Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe
-
Size
454KB
-
MD5
dd0505d68214397e092bc13b917087d1
-
SHA1
66c3cfd2f7e28596df8b2f92195409ddc1f60ba6
-
SHA256
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0
-
SHA512
a02fba83b03ae01f932689672bef2c230c5af6fcd6da91ff1bbecfce569522aaea07fbb06c7cdfd7705b9942acb57cb20923ce1f6c36d431da6d20e422c88d3d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2776-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-152-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1296-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-187-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3036-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/400-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-839-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-866-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-892-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1812-928-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2536-1134-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2776 7jjpd.exe 3048 djjvj.exe 2792 3xxrlrl.exe 2556 jpjdv.exe 2588 lrlxlrl.exe 2592 hhhtnn.exe 3008 7pjjj.exe 1760 llrxrxl.exe 2944 pvjdp.exe 2364 dddvp.exe 1812 rxrfrxf.exe 1268 dvpvj.exe 1532 nhbbbh.exe 1332 ddvdd.exe 1776 9tnnhn.exe 2744 ppjdp.exe 1296 hhnbhh.exe 2884 pjdvp.exe 2516 7bhhhn.exe 2060 xrrfxff.exe 3036 ttnthb.exe 2464 pjjpj.exe 2136 9flfxlx.exe 2504 jdpjv.exe 3012 nbnbth.exe 1044 xffxrfr.exe 2948 9nntnt.exe 2432 fllfflf.exe 2292 1jddj.exe 1892 pjjdj.exe 2768 hnbnbt.exe 2760 pddjd.exe 2812 xlrxxxr.exe 3040 tbbnht.exe 2216 pddvv.exe 2640 xrrxxrl.exe 2808 9bntbn.exe 2552 vjjpp.exe 2548 fxxlxfx.exe 2240 bhhtnb.exe 2040 1ppvv.exe 1888 xxxxrxx.exe 2476 nnthtb.exe 2968 pjpjj.exe 1904 xrxxxrx.exe 376 nbtnnn.exe 1844 nnnbbn.exe 1268 vvvdd.exe 1820 frlffrf.exe 1088 9dvjd.exe 2720 vdddv.exe 776 fxfrxlf.exe 2744 hnhhtt.exe 1296 vvjvd.exe 1796 flrxlxr.exe 2252 tbhhtn.exe 2316 fffrxfr.exe 2060 xxxffrf.exe 1940 dvdpj.exe 1656 vvvpj.exe 1736 1rlfllx.exe 952 9hbnbn.exe 832 dvvdp.exe 108 ffxfxfr.exe -
resource yara_rule behavioral1/memory/2776-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-634-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1280-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/400-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-1120-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1780-1147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-1172-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2776 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 31 PID 3052 wrote to memory of 2776 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 31 PID 3052 wrote to memory of 2776 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 31 PID 3052 wrote to memory of 2776 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 31 PID 2776 wrote to memory of 3048 2776 7jjpd.exe 32 PID 2776 wrote to memory of 3048 2776 7jjpd.exe 32 PID 2776 wrote to memory of 3048 2776 7jjpd.exe 32 PID 2776 wrote to memory of 3048 2776 7jjpd.exe 32 PID 3048 wrote to memory of 2792 3048 djjvj.exe 33 PID 3048 wrote to memory of 2792 3048 djjvj.exe 33 PID 3048 wrote to memory of 2792 3048 djjvj.exe 33 PID 3048 wrote to memory of 2792 3048 djjvj.exe 33 PID 2792 wrote to memory of 2556 2792 3xxrlrl.exe 34 PID 2792 wrote to memory of 2556 2792 3xxrlrl.exe 34 PID 2792 wrote to memory of 2556 2792 3xxrlrl.exe 34 PID 2792 wrote to memory of 2556 2792 3xxrlrl.exe 34 PID 2556 wrote to memory of 2588 2556 jpjdv.exe 35 PID 2556 wrote to memory of 2588 2556 jpjdv.exe 35 PID 2556 wrote to memory of 2588 2556 jpjdv.exe 35 PID 2556 wrote to memory of 2588 2556 jpjdv.exe 35 PID 2588 wrote to memory of 2592 2588 lrlxlrl.exe 36 PID 2588 wrote to memory of 2592 2588 lrlxlrl.exe 36 PID 2588 wrote to memory of 2592 2588 lrlxlrl.exe 36 PID 2588 wrote to memory of 2592 2588 lrlxlrl.exe 36 PID 2592 wrote to memory of 3008 2592 hhhtnn.exe 37 PID 2592 wrote to memory of 3008 2592 hhhtnn.exe 37 PID 2592 wrote to memory of 3008 2592 hhhtnn.exe 37 PID 2592 wrote to memory of 3008 2592 hhhtnn.exe 37 PID 3008 wrote to memory of 1760 3008 7pjjj.exe 38 PID 3008 wrote to memory of 1760 3008 7pjjj.exe 38 PID 3008 wrote to memory of 1760 3008 7pjjj.exe 38 PID 3008 wrote to memory of 1760 3008 7pjjj.exe 38 PID 1760 wrote to memory of 2944 1760 llrxrxl.exe 39 PID 1760 wrote to memory of 2944 1760 llrxrxl.exe 39 PID 1760 wrote to memory of 2944 1760 llrxrxl.exe 39 PID 1760 wrote to memory of 2944 1760 llrxrxl.exe 39 PID 2944 wrote to memory of 2364 2944 pvjdp.exe 40 PID 2944 wrote to memory of 2364 2944 pvjdp.exe 40 PID 2944 wrote to memory of 2364 2944 pvjdp.exe 40 PID 2944 wrote to memory of 2364 2944 pvjdp.exe 40 PID 2364 wrote to memory of 1812 2364 dddvp.exe 41 PID 2364 wrote to memory of 1812 2364 dddvp.exe 41 PID 2364 wrote to memory of 1812 2364 dddvp.exe 41 PID 2364 wrote to memory of 1812 2364 dddvp.exe 41 PID 1812 wrote to memory of 1268 1812 rxrfrxf.exe 42 PID 1812 wrote to memory of 1268 1812 rxrfrxf.exe 42 PID 1812 wrote to memory of 1268 1812 rxrfrxf.exe 42 PID 1812 wrote to memory of 1268 1812 rxrfrxf.exe 42 PID 1268 wrote to memory of 1532 1268 dvpvj.exe 43 PID 1268 wrote to memory of 1532 1268 dvpvj.exe 43 PID 1268 wrote to memory of 1532 1268 dvpvj.exe 43 PID 1268 wrote to memory of 1532 1268 dvpvj.exe 43 PID 1532 wrote to memory of 1332 1532 nhbbbh.exe 44 PID 1532 wrote to memory of 1332 1532 nhbbbh.exe 44 PID 1532 wrote to memory of 1332 1532 nhbbbh.exe 44 PID 1532 wrote to memory of 1332 1532 nhbbbh.exe 44 PID 1332 wrote to memory of 1776 1332 ddvdd.exe 45 PID 1332 wrote to memory of 1776 1332 ddvdd.exe 45 PID 1332 wrote to memory of 1776 1332 ddvdd.exe 45 PID 1332 wrote to memory of 1776 1332 ddvdd.exe 45 PID 1776 wrote to memory of 2744 1776 9tnnhn.exe 46 PID 1776 wrote to memory of 2744 1776 9tnnhn.exe 46 PID 1776 wrote to memory of 2744 1776 9tnnhn.exe 46 PID 1776 wrote to memory of 2744 1776 9tnnhn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe"C:\Users\Admin\AppData\Local\Temp\a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\7jjpd.exec:\7jjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\djjvj.exec:\djjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\3xxrlrl.exec:\3xxrlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jpjdv.exec:\jpjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\lrlxlrl.exec:\lrlxlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hhhtnn.exec:\hhhtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\7pjjj.exec:\7pjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\llrxrxl.exec:\llrxrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\pvjdp.exec:\pvjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dddvp.exec:\dddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rxrfrxf.exec:\rxrfrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\nhbbbh.exec:\nhbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\ddvdd.exec:\ddvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\9tnnhn.exec:\9tnnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ppjdp.exec:\ppjdp.exe17⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hhnbhh.exec:\hhnbhh.exe18⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pjdvp.exec:\pjdvp.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
\??\c:\7bhhhn.exec:\7bhhhn.exe20⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xrrfxff.exec:\xrrfxff.exe21⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ttnthb.exec:\ttnthb.exe22⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pjjpj.exec:\pjjpj.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9flfxlx.exec:\9flfxlx.exe24⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jdpjv.exec:\jdpjv.exe25⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nbnbth.exec:\nbnbth.exe26⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xffxrfr.exec:\xffxrfr.exe27⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9nntnt.exec:\9nntnt.exe28⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fllfflf.exec:\fllfflf.exe29⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1jddj.exec:\1jddj.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pjjdj.exec:\pjjdj.exe31⤵
- Executes dropped EXE
PID:1892 -
\??\c:\hnbnbt.exec:\hnbnbt.exe32⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pddjd.exec:\pddjd.exe33⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xlrxxxr.exec:\xlrxxxr.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tbbnht.exec:\tbbnht.exe35⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pddvv.exec:\pddvv.exe36⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrrxxrl.exec:\xrrxxrl.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9bntbn.exec:\9bntbn.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vjjpp.exec:\vjjpp.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxxlxfx.exec:\fxxlxfx.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bhhtnb.exec:\bhhtnb.exe41⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1ppvv.exec:\1ppvv.exe42⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe43⤵
- Executes dropped EXE
PID:1888 -
\??\c:\nnthtb.exec:\nnthtb.exe44⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjpjj.exec:\pjpjj.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xrxxxrx.exec:\xrxxxrx.exe46⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nbtnnn.exec:\nbtnnn.exe47⤵
- Executes dropped EXE
PID:376 -
\??\c:\nnnbbn.exec:\nnnbbn.exe48⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vvvdd.exec:\vvvdd.exe49⤵
- Executes dropped EXE
PID:1268 -
\??\c:\frlffrf.exec:\frlffrf.exe50⤵
- Executes dropped EXE
PID:1820 -
\??\c:\9dvjd.exec:\9dvjd.exe51⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vdddv.exec:\vdddv.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxfrxlf.exec:\fxfrxlf.exe53⤵
- Executes dropped EXE
PID:776 -
\??\c:\hnhhtt.exec:\hnhhtt.exe54⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvjvd.exec:\vvjvd.exe55⤵
- Executes dropped EXE
PID:1296 -
\??\c:\flrxlxr.exec:\flrxlxr.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tbhhtn.exec:\tbhhtn.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2252 -
\??\c:\fffrxfr.exec:\fffrxfr.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxxffrf.exec:\xxxffrf.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\dvdpj.exec:\dvdpj.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vvvpj.exec:\vvvpj.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1rlfllx.exec:\1rlfllx.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9hbnbn.exec:\9hbnbn.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\dvvdp.exec:\dvvdp.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe65⤵
- Executes dropped EXE
PID:108 -
\??\c:\bbbhbt.exec:\bbbhbt.exe66⤵PID:1848
-
\??\c:\bnthbn.exec:\bnthbn.exe67⤵PID:1604
-
\??\c:\vdjjd.exec:\vdjjd.exe68⤵PID:1692
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe69⤵PID:2016
-
\??\c:\hbbbtb.exec:\hbbbtb.exe70⤵PID:1636
-
\??\c:\pdpjj.exec:\pdpjj.exe71⤵PID:1788
-
\??\c:\dpdjj.exec:\dpdjj.exe72⤵PID:2292
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe73⤵
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\htnnbb.exec:\htnnbb.exe74⤵PID:2780
-
\??\c:\3pddd.exec:\3pddd.exe75⤵PID:1584
-
\??\c:\rrrxrlf.exec:\rrrxrlf.exe76⤵PID:2204
-
\??\c:\7hntnn.exec:\7hntnn.exe77⤵PID:3048
-
\??\c:\ddjdp.exec:\ddjdp.exe78⤵PID:2752
-
\??\c:\lfflffr.exec:\lfflffr.exe79⤵PID:2652
-
\??\c:\hhhtbb.exec:\hhhtbb.exe80⤵PID:2532
-
\??\c:\pvvjd.exec:\pvvjd.exe81⤵PID:2352
-
\??\c:\xxxfrfx.exec:\xxxfrfx.exe82⤵PID:2496
-
\??\c:\hbnhhn.exec:\hbnhhn.exe83⤵PID:2428
-
\??\c:\jppvp.exec:\jppvp.exe84⤵PID:656
-
\??\c:\llfffll.exec:\llfffll.exe85⤵PID:1476
-
\??\c:\tnnthn.exec:\tnnthn.exe86⤵PID:2380
-
\??\c:\1hhnnt.exec:\1hhnnt.exe87⤵PID:2384
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe88⤵PID:2364
-
\??\c:\flllfxl.exec:\flllfxl.exe89⤵PID:1812
-
\??\c:\ttbbbh.exec:\ttbbbh.exe90⤵PID:1280
-
\??\c:\djjdv.exec:\djjdv.exe91⤵PID:1248
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe92⤵PID:400
-
\??\c:\7nthbn.exec:\7nthbn.exe93⤵PID:2836
-
\??\c:\vpddp.exec:\vpddp.exe94⤵PID:2932
-
\??\c:\xxxlrrx.exec:\xxxlrrx.exe95⤵PID:980
-
\??\c:\5hnhbb.exec:\5hnhbb.exe96⤵PID:740
-
\??\c:\5hbtbh.exec:\5hbtbh.exe97⤵PID:2408
-
\??\c:\fllxxfx.exec:\fllxxfx.exe98⤵PID:2748
-
\??\c:\hthhhn.exec:\hthhhn.exe99⤵PID:604
-
\??\c:\pjddp.exec:\pjddp.exe100⤵PID:2236
-
\??\c:\dvppj.exec:\dvppj.exe101⤵PID:1628
-
\??\c:\9lxxlrr.exec:\9lxxlrr.exe102⤵PID:408
-
\??\c:\bhnhnb.exec:\bhnhnb.exe103⤵PID:2196
-
\??\c:\pvvpp.exec:\pvvpp.exe104⤵PID:1596
-
\??\c:\fffrflx.exec:\fffrflx.exe105⤵PID:2600
-
\??\c:\tnnhtn.exec:\tnnhtn.exe106⤵PID:2268
-
\??\c:\1vpjv.exec:\1vpjv.exe107⤵PID:3012
-
\??\c:\1llxrfx.exec:\1llxrfx.exe108⤵PID:1740
-
\??\c:\hbthbh.exec:\hbthbh.exe109⤵PID:2172
-
\??\c:\jdvdp.exec:\jdvdp.exe110⤵PID:2468
-
\??\c:\frxffxx.exec:\frxffxx.exe111⤵PID:2880
-
\??\c:\hbhnbn.exec:\hbhnbn.exe112⤵PID:2728
-
\??\c:\nnhnbn.exec:\nnhnbn.exe113⤵PID:2180
-
\??\c:\ppvpd.exec:\ppvpd.exe114⤵PID:3028
-
\??\c:\llfrlrr.exec:\llfrlrr.exe115⤵PID:1688
-
\??\c:\nnhtnn.exec:\nnhtnn.exe116⤵PID:1576
-
\??\c:\3jjdp.exec:\3jjdp.exe117⤵PID:2772
-
\??\c:\rlflrxl.exec:\rlflrxl.exe118⤵PID:2812
-
\??\c:\tbtnbt.exec:\tbtnbt.exe119⤵PID:2792
-
\??\c:\bhthhn.exec:\bhthhn.exe120⤵PID:2724
-
\??\c:\vdpjj.exec:\vdpjj.exe121⤵PID:2580
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe122⤵PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-