Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe
-
Size
453KB
-
MD5
492df9769bfdcaa8ceb85632d62ed220
-
SHA1
f85dd34aaaadc2a85fc34853f02b15bc5be60cbd
-
SHA256
7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57
-
SHA512
4b6446b7b28d67f9f39576b01596372a384f761909c6e9df040eebc95892e4dd70248bb5fed46dcddd868347ae656f15ea5e64b9e95e91f143bed6d89c8505dc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2224-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-34-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2716-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-49-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2692-55-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/624-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1140-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-149-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1804-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-204-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1320-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-280-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2324-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-308-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1808-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-354-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-501-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2800-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-726-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2272 3tnttb.exe 2804 1dpvd.exe 2984 rlxrffl.exe 2716 5ttbnn.exe 2692 1tbntb.exe 2548 pjvdj.exe 2108 3thbnn.exe 2148 ffllxxl.exe 624 5bnnhh.exe 2128 nhtbnn.exe 1140 frfxxfr.exe 764 xrflrlx.exe 2896 rlrrxlx.exe 324 9tnhnb.exe 2948 1jdjv.exe 2436 3lfrrxr.exe 2932 ddppj.exe 2512 xxrxllf.exe 1964 pjvvp.exe 1804 rfrrxxl.exe 2988 1dvdv.exe 1296 5jvdp.exe 1372 nnnnbb.exe 1320 jjvdp.exe 236 llxfrfr.exe 2300 ppjdv.exe 1000 ffffrfr.exe 1192 tbtbbh.exe 2032 rlffllx.exe 2420 nhhhth.exe 2324 7rflflx.exe 2832 7rfrxfl.exe 2688 ffrxlrf.exe 2756 nhtthh.exe 1808 7jvvd.exe 2728 rlxflrx.exe 1760 5bthtt.exe 2564 vpdjd.exe 2624 5dvvj.exe 2212 3xrrrff.exe 2960 1nbhtb.exe 2964 5jdjj.exe 1696 dvpvd.exe 2284 3rrrxxf.exe 1484 bbhnbh.exe 2848 pjdpp.exe 2884 1pjjj.exe 2764 7rlxllr.exe 2888 nnhnbb.exe 568 7pvdd.exe 772 pjvvv.exe 3008 xrllllx.exe 1104 3nhhnh.exe 1252 jvjjv.exe 2368 rflrrll.exe 1964 xxxxrfl.exe 2200 9bnhnt.exe 1700 jdddd.exe 1296 jdpdd.exe 1860 9xrfllx.exe 1544 nhbbnn.exe 1320 9pvdd.exe 2268 1dpdv.exe 1560 fxllxxx.exe -
resource yara_rule behavioral1/memory/2224-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-204-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1320-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-259-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2420-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-414-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2888-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-727-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2272 2224 7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe 30 PID 2224 wrote to memory of 2272 2224 7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe 30 PID 2224 wrote to memory of 2272 2224 7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe 30 PID 2224 wrote to memory of 2272 2224 7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe 30 PID 2272 wrote to memory of 2804 2272 3tnttb.exe 31 PID 2272 wrote to memory of 2804 2272 3tnttb.exe 31 PID 2272 wrote to memory of 2804 2272 3tnttb.exe 31 PID 2272 wrote to memory of 2804 2272 3tnttb.exe 31 PID 2804 wrote to memory of 2984 2804 1dpvd.exe 32 PID 2804 wrote to memory of 2984 2804 1dpvd.exe 32 PID 2804 wrote to memory of 2984 2804 1dpvd.exe 32 PID 2804 wrote to memory of 2984 2804 1dpvd.exe 32 PID 2984 wrote to memory of 2716 2984 rlxrffl.exe 33 PID 2984 wrote to memory of 2716 2984 rlxrffl.exe 33 PID 2984 wrote to memory of 2716 2984 rlxrffl.exe 33 PID 2984 wrote to memory of 2716 2984 rlxrffl.exe 33 PID 2716 wrote to memory of 2692 2716 5ttbnn.exe 34 PID 2716 wrote to memory of 2692 2716 5ttbnn.exe 34 PID 2716 wrote to memory of 2692 2716 5ttbnn.exe 34 PID 2716 wrote to memory of 2692 2716 5ttbnn.exe 34 PID 2692 wrote to memory of 2548 2692 1tbntb.exe 35 PID 2692 wrote to memory of 2548 2692 1tbntb.exe 35 PID 2692 wrote to memory of 2548 2692 1tbntb.exe 35 PID 2692 wrote to memory of 2548 2692 1tbntb.exe 35 PID 2548 wrote to memory of 2108 2548 pjvdj.exe 36 PID 2548 wrote to memory of 2108 2548 pjvdj.exe 36 PID 2548 wrote to memory of 2108 2548 pjvdj.exe 36 PID 2548 wrote to memory of 2108 2548 pjvdj.exe 36 PID 2108 wrote to memory of 2148 2108 3thbnn.exe 37 PID 2108 wrote to memory of 2148 2108 3thbnn.exe 37 PID 2108 wrote to memory of 2148 2108 3thbnn.exe 37 PID 2108 wrote to memory of 2148 2108 3thbnn.exe 37 PID 2148 wrote to memory of 624 2148 ffllxxl.exe 38 PID 2148 wrote to memory of 624 2148 ffllxxl.exe 38 PID 2148 wrote to memory of 624 2148 ffllxxl.exe 38 PID 2148 wrote to memory of 624 2148 ffllxxl.exe 38 PID 624 wrote to memory of 2128 624 5bnnhh.exe 39 PID 624 wrote to memory of 2128 624 5bnnhh.exe 39 PID 624 wrote to memory of 2128 624 5bnnhh.exe 39 PID 624 wrote to memory of 2128 624 5bnnhh.exe 39 PID 2128 wrote to memory of 1140 2128 nhtbnn.exe 40 PID 2128 wrote to memory of 1140 2128 nhtbnn.exe 40 PID 2128 wrote to memory of 1140 2128 nhtbnn.exe 40 PID 2128 wrote to memory of 1140 2128 nhtbnn.exe 40 PID 1140 wrote to memory of 764 1140 frfxxfr.exe 41 PID 1140 wrote to memory of 764 1140 frfxxfr.exe 41 PID 1140 wrote to memory of 764 1140 frfxxfr.exe 41 PID 1140 wrote to memory of 764 1140 frfxxfr.exe 41 PID 764 wrote to memory of 2896 764 xrflrlx.exe 42 PID 764 wrote to memory of 2896 764 xrflrlx.exe 42 PID 764 wrote to memory of 2896 764 xrflrlx.exe 42 PID 764 wrote to memory of 2896 764 xrflrlx.exe 42 PID 2896 wrote to memory of 324 2896 rlrrxlx.exe 43 PID 2896 wrote to memory of 324 2896 rlrrxlx.exe 43 PID 2896 wrote to memory of 324 2896 rlrrxlx.exe 43 PID 2896 wrote to memory of 324 2896 rlrrxlx.exe 43 PID 324 wrote to memory of 2948 324 9tnhnb.exe 44 PID 324 wrote to memory of 2948 324 9tnhnb.exe 44 PID 324 wrote to memory of 2948 324 9tnhnb.exe 44 PID 324 wrote to memory of 2948 324 9tnhnb.exe 44 PID 2948 wrote to memory of 2436 2948 1jdjv.exe 45 PID 2948 wrote to memory of 2436 2948 1jdjv.exe 45 PID 2948 wrote to memory of 2436 2948 1jdjv.exe 45 PID 2948 wrote to memory of 2436 2948 1jdjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe"C:\Users\Admin\AppData\Local\Temp\7cb47fd08b32a174b1539d2b2c20ecdecd479a65e7a4dfd64bce7fe2110f4c57N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\3tnttb.exec:\3tnttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\1dpvd.exec:\1dpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rlxrffl.exec:\rlxrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\5ttbnn.exec:\5ttbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\1tbntb.exec:\1tbntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\pjvdj.exec:\pjvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\3thbnn.exec:\3thbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ffllxxl.exec:\ffllxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5bnnhh.exec:\5bnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\nhtbnn.exec:\nhtbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\frfxxfr.exec:\frfxxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\xrflrlx.exec:\xrflrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rlrrxlx.exec:\rlrrxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\9tnhnb.exec:\9tnhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\1jdjv.exec:\1jdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\3lfrrxr.exec:\3lfrrxr.exe17⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ddppj.exec:\ddppj.exe18⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xxrxllf.exec:\xxrxllf.exe19⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjvvp.exec:\pjvvp.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe21⤵
- Executes dropped EXE
PID:1804 -
\??\c:\1dvdv.exec:\1dvdv.exe22⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5jvdp.exec:\5jvdp.exe23⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nnnnbb.exec:\nnnnbb.exe24⤵
- Executes dropped EXE
PID:1372 -
\??\c:\jjvdp.exec:\jjvdp.exe25⤵
- Executes dropped EXE
PID:1320 -
\??\c:\llxfrfr.exec:\llxfrfr.exe26⤵
- Executes dropped EXE
PID:236 -
\??\c:\ppjdv.exec:\ppjdv.exe27⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ffffrfr.exec:\ffffrfr.exe28⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tbtbbh.exec:\tbtbbh.exe29⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rlffllx.exec:\rlffllx.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhhhth.exec:\nhhhth.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7rflflx.exec:\7rflflx.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7rfrxfl.exec:\7rfrxfl.exe33⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nhtthh.exec:\nhtthh.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7jvvd.exec:\7jvvd.exe36⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rlxflrx.exec:\rlxflrx.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5bthtt.exec:\5bthtt.exe38⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vpdjd.exec:\vpdjd.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5dvvj.exec:\5dvvj.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3xrrrff.exec:\3xrrrff.exe41⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1nbhtb.exec:\1nbhtb.exe42⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5jdjj.exec:\5jdjj.exe43⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvpvd.exec:\dvpvd.exe44⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3rrrxxf.exec:\3rrrxxf.exe45⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bbhnbh.exec:\bbhnbh.exe46⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pjdpp.exec:\pjdpp.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1pjjj.exec:\1pjjj.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7rlxllr.exec:\7rlxllr.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nnhnbb.exec:\nnhnbb.exe50⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7pvdd.exec:\7pvdd.exe51⤵
- Executes dropped EXE
PID:568 -
\??\c:\pjvvv.exec:\pjvvv.exe52⤵
- Executes dropped EXE
PID:772 -
\??\c:\xrllllx.exec:\xrllllx.exe53⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3nhhnh.exec:\3nhhnh.exe54⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jvjjv.exec:\jvjjv.exe55⤵
- Executes dropped EXE
PID:1252 -
\??\c:\rflrrll.exec:\rflrrll.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xxxxrfl.exec:\xxxxrfl.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9bnhnt.exec:\9bnhnt.exe58⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdddd.exec:\jdddd.exe59⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jdpdd.exec:\jdpdd.exe60⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9xrfllx.exec:\9xrfllx.exe61⤵
- Executes dropped EXE
PID:1860 -
\??\c:\nhbbnn.exec:\nhbbnn.exe62⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9pvdd.exec:\9pvdd.exe63⤵
- Executes dropped EXE
PID:1320 -
\??\c:\1dpdv.exec:\1dpdv.exe64⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxllxxx.exec:\fxllxxx.exe65⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bbnnbb.exec:\bbnnbb.exe66⤵PID:2520
-
\??\c:\jpvdd.exec:\jpvdd.exe67⤵PID:2476
-
\??\c:\pvjdp.exec:\pvjdp.exe68⤵PID:1192
-
\??\c:\9xxxlrx.exec:\9xxxlrx.exe69⤵PID:2044
-
\??\c:\9hnnth.exec:\9hnnth.exe70⤵PID:912
-
\??\c:\dpvdd.exec:\dpvdd.exe71⤵PID:2800
-
\??\c:\9vjjd.exec:\9vjjd.exe72⤵PID:1604
-
\??\c:\rrlxfxr.exec:\rrlxfxr.exe73⤵PID:2816
-
\??\c:\ttnbbh.exec:\ttnbbh.exe74⤵PID:2708
-
\??\c:\9vpvd.exec:\9vpvd.exe75⤵PID:852
-
\??\c:\3xffrxf.exec:\3xffrxf.exe76⤵PID:2776
-
\??\c:\ffrflrf.exec:\ffrflrf.exe77⤵PID:1808
-
\??\c:\9hbtbh.exec:\9hbtbh.exe78⤵PID:2728
-
\??\c:\nthntb.exec:\nthntb.exe79⤵PID:2604
-
\??\c:\jjdjv.exec:\jjdjv.exe80⤵PID:2196
-
\??\c:\rlrrxlr.exec:\rlrrxlr.exe81⤵PID:2108
-
\??\c:\nhtnbn.exec:\nhtnbn.exe82⤵PID:1924
-
\??\c:\9pjpj.exec:\9pjpj.exe83⤵PID:2944
-
\??\c:\vdpdj.exec:\vdpdj.exe84⤵PID:624
-
\??\c:\3xrxxfl.exec:\3xrxxfl.exe85⤵PID:2872
-
\??\c:\hhbbnt.exec:\hhbbnt.exe86⤵PID:1476
-
\??\c:\nnbbhh.exec:\nnbbhh.exe87⤵PID:2656
-
\??\c:\ddppd.exec:\ddppd.exe88⤵PID:2448
-
\??\c:\3xxxffl.exec:\3xxxffl.exe89⤵PID:1028
-
\??\c:\1thnbb.exec:\1thnbb.exe90⤵PID:2924
-
\??\c:\3vpdd.exec:\3vpdd.exe91⤵PID:1100
-
\??\c:\5vpvd.exec:\5vpvd.exe92⤵PID:2912
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe93⤵PID:1912
-
\??\c:\rrffrxl.exec:\rrffrxl.exe94⤵PID:2920
-
\??\c:\hnbnhn.exec:\hnbnhn.exe95⤵PID:2404
-
\??\c:\5dvpv.exec:\5dvpv.exe96⤵PID:2364
-
\??\c:\lrllrrx.exec:\lrllrrx.exe97⤵PID:2276
-
\??\c:\3rllxfx.exec:\3rllxfx.exe98⤵PID:908
-
\??\c:\nhtttt.exec:\nhtttt.exe99⤵PID:2200
-
\??\c:\ppvdv.exec:\ppvdv.exe100⤵PID:296
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe101⤵PID:948
-
\??\c:\lrllxxf.exec:\lrllxxf.exe102⤵PID:1292
-
\??\c:\hbhbbb.exec:\hbhbbb.exe103⤵PID:1544
-
\??\c:\vdpvd.exec:\vdpvd.exe104⤵PID:2004
-
\??\c:\rfrlllr.exec:\rfrlllr.exe105⤵PID:1968
-
\??\c:\lrffrxf.exec:\lrffrxf.exe106⤵PID:288
-
\??\c:\nhbbnh.exec:\nhbbnh.exe107⤵PID:1576
-
\??\c:\vjjpd.exec:\vjjpd.exe108⤵PID:1000
-
\??\c:\5xrrlrr.exec:\5xrrlrr.exe109⤵PID:2856
-
\??\c:\1rffrxx.exec:\1rffrxx.exe110⤵PID:2176
-
\??\c:\nhtntb.exec:\nhtntb.exe111⤵PID:1364
-
\??\c:\5bhthn.exec:\5bhthn.exe112⤵PID:2800
-
\??\c:\vvpdj.exec:\vvpdj.exe113⤵PID:2804
-
\??\c:\9rrlrxl.exec:\9rrlrxl.exe114⤵PID:2704
-
\??\c:\nbtnbt.exec:\nbtnbt.exe115⤵PID:2984
-
\??\c:\btntnt.exec:\btntnt.exe116⤵PID:2756
-
\??\c:\pjdjp.exec:\pjdjp.exe117⤵PID:2576
-
\??\c:\7vjjd.exec:\7vjjd.exe118⤵PID:1808
-
\??\c:\xxfffll.exec:\xxfffll.exe119⤵PID:1760
-
\??\c:\hbtbnt.exec:\hbtbnt.exe120⤵PID:2564
-
\??\c:\tnbnbt.exec:\tnbnbt.exe121⤵PID:2548
-
\??\c:\flflflx.exec:\flflflx.exe122⤵PID:2220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-