Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe
-
Size
453KB
-
MD5
9915e153193a3afaeaa444974fd71a50
-
SHA1
fcf8669f70a5a9fe3d5775f308d2a9ef64468980
-
SHA256
30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221d
-
SHA512
b72c3300ee664929347e6e7ade1b1b910d4a28f3e76adea55134625ea046d2a53740211e161b14d33ff974dbaf5c7eb304a44e20f5c9f91b262de8e85bf61c46
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2284-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2060-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-135-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-230-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2068-251-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2908-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-289-0x0000000077130000-0x000000007722A000-memory.dmp family_blackmoon behavioral1/memory/2964-288-0x0000000077010000-0x000000007712F000-memory.dmp family_blackmoon behavioral1/memory/2992-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-364-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2572-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-395-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1476-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-427-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1992-447-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/320-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-462-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-534-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-560-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2440-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-852-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-866-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2284 3lxxfxf.exe 2824 ddjvd.exe 3036 xllxxrf.exe 2776 lxfrrll.exe 2676 3jjpv.exe 2764 vvdjj.exe 2680 rlxrrrl.exe 2656 pddjv.exe 2620 rlxxxxx.exe 2248 lfrrrrf.exe 268 jvjdj.exe 344 nbtnnn.exe 2060 1pjjp.exe 1920 xrflrxx.exe 2028 bnthbn.exe 332 7dpjd.exe 1864 7lxxxxx.exe 2204 jdpvv.exe 2076 jdppp.exe 972 1bhbbt.exe 2156 5hnhnt.exe 2876 3lxxrrr.exe 1312 bntbbt.exe 1032 5flfrrx.exe 1964 rlflllr.exe 2068 bnthht.exe 2908 rfllrlr.exe 2300 htbbbb.exe 2256 3jvjj.exe 2964 nhnthb.exe 2112 3rxfllx.exe 2992 hthhhh.exe 2692 5pdpd.exe 3036 lxlfrrx.exe 2776 1xfxlff.exe 2700 5nhbbh.exe 2856 vjppp.exe 2708 7vvvp.exe 2632 xlxffxr.exe 2544 fxflllr.exe 2572 ntnnnh.exe 2620 5vjpv.exe 2248 jdjvv.exe 1900 9rxxfxf.exe 852 btnbhb.exe 1012 tnnthb.exe 1344 vpvpj.exe 1476 xlrffxx.exe 1992 xrfllfl.exe 1188 7hnnhh.exe 476 jjdjp.exe 2372 pvjdj.exe 320 9xlfxxx.exe 1308 hbhntt.exe 2408 bnbtbh.exe 2096 ddpvj.exe 1692 xrffffl.exe 2868 9lxrllr.exe 1636 nhnhhh.exe 1368 ddjdd.exe 872 9rxfrrx.exe 1360 1rfxrrr.exe 1472 hbhnnt.exe 2080 jvvdd.exe -
resource yara_rule behavioral1/memory/2284-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-172-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2204-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-230-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2908-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-269-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2300-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-434-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/320-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-911-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2284 1916 30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe 31 PID 1916 wrote to memory of 2284 1916 30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe 31 PID 1916 wrote to memory of 2284 1916 30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe 31 PID 1916 wrote to memory of 2284 1916 30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe 31 PID 2284 wrote to memory of 2824 2284 3lxxfxf.exe 32 PID 2284 wrote to memory of 2824 2284 3lxxfxf.exe 32 PID 2284 wrote to memory of 2824 2284 3lxxfxf.exe 32 PID 2284 wrote to memory of 2824 2284 3lxxfxf.exe 32 PID 2824 wrote to memory of 3036 2824 ddjvd.exe 33 PID 2824 wrote to memory of 3036 2824 ddjvd.exe 33 PID 2824 wrote to memory of 3036 2824 ddjvd.exe 33 PID 2824 wrote to memory of 3036 2824 ddjvd.exe 33 PID 3036 wrote to memory of 2776 3036 xllxxrf.exe 34 PID 3036 wrote to memory of 2776 3036 xllxxrf.exe 34 PID 3036 wrote to memory of 2776 3036 xllxxrf.exe 34 PID 3036 wrote to memory of 2776 3036 xllxxrf.exe 34 PID 2776 wrote to memory of 2676 2776 lxfrrll.exe 35 PID 2776 wrote to memory of 2676 2776 lxfrrll.exe 35 PID 2776 wrote to memory of 2676 2776 lxfrrll.exe 35 PID 2776 wrote to memory of 2676 2776 lxfrrll.exe 35 PID 2676 wrote to memory of 2764 2676 3jjpv.exe 36 PID 2676 wrote to memory of 2764 2676 3jjpv.exe 36 PID 2676 wrote to memory of 2764 2676 3jjpv.exe 36 PID 2676 wrote to memory of 2764 2676 3jjpv.exe 36 PID 2764 wrote to memory of 2680 2764 vvdjj.exe 37 PID 2764 wrote to memory of 2680 2764 vvdjj.exe 37 PID 2764 wrote to memory of 2680 2764 vvdjj.exe 37 PID 2764 wrote to memory of 2680 2764 vvdjj.exe 37 PID 2680 wrote to memory of 2656 2680 rlxrrrl.exe 38 PID 2680 wrote to memory of 2656 2680 rlxrrrl.exe 38 PID 2680 wrote to memory of 2656 2680 rlxrrrl.exe 38 PID 2680 wrote to memory of 2656 2680 rlxrrrl.exe 38 PID 2656 wrote to memory of 2620 2656 pddjv.exe 39 PID 2656 wrote to memory of 2620 2656 pddjv.exe 39 PID 2656 wrote to memory of 2620 2656 pddjv.exe 39 PID 2656 wrote to memory of 2620 2656 pddjv.exe 39 PID 2620 wrote to memory of 2248 2620 rlxxxxx.exe 40 PID 2620 wrote to memory of 2248 2620 rlxxxxx.exe 40 PID 2620 wrote to memory of 2248 2620 rlxxxxx.exe 40 PID 2620 wrote to memory of 2248 2620 rlxxxxx.exe 40 PID 2248 wrote to memory of 268 2248 lfrrrrf.exe 41 PID 2248 wrote to memory of 268 2248 lfrrrrf.exe 41 PID 2248 wrote to memory of 268 2248 lfrrrrf.exe 41 PID 2248 wrote to memory of 268 2248 lfrrrrf.exe 41 PID 268 wrote to memory of 344 268 jvjdj.exe 42 PID 268 wrote to memory of 344 268 jvjdj.exe 42 PID 268 wrote to memory of 344 268 jvjdj.exe 42 PID 268 wrote to memory of 344 268 jvjdj.exe 42 PID 344 wrote to memory of 2060 344 nbtnnn.exe 43 PID 344 wrote to memory of 2060 344 nbtnnn.exe 43 PID 344 wrote to memory of 2060 344 nbtnnn.exe 43 PID 344 wrote to memory of 2060 344 nbtnnn.exe 43 PID 2060 wrote to memory of 1920 2060 1pjjp.exe 44 PID 2060 wrote to memory of 1920 2060 1pjjp.exe 44 PID 2060 wrote to memory of 1920 2060 1pjjp.exe 44 PID 2060 wrote to memory of 1920 2060 1pjjp.exe 44 PID 1920 wrote to memory of 2028 1920 xrflrxx.exe 45 PID 1920 wrote to memory of 2028 1920 xrflrxx.exe 45 PID 1920 wrote to memory of 2028 1920 xrflrxx.exe 45 PID 1920 wrote to memory of 2028 1920 xrflrxx.exe 45 PID 2028 wrote to memory of 332 2028 bnthbn.exe 46 PID 2028 wrote to memory of 332 2028 bnthbn.exe 46 PID 2028 wrote to memory of 332 2028 bnthbn.exe 46 PID 2028 wrote to memory of 332 2028 bnthbn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe"C:\Users\Admin\AppData\Local\Temp\30e330588b6fd81b6b82a343c88798b480e5f2778bfbf7e1f2007a10656d221dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\3lxxfxf.exec:\3lxxfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\ddjvd.exec:\ddjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xllxxrf.exec:\xllxxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lxfrrll.exec:\lxfrrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\3jjpv.exec:\3jjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vvdjj.exec:\vvdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pddjv.exec:\pddjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\jvjdj.exec:\jvjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\nbtnnn.exec:\nbtnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\1pjjp.exec:\1pjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\xrflrxx.exec:\xrflrxx.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\bnthbn.exec:\bnthbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7dpjd.exec:\7dpjd.exe17⤵
- Executes dropped EXE
PID:332 -
\??\c:\7lxxxxx.exec:\7lxxxxx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1864 -
\??\c:\jdpvv.exec:\jdpvv.exe19⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jdppp.exec:\jdppp.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1bhbbt.exec:\1bhbbt.exe21⤵
- Executes dropped EXE
PID:972 -
\??\c:\5hnhnt.exec:\5hnhnt.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3lxxrrr.exec:\3lxxrrr.exe23⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bntbbt.exec:\bntbbt.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5flfrrx.exec:\5flfrrx.exe25⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rlflllr.exec:\rlflllr.exe26⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bnthht.exec:\bnthht.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\rfllrlr.exec:\rfllrlr.exe28⤵
- Executes dropped EXE
PID:2908 -
\??\c:\htbbbb.exec:\htbbbb.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3jvjj.exec:\3jvjj.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhnthb.exec:\nhnthb.exe31⤵
- Executes dropped EXE
PID:2964 -
\??\c:\htbbhn.exec:\htbbhn.exe32⤵PID:1600
-
\??\c:\3rxfllx.exec:\3rxfllx.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hthhhh.exec:\hthhhh.exe34⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5pdpd.exec:\5pdpd.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxlfrrx.exec:\lxlfrrx.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1xfxlff.exec:\1xfxlff.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5nhbbh.exec:\5nhbbh.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vjppp.exec:\vjppp.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7vvvp.exec:\7vvvp.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xlxffxr.exec:\xlxffxr.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fxflllr.exec:\fxflllr.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ntnnnh.exec:\ntnnnh.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5vjpv.exec:\5vjpv.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jdjvv.exec:\jdjvv.exe45⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9rxxfxf.exec:\9rxxfxf.exe46⤵
- Executes dropped EXE
PID:1900 -
\??\c:\btnbhb.exec:\btnbhb.exe47⤵
- Executes dropped EXE
PID:852 -
\??\c:\tnnthb.exec:\tnnthb.exe48⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vpvpj.exec:\vpvpj.exe49⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xlrffxx.exec:\xlrffxx.exe50⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xrfllfl.exec:\xrfllfl.exe51⤵
- Executes dropped EXE
PID:1992 -
\??\c:\7hnnhh.exec:\7hnnhh.exe52⤵
- Executes dropped EXE
PID:1188 -
\??\c:\jjdjp.exec:\jjdjp.exe53⤵
- Executes dropped EXE
PID:476 -
\??\c:\pvjdj.exec:\pvjdj.exe54⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9xlfxxx.exec:\9xlfxxx.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\hbhntt.exec:\hbhntt.exe56⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bnbtbh.exec:\bnbtbh.exe57⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ddpvj.exec:\ddpvj.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xrffffl.exec:\xrffffl.exe59⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9lxrllr.exec:\9lxrllr.exe60⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhnhhh.exec:\nhnhhh.exe61⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ddjdd.exec:\ddjdd.exe62⤵
- Executes dropped EXE
PID:1368 -
\??\c:\9rxfrrx.exec:\9rxfrrx.exe63⤵
- Executes dropped EXE
PID:872 -
\??\c:\1rfxrrr.exec:\1rfxrrr.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1360 -
\??\c:\hbhnnt.exec:\hbhnnt.exe65⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jvvdd.exec:\jvvdd.exe66⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jdpjp.exec:\jdpjp.exe67⤵PID:2976
-
\??\c:\9frlffl.exec:\9frlffl.exe68⤵PID:1020
-
\??\c:\fxlllll.exec:\fxlllll.exe69⤵PID:1496
-
\??\c:\tnbtnn.exec:\tnbtnn.exe70⤵PID:2948
-
\??\c:\7dppv.exec:\7dppv.exe71⤵PID:2256
-
\??\c:\dpvpv.exec:\dpvpv.exe72⤵PID:2440
-
\??\c:\1lxrxlx.exec:\1lxrxlx.exe73⤵PID:2628
-
\??\c:\tnhhhh.exec:\tnhhhh.exe74⤵PID:2112
-
\??\c:\bnhbbb.exec:\bnhbbb.exe75⤵PID:2684
-
\??\c:\pdjdd.exec:\pdjdd.exe76⤵PID:2636
-
\??\c:\lxllllr.exec:\lxllllr.exe77⤵PID:2864
-
\??\c:\3llfxxf.exec:\3llfxxf.exe78⤵PID:3036
-
\??\c:\9thnbb.exec:\9thnbb.exe79⤵PID:2228
-
\??\c:\hthhbt.exec:\hthhbt.exe80⤵PID:2968
-
\??\c:\dpddj.exec:\dpddj.exe81⤵PID:2756
-
\??\c:\dvjdv.exec:\dvjdv.exe82⤵PID:2708
-
\??\c:\lxfxxlr.exec:\lxfxxlr.exe83⤵PID:2632
-
\??\c:\7xlrrlr.exec:\7xlrrlr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\9tbttn.exec:\9tbttn.exe85⤵PID:2940
-
\??\c:\bnhbnh.exec:\bnhbnh.exe86⤵PID:1816
-
\??\c:\pjjdv.exec:\pjjdv.exe87⤵PID:2008
-
\??\c:\xlfrrff.exec:\xlfrrff.exe88⤵PID:1216
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe89⤵PID:344
-
\??\c:\bthnbb.exec:\bthnbb.exe90⤵PID:2064
-
\??\c:\jvdvp.exec:\jvdvp.exe91⤵PID:1868
-
\??\c:\jpvpv.exec:\jpvpv.exe92⤵PID:2760
-
\??\c:\lrrlxrx.exec:\lrrlxrx.exe93⤵PID:2612
-
\??\c:\bhtbhb.exec:\bhtbhb.exe94⤵PID:1524
-
\??\c:\9tbhhh.exec:\9tbhhh.exe95⤵PID:376
-
\??\c:\7vvjj.exec:\7vvjj.exe96⤵PID:2412
-
\??\c:\hbthhh.exec:\hbthhh.exe97⤵PID:2384
-
\??\c:\5hnbtn.exec:\5hnbtn.exe98⤵PID:1080
-
\??\c:\jvjdp.exec:\jvjdp.exe99⤵PID:2236
-
\??\c:\rffflff.exec:\rffflff.exe100⤵PID:1128
-
\??\c:\frlllff.exec:\frlllff.exe101⤵PID:2120
-
\??\c:\bnbbht.exec:\bnbbht.exe102⤵PID:1932
-
\??\c:\5pjpp.exec:\5pjpp.exe103⤵PID:596
-
\??\c:\jvdvv.exec:\jvdvv.exe104⤵PID:2496
-
\??\c:\xlfflrx.exec:\xlfflrx.exe105⤵PID:1048
-
\??\c:\5thbhh.exec:\5thbhh.exe106⤵PID:872
-
\??\c:\tbhhbt.exec:\tbhhbt.exe107⤵PID:1724
-
\??\c:\dpdjd.exec:\dpdjd.exe108⤵PID:1472
-
\??\c:\pdpjj.exec:\pdpjj.exe109⤵PID:708
-
\??\c:\9fxrxfl.exec:\9fxrxfl.exe110⤵PID:2976
-
\??\c:\nhthhb.exec:\nhthhb.exe111⤵PID:788
-
\??\c:\3bnnnn.exec:\3bnnnn.exe112⤵PID:1980
-
\??\c:\jdvjj.exec:\jdvjj.exe113⤵PID:1940
-
\??\c:\9pdvv.exec:\9pdvv.exe114⤵PID:2444
-
\??\c:\5rfxxrf.exec:\5rfxxrf.exe115⤵PID:2500
-
\??\c:\nhttbt.exec:\nhttbt.exe116⤵PID:2128
-
\??\c:\3tbnnh.exec:\3tbnnh.exe117⤵PID:2624
-
\??\c:\dvpvd.exec:\dvpvd.exe118⤵PID:2116
-
\??\c:\fxlllfl.exec:\fxlllfl.exe119⤵PID:2636
-
\??\c:\3lxxlfr.exec:\3lxxlfr.exe120⤵PID:2660
-
\??\c:\1htnnn.exec:\1htnnn.exe121⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-