Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 06:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe
-
Size
256KB
-
MD5
73716db42870027a7e865708d9c49760
-
SHA1
e8a162607cc73d41c21ca3d751d7ac89206293d9
-
SHA256
7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9
-
SHA512
a88795754a2a1fccb7531e3770dd1a27d104e51c96af1788fd2b73dd93f68b6699ce46c1063b8d2833273d3c2d89b416c6b53099610f4cbbef9838d54bd9f825
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYL:l7TcbWXZshJX2VG6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1752-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2472-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2644-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2896-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2108-46-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2856-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2428-62-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2428-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2696-80-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2696-81-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2680-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2152-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2628-116-0x0000000000230000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2628-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2888-126-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/608-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2788-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1592-178-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/860-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1588-197-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1928-208-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1016-271-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2488-294-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2192-315-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2428-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2616-354-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2616-353-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2624-367-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2616-376-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2932-394-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2932-392-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2932-395-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2800-408-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/468-421-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1328-440-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/444-451-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/444-454-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/112-474-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1928-487-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2424-525-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2424-523-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/3000-545-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3064-571-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2652-584-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1716-615-0x0000000000230000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2612-641-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2768-684-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/624-778-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2488-827-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/624-1052-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1592-1238-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/968-1274-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/604-1311-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/1716-1407-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2636-1421-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2636-1420-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2472 vdjvv.exe 2644 rxrrxrx.exe 2896 pjjvv.exe 2108 htbhtn.exe 2856 jpdvv.exe 2428 tbhtbn.exe 2596 pdvjj.exe 2696 nbtttb.exe 2564 1ddjd.exe 2680 hnbhth.exe 2152 pdvdp.exe 2628 tnnhnb.exe 2888 pdjjv.exe 608 ffxffrx.exe 2788 jjdjv.exe 1364 xrlllrf.exe 1980 nhtttn.exe 1700 dddjd.exe 1592 3lrrfrr.exe 860 fxfflrx.exe 1588 rxffxfr.exe 1956 vpjjd.exe 1928 lffxffx.exe 572 bhbthb.exe 784 pjppd.exe 1212 llflxfl.exe 1444 hnbtnb.exe 376 jvppd.exe 276 lrflrxl.exe 1016 vdvpv.exe 584 rllrfrl.exe 2332 tbbntn.exe 2488 vjvjd.exe 2512 rfrxrrr.exe 2940 bnbhtb.exe 2192 dvdvd.exe 2688 lrrxrfr.exe 2864 7nhtnt.exe 2952 bbthbt.exe 2720 jjdpj.exe 2428 xrlrrfr.exe 2616 tthhbb.exe 2872 dvpdd.exe 2624 3lffflr.exe 3040 3hbbth.exe 1120 jjdjv.exe 2152 3jvpj.exe 2932 9btbnn.exe 2908 7jdjv.exe 2800 dpvjj.exe 2768 nttbhh.exe 468 hnhnbb.exe 840 jjvjd.exe 1464 fllxrfx.exe 1328 tbttbb.exe 2396 nbbhbn.exe 444 dpjpv.exe 964 lflxrlx.exe 688 tntnhn.exe 112 vvpvj.exe 552 rxxflll.exe 1928 nbtbnh.exe 2268 ddvjd.exe 1612 lrrrxxl.exe -
resource yara_rule behavioral1/memory/1752-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2472-9-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2472-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2644-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2896-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2108-46-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2856-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2428-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2696-81-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2680-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2628-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2888-126-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/608-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1364-146-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1592-178-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/860-180-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/860-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1588-197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1928-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1016-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2488-294-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2940-302-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2192-315-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2428-346-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2616-353-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2932-395-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2800-408-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/468-421-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/444-454-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/112-474-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2424-525-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2652-584-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2768-684-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/624-778-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2488-827-0x00000000003A0000-0x00000000003C8000-memory.dmp upx behavioral1/memory/2844-864-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-962-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1512-975-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1408-988-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1676-1001-0x00000000001B0000-0x00000000001D8000-memory.dmp upx behavioral1/memory/1784-1008-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/624-1045-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/352-1053-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/892-1066-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2036-1083-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2928-1177-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1592-1238-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/968-1274-0x00000000003C0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/2636-1421-0x0000000000220000-0x0000000000248000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2472 1752 7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe 31 PID 1752 wrote to memory of 2472 1752 7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe 31 PID 1752 wrote to memory of 2472 1752 7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe 31 PID 1752 wrote to memory of 2472 1752 7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe 31 PID 2472 wrote to memory of 2644 2472 vdjvv.exe 32 PID 2472 wrote to memory of 2644 2472 vdjvv.exe 32 PID 2472 wrote to memory of 2644 2472 vdjvv.exe 32 PID 2472 wrote to memory of 2644 2472 vdjvv.exe 32 PID 2644 wrote to memory of 2896 2644 rxrrxrx.exe 33 PID 2644 wrote to memory of 2896 2644 rxrrxrx.exe 33 PID 2644 wrote to memory of 2896 2644 rxrrxrx.exe 33 PID 2644 wrote to memory of 2896 2644 rxrrxrx.exe 33 PID 2896 wrote to memory of 2108 2896 pjjvv.exe 34 PID 2896 wrote to memory of 2108 2896 pjjvv.exe 34 PID 2896 wrote to memory of 2108 2896 pjjvv.exe 34 PID 2896 wrote to memory of 2108 2896 pjjvv.exe 34 PID 2108 wrote to memory of 2856 2108 htbhtn.exe 35 PID 2108 wrote to memory of 2856 2108 htbhtn.exe 35 PID 2108 wrote to memory of 2856 2108 htbhtn.exe 35 PID 2108 wrote to memory of 2856 2108 htbhtn.exe 35 PID 2856 wrote to memory of 2428 2856 jpdvv.exe 36 PID 2856 wrote to memory of 2428 2856 jpdvv.exe 36 PID 2856 wrote to memory of 2428 2856 jpdvv.exe 36 PID 2856 wrote to memory of 2428 2856 jpdvv.exe 36 PID 2428 wrote to memory of 2596 2428 tbhtbn.exe 37 PID 2428 wrote to memory of 2596 2428 tbhtbn.exe 37 PID 2428 wrote to memory of 2596 2428 tbhtbn.exe 37 PID 2428 wrote to memory of 2596 2428 tbhtbn.exe 37 PID 2596 wrote to memory of 2696 2596 pdvjj.exe 38 PID 2596 wrote to memory of 2696 2596 pdvjj.exe 38 PID 2596 wrote to memory of 2696 2596 pdvjj.exe 38 PID 2596 wrote to memory of 2696 2596 pdvjj.exe 38 PID 2696 wrote to memory of 2564 2696 nbtttb.exe 39 PID 2696 wrote to memory of 2564 2696 nbtttb.exe 39 PID 2696 wrote to memory of 2564 2696 nbtttb.exe 39 PID 2696 wrote to memory of 2564 2696 nbtttb.exe 39 PID 2564 wrote to memory of 2680 2564 1ddjd.exe 40 PID 2564 wrote to memory of 2680 2564 1ddjd.exe 40 PID 2564 wrote to memory of 2680 2564 1ddjd.exe 40 PID 2564 wrote to memory of 2680 2564 1ddjd.exe 40 PID 2680 wrote to memory of 2152 2680 hnbhth.exe 41 PID 2680 wrote to memory of 2152 2680 hnbhth.exe 41 PID 2680 wrote to memory of 2152 2680 hnbhth.exe 41 PID 2680 wrote to memory of 2152 2680 hnbhth.exe 41 PID 2152 wrote to memory of 2628 2152 pdvdp.exe 42 PID 2152 wrote to memory of 2628 2152 pdvdp.exe 42 PID 2152 wrote to memory of 2628 2152 pdvdp.exe 42 PID 2152 wrote to memory of 2628 2152 pdvdp.exe 42 PID 2628 wrote to memory of 2888 2628 tnnhnb.exe 43 PID 2628 wrote to memory of 2888 2628 tnnhnb.exe 43 PID 2628 wrote to memory of 2888 2628 tnnhnb.exe 43 PID 2628 wrote to memory of 2888 2628 tnnhnb.exe 43 PID 2888 wrote to memory of 608 2888 pdjjv.exe 44 PID 2888 wrote to memory of 608 2888 pdjjv.exe 44 PID 2888 wrote to memory of 608 2888 pdjjv.exe 44 PID 2888 wrote to memory of 608 2888 pdjjv.exe 44 PID 608 wrote to memory of 2788 608 ffxffrx.exe 45 PID 608 wrote to memory of 2788 608 ffxffrx.exe 45 PID 608 wrote to memory of 2788 608 ffxffrx.exe 45 PID 608 wrote to memory of 2788 608 ffxffrx.exe 45 PID 2788 wrote to memory of 1364 2788 jjdjv.exe 46 PID 2788 wrote to memory of 1364 2788 jjdjv.exe 46 PID 2788 wrote to memory of 1364 2788 jjdjv.exe 46 PID 2788 wrote to memory of 1364 2788 jjdjv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe"C:\Users\Admin\AppData\Local\Temp\7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\vdjvv.exec:\vdjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\rxrrxrx.exec:\rxrrxrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pjjvv.exec:\pjjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\htbhtn.exec:\htbhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jpdvv.exec:\jpdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tbhtbn.exec:\tbhtbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\pdvjj.exec:\pdvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\nbtttb.exec:\nbtttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1ddjd.exec:\1ddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\hnbhth.exec:\hnbhth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pdvdp.exec:\pdvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tnnhnb.exec:\tnnhnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\pdjjv.exec:\pdjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ffxffrx.exec:\ffxffrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\jjdjv.exec:\jjdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xrlllrf.exec:\xrlllrf.exe17⤵
- Executes dropped EXE
PID:1364 -
\??\c:\nhtttn.exec:\nhtttn.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dddjd.exec:\dddjd.exe19⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3lrrfrr.exec:\3lrrfrr.exe20⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fxfflrx.exec:\fxfflrx.exe21⤵
- Executes dropped EXE
PID:860 -
\??\c:\rxffxfr.exec:\rxffxfr.exe22⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vpjjd.exec:\vpjjd.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\lffxffx.exec:\lffxffx.exe24⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bhbthb.exec:\bhbthb.exe25⤵
- Executes dropped EXE
PID:572 -
\??\c:\pjppd.exec:\pjppd.exe26⤵
- Executes dropped EXE
PID:784 -
\??\c:\llflxfl.exec:\llflxfl.exe27⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hnbtnb.exec:\hnbtnb.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jvppd.exec:\jvppd.exe29⤵
- Executes dropped EXE
PID:376 -
\??\c:\lrflrxl.exec:\lrflrxl.exe30⤵
- Executes dropped EXE
PID:276 -
\??\c:\vdvpv.exec:\vdvpv.exe31⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rllrfrl.exec:\rllrfrl.exe32⤵
- Executes dropped EXE
PID:584 -
\??\c:\tbbntn.exec:\tbbntn.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vjvjd.exec:\vjvjd.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rfrxrrr.exec:\rfrxrrr.exe35⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bnbhtb.exec:\bnbhtb.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvdvd.exec:\dvdvd.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lrrxrfr.exec:\lrrxrfr.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7nhtnt.exec:\7nhtnt.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbthbt.exec:\bbthbt.exe40⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jjdpj.exec:\jjdpj.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xrlrrfr.exec:\xrlrrfr.exe42⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tthhbb.exec:\tthhbb.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dvpdd.exec:\dvpdd.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3lffflr.exec:\3lffflr.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3hbbth.exec:\3hbbth.exe46⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jjdjv.exec:\jjdjv.exe47⤵
- Executes dropped EXE
PID:1120 -
\??\c:\3jvpj.exec:\3jvpj.exe48⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9btbnn.exec:\9btbnn.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7jdjv.exec:\7jdjv.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dpvjj.exec:\dpvjj.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nttbhh.exec:\nttbhh.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hnhnbb.exec:\hnhnbb.exe53⤵
- Executes dropped EXE
PID:468 -
\??\c:\jjvjd.exec:\jjvjd.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\fllxrfx.exec:\fllxrfx.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tbttbb.exec:\tbttbb.exe56⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nbbhbn.exec:\nbbhbn.exe57⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dpjpv.exec:\dpjpv.exe58⤵
- Executes dropped EXE
PID:444 -
\??\c:\lflxrlx.exec:\lflxrlx.exe59⤵
- Executes dropped EXE
PID:964 -
\??\c:\tntnhn.exec:\tntnhn.exe60⤵
- Executes dropped EXE
PID:688 -
\??\c:\vvpvj.exec:\vvpvj.exe61⤵
- Executes dropped EXE
PID:112 -
\??\c:\rxxflll.exec:\rxxflll.exe62⤵
- Executes dropped EXE
PID:552 -
\??\c:\nbtbnh.exec:\nbtbnh.exe63⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ddvjd.exec:\ddvjd.exe64⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lrrrxxl.exec:\lrrrxxl.exe65⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hhnhnb.exec:\hhnhnb.exe66⤵PID:2064
-
\??\c:\jjvjp.exec:\jjvjp.exe67⤵PID:2160
-
\??\c:\dpvpv.exec:\dpvpv.exe68⤵PID:1444
-
\??\c:\xxrrxrl.exec:\xxrrxrl.exe69⤵PID:2424
-
\??\c:\nbnbhb.exec:\nbnbhb.exe70⤵PID:3008
-
\??\c:\jvvdp.exec:\jvvdp.exe71⤵PID:324
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe72⤵PID:3000
-
\??\c:\nthnbh.exec:\nthnbh.exe73⤵PID:584
-
\??\c:\vjvpv.exec:\vjvpv.exe74⤵PID:2080
-
\??\c:\nbbbbb.exec:\nbbbbb.exe75⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\jvdjp.exec:\jvdjp.exe76⤵PID:3064
-
\??\c:\xffxxlx.exec:\xffxxlx.exe77⤵PID:2088
-
\??\c:\hntbtb.exec:\hntbtb.exe78⤵PID:2652
-
\??\c:\jdppj.exec:\jdppj.exe79⤵PID:2836
-
\??\c:\llfxfrr.exec:\llfxfrr.exe80⤵PID:2852
-
\??\c:\tnbttt.exec:\tnbttt.exe81⤵PID:2712
-
\??\c:\pjpjv.exec:\pjpjv.exe82⤵PID:2904
-
\??\c:\xllfrrr.exec:\xllfrrr.exe83⤵PID:1716
-
\??\c:\ntbttb.exec:\ntbttb.exe84⤵PID:2820
-
\??\c:\pdjdv.exec:\pdjdv.exe85⤵PID:2576
-
\??\c:\jdvvd.exec:\jdvvd.exe86⤵PID:2564
-
\??\c:\rfrxrrr.exec:\rfrxrrr.exe87⤵PID:2612
-
\??\c:\nbbhnb.exec:\nbbhnb.exe88⤵PID:600
-
\??\c:\vjdjv.exec:\vjdjv.exe89⤵PID:2324
-
\??\c:\xrlxlrl.exec:\xrlxlrl.exe90⤵PID:2628
-
\??\c:\hnbbnh.exec:\hnbbnh.exe91⤵PID:576
-
\??\c:\jpjvv.exec:\jpjvv.exe92⤵PID:2780
-
\??\c:\frrrrxl.exec:\frrrrxl.exe93⤵PID:548
-
\??\c:\bbbbnh.exec:\bbbbnh.exe94⤵PID:2768
-
\??\c:\5pddj.exec:\5pddj.exe95⤵PID:1548
-
\??\c:\rfrrlfl.exec:\rfrrlfl.exe96⤵PID:684
-
\??\c:\5hbbbn.exec:\5hbbbn.exe97⤵PID:844
-
\??\c:\pvdvj.exec:\pvdvj.exe98⤵PID:3056
-
\??\c:\lxrflrf.exec:\lxrflrf.exe99⤵PID:1200
-
\??\c:\1nttnb.exec:\1nttnb.exe100⤵PID:2264
-
\??\c:\llrrxrx.exec:\llrrxrx.exe101⤵PID:1300
-
\??\c:\9dvvv.exec:\9dvvv.exe102⤵PID:1804
-
\??\c:\fffrxfx.exec:\fffrxfx.exe103⤵PID:912
-
\??\c:\tnnhhn.exec:\tnnhhn.exe104⤵PID:1784
-
\??\c:\lxllrxf.exec:\lxllrxf.exe105⤵PID:2240
-
\??\c:\thtbhb.exec:\thtbhb.exe106⤵PID:2156
-
\??\c:\nhtnbt.exec:\nhtnbt.exe107⤵PID:2260
-
\??\c:\vppvd.exec:\vppvd.exe108⤵PID:2128
-
\??\c:\lrxxfff.exec:\lrxxfff.exe109⤵
- System Location Discovery: System Language Discovery
PID:2124 -
\??\c:\tnhtnn.exec:\tnhtnn.exe110⤵PID:624
-
\??\c:\pvddj.exec:\pvddj.exe111⤵PID:2252
-
\??\c:\dvjjj.exec:\dvjjj.exe112⤵PID:960
-
\??\c:\xlfrflr.exec:\xlfrflr.exe113⤵PID:892
-
\??\c:\bbhtbh.exec:\bbhtbh.exe114⤵PID:2068
-
\??\c:\vdjvd.exec:\vdjvd.exe115⤵PID:1868
-
\??\c:\lfxxflr.exec:\lfxxflr.exe116⤵PID:2376
-
\??\c:\tthhtb.exec:\tthhtb.exe117⤵PID:2488
-
\??\c:\tttntb.exec:\tttntb.exe118⤵PID:2500
-
\??\c:\vdjjp.exec:\vdjjp.exe119⤵PID:2536
-
\??\c:\flxrxxf.exec:\flxrxxf.exe120⤵PID:2664
-
\??\c:\3bnnhh.exec:\3bnnhh.exe121⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-