Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 21:20
Behavioral task
behavioral1
Sample
282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe
-
Size
91KB
-
MD5
7c0169178ab535c09016221ecb93dcc0
-
SHA1
9caaaa8bd9e183e4f45f24a09b360e941cb8dde0
-
SHA256
282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6
-
SHA512
bc0cbebbad1eef89d38788c27ee6d7069367239d0138ce2af5d18c03bded1825c09d76a7ddc4afe36f1cde0ea8a5a35980f65932054ad387d08b8a775447f7e4
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglWxR9Yii9J01qCxNi2:chOmTsF93UYfwC6GIout3xR9nx02
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2264-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-24-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2792-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-54-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2888-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-61-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-74-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2360-81-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/3024-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-124-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/568-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-144-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/804-154-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2956-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/804-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-199-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/884-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-315-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2384-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-418-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/680-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-492-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2092-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-528-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/880-559-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2520-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-573-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1488-587-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-867-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2208-942-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-949-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2664-1079-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/876-1106-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2232-1119-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1484-1125-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2176 jpppp.exe 2792 ntbbbt.exe 2588 vvjdj.exe 2708 nnttbt.exe 2972 hbnnbb.exe 2888 vjdpj.exe 2652 llrlfxx.exe 2360 5pjdv.exe 3024 djvjv.exe 1580 tbthtn.exe 1680 5hnhnh.exe 1588 lrflffl.exe 568 5fxxrxl.exe 1496 jvjjv.exe 804 1ddpd.exe 2956 rrlfrfl.exe 2456 nhbnnt.exe 628 djdjv.exe 1524 lllflxf.exe 884 hnhntb.exe 2488 tthnht.exe 2552 rfrxlrx.exe 2468 5llxrxl.exe 1016 vdjpj.exe 828 rxxrfxx.exe 2284 lflxxlf.exe 2496 nnbnbh.exe 776 lrlllrf.exe 544 5htnbn.exe 1336 djvdv.exe 2228 ddjpv.exe 2856 1fffrxl.exe 2384 1bnnhn.exe 2740 vjjdv.exe 2616 1rrfflf.exe 1716 xxflxfl.exe 2720 bbthth.exe 2784 pvjvd.exe 2704 jjdjp.exe 2268 xfrflrf.exe 2652 bnbnhn.exe 2568 bthtbh.exe 1740 ddvdj.exe 3068 xrrfrxr.exe 1580 rxlrfxx.exe 1032 ttntbn.exe 540 ddjvd.exe 2848 jdvvp.exe 2480 xfrfxlr.exe 1496 bttbnb.exe 1104 9ntthh.exe 1140 pddjv.exe 2140 frfrlxx.exe 1548 rfxllrx.exe 2200 tbhbth.exe 680 9jvjp.exe 2328 pdjjj.exe 344 9llrffl.exe 884 fxllllr.exe 2016 5frrlrr.exe 2092 hhtbtb.exe 1168 3vpvv.exe 3016 pvvdj.exe 1088 pvjvp.exe -
resource yara_rule behavioral1/memory/2264-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2264-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2264-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001225e-6.dat upx behavioral1/files/0x000b00000001926b-20.dat upx behavioral1/memory/2792-24-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2792-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001930d-29.dat upx behavioral1/memory/2588-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001932d-39.dat upx behavioral1/files/0x000600000001933b-47.dat upx behavioral1/files/0x0006000000019374-57.dat upx behavioral1/memory/2888-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001939b-67.dat upx behavioral1/memory/2888-66-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2652-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193b3-78.dat upx behavioral1/files/0x00070000000193b5-86.dat upx behavioral1/files/0x0005000000019dbf-93.dat upx behavioral1/memory/1580-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1580-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f8a-106.dat upx behavioral1/files/0x0005000000019f94-117.dat upx behavioral1/memory/1680-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a075-126.dat upx behavioral1/memory/1588-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a07e-137.dat upx behavioral1/memory/568-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/568-134-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a09e-146.dat upx behavioral1/memory/1496-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a359-165.dat upx behavioral1/files/0x000500000001a307-157.dat upx behavioral1/memory/804-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-173-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a41b-177.dat upx behavioral1/memory/628-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41d-185.dat upx behavioral1/files/0x000500000001a41e-196.dat upx behavioral1/memory/884-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a427-206.dat upx behavioral1/memory/884-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42d-215.dat upx behavioral1/memory/2488-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46f-224.dat upx behavioral1/memory/2468-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000019240-232.dat upx behavioral1/files/0x000500000001a48b-241.dat upx behavioral1/memory/828-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48d-250.dat upx behavioral1/memory/2284-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a499-260.dat upx behavioral1/memory/2284-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49a-270.dat upx behavioral1/memory/2496-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a9-278.dat upx behavioral1/files/0x000500000001a4af-288.dat upx behavioral1/memory/544-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b1-295.dat upx behavioral1/files/0x000500000001a4b3-303.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2176 2264 282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe 30 PID 2264 wrote to memory of 2176 2264 282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe 30 PID 2264 wrote to memory of 2176 2264 282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe 30 PID 2264 wrote to memory of 2176 2264 282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe 30 PID 2176 wrote to memory of 2792 2176 jpppp.exe 31 PID 2176 wrote to memory of 2792 2176 jpppp.exe 31 PID 2176 wrote to memory of 2792 2176 jpppp.exe 31 PID 2176 wrote to memory of 2792 2176 jpppp.exe 31 PID 2792 wrote to memory of 2588 2792 ntbbbt.exe 32 PID 2792 wrote to memory of 2588 2792 ntbbbt.exe 32 PID 2792 wrote to memory of 2588 2792 ntbbbt.exe 32 PID 2792 wrote to memory of 2588 2792 ntbbbt.exe 32 PID 2588 wrote to memory of 2708 2588 vvjdj.exe 33 PID 2588 wrote to memory of 2708 2588 vvjdj.exe 33 PID 2588 wrote to memory of 2708 2588 vvjdj.exe 33 PID 2588 wrote to memory of 2708 2588 vvjdj.exe 33 PID 2708 wrote to memory of 2972 2708 nnttbt.exe 34 PID 2708 wrote to memory of 2972 2708 nnttbt.exe 34 PID 2708 wrote to memory of 2972 2708 nnttbt.exe 34 PID 2708 wrote to memory of 2972 2708 nnttbt.exe 34 PID 2972 wrote to memory of 2888 2972 hbnnbb.exe 35 PID 2972 wrote to memory of 2888 2972 hbnnbb.exe 35 PID 2972 wrote to memory of 2888 2972 hbnnbb.exe 35 PID 2972 wrote to memory of 2888 2972 hbnnbb.exe 35 PID 2888 wrote to memory of 2652 2888 vjdpj.exe 36 PID 2888 wrote to memory of 2652 2888 vjdpj.exe 36 PID 2888 wrote to memory of 2652 2888 vjdpj.exe 36 PID 2888 wrote to memory of 2652 2888 vjdpj.exe 36 PID 2652 wrote to memory of 2360 2652 llrlfxx.exe 37 PID 2652 wrote to memory of 2360 2652 llrlfxx.exe 37 PID 2652 wrote to memory of 2360 2652 llrlfxx.exe 37 PID 2652 wrote to memory of 2360 2652 llrlfxx.exe 37 PID 2360 wrote to memory of 3024 2360 5pjdv.exe 38 PID 2360 wrote to memory of 3024 2360 5pjdv.exe 38 PID 2360 wrote to memory of 3024 2360 5pjdv.exe 38 PID 2360 wrote to memory of 3024 2360 5pjdv.exe 38 PID 3024 wrote to memory of 1580 3024 djvjv.exe 39 PID 3024 wrote to memory of 1580 3024 djvjv.exe 39 PID 3024 wrote to memory of 1580 3024 djvjv.exe 39 PID 3024 wrote to memory of 1580 3024 djvjv.exe 39 PID 1580 wrote to memory of 1680 1580 tbthtn.exe 40 PID 1580 wrote to memory of 1680 1580 tbthtn.exe 40 PID 1580 wrote to memory of 1680 1580 tbthtn.exe 40 PID 1580 wrote to memory of 1680 1580 tbthtn.exe 40 PID 1680 wrote to memory of 1588 1680 5hnhnh.exe 41 PID 1680 wrote to memory of 1588 1680 5hnhnh.exe 41 PID 1680 wrote to memory of 1588 1680 5hnhnh.exe 41 PID 1680 wrote to memory of 1588 1680 5hnhnh.exe 41 PID 1588 wrote to memory of 568 1588 lrflffl.exe 42 PID 1588 wrote to memory of 568 1588 lrflffl.exe 42 PID 1588 wrote to memory of 568 1588 lrflffl.exe 42 PID 1588 wrote to memory of 568 1588 lrflffl.exe 42 PID 568 wrote to memory of 1496 568 5fxxrxl.exe 43 PID 568 wrote to memory of 1496 568 5fxxrxl.exe 43 PID 568 wrote to memory of 1496 568 5fxxrxl.exe 43 PID 568 wrote to memory of 1496 568 5fxxrxl.exe 43 PID 1496 wrote to memory of 804 1496 jvjjv.exe 44 PID 1496 wrote to memory of 804 1496 jvjjv.exe 44 PID 1496 wrote to memory of 804 1496 jvjjv.exe 44 PID 1496 wrote to memory of 804 1496 jvjjv.exe 44 PID 804 wrote to memory of 2956 804 1ddpd.exe 45 PID 804 wrote to memory of 2956 804 1ddpd.exe 45 PID 804 wrote to memory of 2956 804 1ddpd.exe 45 PID 804 wrote to memory of 2956 804 1ddpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe"C:\Users\Admin\AppData\Local\Temp\282915e590d7031d690a385a53fe5d3fbc1b9797c43315e215010c055e565ea6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\jpppp.exec:\jpppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\ntbbbt.exec:\ntbbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vvjdj.exec:\vvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nnttbt.exec:\nnttbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hbnnbb.exec:\hbnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vjdpj.exec:\vjdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\llrlfxx.exec:\llrlfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5pjdv.exec:\5pjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\djvjv.exec:\djvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\tbthtn.exec:\tbthtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\5hnhnh.exec:\5hnhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\lrflffl.exec:\lrflffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\5fxxrxl.exec:\5fxxrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\jvjjv.exec:\jvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\1ddpd.exec:\1ddpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\rrlfrfl.exec:\rrlfrfl.exe17⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nhbnnt.exec:\nhbnnt.exe18⤵
- Executes dropped EXE
PID:2456 -
\??\c:\djdjv.exec:\djdjv.exe19⤵
- Executes dropped EXE
PID:628 -
\??\c:\lllflxf.exec:\lllflxf.exe20⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hnhntb.exec:\hnhntb.exe21⤵
- Executes dropped EXE
PID:884 -
\??\c:\tthnht.exec:\tthnht.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rfrxlrx.exec:\rfrxlrx.exe23⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5llxrxl.exec:\5llxrxl.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vdjpj.exec:\vdjpj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1016 -
\??\c:\rxxrfxx.exec:\rxxrfxx.exe26⤵
- Executes dropped EXE
PID:828 -
\??\c:\lflxxlf.exec:\lflxxlf.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nnbnbh.exec:\nnbnbh.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lrlllrf.exec:\lrlllrf.exe29⤵
- Executes dropped EXE
PID:776 -
\??\c:\5htnbn.exec:\5htnbn.exe30⤵
- Executes dropped EXE
PID:544 -
\??\c:\djvdv.exec:\djvdv.exe31⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ddjpv.exec:\ddjpv.exe32⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1fffrxl.exec:\1fffrxl.exe33⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1bnnhn.exec:\1bnnhn.exe34⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vjjdv.exec:\vjjdv.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1rrfflf.exec:\1rrfflf.exe36⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xxflxfl.exec:\xxflxfl.exe37⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bbthth.exec:\bbthth.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pvjvd.exec:\pvjvd.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jjdjp.exec:\jjdjp.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xfrflrf.exec:\xfrflrf.exe41⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bnbnhn.exec:\bnbnhn.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bthtbh.exec:\bthtbh.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ddvdj.exec:\ddvdj.exe44⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xrrfrxr.exec:\xrrfrxr.exe45⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rxlrfxx.exec:\rxlrfxx.exe46⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ttntbn.exec:\ttntbn.exe47⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ddjvd.exec:\ddjvd.exe48⤵
- Executes dropped EXE
PID:540 -
\??\c:\jdvvp.exec:\jdvvp.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xfrfxlr.exec:\xfrfxlr.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bttbnb.exec:\bttbnb.exe51⤵
- Executes dropped EXE
PID:1496 -
\??\c:\9ntthh.exec:\9ntthh.exe52⤵
- Executes dropped EXE
PID:1104 -
\??\c:\pddjv.exec:\pddjv.exe53⤵
- Executes dropped EXE
PID:1140 -
\??\c:\frfrlxx.exec:\frfrlxx.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rfxllrx.exec:\rfxllrx.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tbhbth.exec:\tbhbth.exe56⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9jvjp.exec:\9jvjp.exe57⤵
- Executes dropped EXE
PID:680 -
\??\c:\pdjjj.exec:\pdjjj.exe58⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9llrffl.exec:\9llrffl.exe59⤵
- Executes dropped EXE
PID:344 -
\??\c:\fxllllr.exec:\fxllllr.exe60⤵
- Executes dropped EXE
PID:884 -
\??\c:\5frrlrr.exec:\5frrlrr.exe61⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hhtbtb.exec:\hhtbtb.exe62⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3vpvv.exec:\3vpvv.exe63⤵
- Executes dropped EXE
PID:1168 -
\??\c:\pvvdj.exec:\pvvdj.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pvjvp.exec:\pvjvp.exe65⤵
- Executes dropped EXE
PID:1088 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe66⤵PID:1436
-
\??\c:\bbnhbn.exec:\bbnhbn.exe67⤵PID:1924
-
\??\c:\hhnhnb.exec:\hhnhnb.exe68⤵PID:2492
-
\??\c:\pppjd.exec:\pppjd.exe69⤵PID:2300
-
\??\c:\jpdjp.exec:\jpdjp.exe70⤵PID:1720
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe71⤵PID:880
-
\??\c:\tbhbhh.exec:\tbhbhh.exe72⤵PID:2352
-
\??\c:\hhhhbn.exec:\hhhhbn.exe73⤵PID:2520
-
\??\c:\jpjvp.exec:\jpjvp.exe74⤵PID:2376
-
\??\c:\fxrlfrf.exec:\fxrlfrf.exe75⤵PID:1488
-
\??\c:\lxlrfrl.exec:\lxlrfrl.exe76⤵PID:1480
-
\??\c:\hnthtn.exec:\hnthtn.exe77⤵PID:2176
-
\??\c:\nttntt.exec:\nttntt.exe78⤵PID:2724
-
\??\c:\jvjpd.exec:\jvjpd.exe79⤵
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\vdvvj.exec:\vdvvj.exe80⤵PID:1716
-
\??\c:\rrxxxlr.exec:\rrxxxlr.exe81⤵PID:2972
-
\??\c:\xxxffrl.exec:\xxxffrl.exe82⤵PID:2784
-
\??\c:\ttnbtb.exec:\ttnbtb.exe83⤵PID:2644
-
\??\c:\hnntbn.exec:\hnntbn.exe84⤵PID:2892
-
\??\c:\pjpdj.exec:\pjpdj.exe85⤵PID:2440
-
\??\c:\ffxfllx.exec:\ffxfllx.exe86⤵PID:2324
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe87⤵PID:3064
-
\??\c:\9ttbnt.exec:\9ttbnt.exe88⤵PID:2064
-
\??\c:\httnnb.exec:\httnnb.exe89⤵PID:1520
-
\??\c:\vvvdv.exec:\vvvdv.exe90⤵PID:1820
-
\??\c:\pppvp.exec:\pppvp.exe91⤵PID:2816
-
\??\c:\rrxffrf.exec:\rrxffrf.exe92⤵PID:2820
-
\??\c:\7lflxfr.exec:\7lflxfr.exe93⤵PID:568
-
\??\c:\3bhtbn.exec:\3bhtbn.exe94⤵PID:2480
-
\??\c:\3hhtth.exec:\3hhtth.exe95⤵PID:2344
-
\??\c:\5dvpd.exec:\5dvpd.exe96⤵PID:448
-
\??\c:\rxlrfxf.exec:\rxlrfxf.exe97⤵PID:804
-
\??\c:\fflrflx.exec:\fflrflx.exe98⤵PID:2136
-
\??\c:\bhhntn.exec:\bhhntn.exe99⤵PID:2456
-
\??\c:\bbnthn.exec:\bbnthn.exe100⤵PID:2452
-
\??\c:\tbhnbb.exec:\tbhnbb.exe101⤵PID:2420
-
\??\c:\dpjvd.exec:\dpjvd.exe102⤵PID:2024
-
\??\c:\djjvd.exec:\djjvd.exe103⤵PID:2144
-
\??\c:\xxlrrrx.exec:\xxlrrrx.exe104⤵PID:2008
-
\??\c:\flrxlxx.exec:\flrxlxx.exe105⤵PID:2488
-
\??\c:\ttnnnn.exec:\ttnnnn.exe106⤵PID:2552
-
\??\c:\nthnbh.exec:\nthnbh.exe107⤵PID:1148
-
\??\c:\1vdvj.exec:\1vdvj.exe108⤵PID:1624
-
\??\c:\ppdjd.exec:\ppdjd.exe109⤵PID:1616
-
\??\c:\5rxlxfx.exec:\5rxlxfx.exe110⤵PID:828
-
\??\c:\nhnhnt.exec:\nhnhnt.exe111⤵PID:2664
-
\??\c:\ttbhtb.exec:\ttbhtb.exe112⤵PID:1284
-
\??\c:\1vpvd.exec:\1vpvd.exe113⤵PID:2240
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe114⤵PID:2304
-
\??\c:\rxlxllr.exec:\rxlxllr.exe115⤵PID:1672
-
\??\c:\5xlrlrx.exec:\5xlrlrx.exe116⤵PID:2148
-
\??\c:\1bhnnb.exec:\1bhnnb.exe117⤵PID:1336
-
\??\c:\dddpj.exec:\dddpj.exe118⤵PID:2108
-
\??\c:\vvjjj.exec:\vvjjj.exe119⤵PID:2728
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe120⤵
- System Location Discovery: System Language Discovery
PID:1488 -
\??\c:\llrflrf.exec:\llrflrf.exe121⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-