Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 07:26
Behavioral task
behavioral1
Sample
c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe
-
Size
332KB
-
MD5
0df4e141e383f2281c93a4c3132e1fa0
-
SHA1
8018a5bba361611c48c523254ff71e1b2e940f2f
-
SHA256
c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242
-
SHA512
41c0a9b124e8344c4fda3235a2058f259ae27a74a44508aee2a9bd9db8d552e288b4b78d31fa27fa9b1427bcca70bbe4ff7030e05e6f37dc44005b9c4887e99a
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbee:R4wFHoSHYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2504-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-64-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1964-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-198-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2056-197-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1536-220-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2156-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-277-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1748-278-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1820-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-297-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-460-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1772-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-723-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-726-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2372-740-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1732-807-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1036-818-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3004-8722-0x0000000077B60000-0x0000000077C7F000-memory.dmp family_blackmoon behavioral1/memory/3004-12754-0x0000000077B60000-0x0000000077C7F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 9lxxflr.exe 2412 tnntht.exe 2532 jvvjv.exe 2356 llxlxfr.exe 2816 pppdp.exe 2864 3xrxlrf.exe 1964 5bnhnn.exe 2840 5ddpv.exe 2760 xllrrxl.exe 2592 tntttb.exe 2764 1jjpd.exe 2080 flfrlrf.exe 844 1bbhhn.exe 2664 djjjv.exe 1264 rxfxxfx.exe 552 vvppj.exe 2092 vpjpd.exe 928 bbhtnb.exe 1812 7djpp.exe 1932 3rrrlxr.exe 2924 tttbnt.exe 2472 dpvjd.exe 2056 nhtnnh.exe 2984 3pvjd.exe 1080 rlflxfl.exe 1536 bbtnbn.exe 1828 5vddv.exe 892 xfxrxrr.exe 3032 bttbhn.exe 2156 lllrrll.exe 2428 9tthtt.exe 1624 9jdpd.exe 2404 xrlxlrf.exe 1748 nntnhh.exe 1820 ppjjv.exe 1260 7rlxfrl.exe 1680 bbtbhn.exe 2412 nnnnbh.exe 2548 7vjjp.exe 1968 xxfrlff.exe 2688 nnhhtb.exe 2832 bhtthh.exe 2824 ppjvd.exe 2568 frrrrxf.exe 2792 ffxrrfx.exe 2972 7hbhbb.exe 2860 vdjjj.exe 2600 llxfrxr.exe 2596 xxxrfxx.exe 2260 ntnbnt.exe 1860 vdvpd.exe 1652 xfrxrff.exe 1920 lfxfrrr.exe 844 tnhbnb.exe 2664 ntnbnb.exe 756 jdvvj.exe 1420 rlxrrxf.exe 1716 htnhtb.exe 1784 bhtntb.exe 1616 3jvvd.exe 1544 llrffrr.exe 2904 hhhthb.exe 2696 5dvpd.exe 2936 vpdpd.exe -
resource yara_rule behavioral1/memory/2504-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120ff-8.dat upx behavioral1/memory/2504-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000192f0-15.dat upx behavioral1/memory/1980-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001932a-23.dat upx behavioral1/memory/2412-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001933e-31.dat upx behavioral1/files/0x0006000000019346-40.dat upx behavioral1/files/0x0006000000019384-48.dat upx behavioral1/memory/2816-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000193af-57.dat upx behavioral1/files/0x00060000000194f6-65.dat upx behavioral1/memory/2840-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019501-75.dat upx behavioral1/memory/2840-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019503-83.dat upx behavioral1/files/0x0005000000019515-92.dat upx behavioral1/memory/2592-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001953a-102.dat upx behavioral1/files/0x000500000001957c-109.dat upx behavioral1/memory/2080-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/844-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019589-116.dat upx behavioral1/files/0x000500000001961b-124.dat upx behavioral1/files/0x000500000001961f-132.dat upx behavioral1/memory/1264-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019624-140.dat upx behavioral1/files/0x0005000000019625-149.dat upx behavioral1/memory/2092-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197c1-156.dat upx behavioral1/memory/1812-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019aea-165.dat upx behavioral1/files/0x0005000000019aec-174.dat upx behavioral1/memory/1932-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019228-182.dat upx behavioral1/memory/2472-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019aee-190.dat upx behavioral1/files/0x0005000000019c50-199.dat upx behavioral1/files/0x0005000000019c66-206.dat upx behavioral1/files/0x0005000000019c68-214.dat upx behavioral1/files/0x0005000000019cbf-222.dat upx behavioral1/files/0x0005000000019d8b-229.dat upx behavioral1/files/0x0005000000019f4a-236.dat upx behavioral1/files/0x0005000000019f4e-243.dat upx behavioral1/memory/2156-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a04e-251.dat upx behavioral1/files/0x000500000001a061-258.dat upx behavioral1/memory/1624-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2404-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1820-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1260-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1260-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-377-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 1980 2504 c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe 30 PID 2504 wrote to memory of 1980 2504 c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe 30 PID 2504 wrote to memory of 1980 2504 c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe 30 PID 2504 wrote to memory of 1980 2504 c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe 30 PID 1980 wrote to memory of 2412 1980 9lxxflr.exe 31 PID 1980 wrote to memory of 2412 1980 9lxxflr.exe 31 PID 1980 wrote to memory of 2412 1980 9lxxflr.exe 31 PID 1980 wrote to memory of 2412 1980 9lxxflr.exe 31 PID 2412 wrote to memory of 2532 2412 tnntht.exe 32 PID 2412 wrote to memory of 2532 2412 tnntht.exe 32 PID 2412 wrote to memory of 2532 2412 tnntht.exe 32 PID 2412 wrote to memory of 2532 2412 tnntht.exe 32 PID 2532 wrote to memory of 2356 2532 jvvjv.exe 33 PID 2532 wrote to memory of 2356 2532 jvvjv.exe 33 PID 2532 wrote to memory of 2356 2532 jvvjv.exe 33 PID 2532 wrote to memory of 2356 2532 jvvjv.exe 33 PID 2356 wrote to memory of 2816 2356 llxlxfr.exe 34 PID 2356 wrote to memory of 2816 2356 llxlxfr.exe 34 PID 2356 wrote to memory of 2816 2356 llxlxfr.exe 34 PID 2356 wrote to memory of 2816 2356 llxlxfr.exe 34 PID 2816 wrote to memory of 2864 2816 pppdp.exe 35 PID 2816 wrote to memory of 2864 2816 pppdp.exe 35 PID 2816 wrote to memory of 2864 2816 pppdp.exe 35 PID 2816 wrote to memory of 2864 2816 pppdp.exe 35 PID 2864 wrote to memory of 1964 2864 3xrxlrf.exe 36 PID 2864 wrote to memory of 1964 2864 3xrxlrf.exe 36 PID 2864 wrote to memory of 1964 2864 3xrxlrf.exe 36 PID 2864 wrote to memory of 1964 2864 3xrxlrf.exe 36 PID 1964 wrote to memory of 2840 1964 5bnhnn.exe 37 PID 1964 wrote to memory of 2840 1964 5bnhnn.exe 37 PID 1964 wrote to memory of 2840 1964 5bnhnn.exe 37 PID 1964 wrote to memory of 2840 1964 5bnhnn.exe 37 PID 2840 wrote to memory of 2760 2840 5ddpv.exe 38 PID 2840 wrote to memory of 2760 2840 5ddpv.exe 38 PID 2840 wrote to memory of 2760 2840 5ddpv.exe 38 PID 2840 wrote to memory of 2760 2840 5ddpv.exe 38 PID 2760 wrote to memory of 2592 2760 xllrrxl.exe 39 PID 2760 wrote to memory of 2592 2760 xllrrxl.exe 39 PID 2760 wrote to memory of 2592 2760 xllrrxl.exe 39 PID 2760 wrote to memory of 2592 2760 xllrrxl.exe 39 PID 2592 wrote to memory of 2764 2592 tntttb.exe 40 PID 2592 wrote to memory of 2764 2592 tntttb.exe 40 PID 2592 wrote to memory of 2764 2592 tntttb.exe 40 PID 2592 wrote to memory of 2764 2592 tntttb.exe 40 PID 2764 wrote to memory of 2080 2764 1jjpd.exe 41 PID 2764 wrote to memory of 2080 2764 1jjpd.exe 41 PID 2764 wrote to memory of 2080 2764 1jjpd.exe 41 PID 2764 wrote to memory of 2080 2764 1jjpd.exe 41 PID 2080 wrote to memory of 844 2080 flfrlrf.exe 42 PID 2080 wrote to memory of 844 2080 flfrlrf.exe 42 PID 2080 wrote to memory of 844 2080 flfrlrf.exe 42 PID 2080 wrote to memory of 844 2080 flfrlrf.exe 42 PID 844 wrote to memory of 2664 844 1bbhhn.exe 43 PID 844 wrote to memory of 2664 844 1bbhhn.exe 43 PID 844 wrote to memory of 2664 844 1bbhhn.exe 43 PID 844 wrote to memory of 2664 844 1bbhhn.exe 43 PID 2664 wrote to memory of 1264 2664 djjjv.exe 44 PID 2664 wrote to memory of 1264 2664 djjjv.exe 44 PID 2664 wrote to memory of 1264 2664 djjjv.exe 44 PID 2664 wrote to memory of 1264 2664 djjjv.exe 44 PID 1264 wrote to memory of 552 1264 rxfxxfx.exe 45 PID 1264 wrote to memory of 552 1264 rxfxxfx.exe 45 PID 1264 wrote to memory of 552 1264 rxfxxfx.exe 45 PID 1264 wrote to memory of 552 1264 rxfxxfx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe"C:\Users\Admin\AppData\Local\Temp\c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9lxxflr.exec:\9lxxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\tnntht.exec:\tnntht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\jvvjv.exec:\jvvjv.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\llxlxfr.exec:\llxlxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pppdp.exec:\pppdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3xrxlrf.exec:\3xrxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\5bnhnn.exec:\5bnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\5ddpv.exec:\5ddpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xllrrxl.exec:\xllrrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tntttb.exec:\tntttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1jjpd.exec:\1jjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\flfrlrf.exec:\flfrlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\1bbhhn.exec:\1bbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\djjjv.exec:\djjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rxfxxfx.exec:\rxfxxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\vvppj.exec:\vvppj.exe17⤵
- Executes dropped EXE
PID:552 -
\??\c:\vpjpd.exec:\vpjpd.exe18⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bbhtnb.exec:\bbhtnb.exe19⤵
- Executes dropped EXE
PID:928 -
\??\c:\7djpp.exec:\7djpp.exe20⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3rrrlxr.exec:\3rrrlxr.exe21⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tttbnt.exec:\tttbnt.exe22⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dpvjd.exec:\dpvjd.exe23⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nhtnnh.exec:\nhtnnh.exe24⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3pvjd.exec:\3pvjd.exe25⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rlflxfl.exec:\rlflxfl.exe26⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bbtnbn.exec:\bbtnbn.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\5vddv.exec:\5vddv.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xfxrxrr.exec:\xfxrxrr.exe29⤵
- Executes dropped EXE
PID:892 -
\??\c:\bttbhn.exec:\bttbhn.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lllrrll.exec:\lllrrll.exe31⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9tthtt.exec:\9tthtt.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9jdpd.exec:\9jdpd.exe33⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nntnhh.exec:\nntnhh.exe35⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ppjjv.exec:\ppjjv.exe36⤵
- Executes dropped EXE
PID:1820 -
\??\c:\7rlxfrl.exec:\7rlxfrl.exe37⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bbtbhn.exec:\bbtbhn.exe38⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nnnnbh.exec:\nnnnbh.exe39⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7vjjp.exec:\7vjjp.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xxfrlff.exec:\xxfrlff.exe41⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nnhhtb.exec:\nnhhtb.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bhtthh.exec:\bhtthh.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ppjvd.exec:\ppjvd.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\frrrrxf.exec:\frrrrxf.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ffxrrfx.exec:\ffxrrfx.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7hbhbb.exec:\7hbhbb.exe47⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vdjjj.exec:\vdjjj.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\llxfrxr.exec:\llxfrxr.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xxxrfxx.exec:\xxxrfxx.exe50⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ntnbnt.exec:\ntnbnt.exe51⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vdvpd.exec:\vdvpd.exe52⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xfrxrff.exec:\xfrxrff.exe53⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lfxfrrr.exec:\lfxfrrr.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tnhbnb.exec:\tnhbnb.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\ntnbnb.exec:\ntnbnb.exe56⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdvvj.exec:\jdvvj.exe57⤵
- Executes dropped EXE
PID:756 -
\??\c:\rlxrrxf.exec:\rlxrrxf.exe58⤵
- Executes dropped EXE
PID:1420 -
\??\c:\htnhtb.exec:\htnhtb.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bhtntb.exec:\bhtntb.exe60⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3jvvd.exec:\3jvvd.exe61⤵
- Executes dropped EXE
PID:1616 -
\??\c:\llrffrr.exec:\llrffrr.exe62⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hhhthb.exec:\hhhthb.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5dvpd.exec:\5dvpd.exe64⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpdpd.exec:\vpdpd.exe65⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xxxlxfr.exec:\xxxlxfr.exe66⤵PID:2896
-
\??\c:\btttbb.exec:\btttbb.exe67⤵PID:2472
-
\??\c:\vvpdp.exec:\vvpdp.exe68⤵PID:2988
-
\??\c:\ppvpp.exec:\ppvpp.exe69⤵PID:1500
-
\??\c:\xxlrfrl.exec:\xxlrfrl.exe70⤵PID:2920
-
\??\c:\9thtnt.exec:\9thtnt.exe71⤵PID:1080
-
\??\c:\bbttbn.exec:\bbttbn.exe72⤵PID:1536
-
\??\c:\vpdjv.exec:\vpdjv.exe73⤵PID:1772
-
\??\c:\ddpjj.exec:\ddpjj.exe74⤵PID:880
-
\??\c:\xxxrxfl.exec:\xxxrxfl.exe75⤵PID:2216
-
\??\c:\nhbhnn.exec:\nhbhnn.exe76⤵PID:2268
-
\??\c:\nhthnb.exec:\nhthnb.exe77⤵PID:2256
-
\??\c:\jvvvd.exec:\jvvvd.exe78⤵PID:2236
-
\??\c:\rrlllrf.exec:\rrlllrf.exe79⤵PID:328
-
\??\c:\xrfllrx.exec:\xrfllrx.exe80⤵PID:848
-
\??\c:\5bhnbn.exec:\5bhnbn.exe81⤵PID:868
-
\??\c:\pvdjj.exec:\pvdjj.exe82⤵PID:2160
-
\??\c:\jjddp.exec:\jjddp.exe83⤵PID:1944
-
\??\c:\rrlxllx.exec:\rrlxllx.exe84⤵PID:1820
-
\??\c:\1hnhbh.exec:\1hnhbh.exe85⤵PID:1260
-
\??\c:\tttbnt.exec:\tttbnt.exe86⤵PID:2116
-
\??\c:\dpdvd.exec:\dpdvd.exe87⤵PID:2152
-
\??\c:\djvjv.exec:\djvjv.exe88⤵PID:2004
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe89⤵PID:2220
-
\??\c:\1nhbnh.exec:\1nhbnh.exe90⤵PID:2140
-
\??\c:\ttnnbh.exec:\ttnnbh.exe91⤵PID:2820
-
\??\c:\7vjpv.exec:\7vjpv.exe92⤵PID:2848
-
\??\c:\xrrffrf.exec:\xrrffrf.exe93⤵PID:2824
-
\??\c:\1xlrrfx.exec:\1xlrrfx.exe94⤵PID:1964
-
\??\c:\nthnhb.exec:\nthnhb.exe95⤵PID:2840
-
\??\c:\5pppp.exec:\5pppp.exe96⤵PID:2196
-
\??\c:\vdpjd.exec:\vdpjd.exe97⤵PID:2612
-
\??\c:\xxflffr.exec:\xxflffr.exe98⤵PID:2040
-
\??\c:\btnhhb.exec:\btnhhb.exe99⤵PID:2648
-
\??\c:\pppjv.exec:\pppjv.exe100⤵PID:2716
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe101⤵PID:1860
-
\??\c:\btttnb.exec:\btttnb.exe102⤵PID:1792
-
\??\c:\5hbhtb.exec:\5hbhtb.exe103⤵PID:2888
-
\??\c:\7dpjv.exec:\7dpjv.exe104⤵PID:844
-
\??\c:\lfxfxfx.exec:\lfxfxfx.exe105⤵PID:1972
-
\??\c:\nnthbh.exec:\nnthbh.exe106⤵PID:756
-
\??\c:\bhhbbt.exec:\bhhbbt.exe107⤵PID:1996
-
\??\c:\vvdvv.exec:\vvdvv.exe108⤵PID:1716
-
\??\c:\rlllflx.exec:\rlllflx.exe109⤵PID:1784
-
\??\c:\xrrxllr.exec:\xrrxllr.exe110⤵PID:1300
-
\??\c:\9tttbh.exec:\9tttbh.exe111⤵PID:1592
-
\??\c:\vvjpd.exec:\vvjpd.exe112⤵PID:2932
-
\??\c:\1rlrllr.exec:\1rlrllr.exe113⤵PID:2884
-
\??\c:\lllrlfx.exec:\lllrlfx.exe114⤵PID:2980
-
\??\c:\nnnbtb.exec:\nnnbtb.exe115⤵PID:1988
-
\??\c:\vjddp.exec:\vjddp.exe116⤵PID:2372
-
\??\c:\llllxfl.exec:\llllxfl.exe117⤵PID:1756
-
\??\c:\llfrfrf.exec:\llfrfrf.exe118⤵PID:2996
-
\??\c:\nnhhbn.exec:\nnhhbn.exe119⤵PID:1340
-
\??\c:\9nnthb.exec:\9nnthb.exe120⤵PID:1288
-
\??\c:\9vjdp.exec:\9vjdp.exe121⤵PID:1648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-