Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 08:28
Behavioral task
behavioral1
Sample
8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe
-
Size
79KB
-
MD5
d75f22ed0e55d80d165b2f5fa84e0140
-
SHA1
95c72aade635f75cae9c2f5a338f3570832913cd
-
SHA256
8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413c
-
SHA512
87e64fef79e8de3d4b4a64f7bf584e1ba4e3a4e173f231802ceaf52fd93a6d3ae9386cf1a4a85aa972a2072bcf33b6297e65f99d7a9db4785ddea4629794ef03
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2J:xhOmTsF93UYfwC6GIout03LzGFE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2876-874-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-824-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2232-758-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2200-751-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2316-725-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-638-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-486-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3032-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-372-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-224-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1284-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-194-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-190-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/668-159-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2772-150-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1940-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/828-91-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-15-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1740-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-1004-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-1017-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/448-1056-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1508-1064-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-1204-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1740 djvdd.exe 2892 3hhbtn.exe 2680 48248.exe 2936 ddvvj.exe 1960 ppvjj.exe 2684 c624628.exe 2312 tbhhnn.exe 2848 q60688.exe 828 c408024.exe 1104 a6826.exe 2076 9pjdd.exe 2348 22802.exe 1940 0064488.exe 3032 lfxfrxl.exe 2772 9vpjj.exe 668 8644062.exe 1608 0804002.exe 1200 jvvdp.exe 2652 20240.exe 2416 8206020.exe 2468 9rfrxff.exe 1284 dddjv.exe 2248 bbbtnb.exe 2456 2642440.exe 1584 024640.exe 1268 fxfrrrl.exe 1952 5xfrfxr.exe 1708 5xxrxlf.exe 568 44266.exe 876 6000086.exe 1992 3pdjd.exe 2780 bbbnhb.exe 2876 44264.exe 2568 48624.exe 1560 lfflxfx.exe 3008 vpdvp.exe 3048 xfxrrrl.exe 2912 9tnnhn.exe 2708 vpppj.exe 2684 dvjjp.exe 2752 rfrfxfx.exe 692 bbhbhb.exe 648 xfrlxrx.exe 828 jdvdd.exe 2580 dvpjd.exe 2264 4028882.exe 2024 6268800.exe 2164 hnbbnt.exe 2948 86240.exe 3028 64062.exe 3032 42466.exe 1324 nttttt.exe 1328 28044.exe 1916 g4484.exe 700 rffxxrr.exe 1760 httttt.exe 2096 djpjv.exe 2652 jjddd.exe 2220 880448.exe 2224 888020.exe 2468 xfxlrlr.exe 1716 446028.exe 2536 lrxrlxx.exe 2476 660206.exe -
resource yara_rule behavioral1/memory/2876-874-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-744-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2316-725-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2204-638-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-611-0x0000000000250000-0x0000000000277000-memory.dmp upx behavioral1/memory/1072-579-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-430-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2264-398-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/828-385-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195fd-298.dat upx behavioral1/files/0x00050000000195fb-289.dat upx behavioral1/files/0x00050000000195f9-281.dat upx behavioral1/files/0x0038000000017021-273.dat upx behavioral1/files/0x00050000000195f7-265.dat upx behavioral1/memory/1708-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c0-256.dat upx behavioral1/memory/1268-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019581-247.dat upx behavioral1/memory/1584-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001955c-238.dat upx behavioral1/memory/2456-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019551-228.dat upx behavioral1/memory/2248-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e6-218.dat upx behavioral1/memory/1284-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e4-208.dat upx behavioral1/files/0x00050000000194da-200.dat upx behavioral1/files/0x00050000000194d0-191.dat upx behavioral1/memory/2652-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c6-181.dat upx behavioral1/memory/1200-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001949d-171.dat upx behavioral1/memory/1608-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019490-161.dat upx behavioral1/files/0x0005000000019481-152.dat upx behavioral1/files/0x000500000001946b-143.dat upx behavioral1/files/0x0005000000019429-135.dat upx behavioral1/memory/3032-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941b-125.dat upx behavioral1/memory/2348-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939c-115.dat upx behavioral1/memory/2348-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2076-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938e-104.dat upx behavioral1/memory/1104-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938a-93.dat upx behavioral1/files/0x0005000000019377-84.dat upx behavioral1/memory/2848-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001932a-75.dat upx behavioral1/files/0x0008000000018703-67.dat upx behavioral1/memory/2684-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000186d8-58.dat upx behavioral1/memory/1960-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c9-49.dat upx behavioral1/memory/1960-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c5-39.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k02804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8640880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048046.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 1740 2196 8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe 30 PID 2196 wrote to memory of 1740 2196 8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe 30 PID 2196 wrote to memory of 1740 2196 8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe 30 PID 2196 wrote to memory of 1740 2196 8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe 30 PID 1740 wrote to memory of 2892 1740 djvdd.exe 31 PID 1740 wrote to memory of 2892 1740 djvdd.exe 31 PID 1740 wrote to memory of 2892 1740 djvdd.exe 31 PID 1740 wrote to memory of 2892 1740 djvdd.exe 31 PID 2892 wrote to memory of 2680 2892 3hhbtn.exe 32 PID 2892 wrote to memory of 2680 2892 3hhbtn.exe 32 PID 2892 wrote to memory of 2680 2892 3hhbtn.exe 32 PID 2892 wrote to memory of 2680 2892 3hhbtn.exe 32 PID 2680 wrote to memory of 2936 2680 48248.exe 33 PID 2680 wrote to memory of 2936 2680 48248.exe 33 PID 2680 wrote to memory of 2936 2680 48248.exe 33 PID 2680 wrote to memory of 2936 2680 48248.exe 33 PID 2936 wrote to memory of 1960 2936 ddvvj.exe 34 PID 2936 wrote to memory of 1960 2936 ddvvj.exe 34 PID 2936 wrote to memory of 1960 2936 ddvvj.exe 34 PID 2936 wrote to memory of 1960 2936 ddvvj.exe 34 PID 1960 wrote to memory of 2684 1960 ppvjj.exe 35 PID 1960 wrote to memory of 2684 1960 ppvjj.exe 35 PID 1960 wrote to memory of 2684 1960 ppvjj.exe 35 PID 1960 wrote to memory of 2684 1960 ppvjj.exe 35 PID 2684 wrote to memory of 2312 2684 c624628.exe 36 PID 2684 wrote to memory of 2312 2684 c624628.exe 36 PID 2684 wrote to memory of 2312 2684 c624628.exe 36 PID 2684 wrote to memory of 2312 2684 c624628.exe 36 PID 2312 wrote to memory of 2848 2312 tbhhnn.exe 37 PID 2312 wrote to memory of 2848 2312 tbhhnn.exe 37 PID 2312 wrote to memory of 2848 2312 tbhhnn.exe 37 PID 2312 wrote to memory of 2848 2312 tbhhnn.exe 37 PID 2848 wrote to memory of 828 2848 q60688.exe 38 PID 2848 wrote to memory of 828 2848 q60688.exe 38 PID 2848 wrote to memory of 828 2848 q60688.exe 38 PID 2848 wrote to memory of 828 2848 q60688.exe 38 PID 828 wrote to memory of 1104 828 c408024.exe 39 PID 828 wrote to memory of 1104 828 c408024.exe 39 PID 828 wrote to memory of 1104 828 c408024.exe 39 PID 828 wrote to memory of 1104 828 c408024.exe 39 PID 1104 wrote to memory of 2076 1104 a6826.exe 40 PID 1104 wrote to memory of 2076 1104 a6826.exe 40 PID 1104 wrote to memory of 2076 1104 a6826.exe 40 PID 1104 wrote to memory of 2076 1104 a6826.exe 40 PID 2076 wrote to memory of 2348 2076 9pjdd.exe 41 PID 2076 wrote to memory of 2348 2076 9pjdd.exe 41 PID 2076 wrote to memory of 2348 2076 9pjdd.exe 41 PID 2076 wrote to memory of 2348 2076 9pjdd.exe 41 PID 2348 wrote to memory of 1940 2348 22802.exe 42 PID 2348 wrote to memory of 1940 2348 22802.exe 42 PID 2348 wrote to memory of 1940 2348 22802.exe 42 PID 2348 wrote to memory of 1940 2348 22802.exe 42 PID 1940 wrote to memory of 3032 1940 0064488.exe 43 PID 1940 wrote to memory of 3032 1940 0064488.exe 43 PID 1940 wrote to memory of 3032 1940 0064488.exe 43 PID 1940 wrote to memory of 3032 1940 0064488.exe 43 PID 3032 wrote to memory of 2772 3032 lfxfrxl.exe 44 PID 3032 wrote to memory of 2772 3032 lfxfrxl.exe 44 PID 3032 wrote to memory of 2772 3032 lfxfrxl.exe 44 PID 3032 wrote to memory of 2772 3032 lfxfrxl.exe 44 PID 2772 wrote to memory of 668 2772 9vpjj.exe 45 PID 2772 wrote to memory of 668 2772 9vpjj.exe 45 PID 2772 wrote to memory of 668 2772 9vpjj.exe 45 PID 2772 wrote to memory of 668 2772 9vpjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe"C:\Users\Admin\AppData\Local\Temp\8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\djvdd.exec:\djvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\3hhbtn.exec:\3hhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\48248.exec:\48248.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ddvvj.exec:\ddvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ppvjj.exec:\ppvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\c624628.exec:\c624628.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\tbhhnn.exec:\tbhhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\q60688.exec:\q60688.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\c408024.exec:\c408024.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\a6826.exec:\a6826.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\9pjdd.exec:\9pjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\22802.exec:\22802.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\0064488.exec:\0064488.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\9vpjj.exec:\9vpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\8644062.exec:\8644062.exe17⤵
- Executes dropped EXE
PID:668 -
\??\c:\0804002.exec:\0804002.exe18⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jvvdp.exec:\jvvdp.exe19⤵
- Executes dropped EXE
PID:1200 -
\??\c:\20240.exec:\20240.exe20⤵
- Executes dropped EXE
PID:2652 -
\??\c:\8206020.exec:\8206020.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9rfrxff.exec:\9rfrxff.exe22⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dddjv.exec:\dddjv.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bbbtnb.exec:\bbbtnb.exe24⤵
- Executes dropped EXE
PID:2248 -
\??\c:\2642440.exec:\2642440.exe25⤵
- Executes dropped EXE
PID:2456 -
\??\c:\024640.exec:\024640.exe26⤵
- Executes dropped EXE
PID:1584 -
\??\c:\fxfrrrl.exec:\fxfrrrl.exe27⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5xfrfxr.exec:\5xfrfxr.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5xxrxlf.exec:\5xxrxlf.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\44266.exec:\44266.exe30⤵
- Executes dropped EXE
PID:568 -
\??\c:\6000086.exec:\6000086.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\3pdjd.exec:\3pdjd.exe32⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bbbnhb.exec:\bbbnhb.exe33⤵
- Executes dropped EXE
PID:2780 -
\??\c:\44264.exec:\44264.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\48624.exec:\48624.exe35⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lfflxfx.exec:\lfflxfx.exe36⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vpdvp.exec:\vpdvp.exe37⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9tnnhn.exec:\9tnnhn.exe39⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vpppj.exec:\vpppj.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvjjp.exec:\dvjjp.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rfrfxfx.exec:\rfrfxfx.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bbhbhb.exec:\bbhbhb.exe43⤵
- Executes dropped EXE
PID:692 -
\??\c:\xfrlxrx.exec:\xfrlxrx.exe44⤵
- Executes dropped EXE
PID:648 -
\??\c:\jdvdd.exec:\jdvdd.exe45⤵
- Executes dropped EXE
PID:828 -
\??\c:\dvpjd.exec:\dvpjd.exe46⤵
- Executes dropped EXE
PID:2580 -
\??\c:\4028882.exec:\4028882.exe47⤵
- Executes dropped EXE
PID:2264 -
\??\c:\6268800.exec:\6268800.exe48⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hnbbnt.exec:\hnbbnt.exe49⤵
- Executes dropped EXE
PID:2164 -
\??\c:\86240.exec:\86240.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\64062.exec:\64062.exe51⤵
- Executes dropped EXE
PID:3028 -
\??\c:\42466.exec:\42466.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nttttt.exec:\nttttt.exe53⤵
- Executes dropped EXE
PID:1324 -
\??\c:\28044.exec:\28044.exe54⤵
- Executes dropped EXE
PID:1328 -
\??\c:\g4484.exec:\g4484.exe55⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rffxxrr.exec:\rffxxrr.exe56⤵
- Executes dropped EXE
PID:700 -
\??\c:\httttt.exec:\httttt.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\djpjv.exec:\djpjv.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jjddd.exec:\jjddd.exe59⤵
- Executes dropped EXE
PID:2652 -
\??\c:\880448.exec:\880448.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\888020.exec:\888020.exe61⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xfxlrlr.exec:\xfxlrlr.exe62⤵
- Executes dropped EXE
PID:2468 -
\??\c:\446028.exec:\446028.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lrxrlxx.exec:\lrxrlxx.exe64⤵
- Executes dropped EXE
PID:2536 -
\??\c:\660206.exec:\660206.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\008282.exec:\008282.exe66⤵PID:3068
-
\??\c:\4048204.exec:\4048204.exe67⤵PID:572
-
\??\c:\vvjvd.exec:\vvjvd.exe68⤵PID:2756
-
\??\c:\004200.exec:\004200.exe69⤵PID:1724
-
\??\c:\w64640.exec:\w64640.exe70⤵PID:1600
-
\??\c:\xrrffll.exec:\xrrffll.exe71⤵PID:2108
-
\??\c:\6464202.exec:\6464202.exe72⤵PID:2588
-
\??\c:\4428286.exec:\4428286.exe73⤵PID:2444
-
\??\c:\vpdpp.exec:\vpdpp.exe74⤵PID:1688
-
\??\c:\lfffxfx.exec:\lfffxfx.exe75⤵PID:2816
-
\??\c:\ddvdd.exec:\ddvdd.exe76⤵PID:1072
-
\??\c:\c428062.exec:\c428062.exe77⤵PID:2780
-
\??\c:\7dpjv.exec:\7dpjv.exe78⤵PID:2680
-
\??\c:\5bnbnt.exec:\5bnbnt.exe79⤵PID:3044
-
\??\c:\g0886.exec:\g0886.exe80⤵PID:1548
-
\??\c:\4040224.exec:\4040224.exe81⤵PID:2936
-
\??\c:\k04860.exec:\k04860.exe82⤵PID:3048
-
\??\c:\266868.exec:\266868.exe83⤵PID:2920
-
\??\c:\8262020.exec:\8262020.exe84⤵PID:2708
-
\??\c:\242802.exec:\242802.exe85⤵PID:2204
-
\??\c:\k26428.exec:\k26428.exe86⤵PID:2256
-
\??\c:\868088.exec:\868088.exe87⤵PID:528
-
\??\c:\xrrrllf.exec:\xrrrllf.exe88⤵PID:1120
-
\??\c:\thbhbn.exec:\thbhbn.exe89⤵PID:2364
-
\??\c:\nnhtth.exec:\nnhtth.exe90⤵PID:2060
-
\??\c:\a6684.exec:\a6684.exe91⤵PID:2076
-
\??\c:\042428.exec:\042428.exe92⤵PID:2040
-
\??\c:\48420.exec:\48420.exe93⤵PID:2036
-
\??\c:\q60680.exec:\q60680.exe94⤵PID:1940
-
\??\c:\4808024.exec:\4808024.exe95⤵PID:2964
-
\??\c:\3pjvd.exec:\3pjvd.exe96⤵PID:2180
-
\??\c:\m8864.exec:\m8864.exe97⤵PID:2168
-
\??\c:\4046648.exec:\4046648.exe98⤵PID:1492
-
\??\c:\q60640.exec:\q60640.exe99⤵PID:2316
-
\??\c:\0420402.exec:\0420402.exe100⤵PID:1480
-
\??\c:\048046.exec:\048046.exe101⤵
- System Location Discovery: System Language Discovery
PID:1148 -
\??\c:\46246.exec:\46246.exe102⤵PID:2516
-
\??\c:\462240.exec:\462240.exe103⤵PID:2200
-
\??\c:\ddddp.exec:\ddddp.exe104⤵PID:2232
-
\??\c:\242244.exec:\242244.exe105⤵PID:2440
-
\??\c:\lrllrrf.exec:\lrllrrf.exe106⤵PID:1284
-
\??\c:\frxxlxl.exec:\frxxlxl.exe107⤵PID:2460
-
\??\c:\o264244.exec:\o264244.exe108⤵PID:1672
-
\??\c:\0040846.exec:\0040846.exe109⤵PID:904
-
\??\c:\0468280.exec:\0468280.exe110⤵PID:468
-
\??\c:\86880.exec:\86880.exe111⤵PID:832
-
\??\c:\c602426.exec:\c602426.exe112⤵PID:2608
-
\??\c:\8622262.exec:\8622262.exe113⤵PID:2592
-
\??\c:\220866.exec:\220866.exe114⤵PID:2424
-
\??\c:\xffrrxx.exec:\xffrrxx.exe115⤵PID:1988
-
\??\c:\thttbh.exec:\thttbh.exe116⤵PID:2864
-
\??\c:\htbbnn.exec:\htbbnn.exe117⤵PID:1832
-
\??\c:\7lfxxlr.exec:\7lfxxlr.exe118⤵PID:1824
-
\??\c:\40644.exec:\40644.exe119⤵PID:1720
-
\??\c:\044644.exec:\044644.exe120⤵PID:2820
-
\??\c:\flxrlfr.exec:\flxrlfr.exe121⤵PID:2808
-
\??\c:\0480880.exec:\0480880.exe122⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-