Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe
-
Size
453KB
-
MD5
0a3ba0890e8533ca41eea453d826a3d0
-
SHA1
21072709d92bbc895c69dc3cb3b83506d572ea7c
-
SHA256
40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388
-
SHA512
c97733b2471528ac10ac7d0ec37adccc73ad7c6ae1fc070f534cd40e22112dc8e5bf9dca93b250f053f203f1e5b521c09de331a5474ca60dcd1358fc41a95538
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-133-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1588-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-187-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2200-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-193-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3008-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-206-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2448-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/904-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-385-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-401-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/572-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/596-435-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1120-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-591-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-709-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1652-827-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-834-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-911-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2340-930-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2964-931-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-956-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1956 jjddp.exe 2568 7tnntb.exe 2560 1dpvj.exe 2104 1hbbhn.exe 2872 dvpvp.exe 2768 rfrxfff.exe 3020 vvvdp.exe 2648 5bttbt.exe 2676 hhbhtt.exe 2696 fxrrffr.exe 2504 tnhnbb.exe 1556 vpjpj.exe 704 lrfrflr.exe 1588 5dvvv.exe 2952 7frlxfl.exe 588 7nhnht.exe 1892 7vpvd.exe 1480 nbhhnt.exe 2200 jvpvj.exe 3008 rlffrrx.exe 1660 7hbtnt.exe 2448 3frfffr.exe 708 nhnntt.exe 1984 5jjjj.exe 936 xlxrxxf.exe 3056 flfrrfr.exe 904 jpjpd.exe 1928 frrrrrf.exe 1868 7nbbtt.exe 2024 fxlxlrf.exe 2704 1hhnht.exe 1364 jdddd.exe 2940 rrlrxll.exe 2804 7btttt.exe 2316 ppjpd.exe 2716 xrlrxfl.exe 2900 xrllxxf.exe 2860 bnhhnh.exe 2784 1ddjj.exe 2060 xrlrrxl.exe 2740 3rfrrrr.exe 2620 nbnnnn.exe 2792 1dpvv.exe 1456 3lxflrx.exe 2700 5rxxxxx.exe 2076 tnbbbt.exe 572 tbthbt.exe 2916 jpvpv.exe 1880 lfxxflr.exe 264 hbttbh.exe 756 ntnbtt.exe 596 pppvv.exe 2000 xfrflfr.exe 1756 bhtbbb.exe 1480 ttttbb.exe 1120 dvddj.exe 1012 xlxxrrf.exe 2424 bhhnnt.exe 2388 hhttnn.exe 2336 jvjjp.exe 2600 rlxrlrr.exe 708 htnnbb.exe 3052 ttnthn.exe 3048 pjddj.exe -
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-248-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/904-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-401-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/756-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-769-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/1652-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1956 2364 40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe 30 PID 2364 wrote to memory of 1956 2364 40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe 30 PID 2364 wrote to memory of 1956 2364 40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe 30 PID 2364 wrote to memory of 1956 2364 40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe 30 PID 1956 wrote to memory of 2568 1956 jjddp.exe 31 PID 1956 wrote to memory of 2568 1956 jjddp.exe 31 PID 1956 wrote to memory of 2568 1956 jjddp.exe 31 PID 1956 wrote to memory of 2568 1956 jjddp.exe 31 PID 2568 wrote to memory of 2560 2568 7tnntb.exe 32 PID 2568 wrote to memory of 2560 2568 7tnntb.exe 32 PID 2568 wrote to memory of 2560 2568 7tnntb.exe 32 PID 2568 wrote to memory of 2560 2568 7tnntb.exe 32 PID 2560 wrote to memory of 2104 2560 1dpvj.exe 33 PID 2560 wrote to memory of 2104 2560 1dpvj.exe 33 PID 2560 wrote to memory of 2104 2560 1dpvj.exe 33 PID 2560 wrote to memory of 2104 2560 1dpvj.exe 33 PID 2104 wrote to memory of 2872 2104 1hbbhn.exe 34 PID 2104 wrote to memory of 2872 2104 1hbbhn.exe 34 PID 2104 wrote to memory of 2872 2104 1hbbhn.exe 34 PID 2104 wrote to memory of 2872 2104 1hbbhn.exe 34 PID 2872 wrote to memory of 2768 2872 dvpvp.exe 35 PID 2872 wrote to memory of 2768 2872 dvpvp.exe 35 PID 2872 wrote to memory of 2768 2872 dvpvp.exe 35 PID 2872 wrote to memory of 2768 2872 dvpvp.exe 35 PID 2768 wrote to memory of 3020 2768 rfrxfff.exe 36 PID 2768 wrote to memory of 3020 2768 rfrxfff.exe 36 PID 2768 wrote to memory of 3020 2768 rfrxfff.exe 36 PID 2768 wrote to memory of 3020 2768 rfrxfff.exe 36 PID 3020 wrote to memory of 2648 3020 vvvdp.exe 37 PID 3020 wrote to memory of 2648 3020 vvvdp.exe 37 PID 3020 wrote to memory of 2648 3020 vvvdp.exe 37 PID 3020 wrote to memory of 2648 3020 vvvdp.exe 37 PID 2648 wrote to memory of 2676 2648 5bttbt.exe 38 PID 2648 wrote to memory of 2676 2648 5bttbt.exe 38 PID 2648 wrote to memory of 2676 2648 5bttbt.exe 38 PID 2648 wrote to memory of 2676 2648 5bttbt.exe 38 PID 2676 wrote to memory of 2696 2676 hhbhtt.exe 39 PID 2676 wrote to memory of 2696 2676 hhbhtt.exe 39 PID 2676 wrote to memory of 2696 2676 hhbhtt.exe 39 PID 2676 wrote to memory of 2696 2676 hhbhtt.exe 39 PID 2696 wrote to memory of 2504 2696 fxrrffr.exe 40 PID 2696 wrote to memory of 2504 2696 fxrrffr.exe 40 PID 2696 wrote to memory of 2504 2696 fxrrffr.exe 40 PID 2696 wrote to memory of 2504 2696 fxrrffr.exe 40 PID 2504 wrote to memory of 1556 2504 tnhnbb.exe 41 PID 2504 wrote to memory of 1556 2504 tnhnbb.exe 41 PID 2504 wrote to memory of 1556 2504 tnhnbb.exe 41 PID 2504 wrote to memory of 1556 2504 tnhnbb.exe 41 PID 1556 wrote to memory of 704 1556 vpjpj.exe 42 PID 1556 wrote to memory of 704 1556 vpjpj.exe 42 PID 1556 wrote to memory of 704 1556 vpjpj.exe 42 PID 1556 wrote to memory of 704 1556 vpjpj.exe 42 PID 704 wrote to memory of 1588 704 lrfrflr.exe 43 PID 704 wrote to memory of 1588 704 lrfrflr.exe 43 PID 704 wrote to memory of 1588 704 lrfrflr.exe 43 PID 704 wrote to memory of 1588 704 lrfrflr.exe 43 PID 1588 wrote to memory of 2952 1588 5dvvv.exe 44 PID 1588 wrote to memory of 2952 1588 5dvvv.exe 44 PID 1588 wrote to memory of 2952 1588 5dvvv.exe 44 PID 1588 wrote to memory of 2952 1588 5dvvv.exe 44 PID 2952 wrote to memory of 588 2952 7frlxfl.exe 45 PID 2952 wrote to memory of 588 2952 7frlxfl.exe 45 PID 2952 wrote to memory of 588 2952 7frlxfl.exe 45 PID 2952 wrote to memory of 588 2952 7frlxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe"C:\Users\Admin\AppData\Local\Temp\40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jjddp.exec:\jjddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\7tnntb.exec:\7tnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\1dpvj.exec:\1dpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1hbbhn.exec:\1hbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\dvpvp.exec:\dvpvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rfrxfff.exec:\rfrxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vvvdp.exec:\vvvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\5bttbt.exec:\5bttbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hhbhtt.exec:\hhbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\fxrrffr.exec:\fxrrffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tnhnbb.exec:\tnhnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vpjpj.exec:\vpjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\lrfrflr.exec:\lrfrflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\5dvvv.exec:\5dvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\7frlxfl.exec:\7frlxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\7nhnht.exec:\7nhnht.exe17⤵
- Executes dropped EXE
PID:588 -
\??\c:\7vpvd.exec:\7vpvd.exe18⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nbhhnt.exec:\nbhhnt.exe19⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jvpvj.exec:\jvpvj.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlffrrx.exec:\rlffrrx.exe21⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7hbtnt.exec:\7hbtnt.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3frfffr.exec:\3frfffr.exe23⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nhnntt.exec:\nhnntt.exe24⤵
- Executes dropped EXE
PID:708 -
\??\c:\5jjjj.exec:\5jjjj.exe25⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe26⤵
- Executes dropped EXE
PID:936 -
\??\c:\flfrrfr.exec:\flfrrfr.exe27⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jpjpd.exec:\jpjpd.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\frrrrrf.exec:\frrrrrf.exe29⤵
- Executes dropped EXE
PID:1928 -
\??\c:\7nbbtt.exec:\7nbbtt.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe31⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1hhnht.exec:\1hhnht.exe32⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdddd.exec:\jdddd.exe33⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rrlrxll.exec:\rrlrxll.exe34⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7btttt.exec:\7btttt.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ppjpd.exec:\ppjpd.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xrllxxf.exec:\xrllxxf.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bnhhnh.exec:\bnhhnh.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1ddjj.exec:\1ddjj.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xrlrrxl.exec:\xrlrrxl.exe41⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3rfrrrr.exec:\3rfrrrr.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nbnnnn.exec:\nbnnnn.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1dpvv.exec:\1dpvv.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3lxflrx.exec:\3lxflrx.exe45⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tnbbbt.exec:\tnbbbt.exe47⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tbthbt.exec:\tbthbt.exe48⤵
- Executes dropped EXE
PID:572 -
\??\c:\jpvpv.exec:\jpvpv.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lfxxflr.exec:\lfxxflr.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbttbh.exec:\hbttbh.exe51⤵
- Executes dropped EXE
PID:264 -
\??\c:\ntnbtt.exec:\ntnbtt.exe52⤵
- Executes dropped EXE
PID:756 -
\??\c:\pppvv.exec:\pppvv.exe53⤵
- Executes dropped EXE
PID:596 -
\??\c:\xfrflfr.exec:\xfrflfr.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bhtbbb.exec:\bhtbbb.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ttttbb.exec:\ttttbb.exe56⤵
- Executes dropped EXE
PID:1480 -
\??\c:\dvddj.exec:\dvddj.exe57⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xlxxrrf.exec:\xlxxrrf.exe58⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bhhnnt.exec:\bhhnnt.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hhttnn.exec:\hhttnn.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvjjp.exec:\jvjjp.exe61⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe62⤵
- Executes dropped EXE
PID:2600 -
\??\c:\htnnbb.exec:\htnnbb.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\ttnthn.exec:\ttnthn.exe64⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pjddj.exec:\pjddj.exe65⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lfxflxl.exec:\lfxflxl.exe66⤵PID:3068
-
\??\c:\3llrxxf.exec:\3llrxxf.exe67⤵PID:3056
-
\??\c:\thbhtn.exec:\thbhtn.exe68⤵PID:3016
-
\??\c:\9vpvd.exec:\9vpvd.exe69⤵PID:1436
-
\??\c:\1xrrxxf.exec:\1xrrxxf.exe70⤵PID:2464
-
\??\c:\xfrxlrl.exec:\xfrxlrl.exe71⤵
- System Location Discovery: System Language Discovery
PID:1868 -
\??\c:\htbbnn.exec:\htbbnn.exe72⤵PID:2024
-
\??\c:\1jdpv.exec:\1jdpv.exe73⤵PID:1528
-
\??\c:\jvvvp.exec:\jvvvp.exe74⤵PID:2008
-
\??\c:\llfllff.exec:\llfllff.exe75⤵PID:2112
-
\??\c:\thnnnn.exec:\thnnnn.exe76⤵PID:2708
-
\??\c:\7vpvj.exec:\7vpvj.exe77⤵PID:2540
-
\??\c:\ppjpp.exec:\ppjpp.exe78⤵PID:2892
-
\??\c:\lrlrxxl.exec:\lrlrxxl.exe79⤵PID:2772
-
\??\c:\nhnbhh.exec:\nhnbhh.exe80⤵PID:2776
-
\??\c:\thttbb.exec:\thttbb.exe81⤵PID:2908
-
\??\c:\5dvdj.exec:\5dvdj.exe82⤵PID:2784
-
\??\c:\rlfflrf.exec:\rlfflrf.exe83⤵PID:2760
-
\??\c:\hbtbbb.exec:\hbtbbb.exe84⤵PID:2636
-
\??\c:\nnhtbb.exec:\nnhtbb.exe85⤵PID:2664
-
\??\c:\jdjjj.exec:\jdjjj.exe86⤵PID:2684
-
\??\c:\lrffllr.exec:\lrffllr.exe87⤵PID:1952
-
\??\c:\5ffxxrx.exec:\5ffxxrx.exe88⤵PID:2504
-
\??\c:\tnhthb.exec:\tnhthb.exe89⤵PID:2964
-
\??\c:\jdjdp.exec:\jdjdp.exe90⤵PID:572
-
\??\c:\5jpvv.exec:\5jpvv.exe91⤵PID:2680
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe92⤵PID:704
-
\??\c:\1tbtnt.exec:\1tbtnt.exe93⤵PID:2816
-
\??\c:\ntthnt.exec:\ntthnt.exe94⤵PID:2944
-
\??\c:\vjvdv.exec:\vjvdv.exe95⤵PID:2028
-
\??\c:\flfrllx.exec:\flfrllx.exe96⤵PID:1088
-
\??\c:\bthntb.exec:\bthntb.exe97⤵PID:2004
-
\??\c:\hnbbbn.exec:\hnbbbn.exe98⤵PID:492
-
\??\c:\jvddj.exec:\jvddj.exe99⤵PID:2092
-
\??\c:\xlfllrf.exec:\xlfllrf.exe100⤵PID:2400
-
\??\c:\btttth.exec:\btttth.exe101⤵PID:1188
-
\??\c:\tnhhtt.exec:\tnhhtt.exe102⤵PID:2480
-
\??\c:\jdvjj.exec:\jdvjj.exe103⤵PID:2236
-
\??\c:\7dvdp.exec:\7dvdp.exe104⤵PID:408
-
\??\c:\5xrxxfl.exec:\5xrxxfl.exe105⤵PID:848
-
\??\c:\nbtbhn.exec:\nbtbhn.exe106⤵PID:2296
-
\??\c:\pjppv.exec:\pjppv.exe107⤵PID:2332
-
\??\c:\jdpvd.exec:\jdpvd.exe108⤵PID:1748
-
\??\c:\fxlfllr.exec:\fxlfllr.exe109⤵PID:2992
-
\??\c:\hhbhtt.exec:\hhbhtt.exe110⤵PID:2508
-
\??\c:\nhbnbb.exec:\nhbnbb.exe111⤵PID:1520
-
\??\c:\3jvpv.exec:\3jvpv.exe112⤵PID:1928
-
\??\c:\7rllxlr.exec:\7rllxlr.exe113⤵PID:1604
-
\??\c:\tbbnbb.exec:\tbbnbb.exe114⤵PID:1652
-
\??\c:\nbthhn.exec:\nbthhn.exe115⤵PID:1600
-
\??\c:\ppjpp.exec:\ppjpp.exe116⤵PID:2244
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe117⤵PID:2584
-
\??\c:\rrxrffr.exec:\rrxrffr.exe118⤵PID:2560
-
\??\c:\nnntbb.exec:\nnntbb.exe119⤵PID:2316
-
\??\c:\bbnntt.exec:\bbnntt.exe120⤵PID:2728
-
\??\c:\pjvjp.exec:\pjvjp.exe121⤵PID:2904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-