Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe
-
Size
456KB
-
MD5
117da6eb82496c10554430683054b840
-
SHA1
0ee3eb5f8360581a896e0f77f177e29be7ebaf45
-
SHA256
2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421
-
SHA512
bd419d2e3f58fbce14f40df9f391063f17ac110e82404d7f37f151c0387db3ac42089ddc4f1209ef0f452999b2996e646bcc2a3559ad2326358cd4eb02deddd9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRZ:q7Tc2NYHUrAwfMp3CDRZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/540-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-110-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2120-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-165-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1724-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-200-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2116-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2416-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-459-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1760-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-509-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1008-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-687-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2396-822-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1636-916-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-1344-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1232 9rlrffl.exe 540 3tntbh.exe 1872 bthtbt.exe 2216 jvppp.exe 2864 jdpvj.exe 2236 dvjpp.exe 2820 7rrflrl.exe 1984 pvjdp.exe 2608 ffxrflf.exe 2052 fffxfrr.exe 2120 5pdpd.exe 1572 3jddd.exe 2436 9pppp.exe 1648 fxllrxf.exe 2912 jjpdd.exe 1300 bbbnbb.exe 1216 ddpjd.exe 316 pddvp.exe 1724 thbbnn.exe 272 7nhnnt.exe 2708 bthhtt.exe 2152 lfflrrf.exe 2116 thtttt.exe 2224 hbnntt.exe 1288 7bbhnb.exe 2128 nhtbbb.exe 1088 lfxflfl.exe 2336 bbttbh.exe 688 jjjpj.exe 2384 3lxxrfr.exe 2416 pdvdp.exe 2520 5htbhb.exe 540 vvppd.exe 2216 nbnbhn.exe 1512 bntnnn.exe 2892 3djjd.exe 1892 rfxxffl.exe 712 lfxlxxx.exe 2872 5btbnb.exe 2888 7jddd.exe 2884 jjvpp.exe 2656 rfxxfxl.exe 2624 hhthnn.exe 2676 3jjdd.exe 2732 pdjjp.exe 2196 ffxxxxl.exe 1004 9xflrll.exe 1800 thbhhh.exe 848 jdjdd.exe 1556 fxllrrf.exe 1432 3rrxxxf.exe 2672 bbbbhn.exe 796 3pjjv.exe 1252 jvpjj.exe 1216 lxlfrlr.exe 1728 3httbt.exe 1760 nbttbb.exe 2332 jdvvj.exe 2564 lxrxffl.exe 2032 5nhnbn.exe 852 hbntbh.exe 2076 dvjdj.exe 2116 7jvvd.exe 1152 fxlrxxf.exe -
resource yara_rule behavioral1/memory/540-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-587-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2892-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-1193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-1300-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1232 2524 2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe 30 PID 2524 wrote to memory of 1232 2524 2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe 30 PID 2524 wrote to memory of 1232 2524 2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe 30 PID 2524 wrote to memory of 1232 2524 2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe 30 PID 1232 wrote to memory of 540 1232 9rlrffl.exe 31 PID 1232 wrote to memory of 540 1232 9rlrffl.exe 31 PID 1232 wrote to memory of 540 1232 9rlrffl.exe 31 PID 1232 wrote to memory of 540 1232 9rlrffl.exe 31 PID 540 wrote to memory of 1872 540 3tntbh.exe 32 PID 540 wrote to memory of 1872 540 3tntbh.exe 32 PID 540 wrote to memory of 1872 540 3tntbh.exe 32 PID 540 wrote to memory of 1872 540 3tntbh.exe 32 PID 1872 wrote to memory of 2216 1872 bthtbt.exe 33 PID 1872 wrote to memory of 2216 1872 bthtbt.exe 33 PID 1872 wrote to memory of 2216 1872 bthtbt.exe 33 PID 1872 wrote to memory of 2216 1872 bthtbt.exe 33 PID 2216 wrote to memory of 2864 2216 jvppp.exe 34 PID 2216 wrote to memory of 2864 2216 jvppp.exe 34 PID 2216 wrote to memory of 2864 2216 jvppp.exe 34 PID 2216 wrote to memory of 2864 2216 jvppp.exe 34 PID 2864 wrote to memory of 2236 2864 jdpvj.exe 35 PID 2864 wrote to memory of 2236 2864 jdpvj.exe 35 PID 2864 wrote to memory of 2236 2864 jdpvj.exe 35 PID 2864 wrote to memory of 2236 2864 jdpvj.exe 35 PID 2236 wrote to memory of 2820 2236 dvjpp.exe 36 PID 2236 wrote to memory of 2820 2236 dvjpp.exe 36 PID 2236 wrote to memory of 2820 2236 dvjpp.exe 36 PID 2236 wrote to memory of 2820 2236 dvjpp.exe 36 PID 2820 wrote to memory of 1984 2820 7rrflrl.exe 37 PID 2820 wrote to memory of 1984 2820 7rrflrl.exe 37 PID 2820 wrote to memory of 1984 2820 7rrflrl.exe 37 PID 2820 wrote to memory of 1984 2820 7rrflrl.exe 37 PID 1984 wrote to memory of 2608 1984 pvjdp.exe 38 PID 1984 wrote to memory of 2608 1984 pvjdp.exe 38 PID 1984 wrote to memory of 2608 1984 pvjdp.exe 38 PID 1984 wrote to memory of 2608 1984 pvjdp.exe 38 PID 2608 wrote to memory of 2052 2608 ffxrflf.exe 39 PID 2608 wrote to memory of 2052 2608 ffxrflf.exe 39 PID 2608 wrote to memory of 2052 2608 ffxrflf.exe 39 PID 2608 wrote to memory of 2052 2608 ffxrflf.exe 39 PID 2052 wrote to memory of 2120 2052 fffxfrr.exe 40 PID 2052 wrote to memory of 2120 2052 fffxfrr.exe 40 PID 2052 wrote to memory of 2120 2052 fffxfrr.exe 40 PID 2052 wrote to memory of 2120 2052 fffxfrr.exe 40 PID 2120 wrote to memory of 1572 2120 5pdpd.exe 41 PID 2120 wrote to memory of 1572 2120 5pdpd.exe 41 PID 2120 wrote to memory of 1572 2120 5pdpd.exe 41 PID 2120 wrote to memory of 1572 2120 5pdpd.exe 41 PID 1572 wrote to memory of 2436 1572 3jddd.exe 42 PID 1572 wrote to memory of 2436 1572 3jddd.exe 42 PID 1572 wrote to memory of 2436 1572 3jddd.exe 42 PID 1572 wrote to memory of 2436 1572 3jddd.exe 42 PID 2436 wrote to memory of 1648 2436 9pppp.exe 43 PID 2436 wrote to memory of 1648 2436 9pppp.exe 43 PID 2436 wrote to memory of 1648 2436 9pppp.exe 43 PID 2436 wrote to memory of 1648 2436 9pppp.exe 43 PID 1648 wrote to memory of 2912 1648 fxllrxf.exe 44 PID 1648 wrote to memory of 2912 1648 fxllrxf.exe 44 PID 1648 wrote to memory of 2912 1648 fxllrxf.exe 44 PID 1648 wrote to memory of 2912 1648 fxllrxf.exe 44 PID 2912 wrote to memory of 1300 2912 jjpdd.exe 45 PID 2912 wrote to memory of 1300 2912 jjpdd.exe 45 PID 2912 wrote to memory of 1300 2912 jjpdd.exe 45 PID 2912 wrote to memory of 1300 2912 jjpdd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe"C:\Users\Admin\AppData\Local\Temp\2bcd0f34c3b05a26f98c48cc1f939e57f81bc03cd4c14509e867487511371421N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\9rlrffl.exec:\9rlrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\3tntbh.exec:\3tntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\bthtbt.exec:\bthtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\jvppp.exec:\jvppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jdpvj.exec:\jdpvj.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dvjpp.exec:\dvjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\7rrflrl.exec:\7rrflrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pvjdp.exec:\pvjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\ffxrflf.exec:\ffxrflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fffxfrr.exec:\fffxfrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\5pdpd.exec:\5pdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\3jddd.exec:\3jddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\9pppp.exec:\9pppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fxllrxf.exec:\fxllrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\jjpdd.exec:\jjpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\bbbnbb.exec:\bbbnbb.exe17⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ddpjd.exec:\ddpjd.exe18⤵
- Executes dropped EXE
PID:1216 -
\??\c:\pddvp.exec:\pddvp.exe19⤵
- Executes dropped EXE
PID:316 -
\??\c:\thbbnn.exec:\thbbnn.exe20⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7nhnnt.exec:\7nhnnt.exe21⤵
- Executes dropped EXE
PID:272 -
\??\c:\bthhtt.exec:\bthhtt.exe22⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfflrrf.exec:\lfflrrf.exe23⤵
- Executes dropped EXE
PID:2152 -
\??\c:\thtttt.exec:\thtttt.exe24⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbnntt.exec:\hbnntt.exe25⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7bbhnb.exec:\7bbhnb.exe26⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nhtbbb.exec:\nhtbbb.exe27⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lfxflfl.exec:\lfxflfl.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bbttbh.exec:\bbttbh.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jjjpj.exec:\jjjpj.exe30⤵
- Executes dropped EXE
PID:688 -
\??\c:\3lxxrfr.exec:\3lxxrfr.exe31⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pdvdp.exec:\pdvdp.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5htbhb.exec:\5htbhb.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vvppd.exec:\vvppd.exe34⤵
- Executes dropped EXE
PID:540 -
\??\c:\nbnbhn.exec:\nbnbhn.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bntnnn.exec:\bntnnn.exe36⤵
- Executes dropped EXE
PID:1512 -
\??\c:\3djjd.exec:\3djjd.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rfxxffl.exec:\rfxxffl.exe38⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lfxlxxx.exec:\lfxlxxx.exe39⤵
- Executes dropped EXE
PID:712 -
\??\c:\5btbnb.exec:\5btbnb.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7jddd.exec:\7jddd.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jjvpp.exec:\jjvpp.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rfxxfxl.exec:\rfxxfxl.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hhthnn.exec:\hhthnn.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3jjdd.exec:\3jjdd.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pdjjp.exec:\pdjjp.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ffxxxxl.exec:\ffxxxxl.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9xflrll.exec:\9xflrll.exe48⤵
- Executes dropped EXE
PID:1004 -
\??\c:\thbhhh.exec:\thbhhh.exe49⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdjdd.exec:\jdjdd.exe50⤵
- Executes dropped EXE
PID:848 -
\??\c:\fxllrrf.exec:\fxllrrf.exe51⤵
- Executes dropped EXE
PID:1556 -
\??\c:\3rrxxxf.exec:\3rrxxxf.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1432 -
\??\c:\bbbbhn.exec:\bbbbhn.exe53⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3pjjv.exec:\3pjjv.exe54⤵
- Executes dropped EXE
PID:796 -
\??\c:\jvpjj.exec:\jvpjj.exe55⤵
- Executes dropped EXE
PID:1252 -
\??\c:\lxlfrlr.exec:\lxlfrlr.exe56⤵
- Executes dropped EXE
PID:1216 -
\??\c:\3httbt.exec:\3httbt.exe57⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nbttbb.exec:\nbttbb.exe58⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdvvj.exec:\jdvvj.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lxrxffl.exec:\lxrxffl.exe60⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5nhnbn.exec:\5nhnbn.exe61⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hbntbh.exec:\hbntbh.exe62⤵
- Executes dropped EXE
PID:852 -
\??\c:\dvjdj.exec:\dvjdj.exe63⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7jvvd.exec:\7jvvd.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe65⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1btttt.exec:\1btttt.exe66⤵PID:2316
-
\??\c:\7ddjp.exec:\7ddjp.exe67⤵PID:1288
-
\??\c:\ddvdp.exec:\ddvdp.exe68⤵PID:1364
-
\??\c:\fffrfrf.exec:\fffrfrf.exe69⤵PID:1368
-
\??\c:\nhhbnt.exec:\nhhbnt.exe70⤵PID:2036
-
\??\c:\nbtnnn.exec:\nbtnnn.exe71⤵PID:2004
-
\??\c:\dvjjp.exec:\dvjjp.exe72⤵PID:1416
-
\??\c:\rlflrxl.exec:\rlflrxl.exe73⤵PID:2528
-
\??\c:\hhnnbh.exec:\hhnnbh.exe74⤵PID:1232
-
\??\c:\tnhnbh.exec:\tnhnbh.exe75⤵PID:2452
-
\??\c:\vvjjj.exec:\vvjjj.exe76⤵PID:2124
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe77⤵PID:2752
-
\??\c:\1lrlllx.exec:\1lrlllx.exe78⤵PID:1516
-
\??\c:\hhbnnt.exec:\hhbnnt.exe79⤵PID:2868
-
\??\c:\dvppv.exec:\dvppv.exe80⤵PID:2892
-
\??\c:\1rlrxxr.exec:\1rlrxxr.exe81⤵PID:764
-
\??\c:\1fxxfff.exec:\1fxxfff.exe82⤵PID:2992
-
\??\c:\7nhthh.exec:\7nhthh.exe83⤵PID:2644
-
\??\c:\9hbbhn.exec:\9hbbhn.exe84⤵PID:2824
-
\??\c:\vdvjv.exec:\vdvjv.exe85⤵PID:2784
-
\??\c:\9rrxrrx.exec:\9rrxrrx.exe86⤵PID:1008
-
\??\c:\7lflrxf.exec:\7lflrxf.exe87⤵PID:2624
-
\??\c:\hbtbnb.exec:\hbtbnb.exe88⤵PID:2296
-
\??\c:\nbhbhh.exec:\nbhbhh.exe89⤵PID:2732
-
\??\c:\vpjdj.exec:\vpjdj.exe90⤵PID:2196
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe91⤵PID:492
-
\??\c:\1lflxxf.exec:\1lflxxf.exe92⤵PID:1800
-
\??\c:\5ntntt.exec:\5ntntt.exe93⤵PID:848
-
\??\c:\pdvvv.exec:\pdvvv.exe94⤵PID:616
-
\??\c:\vddpd.exec:\vddpd.exe95⤵
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\3rlrxrx.exec:\3rlrxrx.exe96⤵PID:1404
-
\??\c:\hbtbnt.exec:\hbtbnt.exe97⤵PID:1084
-
\??\c:\nnttbb.exec:\nnttbb.exe98⤵PID:1688
-
\??\c:\ppjpv.exec:\ppjpv.exe99⤵PID:1356
-
\??\c:\lffrllf.exec:\lffrllf.exe100⤵PID:2348
-
\??\c:\7tnntb.exec:\7tnntb.exe101⤵PID:3064
-
\??\c:\ttnbnt.exec:\ttnbnt.exe102⤵PID:272
-
\??\c:\jjjpp.exec:\jjjpp.exe103⤵PID:2400
-
\??\c:\xxlrfll.exec:\xxlrfll.exe104⤵PID:1420
-
\??\c:\frflrrr.exec:\frflrrr.exe105⤵PID:444
-
\??\c:\tthhnh.exec:\tthhnh.exe106⤵PID:3024
-
\??\c:\vpdpv.exec:\vpdpv.exe107⤵PID:1224
-
\??\c:\1rlfllx.exec:\1rlfllx.exe108⤵PID:652
-
\??\c:\5hhnnt.exec:\5hhnnt.exe109⤵PID:684
-
\??\c:\7bntbh.exec:\7bntbh.exe110⤵PID:2128
-
\??\c:\vpjpd.exec:\vpjpd.exe111⤵PID:1088
-
\??\c:\fxxlxfr.exec:\fxxlxfr.exe112⤵PID:1364
-
\??\c:\nhnthn.exec:\nhnthn.exe113⤵PID:2396
-
\??\c:\hhhbnb.exec:\hhhbnb.exe114⤵PID:2036
-
\??\c:\dvpjv.exec:\dvpjv.exe115⤵PID:1756
-
\??\c:\3lffllx.exec:\3lffllx.exe116⤵PID:1416
-
\??\c:\ntbhth.exec:\ntbhth.exe117⤵PID:804
-
\??\c:\bthtbh.exec:\bthtbh.exe118⤵PID:1232
-
\??\c:\pjdpd.exec:\pjdpd.exe119⤵PID:2452
-
\??\c:\ffflfxx.exec:\ffflfxx.exe120⤵PID:2124
-
\??\c:\1bntbh.exec:\1bntbh.exe121⤵PID:264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-