Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 11:20
Behavioral task
behavioral1
Sample
d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe
-
Size
334KB
-
MD5
54d905d46ed09076a8632e47fce229c0
-
SHA1
44dabfef9df96c412e869799755c28383bfedb3c
-
SHA256
d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64
-
SHA512
e01c9703fd0585fe5ebd1cbaa5f0d255d2b126adf31d021d4f12f60757e0d4c5d62b0db687e8870e5fb24c7212d459198e64f6975d27fdb3145b43cf342e5116
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR4:R4wFHoSHYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2792-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-22-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2836-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1472-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/480-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-194-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2300-177-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2168-168-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1660-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-326-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1920-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/996-361-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2168-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-539-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3060-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-621-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1216-798-0x0000000077370000-0x000000007746A000-memory.dmp family_blackmoon behavioral1/memory/1216-1061-0x0000000077250000-0x000000007736F000-memory.dmp family_blackmoon behavioral1/memory/1216-1321-0x0000000077370000-0x000000007746A000-memory.dmp family_blackmoon behavioral1/memory/1216-9907-0x0000000077370000-0x000000007746A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 ddpdj.exe 2836 1lffxff.exe 2952 xxrxflx.exe 2720 vjjpd.exe 2560 xrfxflr.exe 3012 bbnnnb.exe 1676 rflxxlf.exe 2648 nnnttb.exe 2384 vjvpj.exe 1672 rlrrxrx.exe 1472 thtnth.exe 2024 jvddp.exe 2012 llflrrr.exe 1952 bhhbhn.exe 2760 pdpvd.exe 1560 frrxrrf.exe 480 nhhnbn.exe 2404 pjddp.exe 2168 9lfrxrl.exe 2300 thnhnh.exe 2188 5pddj.exe 2344 rfrrrrf.exe 2092 3nhhbb.exe 2432 dppdv.exe 288 rrrllxr.exe 1660 jdpvp.exe 1324 fllllfx.exe 2992 3tbbbb.exe 2156 7dvdp.exe 2480 rlxlllr.exe 2288 htnhtt.exe 2296 jdvdj.exe 1444 5xxxffr.exe 2192 btnnbt.exe 2884 vvdjp.exe 1656 llrrlxr.exe 2892 tbhbbb.exe 2652 1vdjp.exe 2568 xrrxrfx.exe 2716 hbnnbh.exe 2804 7frrrxl.exe 2596 1rxxffl.exe 1920 nhhnnb.exe 2472 jdppd.exe 2972 5xrxllr.exe 1924 5btbhn.exe 2644 tnhnbh.exe 996 vvdjp.exe 1420 ffllfrf.exe 1692 nhbbbh.exe 2028 7vjpj.exe 1992 jvpdd.exe 1428 lfxlxrl.exe 1056 nnhtth.exe 680 jdvvd.exe 600 1dvdd.exe 2808 5rfxfrx.exe 1748 btbhnn.exe 2160 btntbh.exe 2252 jdpvd.exe 1696 rrxlfrr.exe 2168 nhttth.exe 2284 nttbbb.exe 1412 jjppd.exe -
resource yara_rule behavioral1/memory/2792-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012101-5.dat upx behavioral1/memory/2792-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f00000001749c-16.dat upx behavioral1/memory/2836-22-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2952-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000174bf-23.dat upx behavioral1/files/0x0016000000018657-33.dat upx behavioral1/memory/2952-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001867d-44.dat upx behavioral1/memory/2560-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001878d-51.dat upx behavioral1/files/0x00070000000190c6-58.dat upx behavioral1/memory/1676-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1676-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000190c9-67.dat upx behavioral1/files/0x00080000000191fd-76.dat upx behavioral1/files/0x0005000000019c3a-83.dat upx behavioral1/files/0x0005000000019c53-91.dat upx behavioral1/files/0x0005000000019d20-99.dat upx behavioral1/memory/1472-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1472-98-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019d44-108.dat upx behavioral1/memory/2024-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2012-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019da4-116.dat upx behavioral1/files/0x0005000000019db8-125.dat upx behavioral1/memory/2760-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f9f-133.dat upx behavioral1/memory/1560-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fb9-144.dat upx behavioral1/memory/480-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a067-150.dat upx behavioral1/files/0x000500000001a07b-162.dat upx behavioral1/memory/2404-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0a1-171.dat upx behavioral1/memory/2168-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a301-180.dat upx behavioral1/memory/2300-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0032000000017474-188.dat upx behavioral1/files/0x000500000001a345-196.dat upx behavioral1/memory/2344-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42b-204.dat upx behavioral1/files/0x000500000001a42d-212.dat upx behavioral1/files/0x000500000001a431-228.dat upx behavioral1/memory/1660-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42f-220.dat upx behavioral1/memory/2404-155-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a434-234.dat upx behavioral1/files/0x000500000001a46a-241.dat upx behavioral1/files/0x000500000001a48c-248.dat upx behavioral1/files/0x000500000001a48e-255.dat upx behavioral1/memory/2288-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49a-263.dat upx behavioral1/memory/2652-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-332-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxrrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2892 2792 d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe 30 PID 2792 wrote to memory of 2892 2792 d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe 30 PID 2792 wrote to memory of 2892 2792 d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe 30 PID 2792 wrote to memory of 2892 2792 d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe 30 PID 2892 wrote to memory of 2836 2892 ddpdj.exe 31 PID 2892 wrote to memory of 2836 2892 ddpdj.exe 31 PID 2892 wrote to memory of 2836 2892 ddpdj.exe 31 PID 2892 wrote to memory of 2836 2892 ddpdj.exe 31 PID 2836 wrote to memory of 2952 2836 1lffxff.exe 32 PID 2836 wrote to memory of 2952 2836 1lffxff.exe 32 PID 2836 wrote to memory of 2952 2836 1lffxff.exe 32 PID 2836 wrote to memory of 2952 2836 1lffxff.exe 32 PID 2952 wrote to memory of 2720 2952 xxrxflx.exe 33 PID 2952 wrote to memory of 2720 2952 xxrxflx.exe 33 PID 2952 wrote to memory of 2720 2952 xxrxflx.exe 33 PID 2952 wrote to memory of 2720 2952 xxrxflx.exe 33 PID 2720 wrote to memory of 2560 2720 vjjpd.exe 34 PID 2720 wrote to memory of 2560 2720 vjjpd.exe 34 PID 2720 wrote to memory of 2560 2720 vjjpd.exe 34 PID 2720 wrote to memory of 2560 2720 vjjpd.exe 34 PID 2560 wrote to memory of 3012 2560 xrfxflr.exe 35 PID 2560 wrote to memory of 3012 2560 xrfxflr.exe 35 PID 2560 wrote to memory of 3012 2560 xrfxflr.exe 35 PID 2560 wrote to memory of 3012 2560 xrfxflr.exe 35 PID 3012 wrote to memory of 1676 3012 bbnnnb.exe 36 PID 3012 wrote to memory of 1676 3012 bbnnnb.exe 36 PID 3012 wrote to memory of 1676 3012 bbnnnb.exe 36 PID 3012 wrote to memory of 1676 3012 bbnnnb.exe 36 PID 1676 wrote to memory of 2648 1676 rflxxlf.exe 37 PID 1676 wrote to memory of 2648 1676 rflxxlf.exe 37 PID 1676 wrote to memory of 2648 1676 rflxxlf.exe 37 PID 1676 wrote to memory of 2648 1676 rflxxlf.exe 37 PID 2648 wrote to memory of 2384 2648 nnnttb.exe 38 PID 2648 wrote to memory of 2384 2648 nnnttb.exe 38 PID 2648 wrote to memory of 2384 2648 nnnttb.exe 38 PID 2648 wrote to memory of 2384 2648 nnnttb.exe 38 PID 2384 wrote to memory of 1672 2384 vjvpj.exe 39 PID 2384 wrote to memory of 1672 2384 vjvpj.exe 39 PID 2384 wrote to memory of 1672 2384 vjvpj.exe 39 PID 2384 wrote to memory of 1672 2384 vjvpj.exe 39 PID 1672 wrote to memory of 1472 1672 rlrrxrx.exe 40 PID 1672 wrote to memory of 1472 1672 rlrrxrx.exe 40 PID 1672 wrote to memory of 1472 1672 rlrrxrx.exe 40 PID 1672 wrote to memory of 1472 1672 rlrrxrx.exe 40 PID 1472 wrote to memory of 2024 1472 thtnth.exe 41 PID 1472 wrote to memory of 2024 1472 thtnth.exe 41 PID 1472 wrote to memory of 2024 1472 thtnth.exe 41 PID 1472 wrote to memory of 2024 1472 thtnth.exe 41 PID 2024 wrote to memory of 2012 2024 jvddp.exe 42 PID 2024 wrote to memory of 2012 2024 jvddp.exe 42 PID 2024 wrote to memory of 2012 2024 jvddp.exe 42 PID 2024 wrote to memory of 2012 2024 jvddp.exe 42 PID 2012 wrote to memory of 1952 2012 llflrrr.exe 43 PID 2012 wrote to memory of 1952 2012 llflrrr.exe 43 PID 2012 wrote to memory of 1952 2012 llflrrr.exe 43 PID 2012 wrote to memory of 1952 2012 llflrrr.exe 43 PID 1952 wrote to memory of 2760 1952 bhhbhn.exe 44 PID 1952 wrote to memory of 2760 1952 bhhbhn.exe 44 PID 1952 wrote to memory of 2760 1952 bhhbhn.exe 44 PID 1952 wrote to memory of 2760 1952 bhhbhn.exe 44 PID 2760 wrote to memory of 1560 2760 pdpvd.exe 45 PID 2760 wrote to memory of 1560 2760 pdpvd.exe 45 PID 2760 wrote to memory of 1560 2760 pdpvd.exe 45 PID 2760 wrote to memory of 1560 2760 pdpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe"C:\Users\Admin\AppData\Local\Temp\d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ddpdj.exec:\ddpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\1lffxff.exec:\1lffxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xxrxflx.exec:\xxrxflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\vjjpd.exec:\vjjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xrfxflr.exec:\xrfxflr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bbnnnb.exec:\bbnnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rflxxlf.exec:\rflxxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\nnnttb.exec:\nnnttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vjvpj.exec:\vjvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\thtnth.exec:\thtnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\jvddp.exec:\jvddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\llflrrr.exec:\llflrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\bhhbhn.exec:\bhhbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\pdpvd.exec:\pdpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\frrxrrf.exec:\frrxrrf.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\nhhnbn.exec:\nhhnbn.exe18⤵
- Executes dropped EXE
PID:480 -
\??\c:\pjddp.exec:\pjddp.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9lfrxrl.exec:\9lfrxrl.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\thnhnh.exec:\thnhnh.exe21⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5pddj.exec:\5pddj.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe23⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3nhhbb.exec:\3nhhbb.exe24⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dppdv.exec:\dppdv.exe25⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rrrllxr.exec:\rrrllxr.exe26⤵
- Executes dropped EXE
PID:288 -
\??\c:\jdpvp.exec:\jdpvp.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fllllfx.exec:\fllllfx.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\3tbbbb.exec:\3tbbbb.exe29⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7dvdp.exec:\7dvdp.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rlxlllr.exec:\rlxlllr.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\htnhtt.exec:\htnhtt.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jdvdj.exec:\jdvdj.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5xxxffr.exec:\5xxxffr.exe34⤵
- Executes dropped EXE
PID:1444 -
\??\c:\btnnbt.exec:\btnnbt.exe35⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvdjp.exec:\vvdjp.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\llrrlxr.exec:\llrrlxr.exe37⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tbhbbb.exec:\tbhbbb.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1vdjp.exec:\1vdjp.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbnnbh.exec:\hbnnbh.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\7frrrxl.exec:\7frrrxl.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804 -
\??\c:\1rxxffl.exec:\1rxxffl.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nhhnnb.exec:\nhhnnb.exe44⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jdppd.exec:\jdppd.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5xrxllr.exec:\5xrxllr.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5btbhn.exec:\5btbhn.exe47⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tnhnbh.exec:\tnhnbh.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vvdjp.exec:\vvdjp.exe49⤵
- Executes dropped EXE
PID:996 -
\??\c:\ffllfrf.exec:\ffllfrf.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nhbbbh.exec:\nhbbbh.exe51⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7vjpj.exec:\7vjpj.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jvpdd.exec:\jvpdd.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe54⤵
- Executes dropped EXE
PID:1428 -
\??\c:\nnhtth.exec:\nnhtth.exe55⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jdvvd.exec:\jdvvd.exe56⤵
- Executes dropped EXE
PID:680 -
\??\c:\1dvdd.exec:\1dvdd.exe57⤵
- Executes dropped EXE
PID:600 -
\??\c:\5rfxfrx.exec:\5rfxfrx.exe58⤵
- Executes dropped EXE
PID:2808 -
\??\c:\btbhnn.exec:\btbhnn.exe59⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btntbh.exec:\btntbh.exe60⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jdpvd.exec:\jdpvd.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rrxlfrr.exec:\rrxlfrr.exe62⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nhttth.exec:\nhttth.exe63⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nttbbb.exec:\nttbbb.exe64⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jjppd.exec:\jjppd.exe65⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rlffrxf.exec:\rlffrxf.exe66⤵PID:1896
-
\??\c:\bhthbt.exec:\bhthbt.exe67⤵PID:2344
-
\??\c:\nhhntt.exec:\nhhntt.exe68⤵PID:828
-
\??\c:\vpdpp.exec:\vpdpp.exe69⤵PID:1556
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe70⤵PID:2504
-
\??\c:\lrxxxfl.exec:\lrxxxfl.exe71⤵PID:1972
-
\??\c:\nhtnbh.exec:\nhtnbh.exe72⤵PID:2000
-
\??\c:\pjdpp.exec:\pjdpp.exe73⤵PID:1784
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe74⤵PID:1232
-
\??\c:\9nntnt.exec:\9nntnt.exe75⤵PID:2464
-
\??\c:\tntbhn.exec:\tntbhn.exe76⤵PID:2936
-
\??\c:\vpdjj.exec:\vpdjj.exe77⤵PID:2064
-
\??\c:\9rxrfrx.exec:\9rxrfrx.exe78⤵PID:1688
-
\??\c:\3thnnt.exec:\3thnnt.exe79⤵PID:1468
-
\??\c:\bthhhn.exec:\bthhhn.exe80⤵PID:904
-
\??\c:\dvppv.exec:\dvppv.exe81⤵PID:2296
-
\??\c:\rfrfrfl.exec:\rfrfrfl.exe82⤵PID:1856
-
\??\c:\tthnht.exec:\tthnht.exe83⤵PID:2140
-
\??\c:\3bbnbh.exec:\3bbnbh.exe84⤵PID:1508
-
\??\c:\pdvpv.exec:\pdvpv.exe85⤵PID:2712
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe86⤵PID:3060
-
\??\c:\xlxrfrx.exec:\xlxrfrx.exe87⤵PID:2688
-
\??\c:\nbnhnn.exec:\nbnhnn.exe88⤵PID:2952
-
\??\c:\vdjvp.exec:\vdjvp.exe89⤵PID:2612
-
\??\c:\xlrxllr.exec:\xlrxllr.exe90⤵PID:2256
-
\??\c:\9xlfrff.exec:\9xlfrff.exe91⤵PID:2672
-
\??\c:\ttntbh.exec:\ttntbh.exe92⤵PID:3012
-
\??\c:\tntntt.exec:\tntntt.exe93⤵PID:3068
-
\??\c:\3jdpp.exec:\3jdpp.exe94⤵PID:2244
-
\??\c:\lfxxllr.exec:\lfxxllr.exe95⤵PID:2384
-
\??\c:\bntbbb.exec:\bntbbb.exe96⤵PID:2144
-
\??\c:\htntbh.exec:\htntbh.exe97⤵PID:1996
-
\??\c:\vjvvd.exec:\vjvvd.exe98⤵PID:2268
-
\??\c:\7lrxrxf.exec:\7lrxrxf.exe99⤵PID:1380
-
\??\c:\lxrlffl.exec:\lxrlffl.exe100⤵PID:796
-
\??\c:\bnbhnt.exec:\bnbhnt.exe101⤵PID:1880
-
\??\c:\dpddd.exec:\dpddd.exe102⤵PID:2532
-
\??\c:\jdjvd.exec:\jdjvd.exe103⤵PID:920
-
\??\c:\fxrfllf.exec:\fxrfllf.exe104⤵PID:532
-
\??\c:\nhthnn.exec:\nhthnn.exe105⤵PID:596
-
\??\c:\vdppv.exec:\vdppv.exe106⤵PID:1684
-
\??\c:\vpjdj.exec:\vpjdj.exe107⤵PID:2404
-
\??\c:\lxlfllx.exec:\lxlfllx.exe108⤵PID:2240
-
\??\c:\hbthbh.exec:\hbthbh.exe109⤵PID:2088
-
\??\c:\dvjpj.exec:\dvjpj.exe110⤵PID:2200
-
\??\c:\pppvj.exec:\pppvj.exe111⤵PID:1704
-
\??\c:\fxxlrxf.exec:\fxxlrxf.exe112⤵PID:2216
-
\??\c:\7nntnb.exec:\7nntnb.exe113⤵PID:2412
-
\??\c:\dpvdp.exec:\dpvdp.exe114⤵PID:1448
-
\??\c:\jjdpv.exec:\jjdpv.exe115⤵PID:828
-
\??\c:\9lxxlxl.exec:\9lxxlxl.exe116⤵PID:1556
-
\??\c:\3nhhhn.exec:\3nhhhn.exe117⤵PID:1708
-
\??\c:\ttthnb.exec:\ttthnb.exe118⤵PID:1972
-
\??\c:\5jvdj.exec:\5jvdj.exe119⤵PID:2000
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe120⤵PID:1784
-
\??\c:\xxlrffl.exec:\xxlrffl.exe121⤵PID:1652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-