Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:33
Behavioral task
behavioral1
Sample
c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe
-
Size
333KB
-
MD5
9c537586841bf88dac510c1ef69ddbe0
-
SHA1
8da4919eeeebb6139d3593b8637c10abefefd86a
-
SHA256
c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9af
-
SHA512
46eeaec80011dcf6a4b0c3bb369e1f70266875b61272562e2b785480af7d39f4d8b512996d5bed444d54e25d7f462d2ad16145bd9a04ac8fb6f96058390ee2d3
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTZ:R4wFHoSHYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2264-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-133-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1840-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-181-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/344-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-287-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2488-284-0x00000000774E0000-0x00000000775FF000-memory.dmp family_blackmoon behavioral1/memory/2704-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-446-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2380-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-535-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2700-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-683-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2384-748-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-818-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-6476-0x0000000077600000-0x00000000776FA000-memory.dmp family_blackmoon behavioral1/memory/2488-8529-0x00000000774E0000-0x00000000775FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2416 5nnhnn.exe 2816 fxlrxxl.exe 2800 ttnhtn.exe 2844 5vddd.exe 2688 rlxrflf.exe 2548 7dvvv.exe 1740 5bthnh.exe 1932 jpdpd.exe 552 lfxfflf.exe 2932 nnnbbn.exe 3048 lffxrfx.exe 1864 tntnnn.exe 2448 9ppdv.exe 1720 7lfrlrf.exe 1920 llfrffx.exe 2848 vpjjj.exe 320 3lrrrlf.exe 1840 ppjvv.exe 2900 jdpvj.exe 2404 1nnhbt.exe 1960 jdppv.exe 344 tnnntn.exe 1268 jjppv.exe 340 xlffxxf.exe 1660 ntbnnt.exe 3012 pppjv.exe 1464 3rrfrfl.exe 848 7ntnnb.exe 2176 5jjdv.exe 2492 3llfxlx.exe 1916 btbtnb.exe 2056 3htttb.exe 1956 flfrfxx.exe 888 5htbhh.exe 2020 ppjpv.exe 2488 3llrrfr.exe 2752 lxxxfll.exe 2704 ffxlxlx.exe 2784 tnbnbn.exe 2804 pdvjd.exe 2684 jjdjp.exe 1136 5frxflr.exe 2608 ttnthb.exe 2584 pjvjp.exe 2548 9pvdp.exe 2368 ffxrxlr.exe 1584 bbtnbn.exe 2908 3vpvj.exe 2912 dvvpd.exe 2952 rrrfrfr.exe 792 tnthbh.exe 3048 ddppv.exe 1248 jjvdj.exe 928 rlrrxxf.exe 2612 btnhnn.exe 1400 5bhnhn.exe 2252 1vpdv.exe 1876 7fflffl.exe 1892 nnbbhn.exe 1228 jjjjj.exe 536 rlxxlxl.exe 1856 rllfrrl.exe 1848 hthntb.exe 2152 jpjjj.exe -
resource yara_rule behavioral1/memory/2264-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012116-5.dat upx behavioral1/memory/2264-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017403-16.dat upx behavioral1/memory/2816-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017409-26.dat upx behavioral1/files/0x000800000001748f-34.dat upx behavioral1/files/0x000700000001752f-43.dat upx behavioral1/memory/2844-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-42-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x001600000001866d-53.dat upx behavioral1/memory/2688-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000018678-59.dat upx behavioral1/memory/1932-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018690-66.dat upx behavioral1/files/0x000700000001879b-75.dat upx behavioral1/memory/1932-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/552-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000193c4-83.dat upx behavioral1/memory/552-82-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2932-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cc-93.dat upx behavioral1/memory/2932-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d9-100.dat upx behavioral1/files/0x00050000000193df-107.dat upx behavioral1/memory/1864-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019401-116.dat upx behavioral1/memory/1720-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019403-126.dat upx behavioral1/memory/1720-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001942f-134.dat upx behavioral1/memory/2848-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019441-142.dat upx behavioral1/files/0x000500000001947e-151.dat upx behavioral1/files/0x00050000000194d8-158.dat upx behavioral1/memory/1840-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002d0000000173aa-165.dat upx behavioral1/memory/2404-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019539-173.dat upx behavioral1/files/0x00050000000195e4-179.dat upx behavioral1/files/0x000500000001961b-189.dat upx behavioral1/memory/344-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-197.dat upx behavioral1/memory/1268-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961f-205.dat upx behavioral1/memory/340-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019620-212.dat upx behavioral1/files/0x0005000000019621-219.dat upx behavioral1/files/0x0005000000019623-226.dat upx behavioral1/files/0x0005000000019625-233.dat upx behavioral1/files/0x0005000000019629-250.dat upx behavioral1/memory/1916-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019627-244.dat upx behavioral1/memory/2176-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019639-258.dat upx behavioral1/memory/888-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-316-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2416 2264 c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe 30 PID 2264 wrote to memory of 2416 2264 c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe 30 PID 2264 wrote to memory of 2416 2264 c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe 30 PID 2264 wrote to memory of 2416 2264 c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe 30 PID 2416 wrote to memory of 2816 2416 5nnhnn.exe 31 PID 2416 wrote to memory of 2816 2416 5nnhnn.exe 31 PID 2416 wrote to memory of 2816 2416 5nnhnn.exe 31 PID 2416 wrote to memory of 2816 2416 5nnhnn.exe 31 PID 2816 wrote to memory of 2800 2816 fxlrxxl.exe 32 PID 2816 wrote to memory of 2800 2816 fxlrxxl.exe 32 PID 2816 wrote to memory of 2800 2816 fxlrxxl.exe 32 PID 2816 wrote to memory of 2800 2816 fxlrxxl.exe 32 PID 2800 wrote to memory of 2844 2800 ttnhtn.exe 33 PID 2800 wrote to memory of 2844 2800 ttnhtn.exe 33 PID 2800 wrote to memory of 2844 2800 ttnhtn.exe 33 PID 2800 wrote to memory of 2844 2800 ttnhtn.exe 33 PID 2844 wrote to memory of 2688 2844 5vddd.exe 34 PID 2844 wrote to memory of 2688 2844 5vddd.exe 34 PID 2844 wrote to memory of 2688 2844 5vddd.exe 34 PID 2844 wrote to memory of 2688 2844 5vddd.exe 34 PID 2688 wrote to memory of 2548 2688 rlxrflf.exe 35 PID 2688 wrote to memory of 2548 2688 rlxrflf.exe 35 PID 2688 wrote to memory of 2548 2688 rlxrflf.exe 35 PID 2688 wrote to memory of 2548 2688 rlxrflf.exe 35 PID 2548 wrote to memory of 1740 2548 7dvvv.exe 36 PID 2548 wrote to memory of 1740 2548 7dvvv.exe 36 PID 2548 wrote to memory of 1740 2548 7dvvv.exe 36 PID 2548 wrote to memory of 1740 2548 7dvvv.exe 36 PID 1740 wrote to memory of 1932 1740 5bthnh.exe 37 PID 1740 wrote to memory of 1932 1740 5bthnh.exe 37 PID 1740 wrote to memory of 1932 1740 5bthnh.exe 37 PID 1740 wrote to memory of 1932 1740 5bthnh.exe 37 PID 1932 wrote to memory of 552 1932 jpdpd.exe 38 PID 1932 wrote to memory of 552 1932 jpdpd.exe 38 PID 1932 wrote to memory of 552 1932 jpdpd.exe 38 PID 1932 wrote to memory of 552 1932 jpdpd.exe 38 PID 552 wrote to memory of 2932 552 lfxfflf.exe 39 PID 552 wrote to memory of 2932 552 lfxfflf.exe 39 PID 552 wrote to memory of 2932 552 lfxfflf.exe 39 PID 552 wrote to memory of 2932 552 lfxfflf.exe 39 PID 2932 wrote to memory of 3048 2932 nnnbbn.exe 40 PID 2932 wrote to memory of 3048 2932 nnnbbn.exe 40 PID 2932 wrote to memory of 3048 2932 nnnbbn.exe 40 PID 2932 wrote to memory of 3048 2932 nnnbbn.exe 40 PID 3048 wrote to memory of 1864 3048 lffxrfx.exe 41 PID 3048 wrote to memory of 1864 3048 lffxrfx.exe 41 PID 3048 wrote to memory of 1864 3048 lffxrfx.exe 41 PID 3048 wrote to memory of 1864 3048 lffxrfx.exe 41 PID 1864 wrote to memory of 2448 1864 tntnnn.exe 42 PID 1864 wrote to memory of 2448 1864 tntnnn.exe 42 PID 1864 wrote to memory of 2448 1864 tntnnn.exe 42 PID 1864 wrote to memory of 2448 1864 tntnnn.exe 42 PID 2448 wrote to memory of 1720 2448 9ppdv.exe 43 PID 2448 wrote to memory of 1720 2448 9ppdv.exe 43 PID 2448 wrote to memory of 1720 2448 9ppdv.exe 43 PID 2448 wrote to memory of 1720 2448 9ppdv.exe 43 PID 1720 wrote to memory of 1920 1720 7lfrlrf.exe 44 PID 1720 wrote to memory of 1920 1720 7lfrlrf.exe 44 PID 1720 wrote to memory of 1920 1720 7lfrlrf.exe 44 PID 1720 wrote to memory of 1920 1720 7lfrlrf.exe 44 PID 1920 wrote to memory of 2848 1920 llfrffx.exe 45 PID 1920 wrote to memory of 2848 1920 llfrffx.exe 45 PID 1920 wrote to memory of 2848 1920 llfrffx.exe 45 PID 1920 wrote to memory of 2848 1920 llfrffx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe"C:\Users\Admin\AppData\Local\Temp\c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\5nnhnn.exec:\5nnhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ttnhtn.exec:\ttnhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\5vddd.exec:\5vddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\rlxrflf.exec:\rlxrflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7dvvv.exec:\7dvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5bthnh.exec:\5bthnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jpdpd.exec:\jpdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\lfxfflf.exec:\lfxfflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\nnnbbn.exec:\nnnbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lffxrfx.exec:\lffxrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\tntnnn.exec:\tntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\9ppdv.exec:\9ppdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\7lfrlrf.exec:\7lfrlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\llfrffx.exec:\llfrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\vpjjj.exec:\vpjjj.exe17⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3lrrrlf.exec:\3lrrrlf.exe18⤵
- Executes dropped EXE
PID:320 -
\??\c:\ppjvv.exec:\ppjvv.exe19⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jdpvj.exec:\jdpvj.exe20⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1nnhbt.exec:\1nnhbt.exe21⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdppv.exec:\jdppv.exe22⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tnnntn.exec:\tnnntn.exe23⤵
- Executes dropped EXE
PID:344 -
\??\c:\jjppv.exec:\jjppv.exe24⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xlffxxf.exec:\xlffxxf.exe25⤵
- Executes dropped EXE
PID:340 -
\??\c:\ntbnnt.exec:\ntbnnt.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pppjv.exec:\pppjv.exe27⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3rrfrfl.exec:\3rrfrfl.exe28⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7ntnnb.exec:\7ntnnb.exe29⤵
- Executes dropped EXE
PID:848 -
\??\c:\5jjdv.exec:\5jjdv.exe30⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3llfxlx.exec:\3llfxlx.exe31⤵
- Executes dropped EXE
PID:2492 -
\??\c:\btbtnb.exec:\btbtnb.exe32⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3htttb.exec:\3htttb.exe33⤵
- Executes dropped EXE
PID:2056 -
\??\c:\flfrfxx.exec:\flfrfxx.exe34⤵
- Executes dropped EXE
PID:1956 -
\??\c:\5htbhh.exec:\5htbhh.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\ppjpv.exec:\ppjpv.exe36⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3llrrfr.exec:\3llrrfr.exe37⤵
- Executes dropped EXE
PID:2488 -
\??\c:\frlrxfl.exec:\frlrxfl.exe38⤵PID:1512
-
\??\c:\lxxxfll.exec:\lxxxfll.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ffxlxlx.exec:\ffxlxlx.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\tnbnbn.exec:\tnbnbn.exe41⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdvjd.exec:\pdvjd.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jjdjp.exec:\jjdjp.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5frxflr.exec:\5frxflr.exe44⤵
- Executes dropped EXE
PID:1136 -
\??\c:\ttnthb.exec:\ttnthb.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjvjp.exec:\pjvjp.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9pvdp.exec:\9pvdp.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ffxrxlr.exec:\ffxrxlr.exe48⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bbtnbn.exec:\bbtnbn.exe49⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3vpvj.exec:\3vpvj.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dvvpd.exec:\dvvpd.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe52⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tnthbh.exec:\tnthbh.exe53⤵
- Executes dropped EXE
PID:792 -
\??\c:\ddppv.exec:\ddppv.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jjvdj.exec:\jjvdj.exe55⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe56⤵
- Executes dropped EXE
PID:928 -
\??\c:\btnhnn.exec:\btnhnn.exe57⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5bhnhn.exec:\5bhnhn.exe58⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1vpdv.exec:\1vpdv.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7fflffl.exec:\7fflffl.exe60⤵
- Executes dropped EXE
PID:1876 -
\??\c:\nnbbhn.exec:\nnbbhn.exe61⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jjjjj.exec:\jjjjj.exe62⤵
- Executes dropped EXE
PID:1228 -
\??\c:\rlxxlxl.exec:\rlxxlxl.exe63⤵
- Executes dropped EXE
PID:536 -
\??\c:\rllfrrl.exec:\rllfrrl.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hthntb.exec:\hthntb.exe65⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jpjjj.exec:\jpjjj.exe66⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrrxlxr.exec:\xrrxlxr.exe67⤵PID:2380
-
\??\c:\xxrxllr.exec:\xxrxllr.exe68⤵PID:1960
-
\??\c:\nhbntb.exec:\nhbntb.exe69⤵PID:2524
-
\??\c:\jjddj.exec:\jjddj.exe70⤵PID:692
-
\??\c:\xrflrrr.exec:\xrflrrr.exe71⤵PID:1964
-
\??\c:\tnbntt.exec:\tnbntt.exe72⤵PID:1696
-
\??\c:\dddjv.exec:\dddjv.exe73⤵PID:2428
-
\??\c:\lfrfllx.exec:\lfrfllx.exe74⤵PID:1700
-
\??\c:\hhhnbt.exec:\hhhnbt.exe75⤵PID:1460
-
\??\c:\jjvjv.exec:\jjvjv.exe76⤵PID:1240
-
\??\c:\dvpvp.exec:\dvpvp.exe77⤵PID:2060
-
\??\c:\xrxfxxl.exec:\xrxfxxl.exe78⤵PID:2240
-
\??\c:\9xxlxfl.exec:\9xxlxfl.exe79⤵PID:2076
-
\??\c:\5bttbt.exec:\5bttbt.exe80⤵PID:2000
-
\??\c:\vdvvv.exec:\vdvvv.exe81⤵PID:2980
-
\??\c:\xxxlrrf.exec:\xxxlrrf.exe82⤵PID:996
-
\??\c:\5fxlrxf.exec:\5fxlrxf.exe83⤵PID:2248
-
\??\c:\bbhtnt.exec:\bbhtnt.exe84⤵PID:1952
-
\??\c:\bbttbh.exec:\bbttbh.exe85⤵
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\dvdjj.exec:\dvdjj.exe86⤵PID:2700
-
\??\c:\3frrxxf.exec:\3frrxxf.exe87⤵
- System Location Discovery: System Language Discovery
PID:2764 -
\??\c:\fxffllf.exec:\fxffllf.exe88⤵PID:2984
-
\??\c:\5hntbh.exec:\5hntbh.exe89⤵PID:2820
-
\??\c:\hbtbhh.exec:\hbtbhh.exe90⤵PID:2732
-
\??\c:\3pdjj.exec:\3pdjj.exe91⤵PID:2868
-
\??\c:\rffrxxr.exec:\rffrxxr.exe92⤵PID:2112
-
\??\c:\1hnbtb.exec:\1hnbtb.exe93⤵PID:2828
-
\??\c:\btthnt.exec:\btthnt.exe94⤵PID:2688
-
\??\c:\vvdjv.exec:\vvdjv.exe95⤵PID:3052
-
\??\c:\ffrxlxl.exec:\ffrxlxl.exe96⤵PID:2036
-
\??\c:\hbbhtt.exec:\hbbhtt.exe97⤵PID:3068
-
\??\c:\7hbbnt.exec:\7hbbnt.exe98⤵PID:2860
-
\??\c:\vpjpd.exec:\vpjpd.exe99⤵PID:2916
-
\??\c:\1lxrrxl.exec:\1lxrrxl.exe100⤵PID:2912
-
\??\c:\tntnbn.exec:\tntnbn.exe101⤵PID:828
-
\??\c:\hbtttb.exec:\hbtttb.exe102⤵PID:756
-
\??\c:\9pppd.exec:\9pppd.exe103⤵PID:1316
-
\??\c:\fxrxrrf.exec:\fxrxrrf.exe104⤵PID:2448
-
\??\c:\xxxrrlr.exec:\xxxrrlr.exe105⤵PID:1576
-
\??\c:\7nnttb.exec:\7nnttb.exe106⤵PID:2324
-
\??\c:\dvddp.exec:\dvddp.exe107⤵PID:1920
-
\??\c:\ppjpv.exec:\ppjpv.exe108⤵PID:484
-
\??\c:\rrrlxfr.exec:\rrrlxfr.exe109⤵PID:1044
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe110⤵PID:2992
-
\??\c:\7hnbhn.exec:\7hnbhn.exe111⤵PID:2988
-
\??\c:\5vdpd.exec:\5vdpd.exe112⤵PID:2364
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe113⤵PID:2944
-
\??\c:\fxllxrf.exec:\fxllxrf.exe114⤵PID:2184
-
\??\c:\btnthh.exec:\btnthh.exe115⤵PID:1120
-
\??\c:\dvdjj.exec:\dvdjj.exe116⤵PID:2968
-
\??\c:\lxxxflx.exec:\lxxxflx.exe117⤵PID:2504
-
\??\c:\lflfflr.exec:\lflfflr.exe118⤵PID:580
-
\??\c:\bthhnt.exec:\bthhnt.exe119⤵PID:1672
-
\??\c:\9jdvd.exec:\9jdvd.exe120⤵PID:3020
-
\??\c:\jvppv.exec:\jvppv.exe121⤵PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-