Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe
-
Size
454KB
-
MD5
00ebe5aa3e0cfa89b5d66da611833774
-
SHA1
03c2951df57b5427f310d4c230d0b969ed66ef1d
-
SHA256
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819
-
SHA512
534c7935ec0847bad84d9dcbd5b8a19322ae0cd4a850cda4a7b9b07d3a5e45c5a83812b38f9a4afba2c840dca5281fd506db737ec7748587dfdbc0e55caa0ac9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2316-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-156-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2116-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-204-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-254-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1052-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-347-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2612-349-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2672-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-434-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2936-451-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2584-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-681-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2372-700-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2332-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-734-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/688-733-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/332-780-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2868-794-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2328 9thhhh.exe 2812 jjvvv.exe 2804 lllxlll.exe 2364 7tnttb.exe 2624 5frffll.exe 2716 thbnhn.exe 2660 flffrrx.exe 2652 hbbbbh.exe 376 jdppv.exe 2224 rrrrxxl.exe 2312 vpppd.exe 536 3hnnnt.exe 2004 jjdjv.exe 1912 flllxxx.exe 1904 jvdjj.exe 2908 3ntttb.exe 2116 pjvvp.exe 1332 5tthhn.exe 580 3frxffr.exe 2424 1xlfrrr.exe 2248 ddvdj.exe 332 1rffflx.exe 1784 7xxflrx.exe 1688 5nbhnn.exe 2216 fxrllff.exe 1052 7thbbb.exe 796 flflxfx.exe 1632 hhnbbh.exe 268 xrflrrf.exe 3056 1lxflrx.exe 2160 xxrrxrx.exe 2712 ttntbb.exe 2832 jjdjv.exe 2728 rfxxrll.exe 2756 9htbhh.exe 2892 1djjj.exe 2944 jvjjd.exe 2612 xxllllr.exe 2204 thttbb.exe 2644 7tbthb.exe 2288 3djdv.exe 296 llxxfxx.exe 2468 7bnhnn.exe 2520 vjvpv.exe 1712 1rlrrxx.exe 1492 hthhnh.exe 1312 nbttbb.exe 2124 ppddv.exe 2672 fxrrrll.exe 840 tthhnn.exe 2936 jvppj.exe 2908 3vpdd.exe 2012 lfxxxrx.exe 1508 nhtntt.exe 2584 pjdvv.exe 908 ffxlxfx.exe 2244 nnbhnh.exe 3000 pvvdp.exe 2024 llxrrlr.exe 1664 1rfrfxl.exe 1652 5hhnbn.exe 1780 ddjjd.exe 2212 xrffxrx.exe 2216 flllrrl.exe -
resource yara_rule behavioral1/memory/2316-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-234-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1688-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-347-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2672-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-451-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2584-461-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2244-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-792-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2696-832-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2828-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-879-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtntt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2328 2316 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 30 PID 2316 wrote to memory of 2328 2316 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 30 PID 2316 wrote to memory of 2328 2316 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 30 PID 2316 wrote to memory of 2328 2316 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 30 PID 2328 wrote to memory of 2812 2328 9thhhh.exe 31 PID 2328 wrote to memory of 2812 2328 9thhhh.exe 31 PID 2328 wrote to memory of 2812 2328 9thhhh.exe 31 PID 2328 wrote to memory of 2812 2328 9thhhh.exe 31 PID 2812 wrote to memory of 2804 2812 jjvvv.exe 32 PID 2812 wrote to memory of 2804 2812 jjvvv.exe 32 PID 2812 wrote to memory of 2804 2812 jjvvv.exe 32 PID 2812 wrote to memory of 2804 2812 jjvvv.exe 32 PID 2804 wrote to memory of 2364 2804 lllxlll.exe 33 PID 2804 wrote to memory of 2364 2804 lllxlll.exe 33 PID 2804 wrote to memory of 2364 2804 lllxlll.exe 33 PID 2804 wrote to memory of 2364 2804 lllxlll.exe 33 PID 2364 wrote to memory of 2624 2364 7tnttb.exe 34 PID 2364 wrote to memory of 2624 2364 7tnttb.exe 34 PID 2364 wrote to memory of 2624 2364 7tnttb.exe 34 PID 2364 wrote to memory of 2624 2364 7tnttb.exe 34 PID 2624 wrote to memory of 2716 2624 5frffll.exe 35 PID 2624 wrote to memory of 2716 2624 5frffll.exe 35 PID 2624 wrote to memory of 2716 2624 5frffll.exe 35 PID 2624 wrote to memory of 2716 2624 5frffll.exe 35 PID 2716 wrote to memory of 2660 2716 thbnhn.exe 36 PID 2716 wrote to memory of 2660 2716 thbnhn.exe 36 PID 2716 wrote to memory of 2660 2716 thbnhn.exe 36 PID 2716 wrote to memory of 2660 2716 thbnhn.exe 36 PID 2660 wrote to memory of 2652 2660 flffrrx.exe 37 PID 2660 wrote to memory of 2652 2660 flffrrx.exe 37 PID 2660 wrote to memory of 2652 2660 flffrrx.exe 37 PID 2660 wrote to memory of 2652 2660 flffrrx.exe 37 PID 2652 wrote to memory of 376 2652 hbbbbh.exe 38 PID 2652 wrote to memory of 376 2652 hbbbbh.exe 38 PID 2652 wrote to memory of 376 2652 hbbbbh.exe 38 PID 2652 wrote to memory of 376 2652 hbbbbh.exe 38 PID 376 wrote to memory of 2224 376 jdppv.exe 39 PID 376 wrote to memory of 2224 376 jdppv.exe 39 PID 376 wrote to memory of 2224 376 jdppv.exe 39 PID 376 wrote to memory of 2224 376 jdppv.exe 39 PID 2224 wrote to memory of 2312 2224 rrrrxxl.exe 40 PID 2224 wrote to memory of 2312 2224 rrrrxxl.exe 40 PID 2224 wrote to memory of 2312 2224 rrrrxxl.exe 40 PID 2224 wrote to memory of 2312 2224 rrrrxxl.exe 40 PID 2312 wrote to memory of 536 2312 vpppd.exe 41 PID 2312 wrote to memory of 536 2312 vpppd.exe 41 PID 2312 wrote to memory of 536 2312 vpppd.exe 41 PID 2312 wrote to memory of 536 2312 vpppd.exe 41 PID 536 wrote to memory of 2004 536 3hnnnt.exe 42 PID 536 wrote to memory of 2004 536 3hnnnt.exe 42 PID 536 wrote to memory of 2004 536 3hnnnt.exe 42 PID 536 wrote to memory of 2004 536 3hnnnt.exe 42 PID 2004 wrote to memory of 1912 2004 jjdjv.exe 43 PID 2004 wrote to memory of 1912 2004 jjdjv.exe 43 PID 2004 wrote to memory of 1912 2004 jjdjv.exe 43 PID 2004 wrote to memory of 1912 2004 jjdjv.exe 43 PID 1912 wrote to memory of 1904 1912 flllxxx.exe 44 PID 1912 wrote to memory of 1904 1912 flllxxx.exe 44 PID 1912 wrote to memory of 1904 1912 flllxxx.exe 44 PID 1912 wrote to memory of 1904 1912 flllxxx.exe 44 PID 1904 wrote to memory of 2908 1904 jvdjj.exe 45 PID 1904 wrote to memory of 2908 1904 jvdjj.exe 45 PID 1904 wrote to memory of 2908 1904 jvdjj.exe 45 PID 1904 wrote to memory of 2908 1904 jvdjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe"C:\Users\Admin\AppData\Local\Temp\d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\9thhhh.exec:\9thhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\jjvvv.exec:\jjvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lllxlll.exec:\lllxlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7tnttb.exec:\7tnttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5frffll.exec:\5frffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\thbnhn.exec:\thbnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\flffrrx.exec:\flffrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hbbbbh.exec:\hbbbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jdppv.exec:\jdppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\rrrrxxl.exec:\rrrrxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vpppd.exec:\vpppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3hnnnt.exec:\3hnnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\jjdjv.exec:\jjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\flllxxx.exec:\flllxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\jvdjj.exec:\jvdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\3ntttb.exec:\3ntttb.exe17⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pjvvp.exec:\pjvvp.exe18⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5tthhn.exec:\5tthhn.exe19⤵
- Executes dropped EXE
PID:1332 -
\??\c:\3frxffr.exec:\3frxffr.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\1xlfrrr.exec:\1xlfrrr.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ddvdj.exec:\ddvdj.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1rffflx.exec:\1rffflx.exe23⤵
- Executes dropped EXE
PID:332 -
\??\c:\7xxflrx.exec:\7xxflrx.exe24⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5nbhnn.exec:\5nbhnn.exe25⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fxrllff.exec:\fxrllff.exe26⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7thbbb.exec:\7thbbb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1052 -
\??\c:\flflxfx.exec:\flflxfx.exe28⤵
- Executes dropped EXE
PID:796 -
\??\c:\hhnbbh.exec:\hhnbbh.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xrflrrf.exec:\xrflrrf.exe30⤵
- Executes dropped EXE
PID:268 -
\??\c:\1lxflrx.exec:\1lxflrx.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xxrrxrx.exec:\xxrrxrx.exe32⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ttntbb.exec:\ttntbb.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jjdjv.exec:\jjdjv.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rfxxrll.exec:\rfxxrll.exe35⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9htbhh.exec:\9htbhh.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1djjj.exec:\1djjj.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jvjjd.exec:\jvjjd.exe38⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxllllr.exec:\xxllllr.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\thttbb.exec:\thttbb.exe40⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7tbthb.exec:\7tbthb.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3djdv.exec:\3djdv.exe42⤵
- Executes dropped EXE
PID:2288 -
\??\c:\llxxfxx.exec:\llxxfxx.exe43⤵
- Executes dropped EXE
PID:296 -
\??\c:\7bnhnn.exec:\7bnhnn.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vjvpv.exec:\vjvpv.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1rlrrxx.exec:\1rlrrxx.exe46⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hthhnh.exec:\hthhnh.exe47⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nbttbb.exec:\nbttbb.exe48⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ppddv.exec:\ppddv.exe49⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxrrrll.exec:\fxrrrll.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tthhnn.exec:\tthhnn.exe51⤵
- Executes dropped EXE
PID:840 -
\??\c:\jvppj.exec:\jvppj.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3vpdd.exec:\3vpdd.exe53⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfxxxrx.exec:\lfxxxrx.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhtntt.exec:\nhtntt.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pjdvv.exec:\pjdvv.exe56⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe57⤵
- Executes dropped EXE
PID:908 -
\??\c:\nnbhnh.exec:\nnbhnh.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pvvdp.exec:\pvvdp.exe59⤵
- Executes dropped EXE
PID:3000 -
\??\c:\llxrrlr.exec:\llxrrlr.exe60⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1rfrfxl.exec:\1rfrfxl.exe61⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5hhnbn.exec:\5hhnbn.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652 -
\??\c:\ddjjd.exec:\ddjjd.exe63⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xrffxrx.exec:\xrffxrx.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\flllrrl.exec:\flllrrl.exe65⤵
- Executes dropped EXE
PID:2216 -
\??\c:\btbbbb.exec:\btbbbb.exe66⤵PID:2068
-
\??\c:\pjjjp.exec:\pjjjp.exe67⤵PID:2500
-
\??\c:\7vjjj.exec:\7vjjj.exe68⤵PID:1736
-
\??\c:\fxflrrf.exec:\fxflrrf.exe69⤵PID:1632
-
\??\c:\htbtbb.exec:\htbtbb.exe70⤵PID:2292
-
\??\c:\9pjjj.exec:\9pjjj.exe71⤵PID:2280
-
\??\c:\llrllff.exec:\llrllff.exe72⤵PID:1592
-
\??\c:\7xllllr.exec:\7xllllr.exe73⤵PID:2164
-
\??\c:\bnnbtt.exec:\bnnbtt.exe74⤵PID:3004
-
\??\c:\5vvdj.exec:\5vvdj.exe75⤵PID:2864
-
\??\c:\llffllf.exec:\llffllf.exe76⤵PID:2796
-
\??\c:\rrrxflf.exec:\rrrxflf.exe77⤵PID:2916
-
\??\c:\bnhhtt.exec:\bnhhtt.exe78⤵PID:2776
-
\??\c:\vpjvd.exec:\vpjvd.exe79⤵PID:2596
-
\??\c:\fxxfllr.exec:\fxxfllr.exe80⤵PID:2716
-
\??\c:\xrlflfr.exec:\xrlflfr.exe81⤵PID:2272
-
\??\c:\5nhthn.exec:\5nhthn.exe82⤵PID:1728
-
\??\c:\vpvvp.exec:\vpvvp.exe83⤵PID:1744
-
\??\c:\lrllllr.exec:\lrllllr.exe84⤵PID:2452
-
\??\c:\llflrrx.exec:\llflrrx.exe85⤵PID:376
-
\??\c:\9thhnh.exec:\9thhnh.exe86⤵PID:2888
-
\??\c:\vpvdv.exec:\vpvdv.exe87⤵PID:1644
-
\??\c:\vpjdj.exec:\vpjdj.exe88⤵PID:2000
-
\??\c:\rfflxlx.exec:\rfflxlx.exe89⤵PID:1492
-
\??\c:\3hnbbt.exec:\3hnbbt.exe90⤵PID:2372
-
\??\c:\bbntbt.exec:\bbntbt.exe91⤵PID:2124
-
\??\c:\jpppv.exec:\jpppv.exe92⤵PID:2588
-
\??\c:\lffrffr.exec:\lffrffr.exe93⤵PID:1496
-
\??\c:\9bntnh.exec:\9bntnh.exe94⤵PID:2936
-
\??\c:\5tthnn.exec:\5tthnn.exe95⤵PID:568
-
\??\c:\vjvpp.exec:\vjvpp.exe96⤵PID:572
-
\??\c:\xrrxrrx.exec:\xrrxrrx.exe97⤵PID:2332
-
\??\c:\frfffxf.exec:\frfffxf.exe98⤵PID:688
-
\??\c:\tttnbb.exec:\tttnbb.exe99⤵PID:2436
-
\??\c:\dvvpj.exec:\dvvpj.exe100⤵PID:2792
-
\??\c:\9frxfll.exec:\9frxfll.exe101⤵PID:3000
-
\??\c:\bbnntb.exec:\bbnntb.exe102⤵PID:332
-
\??\c:\9nthnt.exec:\9nthnt.exe103⤵PID:800
-
\??\c:\9dvdd.exec:\9dvdd.exe104⤵PID:1396
-
\??\c:\rllxxll.exec:\rllxxll.exe105⤵PID:2688
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe106⤵PID:924
-
\??\c:\5thbtt.exec:\5thbtt.exe107⤵PID:2868
-
\??\c:\dvppj.exec:\dvppj.exe108⤵PID:2300
-
\??\c:\lllrxlr.exec:\lllrxlr.exe109⤵PID:872
-
\??\c:\hthbbt.exec:\hthbbt.exe110⤵PID:2200
-
\??\c:\ntnttt.exec:\ntnttt.exe111⤵PID:2524
-
\??\c:\rlffrlx.exec:\rlffrlx.exe112⤵PID:2316
-
\??\c:\hhbttt.exec:\hhbttt.exe113⤵PID:2696
-
\??\c:\pjjpp.exec:\pjjpp.exe114⤵PID:1600
-
\??\c:\pppvv.exec:\pppvv.exe115⤵PID:2752
-
\??\c:\rrlllrr.exec:\rrlllrr.exe116⤵PID:2736
-
\??\c:\btnthn.exec:\btnthn.exe117⤵PID:2844
-
\??\c:\nhbntn.exec:\nhbntn.exe118⤵PID:2156
-
\??\c:\dpjjv.exec:\dpjjv.exe119⤵PID:2828
-
\??\c:\1rrfrrr.exec:\1rrfrrr.exe120⤵PID:2772
-
\??\c:\1fxlxll.exec:\1fxlxll.exe121⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-