68⤵PID:1348
-
\??\c:\fxllrfr.exec:\fxllrfr.exe69⤵PID:1604
-
\??\c:\bbnnbb.exec:\bbnnbb.exe70⤵PID:1780
-
\??\c:\pdjdd.exec:\pdjdd.exe71⤵PID:1536
-
\??\c:\lffrrxf.exec:\lffrrxf.exe72⤵PID:2040
-
\??\c:\rxxfrll.exec:\rxxfrll.exe73⤵PID:2300
-
\??\c:\nnnnhb.exec:\nnnnhb.exe74⤵PID:1656
-
\??\c:\ppjjv.exec:\ppjjv.exe75⤵PID:2252
-
\??\c:\frxxffx.exec:\frxxffx.exe76⤵PID:2348
-
\??\c:\7nnhnn.exec:\7nnhnn.exe77⤵PID:1948
-
\??\c:\jdjdp.exec:\jdjdp.exe78⤵PID:1748
-
\??\c:\ddpdp.exec:\ddpdp.exe79⤵PID:2412
-
\??\c:\frlflfl.exec:\frlflfl.exe80⤵PID:2372
-
\??\c:\nntttt.exec:\nntttt.exe81⤵PID:2928
-
\??\c:\vpdjp.exec:\vpdjp.exe82⤵PID:1000
-
\??\c:\dvddd.exec:\dvddd.exe83⤵PID:1584
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe84⤵PID:2832
-
\??\c:\btbhtt.exec:\btbhtt.exe85⤵PID:2920
-
\??\c:\vjvvd.exec:\vjvvd.exe86⤵PID:2756
-
\??\c:\9vjjv.exec:\9vjjv.exe87⤵PID:2884
-
\??\c:\xlfrxlr.exec:\xlfrxlr.exe88⤵PID:1312
-
\??\c:\frflrfx.exec:\frflrfx.exe89⤵PID:2580
-
\??\c:\tnhnbt.exec:\tnhnbt.exe90⤵PID:2616
-
\??\c:\vjjpd.exec:\vjjpd.exe91⤵PID:2624
-
\??\c:\fxrfllr.exec:\fxrfllr.exe92⤵PID:2724
-
\??\c:\9xrxrxl.exec:\9xrxrxl.exe93⤵PID:3052
-
\??\c:\tbbtbh.exec:\tbbtbh.exe94⤵PID:1096
-
\??\c:\1bbhnn.exec:\1bbhnn.exe95⤵PID:2220
-
\??\c:\jddvp.exec:\jddvp.exe96⤵PID:2732
-
\??\c:\flxxxrf.exec:\flxxxrf.exe97⤵PID:236
-
\??\c:\xlrxxff.exec:\xlrxxff.exe98⤵PID:1664
-
\??\c:\tnhhhh.exec:\tnhhhh.exe99⤵PID:1724
-
\??\c:\jdpdd.exec:\jdpdd.exe100⤵PID:1376
-
\??\c:\jvpvv.exec:\jvpvv.exe101⤵PID:2868
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe102⤵PID:2076
-
\??\c:\nhtbbh.exec:\nhtbbh.exe103⤵PID:2652
-
\??\c:\1jdvj.exec:\1jdvj.exe104⤵PID:1480
-
\??\c:\jjdpv.exec:\jjdpv.exe105⤵PID:2848
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe106⤵PID:2280
-
\??\c:\hbtnbh.exec:\hbtnbh.exe107⤵PID:3064
-
\??\c:\tnnhnn.exec:\tnnhnn.exe108⤵PID:2272
-
\??\c:\vpjjd.exec:\vpjjd.exe109⤵PID:2084
-
\??\c:\jvpvj.exec:\jvpvj.exe110⤵PID:2320
-
\??\c:\xrrfllx.exec:\xrrfllx.exe111⤵PID:2444
-
\??\c:\5htntn.exec:\5htntn.exe112⤵PID:2472
-
\??\c:\tnhntt.exec:\tnhntt.exe113⤵PID:1952
-
\??\c:\ppjdv.exec:\ppjdv.exe114⤵PID:1372
-
\??\c:\dvppj.exec:\dvppj.exe115⤵PID:1716
-
\??\c:\fxxfxxr.exec:\fxxfxxr.exe116⤵PID:952
-
\??\c:\7hhtnn.exec:\7hhtnn.exe117⤵PID:856
-
\??\c:\thbhtn.exec:\thbhtn.exe118⤵PID:1440
-
\??\c:\pdpvv.exec:\pdpvv.exe119⤵PID:2960
-
\??\c:\pjjjj.exec:\pjjjj.exe120⤵PID:2300
-
\??\c:\fxxfflx.exec:\fxxfflx.exe121⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-