Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe
-
Size
453KB
-
MD5
ce508bfd001b2ddc018c3bd0edaa4d20
-
SHA1
f63cd4b198e924ab8a96ffa1af17ea75dfc70ef0
-
SHA256
cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03
-
SHA512
a9eac797636efa78a7e5afb3cd9587823f0ddcd17b7a8a2d499a45705c9cd7ad8ea9744abb9a101c0e00fc0a6b34d4706c7fd4660376ad70e6f2d9394c3ab90f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1324-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-82-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/384-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-313-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-409-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2908-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/664-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-728-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2456-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-914-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-1041-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2828-1182-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 rffxxlr.exe 2044 bttbhn.exe 2028 lxllxxl.exe 2968 tntthn.exe 2752 rlflrxl.exe 2852 hbbbbb.exe 2616 ppdjv.exe 2804 bbbhbh.exe 2864 ppddp.exe 2612 7lxrfff.exe 2732 9jvvd.exe 1516 rrflrxx.exe 1084 pjppd.exe 2888 lfxxxrx.exe 384 1ntnbh.exe 2596 pjdjj.exe 1296 3hnntt.exe 1908 jdvdj.exe 2176 1rfrfrx.exe 2180 hnttht.exe 2172 5vddj.exe 2552 xrffxff.exe 756 tnhhtt.exe 1120 rfrrfff.exe 3004 nhntbt.exe 1772 9vjjp.exe 1992 thnntt.exe 2280 tbbtbh.exe 1472 xfxlrxx.exe 280 tntntn.exe 1744 1lxflrf.exe 3032 9nttnh.exe 2312 dvjpv.exe 2548 lxxrxxf.exe 2108 bnbbhn.exe 2356 9hbbhb.exe 2028 vjvdj.exe 2720 9rfrxxx.exe 2716 3hnnnn.exe 2824 9httbb.exe 2980 dpddv.exe 2868 rffflrx.exe 2632 bnhhhb.exe 2840 tntbhb.exe 2624 7jvjv.exe 2664 rlxxffl.exe 2184 lfrxfff.exe 2732 1thbnn.exe 1716 djdvd.exe 2892 lxffxxx.exe 2908 5ffflff.exe 984 nnbhbh.exe 2932 5dpdp.exe 1628 pvdpd.exe 1432 7xfxxrl.exe 1108 nnttnh.exe 2648 dvpdv.exe 1752 ppdpj.exe 3068 rfrrrrx.exe 636 5hbnnt.exe 1852 7tbtnn.exe 1624 3vjjv.exe 2592 5rrllrx.exe 1064 1nntbh.exe -
resource yara_rule behavioral1/memory/1324-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/384-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-228-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3004-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-583-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2544-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-998-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1752-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1041-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1992-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-1089-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-1169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-1195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-1208-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9httbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1704 1324 cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe 30 PID 1324 wrote to memory of 1704 1324 cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe 30 PID 1324 wrote to memory of 1704 1324 cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe 30 PID 1324 wrote to memory of 1704 1324 cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe 30 PID 1704 wrote to memory of 2044 1704 rffxxlr.exe 31 PID 1704 wrote to memory of 2044 1704 rffxxlr.exe 31 PID 1704 wrote to memory of 2044 1704 rffxxlr.exe 31 PID 1704 wrote to memory of 2044 1704 rffxxlr.exe 31 PID 2044 wrote to memory of 2028 2044 bttbhn.exe 32 PID 2044 wrote to memory of 2028 2044 bttbhn.exe 32 PID 2044 wrote to memory of 2028 2044 bttbhn.exe 32 PID 2044 wrote to memory of 2028 2044 bttbhn.exe 32 PID 2028 wrote to memory of 2968 2028 lxllxxl.exe 33 PID 2028 wrote to memory of 2968 2028 lxllxxl.exe 33 PID 2028 wrote to memory of 2968 2028 lxllxxl.exe 33 PID 2028 wrote to memory of 2968 2028 lxllxxl.exe 33 PID 2968 wrote to memory of 2752 2968 tntthn.exe 34 PID 2968 wrote to memory of 2752 2968 tntthn.exe 34 PID 2968 wrote to memory of 2752 2968 tntthn.exe 34 PID 2968 wrote to memory of 2752 2968 tntthn.exe 34 PID 2752 wrote to memory of 2852 2752 rlflrxl.exe 35 PID 2752 wrote to memory of 2852 2752 rlflrxl.exe 35 PID 2752 wrote to memory of 2852 2752 rlflrxl.exe 35 PID 2752 wrote to memory of 2852 2752 rlflrxl.exe 35 PID 2852 wrote to memory of 2616 2852 hbbbbb.exe 36 PID 2852 wrote to memory of 2616 2852 hbbbbb.exe 36 PID 2852 wrote to memory of 2616 2852 hbbbbb.exe 36 PID 2852 wrote to memory of 2616 2852 hbbbbb.exe 36 PID 2616 wrote to memory of 2804 2616 ppdjv.exe 37 PID 2616 wrote to memory of 2804 2616 ppdjv.exe 37 PID 2616 wrote to memory of 2804 2616 ppdjv.exe 37 PID 2616 wrote to memory of 2804 2616 ppdjv.exe 37 PID 2804 wrote to memory of 2864 2804 bbbhbh.exe 38 PID 2804 wrote to memory of 2864 2804 bbbhbh.exe 38 PID 2804 wrote to memory of 2864 2804 bbbhbh.exe 38 PID 2804 wrote to memory of 2864 2804 bbbhbh.exe 38 PID 2864 wrote to memory of 2612 2864 ppddp.exe 39 PID 2864 wrote to memory of 2612 2864 ppddp.exe 39 PID 2864 wrote to memory of 2612 2864 ppddp.exe 39 PID 2864 wrote to memory of 2612 2864 ppddp.exe 39 PID 2612 wrote to memory of 2732 2612 7lxrfff.exe 40 PID 2612 wrote to memory of 2732 2612 7lxrfff.exe 40 PID 2612 wrote to memory of 2732 2612 7lxrfff.exe 40 PID 2612 wrote to memory of 2732 2612 7lxrfff.exe 40 PID 2732 wrote to memory of 1516 2732 9jvvd.exe 41 PID 2732 wrote to memory of 1516 2732 9jvvd.exe 41 PID 2732 wrote to memory of 1516 2732 9jvvd.exe 41 PID 2732 wrote to memory of 1516 2732 9jvvd.exe 41 PID 1516 wrote to memory of 1084 1516 rrflrxx.exe 42 PID 1516 wrote to memory of 1084 1516 rrflrxx.exe 42 PID 1516 wrote to memory of 1084 1516 rrflrxx.exe 42 PID 1516 wrote to memory of 1084 1516 rrflrxx.exe 42 PID 1084 wrote to memory of 2888 1084 pjppd.exe 43 PID 1084 wrote to memory of 2888 1084 pjppd.exe 43 PID 1084 wrote to memory of 2888 1084 pjppd.exe 43 PID 1084 wrote to memory of 2888 1084 pjppd.exe 43 PID 2888 wrote to memory of 384 2888 lfxxxrx.exe 44 PID 2888 wrote to memory of 384 2888 lfxxxrx.exe 44 PID 2888 wrote to memory of 384 2888 lfxxxrx.exe 44 PID 2888 wrote to memory of 384 2888 lfxxxrx.exe 44 PID 384 wrote to memory of 2596 384 1ntnbh.exe 45 PID 384 wrote to memory of 2596 384 1ntnbh.exe 45 PID 384 wrote to memory of 2596 384 1ntnbh.exe 45 PID 384 wrote to memory of 2596 384 1ntnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe"C:\Users\Admin\AppData\Local\Temp\cd80ed8aa170da06981d5007e3ebf3f22820bf610b32d8bc0e78cda4aa0d3e03N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\rffxxlr.exec:\rffxxlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\bttbhn.exec:\bttbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lxllxxl.exec:\lxllxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\tntthn.exec:\tntthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rlflrxl.exec:\rlflrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hbbbbb.exec:\hbbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ppdjv.exec:\ppdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bbbhbh.exec:\bbbhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ppddp.exec:\ppddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\7lxrfff.exec:\7lxrfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\9jvvd.exec:\9jvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rrflrxx.exec:\rrflrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\pjppd.exec:\pjppd.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\lfxxxrx.exec:\lfxxxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1ntnbh.exec:\1ntnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\pjdjj.exec:\pjdjj.exe17⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3hnntt.exec:\3hnntt.exe18⤵
- Executes dropped EXE
PID:1296 -
\??\c:\jdvdj.exec:\jdvdj.exe19⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1rfrfrx.exec:\1rfrfrx.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hnttht.exec:\hnttht.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\5vddj.exec:\5vddj.exe22⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xrffxff.exec:\xrffxff.exe23⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tnhhtt.exec:\tnhhtt.exe24⤵
- Executes dropped EXE
PID:756 -
\??\c:\rfrrfff.exec:\rfrrfff.exe25⤵
- Executes dropped EXE
PID:1120 -
\??\c:\nhntbt.exec:\nhntbt.exe26⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9vjjp.exec:\9vjjp.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\thnntt.exec:\thnntt.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tbbtbh.exec:\tbbtbh.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xfxlrxx.exec:\xfxlrxx.exe30⤵
- Executes dropped EXE
PID:1472 -
\??\c:\tntntn.exec:\tntntn.exe31⤵
- Executes dropped EXE
PID:280 -
\??\c:\1lxflrf.exec:\1lxflrf.exe32⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9nttnh.exec:\9nttnh.exe33⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dvjpv.exec:\dvjpv.exe34⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lxxrxxf.exec:\lxxrxxf.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bnbbhn.exec:\bnbbhn.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\9hbbhb.exec:\9hbbhb.exe37⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vjvdj.exec:\vjvdj.exe38⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9rfrxxx.exec:\9rfrxxx.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3hnnnn.exec:\3hnnnn.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9httbb.exec:\9httbb.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\dpddv.exec:\dpddv.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rffflrx.exec:\rffflrx.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bnhhhb.exec:\bnhhhb.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tntbhb.exec:\tntbhb.exe45⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7jvjv.exec:\7jvjv.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rlxxffl.exec:\rlxxffl.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfrxfff.exec:\lfrxfff.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1thbnn.exec:\1thbnn.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\djdvd.exec:\djdvd.exe50⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lxffxxx.exec:\lxffxxx.exe51⤵
- Executes dropped EXE
PID:2892 -
\??\c:\5ffflff.exec:\5ffflff.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nnbhbh.exec:\nnbhbh.exe53⤵
- Executes dropped EXE
PID:984 -
\??\c:\5dpdp.exec:\5dpdp.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pvdpd.exec:\pvdpd.exe55⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7xfxxrl.exec:\7xfxxrl.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nnttnh.exec:\nnttnh.exe57⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dvpdv.exec:\dvpdv.exe58⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ppdpj.exec:\ppdpj.exe59⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe60⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5hbnnt.exec:\5hbnnt.exe61⤵
- Executes dropped EXE
PID:636 -
\??\c:\7tbtnn.exec:\7tbtnn.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\3vjjv.exec:\3vjjv.exe63⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5rrllrx.exec:\5rrllrx.exe64⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1nntbh.exec:\1nntbh.exe65⤵
- Executes dropped EXE
PID:1064 -
\??\c:\dvjdd.exec:\dvjdd.exe66⤵PID:1408
-
\??\c:\vdjjp.exec:\vdjjp.exe67⤵PID:664
-
\??\c:\xrrxffr.exec:\xrrxffr.exe68⤵PID:1808
-
\??\c:\nhtbbh.exec:\nhtbbh.exe69⤵PID:2052
-
\??\c:\pjjpv.exec:\pjjpv.exe70⤵PID:1796
-
\??\c:\xxrxffl.exec:\xxrxffl.exe71⤵PID:3028
-
\??\c:\frflrrr.exec:\frflrrr.exe72⤵PID:1864
-
\??\c:\1tbbhh.exec:\1tbbhh.exe73⤵PID:1712
-
\??\c:\9dddd.exec:\9dddd.exe74⤵PID:1300
-
\??\c:\1lxrxfl.exec:\1lxrxfl.exe75⤵PID:1584
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe76⤵PID:1588
-
\??\c:\9tnhnt.exec:\9tnhnt.exe77⤵PID:1720
-
\??\c:\pdpdd.exec:\pdpdd.exe78⤵PID:2544
-
\??\c:\1rrllxf.exec:\1rrllxf.exe79⤵PID:1616
-
\??\c:\ffrfrlr.exec:\ffrfrlr.exe80⤵PID:2252
-
\??\c:\5nttnh.exec:\5nttnh.exe81⤵PID:2816
-
\??\c:\dvpvp.exec:\dvpvp.exe82⤵PID:2812
-
\??\c:\lrxrrlr.exec:\lrxrrlr.exe83⤵PID:2828
-
\??\c:\lfxxllx.exec:\lfxxllx.exe84⤵PID:2984
-
\??\c:\9hhbbt.exec:\9hhbbt.exe85⤵PID:2944
-
\??\c:\pjddp.exec:\pjddp.exe86⤵PID:2616
-
\??\c:\frfflfl.exec:\frfflfl.exe87⤵PID:2348
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe88⤵PID:2840
-
\??\c:\hnbtbt.exec:\hnbtbt.exe89⤵PID:840
-
\??\c:\jdjjv.exec:\jdjjv.exe90⤵PID:2664
-
\??\c:\lrfxlff.exec:\lrfxlff.exe91⤵PID:2184
-
\??\c:\3lffffx.exec:\3lffffx.exe92⤵PID:2732
-
\??\c:\nhtttt.exec:\nhtttt.exe93⤵PID:2948
-
\??\c:\btbbnn.exec:\btbbnn.exe94⤵PID:1736
-
\??\c:\pdjpv.exec:\pdjpv.exe95⤵PID:1932
-
\??\c:\5xxrrrx.exec:\5xxrrrx.exe96⤵PID:2888
-
\??\c:\hthnnh.exec:\hthnnh.exe97⤵PID:1072
-
\??\c:\htttnn.exec:\htttnn.exe98⤵PID:832
-
\??\c:\vpdjd.exec:\vpdjd.exe99⤵PID:2024
-
\??\c:\xlxfffr.exec:\xlxfffr.exe100⤵PID:3052
-
\??\c:\ttbbnh.exec:\ttbbnh.exe101⤵PID:3060
-
\??\c:\hhthtt.exec:\hhthtt.exe102⤵PID:1632
-
\??\c:\pdpjj.exec:\pdpjj.exe103⤵PID:2180
-
\??\c:\vvppd.exec:\vvppd.exe104⤵PID:2172
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe105⤵PID:2588
-
\??\c:\hnhtnh.exec:\hnhtnh.exe106⤵PID:2188
-
\??\c:\ppddj.exec:\ppddj.exe107⤵PID:444
-
\??\c:\vpjjp.exec:\vpjjp.exe108⤵PID:3008
-
\??\c:\rflrrxf.exec:\rflrrxf.exe109⤵PID:848
-
\??\c:\hhthhn.exec:\hhthhn.exe110⤵PID:1020
-
\??\c:\tbbnnb.exec:\tbbnnb.exe111⤵PID:2396
-
\??\c:\7vjpv.exec:\7vjpv.exe112⤵PID:1772
-
\??\c:\lxrlffr.exec:\lxrlffr.exe113⤵PID:3036
-
\??\c:\1lxxrfl.exec:\1lxxrfl.exe114⤵PID:2380
-
\??\c:\ttntbb.exec:\ttntbb.exe115⤵PID:1696
-
\??\c:\5jdjj.exec:\5jdjj.exe116⤵PID:1824
-
\??\c:\rflfffl.exec:\rflfffl.exe117⤵PID:1744
-
\??\c:\flrxlrf.exec:\flrxlrf.exe118⤵PID:1580
-
\??\c:\hbtntn.exec:\hbtntn.exe119⤵PID:1548
-
\??\c:\nbtnnn.exec:\nbtnnn.exe120⤵PID:1684
-
\??\c:\jvdvv.exec:\jvdvv.exe121⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-