Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:23
Behavioral task
behavioral1
Sample
64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe
-
Size
345KB
-
MD5
27717abaeb775b0f85cfddc392ce9ef1
-
SHA1
09485133b2e01b1d16648af9c465953970a5e4e6
-
SHA256
64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe
-
SHA512
6fb0b513f3d66c8c0b1e2c8622b241dc48cf8965c0a9109deb10384f034da4dedd5e46d56ad27a01a228ad188b99f150d24fdde22786aefe2a9bae6660bc4457
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA2:R4wFHoS3WXZshJX2VGd2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2704-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-68-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1224-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-113-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/468-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1256-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-175-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2992-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-281-0x0000000076DD0000-0x0000000076ECA000-memory.dmp family_blackmoon behavioral1/memory/2492-280-0x0000000076ED0000-0x0000000076FEF000-memory.dmp family_blackmoon behavioral1/memory/2104-245-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-156-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1224-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-386-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1888-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/704-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-570-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2412-698-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-730-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-2577-0x0000000076ED0000-0x0000000076FEF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2820 lxflfff.exe 2712 7flrrrr.exe 2180 hthhhh.exe 2936 hbnhnh.exe 2700 nhbbnt.exe 2568 9lxrxxx.exe 2684 xrlxrxr.exe 1224 hbtttn.exe 2940 vpdjv.exe 1520 xrfxxlr.exe 2172 9tnbhh.exe 2880 jjvdd.exe 2624 1frllfl.exe 468 3thhnt.exe 1256 pjppd.exe 2760 7lrrfxf.exe 1308 ttntbb.exe 2544 jvjjp.exe 2992 9lflrxl.exe 2408 3nnthn.exe 2108 hbtbhn.exe 448 dvdpv.exe 1348 3rffrrf.exe 948 tnthnt.exe 1796 5dpjp.exe 2000 dvvvd.exe 3020 btbbhb.exe 2104 pjdvd.exe 1928 dvjpv.exe 1948 3xxlxlr.exe 1004 3nbtbh.exe 2644 9jvdd.exe 2184 rlrxffl.exe 2492 tntbhh.exe 2976 fxffffr.exe 1352 rlrrxlx.exe 2688 thbbbb.exe 2860 9vdvv.exe 2844 rfrxflr.exe 2908 hbttbt.exe 2588 bnbbhh.exe 2620 pjvvj.exe 2568 5lflxxf.exe 588 9rfxrlr.exe 1224 1hbntt.exe 3056 3jjdj.exe 2376 fxrxrfr.exe 1604 7bhbnn.exe 2028 dvpvj.exe 1964 llrxrff.exe 2632 fflfxxx.exe 2912 btnhtt.exe 1888 vvpvj.exe 2132 9jpjj.exe 2768 frlrxxf.exe 2364 3nhtbh.exe 2760 5pdpd.exe 1524 5xllrfl.exe 1844 rlxflrx.exe 2144 nhntbn.exe 2992 jdddp.exe 2408 dddjj.exe 1860 pdjpv.exe 2016 9lrlrrx.exe -
resource yara_rule behavioral1/memory/2704-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-5.dat upx behavioral1/files/0x000c0000000186c8-17.dat upx behavioral1/memory/2712-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000190c6-24.dat upx behavioral1/memory/2712-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000190c9-34.dat upx behavioral1/files/0x00070000000191f3-42.dat upx behavioral1/memory/2936-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019217-50.dat upx behavioral1/memory/2684-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019220-62.dat upx behavioral1/files/0x0006000000019238-69.dat upx behavioral1/memory/2940-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1224-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001925d-80.dat upx behavioral1/memory/2940-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194bd-89.dat upx behavioral1/files/0x0005000000019fb9-98.dat upx behavioral1/memory/1520-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a067-107.dat upx behavioral1/memory/2172-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a07b-115.dat upx behavioral1/memory/2624-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0a1-122.dat upx behavioral1/files/0x000500000001a301-133.dat upx behavioral1/memory/468-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1256-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a345-141.dat upx behavioral1/files/0x000500000001a42b-148.dat upx behavioral1/memory/2760-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42f-167.dat upx behavioral1/files/0x000500000001a431-173.dat upx behavioral1/memory/2992-175-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x000500000001a434-184.dat upx behavioral1/memory/2992-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42d-159.dat upx behavioral1/memory/1308-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46a-190.dat upx behavioral1/files/0x000500000001a48c-199.dat upx behavioral1/files/0x000500000001a48e-206.dat upx behavioral1/files/0x0039000000018662-213.dat upx behavioral1/files/0x000500000001a49a-221.dat upx behavioral1/files/0x000500000001a49c-230.dat upx behavioral1/memory/2000-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4aa-239.dat upx behavioral1/files/0x000500000001a4b5-248.dat upx behavioral1/files/0x000500000001a4b7-255.dat upx behavioral1/memory/1928-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bb-261.dat upx behavioral1/files/0x000500000001a4c0-268.dat upx behavioral1/memory/2492-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-280-0x0000000076ED0000-0x0000000076FEF000-memory.dmp upx behavioral1/memory/2568-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/448-197-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1224-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1888-388-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9httbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2820 2704 64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe 30 PID 2704 wrote to memory of 2820 2704 64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe 30 PID 2704 wrote to memory of 2820 2704 64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe 30 PID 2704 wrote to memory of 2820 2704 64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe 30 PID 2820 wrote to memory of 2712 2820 lxflfff.exe 31 PID 2820 wrote to memory of 2712 2820 lxflfff.exe 31 PID 2820 wrote to memory of 2712 2820 lxflfff.exe 31 PID 2820 wrote to memory of 2712 2820 lxflfff.exe 31 PID 2712 wrote to memory of 2180 2712 7flrrrr.exe 32 PID 2712 wrote to memory of 2180 2712 7flrrrr.exe 32 PID 2712 wrote to memory of 2180 2712 7flrrrr.exe 32 PID 2712 wrote to memory of 2180 2712 7flrrrr.exe 32 PID 2180 wrote to memory of 2936 2180 hthhhh.exe 33 PID 2180 wrote to memory of 2936 2180 hthhhh.exe 33 PID 2180 wrote to memory of 2936 2180 hthhhh.exe 33 PID 2180 wrote to memory of 2936 2180 hthhhh.exe 33 PID 2936 wrote to memory of 2700 2936 hbnhnh.exe 34 PID 2936 wrote to memory of 2700 2936 hbnhnh.exe 34 PID 2936 wrote to memory of 2700 2936 hbnhnh.exe 34 PID 2936 wrote to memory of 2700 2936 hbnhnh.exe 34 PID 2700 wrote to memory of 2568 2700 nhbbnt.exe 73 PID 2700 wrote to memory of 2568 2700 nhbbnt.exe 73 PID 2700 wrote to memory of 2568 2700 nhbbnt.exe 73 PID 2700 wrote to memory of 2568 2700 nhbbnt.exe 73 PID 2568 wrote to memory of 2684 2568 9lxrxxx.exe 36 PID 2568 wrote to memory of 2684 2568 9lxrxxx.exe 36 PID 2568 wrote to memory of 2684 2568 9lxrxxx.exe 36 PID 2568 wrote to memory of 2684 2568 9lxrxxx.exe 36 PID 2684 wrote to memory of 1224 2684 xrlxrxr.exe 75 PID 2684 wrote to memory of 1224 2684 xrlxrxr.exe 75 PID 2684 wrote to memory of 1224 2684 xrlxrxr.exe 75 PID 2684 wrote to memory of 1224 2684 xrlxrxr.exe 75 PID 1224 wrote to memory of 2940 1224 hbtttn.exe 38 PID 1224 wrote to memory of 2940 1224 hbtttn.exe 38 PID 1224 wrote to memory of 2940 1224 hbtttn.exe 38 PID 1224 wrote to memory of 2940 1224 hbtttn.exe 38 PID 2940 wrote to memory of 1520 2940 vpdjv.exe 39 PID 2940 wrote to memory of 1520 2940 vpdjv.exe 39 PID 2940 wrote to memory of 1520 2940 vpdjv.exe 39 PID 2940 wrote to memory of 1520 2940 vpdjv.exe 39 PID 1520 wrote to memory of 2172 1520 xrfxxlr.exe 40 PID 1520 wrote to memory of 2172 1520 xrfxxlr.exe 40 PID 1520 wrote to memory of 2172 1520 xrfxxlr.exe 40 PID 1520 wrote to memory of 2172 1520 xrfxxlr.exe 40 PID 2172 wrote to memory of 2880 2172 9tnbhh.exe 41 PID 2172 wrote to memory of 2880 2172 9tnbhh.exe 41 PID 2172 wrote to memory of 2880 2172 9tnbhh.exe 41 PID 2172 wrote to memory of 2880 2172 9tnbhh.exe 41 PID 2880 wrote to memory of 2624 2880 jjvdd.exe 42 PID 2880 wrote to memory of 2624 2880 jjvdd.exe 42 PID 2880 wrote to memory of 2624 2880 jjvdd.exe 42 PID 2880 wrote to memory of 2624 2880 jjvdd.exe 42 PID 2624 wrote to memory of 468 2624 1frllfl.exe 43 PID 2624 wrote to memory of 468 2624 1frllfl.exe 43 PID 2624 wrote to memory of 468 2624 1frllfl.exe 43 PID 2624 wrote to memory of 468 2624 1frllfl.exe 43 PID 468 wrote to memory of 1256 468 3thhnt.exe 44 PID 468 wrote to memory of 1256 468 3thhnt.exe 44 PID 468 wrote to memory of 1256 468 3thhnt.exe 44 PID 468 wrote to memory of 1256 468 3thhnt.exe 44 PID 1256 wrote to memory of 2760 1256 pjppd.exe 45 PID 1256 wrote to memory of 2760 1256 pjppd.exe 45 PID 1256 wrote to memory of 2760 1256 pjppd.exe 45 PID 1256 wrote to memory of 2760 1256 pjppd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe"C:\Users\Admin\AppData\Local\Temp\64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lxflfff.exec:\lxflfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7flrrrr.exec:\7flrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hthhhh.exec:\hthhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\hbnhnh.exec:\hbnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\nhbbnt.exec:\nhbbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\9lxrxxx.exec:\9lxrxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hbtttn.exec:\hbtttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\vpdjv.exec:\vpdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xrfxxlr.exec:\xrfxxlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\9tnbhh.exec:\9tnbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jjvdd.exec:\jjvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\1frllfl.exec:\1frllfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3thhnt.exec:\3thhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\pjppd.exec:\pjppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\7lrrfxf.exec:\7lrrfxf.exe17⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ttntbb.exec:\ttntbb.exe18⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jvjjp.exec:\jvjjp.exe19⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9lflrxl.exec:\9lflrxl.exe20⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3nnthn.exec:\3nnthn.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hbtbhn.exec:\hbtbhn.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvdpv.exec:\dvdpv.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\3rffrrf.exec:\3rffrrf.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tnthnt.exec:\tnthnt.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\5dpjp.exec:\5dpjp.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dvvvd.exec:\dvvvd.exe27⤵
- Executes dropped EXE
PID:2000 -
\??\c:\btbbhb.exec:\btbbhb.exe28⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pjdvd.exec:\pjdvd.exe29⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dvjpv.exec:\dvjpv.exe30⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3xxlxlr.exec:\3xxlxlr.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3nbtbh.exec:\3nbtbh.exe32⤵
- Executes dropped EXE
PID:1004 -
\??\c:\9jvdd.exec:\9jvdd.exe33⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rlrxffl.exec:\rlrxffl.exe34⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tntbhh.exec:\tntbhh.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jvdjv.exec:\jvdjv.exe36⤵PID:2836
-
\??\c:\fxffffr.exec:\fxffffr.exe37⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rlrrxlx.exec:\rlrrxlx.exe38⤵
- Executes dropped EXE
PID:1352 -
\??\c:\thbbbb.exec:\thbbbb.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9vdvv.exec:\9vdvv.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rfrxflr.exec:\rfrxflr.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hbttbt.exec:\hbttbt.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bnbbhh.exec:\bnbbhh.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pjvvj.exec:\pjvvj.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\5lflxxf.exec:\5lflxxf.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9rfxrlr.exec:\9rfxrlr.exe46⤵
- Executes dropped EXE
PID:588 -
\??\c:\1hbntt.exec:\1hbntt.exe47⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3jjdj.exec:\3jjdj.exe48⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fxrxrfr.exec:\fxrxrfr.exe49⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7bhbnn.exec:\7bhbnn.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dvpvj.exec:\dvpvj.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\llrxrff.exec:\llrxrff.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fflfxxx.exec:\fflfxxx.exe53⤵
- Executes dropped EXE
PID:2632 -
\??\c:\btnhtt.exec:\btnhtt.exe54⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vvpvj.exec:\vvpvj.exe55⤵
- Executes dropped EXE
PID:1888 -
\??\c:\9jpjj.exec:\9jpjj.exe56⤵
- Executes dropped EXE
PID:2132 -
\??\c:\frlrxxf.exec:\frlrxxf.exe57⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3nhtbh.exec:\3nhtbh.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\5pdpd.exec:\5pdpd.exe59⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5xllrfl.exec:\5xllrfl.exe60⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rlxflrx.exec:\rlxflrx.exe61⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nhntbn.exec:\nhntbn.exe62⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jdddp.exec:\jdddp.exe63⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dddjj.exec:\dddjj.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pdjpv.exec:\pdjpv.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9lrlrrx.exec:\9lrlrrx.exe66⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bnbhnn.exec:\bnbhnn.exe67⤵PID:2340
-
\??\c:\nbnbhh.exec:\nbnbhh.exe68⤵PID:1500
-
\??\c:\jdjdd.exec:\jdjdd.exe69⤵PID:948
-
\??\c:\xrfxfll.exec:\xrfxfll.exe70⤵PID:2212
-
\??\c:\xxrfflf.exec:\xxrfflf.exe71⤵PID:1796
-
\??\c:\bbtbhn.exec:\bbtbhn.exe72⤵PID:2040
-
\??\c:\vppdd.exec:\vppdd.exe73⤵PID:704
-
\??\c:\vvjpv.exec:\vvjpv.exe74⤵PID:2352
-
\??\c:\lflfrxl.exec:\lflfrxl.exe75⤵PID:1516
-
\??\c:\btbbth.exec:\btbbth.exe76⤵
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\vvjvd.exec:\vvjvd.exe77⤵PID:1948
-
\??\c:\dvjpv.exec:\dvjpv.exe78⤵PID:884
-
\??\c:\1rxrrxx.exec:\1rxrrxx.exe79⤵PID:1680
-
\??\c:\9llflrl.exec:\9llflrl.exe80⤵PID:2324
-
\??\c:\bnhhbb.exec:\bnhhbb.exe81⤵PID:2812
-
\??\c:\ppvdp.exec:\ppvdp.exe82⤵PID:2708
-
\??\c:\5fxxlfl.exec:\5fxxlfl.exe83⤵PID:2720
-
\??\c:\lfxflrf.exec:\lfxflrf.exe84⤵PID:1584
-
\??\c:\hbthnt.exec:\hbthnt.exe85⤵PID:1352
-
\??\c:\jdjjp.exec:\jdjjp.exe86⤵PID:2724
-
\??\c:\1dppd.exec:\1dppd.exe87⤵PID:2852
-
\??\c:\rxrflrf.exec:\rxrflrf.exe88⤵PID:2592
-
\??\c:\btbhnt.exec:\btbhnt.exe89⤵PID:2700
-
\??\c:\nnbhtt.exec:\nnbhtt.exe90⤵PID:2588
-
\??\c:\jdppv.exec:\jdppv.exe91⤵PID:2620
-
\??\c:\djvjv.exec:\djvjv.exe92⤵PID:2568
-
\??\c:\ffrxfff.exec:\ffrxfff.exe93⤵PID:1944
-
\??\c:\bhbtnh.exec:\bhbtnh.exe94⤵PID:3032
-
\??\c:\jddjp.exec:\jddjp.exe95⤵PID:2940
-
\??\c:\vjddd.exec:\vjddd.exe96⤵PID:2660
-
\??\c:\5rrlxxl.exec:\5rrlxxl.exe97⤵PID:1248
-
\??\c:\lrlffrx.exec:\lrlffrx.exe98⤵PID:2028
-
\??\c:\hbtnnt.exec:\hbtnnt.exe99⤵PID:2024
-
\??\c:\pjjjv.exec:\pjjjv.exe100⤵PID:2784
-
\??\c:\dvpdp.exec:\dvpdp.exe101⤵PID:2140
-
\??\c:\lxlfflr.exec:\lxlfflr.exe102⤵PID:468
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe103⤵PID:1412
-
\??\c:\nhhthh.exec:\nhhthh.exe104⤵PID:2768
-
\??\c:\ppdpd.exec:\ppdpd.exe105⤵PID:348
-
\??\c:\jjvpv.exec:\jjvpv.exe106⤵PID:2760
-
\??\c:\1flrxxr.exec:\1flrxxr.exe107⤵PID:792
-
\??\c:\1lfxxxl.exec:\1lfxxxl.exe108⤵PID:2512
-
\??\c:\tntbhh.exec:\tntbhh.exe109⤵PID:2412
-
\??\c:\pjvvd.exec:\pjvvd.exe110⤵PID:2992
-
\??\c:\fffxxlf.exec:\fffxxlf.exe111⤵PID:408
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe112⤵PID:1092
-
\??\c:\1htbbh.exec:\1htbbh.exe113⤵PID:1176
-
\??\c:\9jdjp.exec:\9jdjp.exe114⤵PID:828
-
\??\c:\xrllrfl.exec:\xrllrfl.exe115⤵PID:944
-
\??\c:\lllxxfr.exec:\lllxxfr.exe116⤵PID:1500
-
\??\c:\tnbntb.exec:\tnbntb.exe117⤵
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\jdjdd.exec:\jdjdd.exe118⤵PID:1868
-
\??\c:\dpddp.exec:\dpddp.exe119⤵PID:2316
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe120⤵PID:1628
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe121⤵PID:704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-