Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe
-
Size
453KB
-
MD5
ce417fdd5c854baf6e47a136ddee9eae
-
SHA1
545b12a384d80b59ba13dcd2a354f7045fe89b30
-
SHA256
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789
-
SHA512
1809ae6ef8e36605f194387c2c9e3a12c1023b34f2699fc991b5af06d0a3fda399a9c0536dfbb8c4fb48274382611458bc38ee129d5353cade0591bba34bbb04
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-517-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2676-584-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/320-688-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-811-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 3xxfllr.exe 2920 5vjjj.exe 2568 jjjvp.exe 2836 pjppv.exe 2716 rlxfllf.exe 2608 bhbntt.exe 3024 hhbbhn.exe 1120 xxrxffx.exe 2900 3btntt.exe 1432 vdvdd.exe 604 frxxlxx.exe 1852 pvpjj.exe 2520 3xllffx.exe 2004 bnbbnn.exe 2804 7pddj.exe 1968 rllrxfl.exe 2160 nbntbb.exe 2512 rflxlrl.exe 2128 nhthbt.exe 1604 jvddj.exe 2628 3pjjv.exe 956 frffllr.exe 1936 nhtnnt.exe 1124 jpdjp.exe 1704 frxlllx.exe 1600 1hbhnt.exe 1856 9vpvv.exe 1424 9bbhhn.exe 2060 5tntbb.exe 1496 7fxrlxl.exe 2540 hhbbht.exe 2992 rlxflfr.exe 2788 1frfllr.exe 2892 jpvdj.exe 2548 jdpvv.exe 2532 hhbnbn.exe 2656 dvjjv.exe 2596 5flllxr.exe 1256 7bhnnn.exe 1120 1bhhhb.exe 2472 7pvjj.exe 3032 frxrxrx.exe 1792 5bntnn.exe 2400 3djjv.exe 2348 7pjpd.exe 2008 frlrrrx.exe 1928 1fllrrr.exe 1976 bbnntt.exe 328 5jdvd.exe 272 7rfxxxf.exe 2116 3rxflll.exe 2944 bnbbbh.exe 236 pjvpv.exe 1940 3lxrxfl.exe 2236 lxxrxxl.exe 844 hbtnbh.exe 1832 pjppv.exe 2628 9fxlrlr.exe 2448 5ffrllr.exe 2592 bthtbn.exe 1260 1dvvv.exe 1476 fxrxlrx.exe 996 btnthh.exe 1680 3hbnbn.exe -
resource yara_rule behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-584-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2496-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-804-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2748 2664 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 31 PID 2664 wrote to memory of 2748 2664 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 31 PID 2664 wrote to memory of 2748 2664 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 31 PID 2664 wrote to memory of 2748 2664 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 31 PID 2748 wrote to memory of 2920 2748 3xxfllr.exe 32 PID 2748 wrote to memory of 2920 2748 3xxfllr.exe 32 PID 2748 wrote to memory of 2920 2748 3xxfllr.exe 32 PID 2748 wrote to memory of 2920 2748 3xxfllr.exe 32 PID 2920 wrote to memory of 2568 2920 5vjjj.exe 33 PID 2920 wrote to memory of 2568 2920 5vjjj.exe 33 PID 2920 wrote to memory of 2568 2920 5vjjj.exe 33 PID 2920 wrote to memory of 2568 2920 5vjjj.exe 33 PID 2568 wrote to memory of 2836 2568 jjjvp.exe 34 PID 2568 wrote to memory of 2836 2568 jjjvp.exe 34 PID 2568 wrote to memory of 2836 2568 jjjvp.exe 34 PID 2568 wrote to memory of 2836 2568 jjjvp.exe 34 PID 2836 wrote to memory of 2716 2836 pjppv.exe 35 PID 2836 wrote to memory of 2716 2836 pjppv.exe 35 PID 2836 wrote to memory of 2716 2836 pjppv.exe 35 PID 2836 wrote to memory of 2716 2836 pjppv.exe 35 PID 2716 wrote to memory of 2608 2716 rlxfllf.exe 36 PID 2716 wrote to memory of 2608 2716 rlxfllf.exe 36 PID 2716 wrote to memory of 2608 2716 rlxfllf.exe 36 PID 2716 wrote to memory of 2608 2716 rlxfllf.exe 36 PID 2608 wrote to memory of 3024 2608 bhbntt.exe 37 PID 2608 wrote to memory of 3024 2608 bhbntt.exe 37 PID 2608 wrote to memory of 3024 2608 bhbntt.exe 37 PID 2608 wrote to memory of 3024 2608 bhbntt.exe 37 PID 3024 wrote to memory of 1120 3024 hhbbhn.exe 38 PID 3024 wrote to memory of 1120 3024 hhbbhn.exe 38 PID 3024 wrote to memory of 1120 3024 hhbbhn.exe 38 PID 3024 wrote to memory of 1120 3024 hhbbhn.exe 38 PID 1120 wrote to memory of 2900 1120 xxrxffx.exe 39 PID 1120 wrote to memory of 2900 1120 xxrxffx.exe 39 PID 1120 wrote to memory of 2900 1120 xxrxffx.exe 39 PID 1120 wrote to memory of 2900 1120 xxrxffx.exe 39 PID 2900 wrote to memory of 1432 2900 3btntt.exe 40 PID 2900 wrote to memory of 1432 2900 3btntt.exe 40 PID 2900 wrote to memory of 1432 2900 3btntt.exe 40 PID 2900 wrote to memory of 1432 2900 3btntt.exe 40 PID 1432 wrote to memory of 604 1432 vdvdd.exe 41 PID 1432 wrote to memory of 604 1432 vdvdd.exe 41 PID 1432 wrote to memory of 604 1432 vdvdd.exe 41 PID 1432 wrote to memory of 604 1432 vdvdd.exe 41 PID 604 wrote to memory of 1852 604 frxxlxx.exe 42 PID 604 wrote to memory of 1852 604 frxxlxx.exe 42 PID 604 wrote to memory of 1852 604 frxxlxx.exe 42 PID 604 wrote to memory of 1852 604 frxxlxx.exe 42 PID 1852 wrote to memory of 2520 1852 pvpjj.exe 43 PID 1852 wrote to memory of 2520 1852 pvpjj.exe 43 PID 1852 wrote to memory of 2520 1852 pvpjj.exe 43 PID 1852 wrote to memory of 2520 1852 pvpjj.exe 43 PID 2520 wrote to memory of 2004 2520 3xllffx.exe 44 PID 2520 wrote to memory of 2004 2520 3xllffx.exe 44 PID 2520 wrote to memory of 2004 2520 3xllffx.exe 44 PID 2520 wrote to memory of 2004 2520 3xllffx.exe 44 PID 2004 wrote to memory of 2804 2004 bnbbnn.exe 45 PID 2004 wrote to memory of 2804 2004 bnbbnn.exe 45 PID 2004 wrote to memory of 2804 2004 bnbbnn.exe 45 PID 2004 wrote to memory of 2804 2004 bnbbnn.exe 45 PID 2804 wrote to memory of 1968 2804 7pddj.exe 46 PID 2804 wrote to memory of 1968 2804 7pddj.exe 46 PID 2804 wrote to memory of 1968 2804 7pddj.exe 46 PID 2804 wrote to memory of 1968 2804 7pddj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe"C:\Users\Admin\AppData\Local\Temp\d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3xxfllr.exec:\3xxfllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\5vjjj.exec:\5vjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jjjvp.exec:\jjjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\pjppv.exec:\pjppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rlxfllf.exec:\rlxfllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bhbntt.exec:\bhbntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hhbbhn.exec:\hhbbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xxrxffx.exec:\xxrxffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\3btntt.exec:\3btntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vdvdd.exec:\vdvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\frxxlxx.exec:\frxxlxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\pvpjj.exec:\pvpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\3xllffx.exec:\3xllffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bnbbnn.exec:\bnbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\7pddj.exec:\7pddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rllrxfl.exec:\rllrxfl.exe17⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbntbb.exec:\nbntbb.exe18⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rflxlrl.exec:\rflxlrl.exe19⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhthbt.exec:\nhthbt.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jvddj.exec:\jvddj.exe21⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3pjjv.exec:\3pjjv.exe22⤵
- Executes dropped EXE
PID:2628 -
\??\c:\frffllr.exec:\frffllr.exe23⤵
- Executes dropped EXE
PID:956 -
\??\c:\nhtnnt.exec:\nhtnnt.exe24⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jpdjp.exec:\jpdjp.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\frxlllx.exec:\frxlllx.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1hbhnt.exec:\1hbhnt.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9vpvv.exec:\9vpvv.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9bbhhn.exec:\9bbhhn.exe29⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5tntbb.exec:\5tntbb.exe30⤵
- Executes dropped EXE
PID:2060 -
\??\c:\7fxrlxl.exec:\7fxrlxl.exe31⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hhbbht.exec:\hhbbht.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rlxflfr.exec:\rlxflfr.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1frfllr.exec:\1frfllr.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jpvdj.exec:\jpvdj.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdpvv.exec:\jdpvv.exe36⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hhbnbn.exec:\hhbnbn.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dvjjv.exec:\dvjjv.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5flllxr.exec:\5flllxr.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\7bhnnn.exec:\7bhnnn.exe40⤵
- Executes dropped EXE
PID:1256 -
\??\c:\1bhhhb.exec:\1bhhhb.exe41⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7pvjj.exec:\7pvjj.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\frxrxrx.exec:\frxrxrx.exe43⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5bntnn.exec:\5bntnn.exe44⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3djjv.exec:\3djjv.exe45⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7pjpd.exec:\7pjpd.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2348 -
\??\c:\frlrrrx.exec:\frlrrrx.exe47⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1fllrrr.exec:\1fllrrr.exe48⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bbnntt.exec:\bbnntt.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5jdvd.exec:\5jdvd.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:328 -
\??\c:\7rfxxxf.exec:\7rfxxxf.exe51⤵
- Executes dropped EXE
PID:272 -
\??\c:\3rxflll.exec:\3rxflll.exe52⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnbbbh.exec:\bnbbbh.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\pjvpv.exec:\pjvpv.exe54⤵
- Executes dropped EXE
PID:236 -
\??\c:\3lxrxfl.exec:\3lxrxfl.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lxxrxxl.exec:\lxxrxxl.exe56⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbtnbh.exec:\hbtnbh.exe57⤵
- Executes dropped EXE
PID:844 -
\??\c:\pjppv.exec:\pjppv.exe58⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9fxlrlr.exec:\9fxlrlr.exe59⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5ffrllr.exec:\5ffrllr.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bthtbn.exec:\bthtbn.exe61⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1dvvv.exec:\1dvvv.exe62⤵
- Executes dropped EXE
PID:1260 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe63⤵
- Executes dropped EXE
PID:1476 -
\??\c:\btnthh.exec:\btnthh.exe64⤵
- Executes dropped EXE
PID:996 -
\??\c:\3hbnbn.exec:\3hbnbn.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jddjd.exec:\jddjd.exe66⤵PID:2292
-
\??\c:\fxflxrr.exec:\fxflxrr.exe67⤵PID:1568
-
\??\c:\3btttt.exec:\3btttt.exe68⤵PID:2460
-
\??\c:\btnnbb.exec:\btnnbb.exe69⤵PID:2012
-
\??\c:\jdppp.exec:\jdppp.exe70⤵PID:1628
-
\??\c:\lxlfffl.exec:\lxlfffl.exe71⤵PID:2756
-
\??\c:\3xlrrfr.exec:\3xlrrfr.exe72⤵PID:2344
-
\??\c:\5bhnnb.exec:\5bhnnb.exe73⤵PID:2560
-
\??\c:\ppddv.exec:\ppddv.exe74⤵PID:1648
-
\??\c:\9vddd.exec:\9vddd.exe75⤵PID:2676
-
\??\c:\1fxxxxf.exec:\1fxxxxf.exe76⤵PID:2848
-
\??\c:\1tnntb.exec:\1tnntb.exe77⤵PID:3020
-
\??\c:\jdddd.exec:\jdddd.exe78⤵PID:2576
-
\??\c:\9vjjv.exec:\9vjjv.exe79⤵PID:2496
-
\??\c:\7xfllrx.exec:\7xfllrx.exe80⤵PID:2988
-
\??\c:\5tbtbb.exec:\5tbtbb.exe81⤵PID:3008
-
\??\c:\1hbbbh.exec:\1hbbbh.exe82⤵PID:2884
-
\??\c:\vpddv.exec:\vpddv.exe83⤵PID:1876
-
\??\c:\rrrfxll.exec:\rrrfxll.exe84⤵PID:2796
-
\??\c:\thttbb.exec:\thttbb.exe85⤵PID:1836
-
\??\c:\3vvdv.exec:\3vvdv.exe86⤵PID:1884
-
\??\c:\9pddj.exec:\9pddj.exe87⤵PID:1644
-
\??\c:\frlrxxl.exec:\frlrxxl.exe88⤵PID:332
-
\??\c:\7tbbbb.exec:\7tbbbb.exe89⤵PID:1656
-
\??\c:\nnnthb.exec:\nnnthb.exe90⤵PID:320
-
\??\c:\vpjpp.exec:\vpjpp.exe91⤵PID:1572
-
\??\c:\xlflfff.exec:\xlflfff.exe92⤵PID:2224
-
\??\c:\5lllfxx.exec:\5lllfxx.exe93⤵PID:1688
-
\??\c:\nbthhh.exec:\nbthhh.exe94⤵PID:2700
-
\??\c:\jvjjj.exec:\jvjjj.exe95⤵PID:2092
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe96⤵PID:1604
-
\??\c:\5xffrrr.exec:\5xffrrr.exe97⤵PID:408
-
\??\c:\5thttb.exec:\5thttb.exe98⤵PID:688
-
\??\c:\thttbb.exec:\thttbb.exe99⤵PID:1304
-
\??\c:\jvjjj.exec:\jvjjj.exe100⤵PID:1548
-
\??\c:\9lflfrf.exec:\9lflfrf.exe101⤵
- System Location Discovery: System Language Discovery
PID:1208 -
\??\c:\frlrxxf.exec:\frlrxxf.exe102⤵PID:1124
-
\??\c:\bthhbt.exec:\bthhbt.exe103⤵PID:864
-
\??\c:\jvppp.exec:\jvppp.exe104⤵PID:1780
-
\??\c:\3vppp.exec:\3vppp.exe105⤵PID:2016
-
\??\c:\lxlfllx.exec:\lxlfllx.exe106⤵PID:1576
-
\??\c:\hbhbbt.exec:\hbhbbt.exe107⤵PID:2112
-
\??\c:\thnntb.exec:\thnntb.exe108⤵PID:2952
-
\??\c:\5pvvp.exec:\5pvvp.exe109⤵PID:1516
-
\??\c:\lxxfllr.exec:\lxxfllr.exe110⤵PID:2736
-
\??\c:\9rflxfl.exec:\9rflxfl.exe111⤵PID:2832
-
\??\c:\hhtbbt.exec:\hhtbbt.exe112⤵PID:2840
-
\??\c:\7dpjj.exec:\7dpjj.exe113⤵PID:2504
-
\??\c:\pvvdv.exec:\pvvdv.exe114⤵PID:2588
-
\??\c:\frffxxl.exec:\frffxxl.exe115⤵PID:2788
-
\??\c:\hbhhnt.exec:\hbhhnt.exe116⤵PID:2080
-
\??\c:\tnhnnn.exec:\tnhnnn.exe117⤵PID:2716
-
\??\c:\pdpjp.exec:\pdpjp.exe118⤵PID:2608
-
\??\c:\fxrxlxx.exec:\fxrxlxx.exe119⤵PID:2584
-
\??\c:\frffllx.exec:\frffllx.exe120⤵PID:1256
-
\??\c:\btnnbb.exec:\btnnbb.exe121⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-