Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe
-
Size
454KB
-
MD5
d38c400eb5d526124627d1cf3f926ca0
-
SHA1
9ca172c71b903bf8611a5f4816efadeb42924d30
-
SHA256
67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4
-
SHA512
c5adbd51511683c98049f16a78784ed28a5fd77212a63a3c13305477dd272c33e1041c10c7046e7236107a3770c4daed7bdd92e63a88f7b70906732da3a97065
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/632-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-118-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1172-136-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1536-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-155-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1956-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-225-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2712-243-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2424-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-276-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1920-294-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-475-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1468-584-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2084-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-783-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2960-970-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1828-996-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2464-1054-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1072-1087-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1604-1100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-1113-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2396-1126-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/3064-1139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-1146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-1165-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2084-1168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-1179-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2776-1200-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1204 jvjjv.exe 2324 vppvd.exe 2696 5jvvd.exe 2472 vvjjd.exe 2832 1bthnt.exe 2720 jdvdj.exe 2860 xrlxlrx.exe 2788 dvddd.exe 2780 xxllxxr.exe 2632 tntttt.exe 2260 5vjjv.exe 1012 rlffxfr.exe 2960 9nhtht.exe 1172 1pdpd.exe 1536 hbnntt.exe 2964 tnhnth.exe 2336 lfrflxr.exe 1956 lxlxxff.exe 956 ntntbb.exe 1692 vvpvj.exe 2920 bhtbnn.exe 1112 vpjpd.exe 2712 ffrxffr.exe 848 3tnnnt.exe 2148 jdvvj.exe 1772 ffxlrxl.exe 2424 vvjpd.exe 1716 ffrxxll.exe 1808 5bntbh.exe 2524 pjvjd.exe 2520 pdvvj.exe 1920 9xllxfr.exe 1608 btnntt.exe 2348 1vjjj.exe 3036 xlffllx.exe 2980 bnbbnn.exe 2696 7htbhh.exe 2836 jjdjv.exe 2764 fxlxlrl.exe 2852 7xfrrff.exe 2848 thtbhn.exe 2108 1pvvp.exe 2904 3jvdj.exe 2812 rrfrxxl.exe 2680 bnbhhn.exe 2088 3hthtn.exe 2340 pjddj.exe 2664 7vpvd.exe 3048 rrfxlfl.exe 556 nnbhhn.exe 792 1bntnt.exe 1200 jvddd.exe 1428 rrflrrf.exe 1232 fxrrxfr.exe 1688 nnhnbh.exe 2656 3jvvd.exe 1800 9pdjp.exe 2592 xlfflrr.exe 2116 7frxlrx.exe 1940 bnbbhn.exe 1936 fxllrrx.exe 1588 xrflxlf.exe 1280 bnnttb.exe 848 5jjdd.exe -
resource yara_rule behavioral1/memory/1204-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-118-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1536-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-294-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1920-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-963-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-1055-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-1179-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2924-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-1232-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 1204 632 67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe 30 PID 632 wrote to memory of 1204 632 67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe 30 PID 632 wrote to memory of 1204 632 67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe 30 PID 632 wrote to memory of 1204 632 67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe 30 PID 1204 wrote to memory of 2324 1204 jvjjv.exe 31 PID 1204 wrote to memory of 2324 1204 jvjjv.exe 31 PID 1204 wrote to memory of 2324 1204 jvjjv.exe 31 PID 1204 wrote to memory of 2324 1204 jvjjv.exe 31 PID 2324 wrote to memory of 2696 2324 vppvd.exe 32 PID 2324 wrote to memory of 2696 2324 vppvd.exe 32 PID 2324 wrote to memory of 2696 2324 vppvd.exe 32 PID 2324 wrote to memory of 2696 2324 vppvd.exe 32 PID 2696 wrote to memory of 2472 2696 5jvvd.exe 33 PID 2696 wrote to memory of 2472 2696 5jvvd.exe 33 PID 2696 wrote to memory of 2472 2696 5jvvd.exe 33 PID 2696 wrote to memory of 2472 2696 5jvvd.exe 33 PID 2472 wrote to memory of 2832 2472 vvjjd.exe 34 PID 2472 wrote to memory of 2832 2472 vvjjd.exe 34 PID 2472 wrote to memory of 2832 2472 vvjjd.exe 34 PID 2472 wrote to memory of 2832 2472 vvjjd.exe 34 PID 2832 wrote to memory of 2720 2832 1bthnt.exe 35 PID 2832 wrote to memory of 2720 2832 1bthnt.exe 35 PID 2832 wrote to memory of 2720 2832 1bthnt.exe 35 PID 2832 wrote to memory of 2720 2832 1bthnt.exe 35 PID 2720 wrote to memory of 2860 2720 jdvdj.exe 36 PID 2720 wrote to memory of 2860 2720 jdvdj.exe 36 PID 2720 wrote to memory of 2860 2720 jdvdj.exe 36 PID 2720 wrote to memory of 2860 2720 jdvdj.exe 36 PID 2860 wrote to memory of 2788 2860 xrlxlrx.exe 37 PID 2860 wrote to memory of 2788 2860 xrlxlrx.exe 37 PID 2860 wrote to memory of 2788 2860 xrlxlrx.exe 37 PID 2860 wrote to memory of 2788 2860 xrlxlrx.exe 37 PID 2788 wrote to memory of 2780 2788 dvddd.exe 38 PID 2788 wrote to memory of 2780 2788 dvddd.exe 38 PID 2788 wrote to memory of 2780 2788 dvddd.exe 38 PID 2788 wrote to memory of 2780 2788 dvddd.exe 38 PID 2780 wrote to memory of 2632 2780 xxllxxr.exe 39 PID 2780 wrote to memory of 2632 2780 xxllxxr.exe 39 PID 2780 wrote to memory of 2632 2780 xxllxxr.exe 39 PID 2780 wrote to memory of 2632 2780 xxllxxr.exe 39 PID 2632 wrote to memory of 2260 2632 tntttt.exe 40 PID 2632 wrote to memory of 2260 2632 tntttt.exe 40 PID 2632 wrote to memory of 2260 2632 tntttt.exe 40 PID 2632 wrote to memory of 2260 2632 tntttt.exe 40 PID 2260 wrote to memory of 1012 2260 5vjjv.exe 41 PID 2260 wrote to memory of 1012 2260 5vjjv.exe 41 PID 2260 wrote to memory of 1012 2260 5vjjv.exe 41 PID 2260 wrote to memory of 1012 2260 5vjjv.exe 41 PID 1012 wrote to memory of 2960 1012 rlffxfr.exe 42 PID 1012 wrote to memory of 2960 1012 rlffxfr.exe 42 PID 1012 wrote to memory of 2960 1012 rlffxfr.exe 42 PID 1012 wrote to memory of 2960 1012 rlffxfr.exe 42 PID 2960 wrote to memory of 1172 2960 9nhtht.exe 43 PID 2960 wrote to memory of 1172 2960 9nhtht.exe 43 PID 2960 wrote to memory of 1172 2960 9nhtht.exe 43 PID 2960 wrote to memory of 1172 2960 9nhtht.exe 43 PID 1172 wrote to memory of 1536 1172 1pdpd.exe 44 PID 1172 wrote to memory of 1536 1172 1pdpd.exe 44 PID 1172 wrote to memory of 1536 1172 1pdpd.exe 44 PID 1172 wrote to memory of 1536 1172 1pdpd.exe 44 PID 1536 wrote to memory of 2964 1536 hbnntt.exe 45 PID 1536 wrote to memory of 2964 1536 hbnntt.exe 45 PID 1536 wrote to memory of 2964 1536 hbnntt.exe 45 PID 1536 wrote to memory of 2964 1536 hbnntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe"C:\Users\Admin\AppData\Local\Temp\67fe89c7434a6f7b307a106b319ab27d5d7b35d88a306248f19dc6d049e892b4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\jvjjv.exec:\jvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\vppvd.exec:\vppvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\5jvvd.exec:\5jvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vvjjd.exec:\vvjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\1bthnt.exec:\1bthnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\jdvdj.exec:\jdvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dvddd.exec:\dvddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xxllxxr.exec:\xxllxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\tntttt.exec:\tntttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5vjjv.exec:\5vjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\rlffxfr.exec:\rlffxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\9nhtht.exec:\9nhtht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\1pdpd.exec:\1pdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\hbnntt.exec:\hbnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\tnhnth.exec:\tnhnth.exe17⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfrflxr.exec:\lfrflxr.exe18⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lxlxxff.exec:\lxlxxff.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ntntbb.exec:\ntntbb.exe20⤵
- Executes dropped EXE
PID:956 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bhtbnn.exec:\bhtbnn.exe22⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vpjpd.exec:\vpjpd.exe23⤵
- Executes dropped EXE
PID:1112 -
\??\c:\ffrxffr.exec:\ffrxffr.exe24⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3tnnnt.exec:\3tnnnt.exe25⤵
- Executes dropped EXE
PID:848 -
\??\c:\jdvvj.exec:\jdvvj.exe26⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vvjpd.exec:\vvjpd.exe28⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffrxxll.exec:\ffrxxll.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\5bntbh.exec:\5bntbh.exe30⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pjvjd.exec:\pjvjd.exe31⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pdvvj.exec:\pdvvj.exe32⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9xllxfr.exec:\9xllxfr.exe33⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btnntt.exec:\btnntt.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1vjjj.exec:\1vjjj.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xlffllx.exec:\xlffllx.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bnbbnn.exec:\bnbbnn.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7htbhh.exec:\7htbhh.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jjdjv.exec:\jjdjv.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fxlxlrl.exec:\fxlxlrl.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7xfrrff.exec:\7xfrrff.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\thtbhn.exec:\thtbhn.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848 -
\??\c:\1pvvp.exec:\1pvvp.exe43⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3jvdj.exec:\3jvdj.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rrfrxxl.exec:\rrfrxxl.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bnbhhn.exec:\bnbhhn.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\3hthtn.exec:\3hthtn.exe47⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pjddj.exec:\pjddj.exe48⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7vpvd.exec:\7vpvd.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrfxlfl.exec:\rrfxlfl.exe50⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nnbhhn.exec:\nnbhhn.exe51⤵
- Executes dropped EXE
PID:556 -
\??\c:\1bntnt.exec:\1bntnt.exe52⤵
- Executes dropped EXE
PID:792 -
\??\c:\jvddd.exec:\jvddd.exe53⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rrflrrf.exec:\rrflrrf.exe54⤵
- Executes dropped EXE
PID:1428 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe55⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nnhnbh.exec:\nnhnbh.exe56⤵
- Executes dropped EXE
PID:1688 -
\??\c:\3jvvd.exec:\3jvvd.exe57⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9pdjp.exec:\9pdjp.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xlfflrr.exec:\xlfflrr.exe59⤵
- Executes dropped EXE
PID:2592 -
\??\c:\7frxlrx.exec:\7frxlrx.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnbbhn.exec:\bnbbhn.exe61⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fxllrrx.exec:\fxllrrx.exe62⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xrflxlf.exec:\xrflxlf.exe63⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bnnttb.exec:\bnnttb.exe64⤵
- Executes dropped EXE
PID:1280 -
\??\c:\5jjdd.exec:\5jjdd.exe65⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjddj.exec:\pjddj.exe66⤵PID:2564
-
\??\c:\lxxrxxf.exec:\lxxrxxf.exe67⤵PID:1404
-
\??\c:\bthntt.exec:\bthntt.exe68⤵PID:2272
-
\??\c:\hhbhtn.exec:\hhbhtn.exe69⤵PID:1620
-
\??\c:\ppvpd.exec:\ppvpd.exe70⤵PID:2168
-
\??\c:\lflfflr.exec:\lflfflr.exe71⤵
- System Location Discovery: System Language Discovery
PID:1808 -
\??\c:\7fxfllx.exec:\7fxfllx.exe72⤵PID:2588
-
\??\c:\bbnntt.exec:\bbnntt.exe73⤵PID:876
-
\??\c:\dpjjp.exec:\dpjjp.exe74⤵PID:2996
-
\??\c:\vpjpv.exec:\vpjpv.exe75⤵PID:2316
-
\??\c:\1lflxfl.exec:\1lflxfl.exe76⤵PID:1616
-
\??\c:\9rflxrf.exec:\9rflxrf.exe77⤵PID:1468
-
\??\c:\thbbth.exec:\thbbth.exe78⤵PID:3064
-
\??\c:\vpvvv.exec:\vpvvv.exe79⤵PID:2240
-
\??\c:\jdvdv.exec:\jdvdv.exe80⤵PID:888
-
\??\c:\lllrrrf.exec:\lllrrrf.exe81⤵PID:2844
-
\??\c:\lxffrxx.exec:\lxffrxx.exe82⤵PID:1736
-
\??\c:\nbnnth.exec:\nbnnth.exe83⤵PID:2084
-
\??\c:\jjvvd.exec:\jjvvd.exe84⤵PID:2776
-
\??\c:\7jvjp.exec:\7jvjp.exe85⤵PID:2952
-
\??\c:\rlflxxf.exec:\rlflxxf.exe86⤵PID:2760
-
\??\c:\9bttbh.exec:\9bttbh.exe87⤵PID:2780
-
\??\c:\7hnhhh.exec:\7hnhhh.exe88⤵PID:2648
-
\??\c:\jjdpv.exec:\jjdpv.exe89⤵PID:2736
-
\??\c:\xlxllrf.exec:\xlxllrf.exe90⤵PID:2088
-
\??\c:\5rxrxxf.exec:\5rxrxxf.exe91⤵PID:2792
-
\??\c:\nhttbh.exec:\nhttbh.exe92⤵PID:692
-
\??\c:\pvdjd.exec:\pvdjd.exe93⤵PID:2948
-
\??\c:\7vppv.exec:\7vppv.exe94⤵PID:1172
-
\??\c:\fxxrlff.exec:\fxxrlff.exe95⤵PID:2956
-
\??\c:\lfrflrf.exec:\lfrflrf.exe96⤵PID:2908
-
\??\c:\tnhnnn.exec:\tnhnnn.exe97⤵PID:1428
-
\??\c:\5dvdd.exec:\5dvdd.exe98⤵PID:1232
-
\??\c:\vvjjp.exec:\vvjjp.exe99⤵PID:1828
-
\??\c:\7rrflrx.exec:\7rrflrx.exe100⤵PID:2368
-
\??\c:\hbnhnh.exec:\hbnhnh.exe101⤵PID:1252
-
\??\c:\bbtbbb.exec:\bbtbbb.exe102⤵PID:2928
-
\??\c:\3jpvd.exec:\3jpvd.exe103⤵PID:1632
-
\??\c:\xlxlxff.exec:\xlxlxff.exe104⤵PID:2116
-
\??\c:\lxrlrlr.exec:\lxrlrlr.exe105⤵PID:568
-
\??\c:\nbntbb.exec:\nbntbb.exe106⤵PID:2296
-
\??\c:\jjvvv.exec:\jjvvv.exe107⤵PID:3016
-
\??\c:\frlrflx.exec:\frlrflx.exe108⤵PID:3020
-
\??\c:\lrrfxlx.exec:\lrrfxlx.exe109⤵PID:3012
-
\??\c:\5hbbhh.exec:\5hbbhh.exe110⤵PID:1144
-
\??\c:\pjvvd.exec:\pjvvd.exe111⤵PID:2400
-
\??\c:\pjvpp.exec:\pjvpp.exe112⤵PID:1856
-
\??\c:\fxrxffl.exec:\fxrxffl.exe113⤵PID:1620
-
\??\c:\httbhh.exec:\httbhh.exe114⤵PID:308
-
\??\c:\7htthh.exec:\7htthh.exe115⤵PID:1808
-
\??\c:\pvpvj.exec:\pvpvj.exe116⤵PID:2180
-
\??\c:\pdvdd.exec:\pdvdd.exe117⤵PID:2520
-
\??\c:\llxrxxl.exec:\llxrxxl.exe118⤵PID:2508
-
\??\c:\hbttbt.exec:\hbttbt.exe119⤵PID:1584
-
\??\c:\5vppv.exec:\5vppv.exe120⤵PID:2348
-
\??\c:\jjddv.exec:\jjddv.exe121⤵PID:1468
-
\??\c:\rrffrxl.exec:\rrffrxl.exe122⤵PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-