Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe
-
Size
454KB
-
MD5
151c15a739ef0ab44161b0e07d51a2b0
-
SHA1
0952993bdbe1fe3065913097f0ece4025441c0d7
-
SHA256
e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284d
-
SHA512
99c2faffa84e381ce134ff03d8fb0183000fd53cc693e2ddc5f2ed46b38df3508742b368f6aec6144d842ba659855f46a2eb74ca94830617631d92ec1e31ae17
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2416-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-33-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-55-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2736-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-69-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2792-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-282-0x0000000076FB0000-0x00000000770CF000-memory.dmp family_blackmoon behavioral1/memory/2128-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-882-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-1154-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2936-1223-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-1236-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1196 jpdpj.exe 624 flrrrfr.exe 2344 lxxffxx.exe 2216 ddvdv.exe 2876 llxxxll.exe 2736 xrfllfx.exe 2792 ffflxrl.exe 2776 jpjpj.exe 2624 xfrfxrx.exe 2172 xfffxll.exe 1628 3bbnhh.exe 1112 vdvvp.exe 2956 jdjjj.exe 2364 rrxlxlf.exe 1176 5ntnhn.exe 2596 nnhtnh.exe 1464 jjvdp.exe 316 frfxxrx.exe 1728 hntbtn.exe 3064 hnthbn.exe 2188 ppvdd.exe 2008 jjjpj.exe 3012 rrrlfrl.exe 1152 ntnhbb.exe 1848 nnhnht.exe 2128 jvvjv.exe 2292 flxlrff.exe 2336 1dvpj.exe 2356 pvdvj.exe 1552 fxxfrfx.exe 3056 3nnnth.exe 2420 dpddd.exe 2456 fflrflf.exe 540 nnthbt.exe 2892 jjjdd.exe 2344 dddvp.exe 2872 fllxxff.exe 2840 nthhnh.exe 2644 dvpdd.exe 2820 7rrfxlf.exe 2824 7bbnnh.exe 1984 vdvjj.exe 2652 dvddd.exe 1808 7llrlff.exe 556 nttbnt.exe 2700 3vdvp.exe 2120 jjvpv.exe 2016 lfxrlff.exe 2432 nbnnhn.exe 2680 lrrrxrl.exe 1592 9xlfxrf.exe 1532 tttnnb.exe 1964 vdjvp.exe 1868 fllllfx.exe 2220 htnhnh.exe 2188 vpvvd.exe 2136 5xrlfrl.exe 2064 thhbbn.exe 1564 bntnbn.exe 2912 9rrlxfx.exe 2116 tbbtnh.exe 1920 jpdpd.exe 1304 rllxlrl.exe 744 5tntht.exe -
resource yara_rule behavioral1/memory/2416-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-33-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2216-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-282-0x0000000076FB0000-0x00000000770CF000-memory.dmp upx behavioral1/memory/2128-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-925-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-1109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-1154-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/580-1196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-1299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-1312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1339-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1196 2416 e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe 30 PID 2416 wrote to memory of 1196 2416 e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe 30 PID 2416 wrote to memory of 1196 2416 e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe 30 PID 2416 wrote to memory of 1196 2416 e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe 30 PID 1196 wrote to memory of 624 1196 jpdpj.exe 31 PID 1196 wrote to memory of 624 1196 jpdpj.exe 31 PID 1196 wrote to memory of 624 1196 jpdpj.exe 31 PID 1196 wrote to memory of 624 1196 jpdpj.exe 31 PID 624 wrote to memory of 2344 624 flrrrfr.exe 32 PID 624 wrote to memory of 2344 624 flrrrfr.exe 32 PID 624 wrote to memory of 2344 624 flrrrfr.exe 32 PID 624 wrote to memory of 2344 624 flrrrfr.exe 32 PID 2344 wrote to memory of 2216 2344 lxxffxx.exe 33 PID 2344 wrote to memory of 2216 2344 lxxffxx.exe 33 PID 2344 wrote to memory of 2216 2344 lxxffxx.exe 33 PID 2344 wrote to memory of 2216 2344 lxxffxx.exe 33 PID 2216 wrote to memory of 2876 2216 ddvdv.exe 34 PID 2216 wrote to memory of 2876 2216 ddvdv.exe 34 PID 2216 wrote to memory of 2876 2216 ddvdv.exe 34 PID 2216 wrote to memory of 2876 2216 ddvdv.exe 34 PID 2876 wrote to memory of 2736 2876 llxxxll.exe 35 PID 2876 wrote to memory of 2736 2876 llxxxll.exe 35 PID 2876 wrote to memory of 2736 2876 llxxxll.exe 35 PID 2876 wrote to memory of 2736 2876 llxxxll.exe 35 PID 2736 wrote to memory of 2792 2736 xrfllfx.exe 36 PID 2736 wrote to memory of 2792 2736 xrfllfx.exe 36 PID 2736 wrote to memory of 2792 2736 xrfllfx.exe 36 PID 2736 wrote to memory of 2792 2736 xrfllfx.exe 36 PID 2792 wrote to memory of 2776 2792 ffflxrl.exe 37 PID 2792 wrote to memory of 2776 2792 ffflxrl.exe 37 PID 2792 wrote to memory of 2776 2792 ffflxrl.exe 37 PID 2792 wrote to memory of 2776 2792 ffflxrl.exe 37 PID 2776 wrote to memory of 2624 2776 jpjpj.exe 38 PID 2776 wrote to memory of 2624 2776 jpjpj.exe 38 PID 2776 wrote to memory of 2624 2776 jpjpj.exe 38 PID 2776 wrote to memory of 2624 2776 jpjpj.exe 38 PID 2624 wrote to memory of 2172 2624 xfrfxrx.exe 39 PID 2624 wrote to memory of 2172 2624 xfrfxrx.exe 39 PID 2624 wrote to memory of 2172 2624 xfrfxrx.exe 39 PID 2624 wrote to memory of 2172 2624 xfrfxrx.exe 39 PID 2172 wrote to memory of 1628 2172 xfffxll.exe 40 PID 2172 wrote to memory of 1628 2172 xfffxll.exe 40 PID 2172 wrote to memory of 1628 2172 xfffxll.exe 40 PID 2172 wrote to memory of 1628 2172 xfffxll.exe 40 PID 1628 wrote to memory of 1112 1628 3bbnhh.exe 41 PID 1628 wrote to memory of 1112 1628 3bbnhh.exe 41 PID 1628 wrote to memory of 1112 1628 3bbnhh.exe 41 PID 1628 wrote to memory of 1112 1628 3bbnhh.exe 41 PID 1112 wrote to memory of 2956 1112 vdvvp.exe 42 PID 1112 wrote to memory of 2956 1112 vdvvp.exe 42 PID 1112 wrote to memory of 2956 1112 vdvvp.exe 42 PID 1112 wrote to memory of 2956 1112 vdvvp.exe 42 PID 2956 wrote to memory of 2364 2956 jdjjj.exe 43 PID 2956 wrote to memory of 2364 2956 jdjjj.exe 43 PID 2956 wrote to memory of 2364 2956 jdjjj.exe 43 PID 2956 wrote to memory of 2364 2956 jdjjj.exe 43 PID 2364 wrote to memory of 1176 2364 rrxlxlf.exe 44 PID 2364 wrote to memory of 1176 2364 rrxlxlf.exe 44 PID 2364 wrote to memory of 1176 2364 rrxlxlf.exe 44 PID 2364 wrote to memory of 1176 2364 rrxlxlf.exe 44 PID 1176 wrote to memory of 2596 1176 5ntnhn.exe 45 PID 1176 wrote to memory of 2596 1176 5ntnhn.exe 45 PID 1176 wrote to memory of 2596 1176 5ntnhn.exe 45 PID 1176 wrote to memory of 2596 1176 5ntnhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe"C:\Users\Admin\AppData\Local\Temp\e142dcd5f51f185d5875042fcdeb5390c1d72daedbb9692dd91ec99c5e9c284dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\jpdpj.exec:\jpdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\flrrrfr.exec:\flrrrfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\lxxffxx.exec:\lxxffxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\ddvdv.exec:\ddvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\llxxxll.exec:\llxxxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xrfllfx.exec:\xrfllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ffflxrl.exec:\ffflxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jpjpj.exec:\jpjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xfrfxrx.exec:\xfrfxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xfffxll.exec:\xfffxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\3bbnhh.exec:\3bbnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vdvvp.exec:\vdvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\jdjjj.exec:\jdjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rrxlxlf.exec:\rrxlxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5ntnhn.exec:\5ntnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\nnhtnh.exec:\nnhtnh.exe17⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjvdp.exec:\jjvdp.exe18⤵
- Executes dropped EXE
PID:1464 -
\??\c:\frfxxrx.exec:\frfxxrx.exe19⤵
- Executes dropped EXE
PID:316 -
\??\c:\hntbtn.exec:\hntbtn.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hnthbn.exec:\hnthbn.exe21⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ppvdd.exec:\ppvdd.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jjjpj.exec:\jjjpj.exe23⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rrrlfrl.exec:\rrrlfrl.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ntnhbb.exec:\ntnhbb.exe25⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nnhnht.exec:\nnhnht.exe26⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jvvjv.exec:\jvvjv.exe27⤵
- Executes dropped EXE
PID:2128 -
\??\c:\flxlrff.exec:\flxlrff.exe28⤵
- Executes dropped EXE
PID:2292 -
\??\c:\1dvpj.exec:\1dvpj.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pvdvj.exec:\pvdvj.exe30⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fxxfrfx.exec:\fxxfrfx.exe31⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3nnnth.exec:\3nnnth.exe32⤵
- Executes dropped EXE
PID:3056 -
\??\c:\dpddd.exec:\dpddd.exe33⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9pjdd.exec:\9pjdd.exe34⤵PID:1516
-
\??\c:\fflrflf.exec:\fflrflf.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nnthbt.exec:\nnthbt.exe36⤵
- Executes dropped EXE
PID:540 -
\??\c:\jjjdd.exec:\jjjdd.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dddvp.exec:\dddvp.exe38⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fllxxff.exec:\fllxxff.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nthhnh.exec:\nthhnh.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dvpdd.exec:\dvpdd.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7rrfxlf.exec:\7rrfxlf.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7bbnnh.exec:\7bbnnh.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vdvjj.exec:\vdvjj.exe44⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvddd.exec:\dvddd.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\7llrlff.exec:\7llrlff.exe46⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nttbnt.exec:\nttbnt.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\3vdvp.exec:\3vdvp.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jjvpv.exec:\jjvpv.exe49⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lfxrlff.exec:\lfxrlff.exe50⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbnnhn.exec:\nbnnhn.exe51⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lrrrxrl.exec:\lrrrxrl.exe52⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9xlfxrf.exec:\9xlfxrf.exe53⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tttnnb.exec:\tttnnb.exe54⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vdjvp.exec:\vdjvp.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fllllfx.exec:\fllllfx.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\htnhnh.exec:\htnhnh.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpvvd.exec:\vpvvd.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5xrlfrl.exec:\5xrlfrl.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\thhbbn.exec:\thhbbn.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bntnbn.exec:\bntnbn.exe61⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9rrlxfx.exec:\9rrlxfx.exe62⤵
- Executes dropped EXE
PID:2912 -
\??\c:\tbbtnh.exec:\tbbtnh.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jpdpd.exec:\jpdpd.exe64⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rllxlrl.exec:\rllxlrl.exe65⤵
- Executes dropped EXE
PID:1304 -
\??\c:\5tntht.exec:\5tntht.exe66⤵
- Executes dropped EXE
PID:744 -
\??\c:\jvpvj.exec:\jvpvj.exe67⤵PID:2692
-
\??\c:\rlxxffx.exec:\rlxxffx.exe68⤵PID:2004
-
\??\c:\hhttbt.exec:\hhttbt.exe69⤵PID:872
-
\??\c:\1pvdp.exec:\1pvdp.exe70⤵PID:1512
-
\??\c:\xfrxrfx.exec:\xfrxrfx.exe71⤵PID:1876
-
\??\c:\tntbnt.exec:\tntbnt.exe72⤵PID:1232
-
\??\c:\xlrrfxx.exec:\xlrrfxx.exe73⤵PID:2160
-
\??\c:\ttnntb.exec:\ttnntb.exe74⤵PID:1620
-
\??\c:\5vppd.exec:\5vppd.exe75⤵PID:2344
-
\??\c:\pvvjd.exec:\pvvjd.exe76⤵PID:2872
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe77⤵PID:2836
-
\??\c:\nnnbth.exec:\nnnbth.exe78⤵PID:2756
-
\??\c:\ddjpp.exec:\ddjpp.exe79⤵PID:2800
-
\??\c:\xfxlfrl.exec:\xfxlfrl.exe80⤵PID:2736
-
\??\c:\5xrxrrx.exec:\5xrxrrx.exe81⤵PID:764
-
\??\c:\hnntnb.exec:\hnntnb.exe82⤵PID:2788
-
\??\c:\pvddv.exec:\pvddv.exe83⤵PID:2636
-
\??\c:\lrxxlfr.exec:\lrxxlfr.exe84⤵PID:2676
-
\??\c:\7fflxfl.exec:\7fflxfl.exe85⤵PID:2612
-
\??\c:\bbhtth.exec:\bbhtth.exe86⤵PID:2184
-
\??\c:\vvdjv.exec:\vvdjv.exe87⤵PID:1008
-
\??\c:\xllxrfx.exec:\xllxrfx.exe88⤵PID:296
-
\??\c:\hhbhnt.exec:\hhbhnt.exe89⤵PID:340
-
\??\c:\ttnnbh.exec:\ttnnbh.exe90⤵PID:1416
-
\??\c:\ddpjv.exec:\ddpjv.exe91⤵PID:1896
-
\??\c:\7xxlfxx.exec:\7xxlfxx.exe92⤵PID:616
-
\??\c:\rrxfrxr.exec:\rrxfrxr.exe93⤵PID:2520
-
\??\c:\bbhnht.exec:\bbhnht.exe94⤵PID:1616
-
\??\c:\1dvdd.exec:\1dvdd.exe95⤵PID:2932
-
\??\c:\ddjjd.exec:\ddjjd.exe96⤵PID:580
-
\??\c:\lrxllrl.exec:\lrxllrl.exe97⤵PID:1356
-
\??\c:\ttbbtb.exec:\ttbbtb.exe98⤵PID:3064
-
\??\c:\5vdvd.exec:\5vdvd.exe99⤵PID:2976
-
\??\c:\9ddpj.exec:\9ddpj.exe100⤵PID:848
-
\??\c:\5llflrx.exec:\5llflrx.exe101⤵PID:2188
-
\??\c:\ttbnnb.exec:\ttbnnb.exe102⤵PID:1284
-
\??\c:\vpjpp.exec:\vpjpp.exe103⤵PID:2444
-
\??\c:\vjdpp.exec:\vjdpp.exe104⤵PID:1564
-
\??\c:\lllxlxx.exec:\lllxlxx.exe105⤵PID:1224
-
\??\c:\thnnth.exec:\thnnth.exe106⤵PID:2292
-
\??\c:\bhnnhb.exec:\bhnnhb.exe107⤵PID:2504
-
\??\c:\pdjvp.exec:\pdjvp.exe108⤵PID:1084
-
\??\c:\xlrlxrf.exec:\xlrlxrf.exe109⤵PID:744
-
\??\c:\3xlrlrr.exec:\3xlrlrr.exe110⤵PID:2420
-
\??\c:\htnhbn.exec:\htnhbn.exe111⤵PID:2004
-
\??\c:\9djdj.exec:\9djdj.exe112⤵PID:1744
-
\??\c:\lllrfrf.exec:\lllrfrf.exe113⤵PID:1928
-
\??\c:\rrxfrlf.exec:\rrxfrlf.exe114⤵PID:2352
-
\??\c:\nbhbnb.exec:\nbhbnb.exe115⤵PID:1400
-
\??\c:\ddjdv.exec:\ddjdv.exe116⤵PID:2160
-
\??\c:\jppjj.exec:\jppjj.exe117⤵PID:1620
-
\??\c:\lrfrlff.exec:\lrfrlff.exe118⤵PID:1220
-
\??\c:\1ttbnb.exec:\1ttbnb.exe119⤵PID:2256
-
\??\c:\1pjvj.exec:\1pjvj.exe120⤵PID:2836
-
\??\c:\jjjdv.exec:\jjjdv.exe121⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-