Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:20
Behavioral task
behavioral1
Sample
14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe
-
Size
332KB
-
MD5
e3dd7ebc883d19045f227aecce9b6ab0
-
SHA1
e1df6f7fd9b44688fc41ce7bfbc09815c68ad045
-
SHA256
14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7
-
SHA512
1911a2b81908e638bd16067b6d473e9c1cde03223902a80a54ba5dd84459ade1293b560d9fe925103483115417ce2fd43fba59d44ddcf6435a41be6ff01d16ee
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbev:R4wFHoSHYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1052-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-59-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2760-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/872-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-140-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1932-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-218-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1468-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/912-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-289-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1544-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-296-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2704-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-393-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2932-399-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3028-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-634-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1524-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-697-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/788-737-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2976-744-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2976-745-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2348-756-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2976-763-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2272-6752-0x0000000077210000-0x000000007730A000-memory.dmp family_blackmoon behavioral1/memory/2272-6751-0x0000000077310000-0x000000007742F000-memory.dmp family_blackmoon behavioral1/memory/2272-17590-0x0000000077310000-0x000000007742F000-memory.dmp family_blackmoon behavioral1/memory/2272-18688-0x0000000077210000-0x000000007730A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1052 pdpjd.exe 2940 xxxfxfr.exe 2412 hbhtnh.exe 2120 xlxfffl.exe 2780 9httbt.exe 2768 bthntt.exe 2760 ddpvj.exe 2576 fffrlxr.exe 2712 nhtbbb.exe 2556 jjjvp.exe 2924 9nbttt.exe 1656 9nhhht.exe 540 ffrrrrx.exe 2312 frlxffx.exe 872 hbnbhh.exe 1708 1rxxflx.exe 2080 ttnbnb.exe 1932 3ddpp.exe 1740 fxrxffl.exe 1572 tbthtb.exe 276 vppdv.exe 2064 vpjpv.exe 1792 rrfxffl.exe 1640 tnbhnb.exe 860 pvjdp.exe 1712 lllrllf.exe 1468 tnbtth.exe 3052 pvpvj.exe 2292 rrllrxf.exe 568 nnhtbh.exe 3020 dvppd.exe 2116 ddvdp.exe 912 nttntt.exe 2056 pdvdp.exe 1840 dvpvv.exe 1544 7rxfxxl.exe 2944 hbthtt.exe 2896 1bthnh.exe 2656 1jjdj.exe 1952 3rxlffr.exe 2704 1rfrxfl.exe 2772 hhhnbh.exe 2736 pvpjj.exe 2564 vvjjp.exe 2596 xrllxxf.exe 2536 ttnntb.exe 2608 bbtbht.exe 2592 pvjvd.exe 1624 9flrflx.exe 2932 3xxflxr.exe 332 hhbbtb.exe 604 bbtnhh.exe 2036 jvpdj.exe 872 rllxlrr.exe 1316 lxlrfxf.exe 1568 bhbhtb.exe 1880 5jdjv.exe 2068 jjpjd.exe 1944 rfxfrrl.exe 2436 tththt.exe 1572 hbbntb.exe 276 jdpdp.exe 2344 1lfrfrf.exe 328 rlflllf.exe -
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000013a51-10.dat upx behavioral1/memory/1052-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2384-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f2-18.dat upx behavioral1/memory/2412-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f8-25.dat upx behavioral1/memory/2412-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018731-34.dat upx behavioral1/files/0x0006000000018742-43.dat upx behavioral1/memory/2780-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001878c-51.dat upx behavioral1/files/0x0007000000018bf3-62.dat upx behavioral1/memory/2760-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019438-69.dat upx behavioral1/files/0x0005000000019456-77.dat upx behavioral1/memory/2712-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001945c-85.dat upx behavioral1/files/0x0005000000019467-94.dat upx behavioral1/memory/2924-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019496-102.dat upx behavioral1/files/0x00050000000194ad-109.dat upx behavioral1/memory/540-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d0-117.dat upx behavioral1/memory/2312-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-124.dat upx behavioral1/memory/872-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194fc-133.dat upx behavioral1/files/0x0005000000019506-141.dat upx behavioral1/memory/2080-148-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x000500000001952f-149.dat upx behavioral1/files/0x000500000001957e-156.dat upx behavioral1/memory/1740-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-165.dat upx behavioral1/files/0x00050000000195e6-172.dat upx behavioral1/memory/1572-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/276-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-181.dat upx behavioral1/files/0x000500000001961f-189.dat upx behavioral1/memory/1792-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001700000001866f-197.dat upx behavioral1/files/0x0005000000019621-204.dat upx behavioral1/files/0x0005000000019622-211.dat upx behavioral1/files/0x0005000000019623-220.dat upx behavioral1/memory/1712-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1468-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-228.dat upx behavioral1/files/0x0005000000019627-236.dat upx behavioral1/memory/2292-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019629-243.dat upx behavioral1/files/0x000500000001962b-252.dat upx behavioral1/memory/3020-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001963b-259.dat upx behavioral1/memory/912-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1840-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-334-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1052 2384 14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe 31 PID 2384 wrote to memory of 1052 2384 14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe 31 PID 2384 wrote to memory of 1052 2384 14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe 31 PID 2384 wrote to memory of 1052 2384 14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe 31 PID 1052 wrote to memory of 2940 1052 pdpjd.exe 32 PID 1052 wrote to memory of 2940 1052 pdpjd.exe 32 PID 1052 wrote to memory of 2940 1052 pdpjd.exe 32 PID 1052 wrote to memory of 2940 1052 pdpjd.exe 32 PID 2940 wrote to memory of 2412 2940 xxxfxfr.exe 33 PID 2940 wrote to memory of 2412 2940 xxxfxfr.exe 33 PID 2940 wrote to memory of 2412 2940 xxxfxfr.exe 33 PID 2940 wrote to memory of 2412 2940 xxxfxfr.exe 33 PID 2412 wrote to memory of 2120 2412 hbhtnh.exe 34 PID 2412 wrote to memory of 2120 2412 hbhtnh.exe 34 PID 2412 wrote to memory of 2120 2412 hbhtnh.exe 34 PID 2412 wrote to memory of 2120 2412 hbhtnh.exe 34 PID 2120 wrote to memory of 2780 2120 xlxfffl.exe 35 PID 2120 wrote to memory of 2780 2120 xlxfffl.exe 35 PID 2120 wrote to memory of 2780 2120 xlxfffl.exe 35 PID 2120 wrote to memory of 2780 2120 xlxfffl.exe 35 PID 2780 wrote to memory of 2768 2780 9httbt.exe 36 PID 2780 wrote to memory of 2768 2780 9httbt.exe 36 PID 2780 wrote to memory of 2768 2780 9httbt.exe 36 PID 2780 wrote to memory of 2768 2780 9httbt.exe 36 PID 2768 wrote to memory of 2760 2768 bthntt.exe 37 PID 2768 wrote to memory of 2760 2768 bthntt.exe 37 PID 2768 wrote to memory of 2760 2768 bthntt.exe 37 PID 2768 wrote to memory of 2760 2768 bthntt.exe 37 PID 2760 wrote to memory of 2576 2760 ddpvj.exe 38 PID 2760 wrote to memory of 2576 2760 ddpvj.exe 38 PID 2760 wrote to memory of 2576 2760 ddpvj.exe 38 PID 2760 wrote to memory of 2576 2760 ddpvj.exe 38 PID 2576 wrote to memory of 2712 2576 fffrlxr.exe 39 PID 2576 wrote to memory of 2712 2576 fffrlxr.exe 39 PID 2576 wrote to memory of 2712 2576 fffrlxr.exe 39 PID 2576 wrote to memory of 2712 2576 fffrlxr.exe 39 PID 2712 wrote to memory of 2556 2712 nhtbbb.exe 40 PID 2712 wrote to memory of 2556 2712 nhtbbb.exe 40 PID 2712 wrote to memory of 2556 2712 nhtbbb.exe 40 PID 2712 wrote to memory of 2556 2712 nhtbbb.exe 40 PID 2556 wrote to memory of 2924 2556 jjjvp.exe 41 PID 2556 wrote to memory of 2924 2556 jjjvp.exe 41 PID 2556 wrote to memory of 2924 2556 jjjvp.exe 41 PID 2556 wrote to memory of 2924 2556 jjjvp.exe 41 PID 2924 wrote to memory of 1656 2924 9nbttt.exe 42 PID 2924 wrote to memory of 1656 2924 9nbttt.exe 42 PID 2924 wrote to memory of 1656 2924 9nbttt.exe 42 PID 2924 wrote to memory of 1656 2924 9nbttt.exe 42 PID 1656 wrote to memory of 540 1656 9nhhht.exe 43 PID 1656 wrote to memory of 540 1656 9nhhht.exe 43 PID 1656 wrote to memory of 540 1656 9nhhht.exe 43 PID 1656 wrote to memory of 540 1656 9nhhht.exe 43 PID 540 wrote to memory of 2312 540 ffrrrrx.exe 44 PID 540 wrote to memory of 2312 540 ffrrrrx.exe 44 PID 540 wrote to memory of 2312 540 ffrrrrx.exe 44 PID 540 wrote to memory of 2312 540 ffrrrrx.exe 44 PID 2312 wrote to memory of 872 2312 frlxffx.exe 45 PID 2312 wrote to memory of 872 2312 frlxffx.exe 45 PID 2312 wrote to memory of 872 2312 frlxffx.exe 45 PID 2312 wrote to memory of 872 2312 frlxffx.exe 45 PID 872 wrote to memory of 1708 872 hbnbhh.exe 46 PID 872 wrote to memory of 1708 872 hbnbhh.exe 46 PID 872 wrote to memory of 1708 872 hbnbhh.exe 46 PID 872 wrote to memory of 1708 872 hbnbhh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe"C:\Users\Admin\AppData\Local\Temp\14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\pdpjd.exec:\pdpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\xxxfxfr.exec:\xxxfxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hbhtnh.exec:\hbhtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xlxfffl.exec:\xlxfffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\9httbt.exec:\9httbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bthntt.exec:\bthntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ddpvj.exec:\ddpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fffrlxr.exec:\fffrlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nhtbbb.exec:\nhtbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jjjvp.exec:\jjjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9nbttt.exec:\9nbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\9nhhht.exec:\9nhhht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\frlxffx.exec:\frlxffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\hbnbhh.exec:\hbnbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\1rxxflx.exec:\1rxxflx.exe17⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ttnbnb.exec:\ttnbnb.exe18⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3ddpp.exec:\3ddpp.exe19⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fxrxffl.exec:\fxrxffl.exe20⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tbthtb.exec:\tbthtb.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\vppdv.exec:\vppdv.exe22⤵
- Executes dropped EXE
PID:276 -
\??\c:\vpjpv.exec:\vpjpv.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rrfxffl.exec:\rrfxffl.exe24⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tnbhnb.exec:\tnbhnb.exe25⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pvjdp.exec:\pvjdp.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\lllrllf.exec:\lllrllf.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tnbtth.exec:\tnbtth.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pvpvj.exec:\pvpvj.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rrllrxf.exec:\rrllrxf.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nnhtbh.exec:\nnhtbh.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\dvppd.exec:\dvppd.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ddvdp.exec:\ddvdp.exe33⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nttntt.exec:\nttntt.exe34⤵
- Executes dropped EXE
PID:912 -
\??\c:\pdvdp.exec:\pdvdp.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvpvv.exec:\dvpvv.exe36⤵
- Executes dropped EXE
PID:1840 -
\??\c:\7rxfxxl.exec:\7rxfxxl.exe37⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hbthtt.exec:\hbthtt.exe38⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1bthnh.exec:\1bthnh.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1jjdj.exec:\1jjdj.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3rxlffr.exec:\3rxlffr.exe41⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1rfrxfl.exec:\1rfrxfl.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hhhnbh.exec:\hhhnbh.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pvpjj.exec:\pvpjj.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vvjjp.exec:\vvjjp.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xrllxxf.exec:\xrllxxf.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ttnntb.exec:\ttnntb.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bbtbht.exec:\bbtbht.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pvjvd.exec:\pvjvd.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9flrflx.exec:\9flrflx.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3xxflxr.exec:\3xxflxr.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhbbtb.exec:\hhbbtb.exe52⤵
- Executes dropped EXE
PID:332 -
\??\c:\bbtnhh.exec:\bbtnhh.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
\??\c:\jvpdj.exec:\jvpdj.exe54⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rllxlrr.exec:\rllxlrr.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:872 -
\??\c:\lxlrfxf.exec:\lxlrfxf.exe56⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bhbhtb.exec:\bhbhtb.exe57⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5jdjv.exec:\5jdjv.exe58⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jjpjd.exec:\jjpjd.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rfxfrrl.exec:\rfxfrrl.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tththt.exec:\tththt.exe61⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbbntb.exec:\hbbntb.exe62⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jdpdp.exec:\jdpdp.exe63⤵
- Executes dropped EXE
PID:276 -
\??\c:\1lfrfrf.exec:\1lfrfrf.exe64⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rlflllf.exec:\rlflllf.exe65⤵
- Executes dropped EXE
PID:328 -
\??\c:\nhhhth.exec:\nhhhth.exe66⤵PID:1664
-
\??\c:\bbbhht.exec:\bbbhht.exe67⤵PID:1556
-
\??\c:\jpjpv.exec:\jpjpv.exe68⤵PID:1264
-
\??\c:\ppjvj.exec:\ppjvj.exe69⤵PID:3028
-
\??\c:\xrxfllx.exec:\xrxfllx.exe70⤵PID:2976
-
\??\c:\1fflxrx.exec:\1fflxrx.exe71⤵PID:1216
-
\??\c:\hbnnbb.exec:\hbnnbb.exe72⤵PID:2476
-
\??\c:\5jdjp.exec:\5jdjp.exe73⤵PID:2076
-
\??\c:\pjddd.exec:\pjddd.exe74⤵PID:2248
-
\??\c:\frllflr.exec:\frllflr.exe75⤵PID:568
-
\??\c:\9xlxlxl.exec:\9xlxlxl.exe76⤵PID:1396
-
\??\c:\3ttbbb.exec:\3ttbbb.exe77⤵PID:2464
-
\??\c:\jdddj.exec:\jdddj.exe78⤵PID:2116
-
\??\c:\7ppdj.exec:\7ppdj.exe79⤵PID:2180
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe80⤵PID:2144
-
\??\c:\btnnbb.exec:\btnnbb.exe81⤵PID:2168
-
\??\c:\nnbnnt.exec:\nnbnnt.exe82⤵PID:2044
-
\??\c:\1jjpp.exec:\1jjpp.exe83⤵PID:2948
-
\??\c:\ppjvd.exec:\ppjvd.exe84⤵PID:1592
-
\??\c:\lfxrxxx.exec:\lfxrxxx.exe85⤵PID:824
-
\??\c:\bhnthb.exec:\bhnthb.exe86⤵PID:2380
-
\??\c:\7nthth.exec:\7nthth.exe87⤵PID:2120
-
\??\c:\jdppv.exec:\jdppv.exe88⤵PID:2824
-
\??\c:\rllrrrf.exec:\rllrrrf.exe89⤵PID:2744
-
\??\c:\1fxlrll.exec:\1fxlrll.exe90⤵PID:2700
-
\??\c:\btnnbt.exec:\btnnbt.exe91⤵PID:2204
-
\??\c:\5nbbnt.exec:\5nbbnt.exe92⤵PID:2784
-
\??\c:\vpddj.exec:\vpddj.exe93⤵PID:2684
-
\??\c:\jdvdj.exec:\jdvdj.exe94⤵PID:2588
-
\??\c:\frlxfff.exec:\frlxfff.exe95⤵PID:2536
-
\??\c:\nnhhnn.exec:\nnhhnn.exe96⤵PID:2100
-
\??\c:\7hnbbt.exec:\7hnbbt.exe97⤵PID:2924
-
\??\c:\vdvjj.exec:\vdvjj.exe98⤵PID:1624
-
\??\c:\rlrffrl.exec:\rlrffrl.exe99⤵PID:2000
-
\??\c:\fxlxflx.exec:\fxlxflx.exe100⤵PID:1048
-
\??\c:\ntthtb.exec:\ntthtb.exe101⤵PID:1672
-
\??\c:\vjvdd.exec:\vjvdd.exe102⤵PID:900
-
\??\c:\ppjvj.exec:\ppjvj.exe103⤵PID:1204
-
\??\c:\llffrrr.exec:\llffrrr.exe104⤵PID:2304
-
\??\c:\flrlrrx.exec:\flrlrrx.exe105⤵PID:2040
-
\??\c:\3nhnth.exec:\3nhnth.exe106⤵PID:2316
-
\??\c:\5tnnnb.exec:\5tnnnb.exe107⤵PID:1524
-
\??\c:\3pdpp.exec:\3pdpp.exe108⤵PID:2276
-
\??\c:\lxrrxlr.exec:\lxrrxlr.exe109⤵PID:1120
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe110⤵PID:2580
-
\??\c:\bbbntb.exec:\bbbntb.exe111⤵PID:1188
-
\??\c:\hhbnbb.exec:\hhbnbb.exe112⤵PID:276
-
\??\c:\jjvdj.exec:\jjvdj.exe113⤵PID:2856
-
\??\c:\pjvvp.exec:\pjvvp.exe114⤵PID:328
-
\??\c:\5lfflrx.exec:\5lfflrx.exe115⤵PID:680
-
\??\c:\5bttht.exec:\5bttht.exe116⤵PID:932
-
\??\c:\bbthnt.exec:\bbthnt.exe117⤵PID:1264
-
\??\c:\pvpvp.exec:\pvpvp.exe118⤵PID:788
-
\??\c:\xllrxlx.exec:\xllrxlx.exe119⤵PID:2976
-
\??\c:\9xxfrlr.exec:\9xxfrlr.exe120⤵PID:1732
-
\??\c:\bbbhbb.exec:\bbbhbb.exe121⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-