Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe
-
Size
453KB
-
MD5
2c62a0e9528ad681d332fe7cbfb47b90
-
SHA1
2309b65c6d9e57019a29ce0601e6c170332f4621
-
SHA256
aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634
-
SHA512
d9618bd088aaf17f3da0c040da070a41771d7f66f5dd06863dab8e4ef0a54ea5bd034ae407608b80e43fe506b23f39bd308230ad77df35bb14bad7fa9e8a103b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ5:q7Tc2NYHUrAwfMp3CDJ5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2152-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1056-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-209-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2220-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-325-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2136-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-361-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1868-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-430-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-730-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2876-744-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2244 9rrxlxr.exe 2788 bhhnhn.exe 2708 tbtbnt.exe 2812 xxxlxrl.exe 2740 tthtbh.exe 2584 7fxllrr.exe 1660 9xrfrfx.exe 1536 nttbbn.exe 1468 fxrfrxl.exe 2664 5rfxfrr.exe 2040 xfxxrxr.exe 1684 pjdjd.exe 1616 llrlfxx.exe 1300 hbbhnt.exe 1056 jdpvj.exe 780 xfxlxff.exe 2408 jddpd.exe 2128 hbhthh.exe 2164 pppvp.exe 1964 llfxlrf.exe 2012 5tnthh.exe 2220 1jdjv.exe 2188 nthnbh.exe 700 7jpjv.exe 1688 1xlxffl.exe 1248 hnbtth.exe 1444 ntnhbn.exe 1804 btnbnt.exe 2920 5tbbtt.exe 1752 pjjvj.exe 2352 xxxlfrl.exe 2720 dpvdp.exe 2808 5jjjv.exe 2136 7xllrxl.exe 2700 bhbtnb.exe 2776 jdvjv.exe 2712 llrxlrf.exe 2884 nhttbb.exe 2616 tbtnbt.exe 2428 1dvpp.exe 1980 rrrfxlf.exe 680 nnbnbn.exe 1868 vvdpj.exe 2880 9frrflx.exe 2372 lrrfxfr.exe 2040 9vvpd.exe 380 flrrlxl.exe 2072 hnnhnt.exe 2540 vvjvj.exe 1104 rrlfxxf.exe 2384 lxfxrrf.exe 292 ddvdp.exe 1084 jpvjj.exe 2392 thbtbn.exe 2176 9ppdv.exe 2824 5vddd.exe 444 9xflxlf.exe 2168 bbnthh.exe 2988 7tthnb.exe 1324 jvpjp.exe 1524 fflfxlx.exe 2964 7hntht.exe 1700 jjvjv.exe 1708 vpdvd.exe -
resource yara_rule behavioral1/memory/2152-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-487-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1248-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-758-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2244 2152 aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe 30 PID 2152 wrote to memory of 2244 2152 aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe 30 PID 2152 wrote to memory of 2244 2152 aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe 30 PID 2152 wrote to memory of 2244 2152 aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe 30 PID 2244 wrote to memory of 2788 2244 9rrxlxr.exe 31 PID 2244 wrote to memory of 2788 2244 9rrxlxr.exe 31 PID 2244 wrote to memory of 2788 2244 9rrxlxr.exe 31 PID 2244 wrote to memory of 2788 2244 9rrxlxr.exe 31 PID 2788 wrote to memory of 2708 2788 bhhnhn.exe 32 PID 2788 wrote to memory of 2708 2788 bhhnhn.exe 32 PID 2788 wrote to memory of 2708 2788 bhhnhn.exe 32 PID 2788 wrote to memory of 2708 2788 bhhnhn.exe 32 PID 2708 wrote to memory of 2812 2708 tbtbnt.exe 33 PID 2708 wrote to memory of 2812 2708 tbtbnt.exe 33 PID 2708 wrote to memory of 2812 2708 tbtbnt.exe 33 PID 2708 wrote to memory of 2812 2708 tbtbnt.exe 33 PID 2812 wrote to memory of 2740 2812 xxxlxrl.exe 34 PID 2812 wrote to memory of 2740 2812 xxxlxrl.exe 34 PID 2812 wrote to memory of 2740 2812 xxxlxrl.exe 34 PID 2812 wrote to memory of 2740 2812 xxxlxrl.exe 34 PID 2740 wrote to memory of 2584 2740 tthtbh.exe 35 PID 2740 wrote to memory of 2584 2740 tthtbh.exe 35 PID 2740 wrote to memory of 2584 2740 tthtbh.exe 35 PID 2740 wrote to memory of 2584 2740 tthtbh.exe 35 PID 2584 wrote to memory of 1660 2584 7fxllrr.exe 36 PID 2584 wrote to memory of 1660 2584 7fxllrr.exe 36 PID 2584 wrote to memory of 1660 2584 7fxllrr.exe 36 PID 2584 wrote to memory of 1660 2584 7fxllrr.exe 36 PID 1660 wrote to memory of 1536 1660 9xrfrfx.exe 37 PID 1660 wrote to memory of 1536 1660 9xrfrfx.exe 37 PID 1660 wrote to memory of 1536 1660 9xrfrfx.exe 37 PID 1660 wrote to memory of 1536 1660 9xrfrfx.exe 37 PID 1536 wrote to memory of 1468 1536 nttbbn.exe 38 PID 1536 wrote to memory of 1468 1536 nttbbn.exe 38 PID 1536 wrote to memory of 1468 1536 nttbbn.exe 38 PID 1536 wrote to memory of 1468 1536 nttbbn.exe 38 PID 1468 wrote to memory of 2664 1468 fxrfrxl.exe 39 PID 1468 wrote to memory of 2664 1468 fxrfrxl.exe 39 PID 1468 wrote to memory of 2664 1468 fxrfrxl.exe 39 PID 1468 wrote to memory of 2664 1468 fxrfrxl.exe 39 PID 2664 wrote to memory of 2040 2664 5rfxfrr.exe 40 PID 2664 wrote to memory of 2040 2664 5rfxfrr.exe 40 PID 2664 wrote to memory of 2040 2664 5rfxfrr.exe 40 PID 2664 wrote to memory of 2040 2664 5rfxfrr.exe 40 PID 2040 wrote to memory of 1684 2040 xfxxrxr.exe 41 PID 2040 wrote to memory of 1684 2040 xfxxrxr.exe 41 PID 2040 wrote to memory of 1684 2040 xfxxrxr.exe 41 PID 2040 wrote to memory of 1684 2040 xfxxrxr.exe 41 PID 1684 wrote to memory of 1616 1684 pjdjd.exe 42 PID 1684 wrote to memory of 1616 1684 pjdjd.exe 42 PID 1684 wrote to memory of 1616 1684 pjdjd.exe 42 PID 1684 wrote to memory of 1616 1684 pjdjd.exe 42 PID 1616 wrote to memory of 1300 1616 llrlfxx.exe 43 PID 1616 wrote to memory of 1300 1616 llrlfxx.exe 43 PID 1616 wrote to memory of 1300 1616 llrlfxx.exe 43 PID 1616 wrote to memory of 1300 1616 llrlfxx.exe 43 PID 1300 wrote to memory of 1056 1300 hbbhnt.exe 44 PID 1300 wrote to memory of 1056 1300 hbbhnt.exe 44 PID 1300 wrote to memory of 1056 1300 hbbhnt.exe 44 PID 1300 wrote to memory of 1056 1300 hbbhnt.exe 44 PID 1056 wrote to memory of 780 1056 jdpvj.exe 45 PID 1056 wrote to memory of 780 1056 jdpvj.exe 45 PID 1056 wrote to memory of 780 1056 jdpvj.exe 45 PID 1056 wrote to memory of 780 1056 jdpvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe"C:\Users\Admin\AppData\Local\Temp\aea21d85085e6171ee3ab3d0523666c9a1fc96f9f137c63c48558cc955427634N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\9rrxlxr.exec:\9rrxlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\bhhnhn.exec:\bhhnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\tbtbnt.exec:\tbtbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tthtbh.exec:\tthtbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7fxllrr.exec:\7fxllrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\9xrfrfx.exec:\9xrfrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\nttbbn.exec:\nttbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\5rfxfrr.exec:\5rfxfrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\xfxxrxr.exec:\xfxxrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\pjdjd.exec:\pjdjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\llrlfxx.exec:\llrlfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\hbbhnt.exec:\hbbhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\jdpvj.exec:\jdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\xfxlxff.exec:\xfxlxff.exe17⤵
- Executes dropped EXE
PID:780 -
\??\c:\jddpd.exec:\jddpd.exe18⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hbhthh.exec:\hbhthh.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pppvp.exec:\pppvp.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\llfxlrf.exec:\llfxlrf.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5tnthh.exec:\5tnthh.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1jdjv.exec:\1jdjv.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nthnbh.exec:\nthnbh.exe24⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7jpjv.exec:\7jpjv.exe25⤵
- Executes dropped EXE
PID:700 -
\??\c:\1xlxffl.exec:\1xlxffl.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hnbtth.exec:\hnbtth.exe27⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ntnhbn.exec:\ntnhbn.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\btnbnt.exec:\btnbnt.exe29⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5tbbtt.exec:\5tbbtt.exe30⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjjvj.exec:\pjjvj.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dpvdp.exec:\dpvdp.exe33⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5jjjv.exec:\5jjjv.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7xllrxl.exec:\7xllrxl.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bhbtnb.exec:\bhbtnb.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jdvjv.exec:\jdvjv.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\llrxlrf.exec:\llrxlrf.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhttbb.exec:\nhttbb.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tbtnbt.exec:\tbtnbt.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1dvpp.exec:\1dvpp.exe41⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe42⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nnbnbn.exec:\nnbnbn.exe43⤵
- Executes dropped EXE
PID:680 -
\??\c:\vvdpj.exec:\vvdpj.exe44⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9frrflx.exec:\9frrflx.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lrrfxfr.exec:\lrrfxfr.exe46⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9vvpd.exec:\9vvpd.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\flrrlxl.exec:\flrrlxl.exe48⤵
- Executes dropped EXE
PID:380 -
\??\c:\hnnhnt.exec:\hnnhnt.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\vvjvj.exec:\vvjvj.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe51⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lxfxrrf.exec:\lxfxrrf.exe52⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ddvdp.exec:\ddvdp.exe53⤵
- Executes dropped EXE
PID:292 -
\??\c:\jpvjj.exec:\jpvjj.exe54⤵
- Executes dropped EXE
PID:1084 -
\??\c:\thbtbn.exec:\thbtbn.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9ppdv.exec:\9ppdv.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\5vddd.exec:\5vddd.exe57⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9xflxlf.exec:\9xflxlf.exe58⤵
- Executes dropped EXE
PID:444 -
\??\c:\bbnthh.exec:\bbnthh.exe59⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7tthnb.exec:\7tthnb.exe60⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jvpjp.exec:\jvpjp.exe61⤵
- Executes dropped EXE
PID:1324 -
\??\c:\fflfxlx.exec:\fflfxlx.exe62⤵
- Executes dropped EXE
PID:1524 -
\??\c:\7hntht.exec:\7hntht.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jjvjv.exec:\jjvjv.exe64⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vpdvd.exec:\vpdvd.exe65⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5rlxrfl.exec:\5rlxrfl.exe66⤵PID:1688
-
\??\c:\bnntnn.exec:\bnntnn.exe67⤵PID:1248
-
\??\c:\nnhbnb.exec:\nnhbnb.exe68⤵PID:2076
-
\??\c:\1pdvv.exec:\1pdvv.exe69⤵PID:1948
-
\??\c:\llflxfr.exec:\llflxfr.exe70⤵PID:2212
-
\??\c:\nhbnbb.exec:\nhbnbb.exe71⤵PID:2920
-
\??\c:\9bnbnb.exec:\9bnbnb.exe72⤵PID:1752
-
\??\c:\vddjd.exec:\vddjd.exe73⤵PID:2096
-
\??\c:\3lfllrx.exec:\3lfllrx.exe74⤵PID:1544
-
\??\c:\bnbhnt.exec:\bnbhnt.exe75⤵PID:2720
-
\??\c:\dppvp.exec:\dppvp.exe76⤵PID:2808
-
\??\c:\pdvvj.exec:\pdvvj.exe77⤵PID:2796
-
\??\c:\xffrrlr.exec:\xffrrlr.exe78⤵PID:2772
-
\??\c:\hbttbh.exec:\hbttbh.exe79⤵PID:2804
-
\??\c:\vpppd.exec:\vpppd.exe80⤵
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\9xlffxf.exec:\9xlffxf.exe81⤵PID:2748
-
\??\c:\xlffffr.exec:\xlffffr.exe82⤵PID:2584
-
\??\c:\5nbhnb.exec:\5nbhnb.exe83⤵PID:2648
-
\??\c:\9pjpv.exec:\9pjpv.exe84⤵PID:2640
-
\??\c:\xlxflxf.exec:\xlxflxf.exe85⤵PID:2508
-
\??\c:\9ffrlxx.exec:\9ffrlxx.exe86⤵PID:1860
-
\??\c:\bhhtbn.exec:\bhhtbn.exe87⤵PID:2892
-
\??\c:\1jppd.exec:\1jppd.exe88⤵PID:2664
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe89⤵PID:1556
-
\??\c:\rrlrxxr.exec:\rrlrxxr.exe90⤵PID:2904
-
\??\c:\1nnthb.exec:\1nnthb.exe91⤵PID:2040
-
\??\c:\jpjpd.exec:\jpjpd.exe92⤵PID:1720
-
\??\c:\rlfrxxr.exec:\rlfrxxr.exe93⤵PID:812
-
\??\c:\tthtbh.exec:\tthtbh.exe94⤵PID:2544
-
\??\c:\ddvvd.exec:\ddvvd.exe95⤵PID:536
-
\??\c:\vjddp.exec:\vjddp.exe96⤵PID:1952
-
\??\c:\1rxlrrf.exec:\1rxlrrf.exe97⤵PID:2412
-
\??\c:\hbnhnn.exec:\hbnhnn.exe98⤵PID:2876
-
\??\c:\7pjdd.exec:\7pjdd.exe99⤵PID:1928
-
\??\c:\7ppdp.exec:\7ppdp.exe100⤵PID:2960
-
\??\c:\lfxflrf.exec:\lfxflrf.exe101⤵PID:3024
-
\??\c:\1xxlrfr.exec:\1xxlrfr.exe102⤵PID:2916
-
\??\c:\bttbnt.exec:\bttbnt.exe103⤵PID:1264
-
\??\c:\pdppd.exec:\pdppd.exe104⤵PID:2012
-
\??\c:\lxxfxlx.exec:\lxxfxlx.exe105⤵PID:340
-
\??\c:\rlflxfx.exec:\rlflxfx.exe106⤵PID:832
-
\??\c:\3hhhtb.exec:\3hhhtb.exe107⤵PID:2108
-
\??\c:\5dvpv.exec:\5dvpv.exe108⤵PID:1956
-
\??\c:\1xxlfrl.exec:\1xxlfrl.exe109⤵PID:2328
-
\??\c:\9xlrxfr.exec:\9xlrxfr.exe110⤵PID:2852
-
\??\c:\ttnbnt.exec:\ttnbnt.exe111⤵PID:2464
-
\??\c:\dvjjd.exec:\dvjjd.exe112⤵PID:2076
-
\??\c:\5pdpv.exec:\5pdpv.exe113⤵PID:1036
-
\??\c:\lxrflrf.exec:\lxrflrf.exe114⤵PID:1668
-
\??\c:\nhbthn.exec:\nhbthn.exe115⤵PID:2304
-
\??\c:\vppjj.exec:\vppjj.exe116⤵PID:2348
-
\??\c:\9llfxrf.exec:\9llfxrf.exe117⤵PID:1696
-
\??\c:\1ppdp.exec:\1ppdp.exe118⤵PID:2944
-
\??\c:\lrrxrxr.exec:\lrrxrxr.exe119⤵PID:2732
-
\??\c:\rxfllfr.exec:\rxfllfr.exe120⤵PID:2692
-
\??\c:\ttbthh.exec:\ttbthh.exe121⤵PID:2700
-
\??\c:\pjpvp.exec:\pjpvp.exe122⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-