Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe
-
Size
455KB
-
MD5
684b6bba76d5ee98d04e4225a85ea070
-
SHA1
83513500e59ce0564683840efe5aada67324b885
-
SHA256
9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7
-
SHA512
56e7b7fae4f91f459fad7bef5736835b249105cfeb13fea1427f4548bc5854ad5adf8764f8d20e59b1b10d1cfa174e2644fa22c75b9fdd3550557abc1752b5a8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2276-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-61-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-133-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/912-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-167-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2852-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-259-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1660-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-281-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-613-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/348-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-873-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2580-900-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1464-952-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/928-1013-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1560-1084-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-1128-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2316-1143-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 dddjv.exe 1704 lfrrxxl.exe 1756 1ttttt.exe 2304 ffxxlxf.exe 2752 btntbb.exe 2964 jddjv.exe 2700 7llfffl.exe 2204 vvddj.exe 2544 fxllrrr.exe 592 7jpjj.exe 2420 llxflxf.exe 2780 tnbbhh.exe 1792 xlxlrxf.exe 2020 btbntn.exe 1496 5ddpd.exe 912 1lfrxlr.exe 756 vdvvj.exe 2852 lfxlxfx.exe 2388 bbbnbb.exe 844 dvppv.exe 808 jdpvd.exe 1640 9xrlxxl.exe 2496 dvvvj.exe 1636 xxlrlrx.exe 2800 vpjpv.exe 1724 pjddj.exe 1696 ttnntb.exe 1660 vjdvd.exe 2860 ddvjd.exe 1020 bbhhtt.exe 2152 djdjv.exe 1488 tttbnt.exe 2336 5bnhhb.exe 2440 3pjdj.exe 1896 vjvpp.exe 2260 rxxfxfx.exe 2688 bbtbnt.exe 2792 btnntt.exe 2548 pjddp.exe 2844 rrrrflf.exe 3032 9bnntt.exe 1920 nnnthh.exe 2204 9jddd.exe 2536 ffrrxrf.exe 2660 bbtbnn.exe 2272 7bhhnn.exe 1988 jdvvv.exe 1436 frfxxrx.exe 2776 9htnnt.exe 2772 5tntnn.exe 1984 9jjvv.exe 804 lfxrflf.exe 1252 fxllllx.exe 2872 9tbbnn.exe 2716 jvvdd.exe 2852 1dvvd.exe 1600 llffllx.exe 1932 bthhtb.exe 980 vvjdp.exe 1268 vddjv.exe 1700 lflfllr.exe 1632 tttbnt.exe 752 9bthbh.exe 900 pjpjj.exe -
resource yara_rule behavioral1/memory/2276-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-279-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2336-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-613-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2608-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-952-0x0000000001C50000-0x0000000001C7A000-memory.dmp upx behavioral1/memory/928-1013-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1560-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-1150-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3064-1203-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2316 2276 9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe 31 PID 2276 wrote to memory of 2316 2276 9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe 31 PID 2276 wrote to memory of 2316 2276 9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe 31 PID 2276 wrote to memory of 2316 2276 9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe 31 PID 2316 wrote to memory of 1704 2316 dddjv.exe 32 PID 2316 wrote to memory of 1704 2316 dddjv.exe 32 PID 2316 wrote to memory of 1704 2316 dddjv.exe 32 PID 2316 wrote to memory of 1704 2316 dddjv.exe 32 PID 1704 wrote to memory of 1756 1704 lfrrxxl.exe 33 PID 1704 wrote to memory of 1756 1704 lfrrxxl.exe 33 PID 1704 wrote to memory of 1756 1704 lfrrxxl.exe 33 PID 1704 wrote to memory of 1756 1704 lfrrxxl.exe 33 PID 1756 wrote to memory of 2304 1756 1ttttt.exe 34 PID 1756 wrote to memory of 2304 1756 1ttttt.exe 34 PID 1756 wrote to memory of 2304 1756 1ttttt.exe 34 PID 1756 wrote to memory of 2304 1756 1ttttt.exe 34 PID 2304 wrote to memory of 2752 2304 ffxxlxf.exe 35 PID 2304 wrote to memory of 2752 2304 ffxxlxf.exe 35 PID 2304 wrote to memory of 2752 2304 ffxxlxf.exe 35 PID 2304 wrote to memory of 2752 2304 ffxxlxf.exe 35 PID 2752 wrote to memory of 2964 2752 btntbb.exe 36 PID 2752 wrote to memory of 2964 2752 btntbb.exe 36 PID 2752 wrote to memory of 2964 2752 btntbb.exe 36 PID 2752 wrote to memory of 2964 2752 btntbb.exe 36 PID 2964 wrote to memory of 2700 2964 jddjv.exe 37 PID 2964 wrote to memory of 2700 2964 jddjv.exe 37 PID 2964 wrote to memory of 2700 2964 jddjv.exe 37 PID 2964 wrote to memory of 2700 2964 jddjv.exe 37 PID 2700 wrote to memory of 2204 2700 7llfffl.exe 38 PID 2700 wrote to memory of 2204 2700 7llfffl.exe 38 PID 2700 wrote to memory of 2204 2700 7llfffl.exe 38 PID 2700 wrote to memory of 2204 2700 7llfffl.exe 38 PID 2204 wrote to memory of 2544 2204 vvddj.exe 39 PID 2204 wrote to memory of 2544 2204 vvddj.exe 39 PID 2204 wrote to memory of 2544 2204 vvddj.exe 39 PID 2204 wrote to memory of 2544 2204 vvddj.exe 39 PID 2544 wrote to memory of 592 2544 fxllrrr.exe 40 PID 2544 wrote to memory of 592 2544 fxllrrr.exe 40 PID 2544 wrote to memory of 592 2544 fxllrrr.exe 40 PID 2544 wrote to memory of 592 2544 fxllrrr.exe 40 PID 592 wrote to memory of 2420 592 7jpjj.exe 41 PID 592 wrote to memory of 2420 592 7jpjj.exe 41 PID 592 wrote to memory of 2420 592 7jpjj.exe 41 PID 592 wrote to memory of 2420 592 7jpjj.exe 41 PID 2420 wrote to memory of 2780 2420 llxflxf.exe 42 PID 2420 wrote to memory of 2780 2420 llxflxf.exe 42 PID 2420 wrote to memory of 2780 2420 llxflxf.exe 42 PID 2420 wrote to memory of 2780 2420 llxflxf.exe 42 PID 2780 wrote to memory of 1792 2780 tnbbhh.exe 43 PID 2780 wrote to memory of 1792 2780 tnbbhh.exe 43 PID 2780 wrote to memory of 1792 2780 tnbbhh.exe 43 PID 2780 wrote to memory of 1792 2780 tnbbhh.exe 43 PID 1792 wrote to memory of 2020 1792 xlxlrxf.exe 44 PID 1792 wrote to memory of 2020 1792 xlxlrxf.exe 44 PID 1792 wrote to memory of 2020 1792 xlxlrxf.exe 44 PID 1792 wrote to memory of 2020 1792 xlxlrxf.exe 44 PID 2020 wrote to memory of 1496 2020 btbntn.exe 45 PID 2020 wrote to memory of 1496 2020 btbntn.exe 45 PID 2020 wrote to memory of 1496 2020 btbntn.exe 45 PID 2020 wrote to memory of 1496 2020 btbntn.exe 45 PID 1496 wrote to memory of 912 1496 5ddpd.exe 46 PID 1496 wrote to memory of 912 1496 5ddpd.exe 46 PID 1496 wrote to memory of 912 1496 5ddpd.exe 46 PID 1496 wrote to memory of 912 1496 5ddpd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe"C:\Users\Admin\AppData\Local\Temp\9e12b1720a1b036b29f526dc2538060a7c5a169cb5bfa4411e54ae67a37a2ff7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\dddjv.exec:\dddjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\1ttttt.exec:\1ttttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\ffxxlxf.exec:\ffxxlxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\btntbb.exec:\btntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jddjv.exec:\jddjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7llfffl.exec:\7llfffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vvddj.exec:\vvddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\fxllrrr.exec:\fxllrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\7jpjj.exec:\7jpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\llxflxf.exec:\llxflxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tnbbhh.exec:\tnbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xlxlrxf.exec:\xlxlrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\btbntn.exec:\btbntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\5ddpd.exec:\5ddpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\1lfrxlr.exec:\1lfrxlr.exe17⤵
- Executes dropped EXE
PID:912 -
\??\c:\vdvvj.exec:\vdvvj.exe18⤵
- Executes dropped EXE
PID:756 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe19⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bbbnbb.exec:\bbbnbb.exe20⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dvppv.exec:\dvppv.exe21⤵
- Executes dropped EXE
PID:844 -
\??\c:\jdpvd.exec:\jdpvd.exe22⤵
- Executes dropped EXE
PID:808 -
\??\c:\9xrlxxl.exec:\9xrlxxl.exe23⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dvvvj.exec:\dvvvj.exe24⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xxlrlrx.exec:\xxlrlrx.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vpjpv.exec:\vpjpv.exe26⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjddj.exec:\pjddj.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ttnntb.exec:\ttnntb.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vjdvd.exec:\vjdvd.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ddvjd.exec:\ddvjd.exe30⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bbhhtt.exec:\bbhhtt.exe31⤵
- Executes dropped EXE
PID:1020 -
\??\c:\djdjv.exec:\djdjv.exe32⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tttbnt.exec:\tttbnt.exe33⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5bnhhb.exec:\5bnhhb.exe34⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3pjdj.exec:\3pjdj.exe35⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vjvpp.exec:\vjvpp.exe36⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rxxfxfx.exec:\rxxfxfx.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bbtbnt.exec:\bbtbnt.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\btnntt.exec:\btnntt.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pjddp.exec:\pjddp.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rrrrflf.exec:\rrrrflf.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9bnntt.exec:\9bnntt.exe42⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nnnthh.exec:\nnnthh.exe43⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9jddd.exec:\9jddd.exe44⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ffrrxrf.exec:\ffrrxrf.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bbtbnn.exec:\bbtbnn.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\7bhhnn.exec:\7bhhnn.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\jdvvv.exec:\jdvvv.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\frfxxrx.exec:\frfxxrx.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436 -
\??\c:\9htnnt.exec:\9htnnt.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5tntnn.exec:\5tntnn.exe51⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9jjvv.exec:\9jjvv.exe52⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lfxrflf.exec:\lfxrflf.exe53⤵
- Executes dropped EXE
PID:804 -
\??\c:\fxllllx.exec:\fxllllx.exe54⤵
- Executes dropped EXE
PID:1252 -
\??\c:\9tbbnn.exec:\9tbbnn.exe55⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jvvdd.exec:\jvvdd.exe56⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1dvvd.exec:\1dvvd.exe57⤵
- Executes dropped EXE
PID:2852 -
\??\c:\llffllx.exec:\llffllx.exe58⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bthhtb.exec:\bthhtb.exe59⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vvjdp.exec:\vvjdp.exe60⤵
- Executes dropped EXE
PID:980 -
\??\c:\vddjv.exec:\vddjv.exe61⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lflfllr.exec:\lflfllr.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tttbnt.exec:\tttbnt.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9bthbh.exec:\9bthbh.exe64⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjpjj.exec:\pjpjj.exe65⤵
- Executes dropped EXE
PID:900 -
\??\c:\1rrllrx.exec:\1rrllrx.exe66⤵PID:1572
-
\??\c:\9xlrrxf.exec:\9xlrrxf.exe67⤵PID:2216
-
\??\c:\tnbhtt.exec:\tnbhtt.exe68⤵PID:2116
-
\??\c:\pdpjp.exec:\pdpjp.exe69⤵PID:2108
-
\??\c:\xlrllxr.exec:\xlrllxr.exe70⤵PID:1660
-
\??\c:\9frlrxl.exec:\9frlrxl.exe71⤵PID:984
-
\??\c:\hbntbh.exec:\hbntbh.exe72⤵PID:1668
-
\??\c:\djdjv.exec:\djdjv.exe73⤵PID:2032
-
\??\c:\7lrxxlr.exec:\7lrxxlr.exe74⤵PID:1508
-
\??\c:\7rrflrf.exec:\7rrflrf.exe75⤵PID:2956
-
\??\c:\nhbnbb.exec:\nhbnbb.exe76⤵PID:1516
-
\??\c:\dpdpd.exec:\dpdpd.exe77⤵PID:2316
-
\??\c:\ffrxffr.exec:\ffrxffr.exe78⤵PID:2296
-
\??\c:\rfxxllf.exec:\rfxxllf.exe79⤵PID:2684
-
\??\c:\hhhnbb.exec:\hhhnbb.exe80⤵PID:2744
-
\??\c:\jjdpd.exec:\jjdpd.exe81⤵PID:2972
-
\??\c:\rfxxflr.exec:\rfxxflr.exe82⤵PID:2796
-
\??\c:\ffxlrxf.exec:\ffxlrxf.exe83⤵PID:2760
-
\??\c:\tnbhnn.exec:\tnbhnn.exe84⤵PID:2576
-
\??\c:\pdppp.exec:\pdppp.exe85⤵PID:2704
-
\??\c:\lxlllxf.exec:\lxlllxf.exe86⤵PID:2552
-
\??\c:\7xllrxx.exec:\7xllrxx.exe87⤵PID:2572
-
\??\c:\thbtbh.exec:\thbtbh.exe88⤵PID:3044
-
\??\c:\dpjpv.exec:\dpjpv.exe89⤵PID:2192
-
\??\c:\5pddj.exec:\5pddj.exe90⤵PID:3064
-
\??\c:\1rllrxl.exec:\1rllrxl.exe91⤵PID:2608
-
\??\c:\bbthbb.exec:\bbthbb.exe92⤵PID:820
-
\??\c:\9djjd.exec:\9djjd.exe93⤵PID:1792
-
\??\c:\vpdpd.exec:\vpdpd.exe94⤵PID:2528
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe95⤵PID:1908
-
\??\c:\bntthh.exec:\bntthh.exe96⤵PID:348
-
\??\c:\tnbtbb.exec:\tnbtbb.exe97⤵PID:2920
-
\??\c:\dvjvp.exec:\dvjvp.exe98⤵PID:2936
-
\??\c:\ffxfllx.exec:\ffxfllx.exe99⤵PID:1924
-
\??\c:\tnbbnn.exec:\tnbbnn.exe100⤵PID:1048
-
\??\c:\1tnthb.exec:\1tnthb.exe101⤵PID:1736
-
\??\c:\jdvvj.exec:\jdvvj.exe102⤵PID:844
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe103⤵PID:708
-
\??\c:\hhtbhn.exec:\hhtbhn.exe104⤵PID:1764
-
\??\c:\tnntnn.exec:\tnntnn.exe105⤵PID:948
-
\??\c:\ddpvd.exec:\ddpvd.exe106⤵PID:2496
-
\??\c:\rlfrffr.exec:\rlfrffr.exe107⤵PID:1092
-
\??\c:\7rxflrf.exec:\7rxflrf.exe108⤵PID:1892
-
\??\c:\5tthhn.exec:\5tthhn.exe109⤵PID:1900
-
\??\c:\3ddjd.exec:\3ddjd.exe110⤵PID:596
-
\??\c:\1djjp.exec:\1djjp.exe111⤵PID:2096
-
\??\c:\rrffrrf.exec:\rrffrrf.exe112⤵PID:3024
-
\??\c:\1hnntb.exec:\1hnntb.exe113⤵PID:776
-
\??\c:\hhbhbt.exec:\hhbhbt.exe114⤵PID:1560
-
\??\c:\dpjpd.exec:\dpjpd.exe115⤵PID:888
-
\??\c:\lfrxflr.exec:\lfrxflr.exe116⤵PID:872
-
\??\c:\nhbhhn.exec:\nhbhhn.exe117⤵PID:1628
-
\??\c:\1bbhnn.exec:\1bbhnn.exe118⤵PID:1520
-
\??\c:\1ppjj.exec:\1ppjj.exe119⤵PID:2480
-
\??\c:\xrlrrrx.exec:\xrlrrrx.exe120⤵PID:2084
-
\??\c:\bnnbbn.exec:\bnnbbn.exe121⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-