Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe
-
Size
454KB
-
MD5
0bd10d422e6556573b7f98066bd9f710
-
SHA1
fd67bc9ce6a360148870f422c77df492269a0f9a
-
SHA256
eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0a
-
SHA512
7c5748398bae6e7aa8b9d17b7bd3a659db456e8685fd1eaee971d33d2bbb27756835542db914d8e350fc7c2a6c9464b249c4e16dbdc7da1ccfda37f1ff87cd11
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1364-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2748-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-297-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1644-319-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2876-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-392-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-432-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1984-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-464-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2484-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-815-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-903-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-917-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-1038-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2248-1060-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2552-1116-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2684-1117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1364 djddd.exe 2524 fxrflxl.exe 2260 7pjjv.exe 2696 flfrffr.exe 2748 7bnttb.exe 2752 jddjd.exe 1736 ffffrrf.exe 2632 1jddd.exe 2924 1lrxrxx.exe 2676 nhtbnn.exe 2328 vdvpd.exe 316 tthnbh.exe 2796 tnbthn.exe 1956 lrflxff.exe 592 rrrfrxf.exe 2864 1jdvd.exe 1696 xfxrxfx.exe 1828 7lxlrxl.exe 2196 vdvdv.exe 2244 lfxlrrr.exe 1776 7hhhhb.exe 2164 hhtbbh.exe 2256 7dvvj.exe 2984 thnnhh.exe 1476 pjvvd.exe 2120 ntntbn.exe 3008 vdjvp.exe 2288 xxlfrfl.exe 900 3thnbb.exe 1724 fflxrfx.exe 2528 lrxfrrx.exe 2320 hnhnbh.exe 1184 dppvj.exe 1644 lllxlxx.exe 2956 tthnht.exe 2296 vdvjp.exe 2880 vvppd.exe 2876 xxrfrrl.exe 2724 xxxfxxr.exe 2728 hnhhbb.exe 2764 pppvv.exe 2608 ffxfxrr.exe 2668 lrlxlrr.exe 2768 bbtnbh.exe 1404 7vpjd.exe 2328 djjjv.exe 316 5rrxfxl.exe 1412 9hhhnh.exe 2836 3jdvd.exe 320 jvjdv.exe 2664 rxrxlrf.exe 908 nhtbnt.exe 1984 ttnbbh.exe 1696 dvpdv.exe 1828 rxrlxlf.exe 1964 rffrlrl.exe 3044 5htbnt.exe 2244 dvjpd.exe 2076 ddvjv.exe 1776 fxxxfrf.exe 448 bbtbnt.exe 2784 hbhhth.exe 956 7vjpv.exe 556 vvvdp.exe -
resource yara_rule behavioral1/memory/1364-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-611-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2000-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-1038-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2684-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1364 2348 eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe 30 PID 2348 wrote to memory of 1364 2348 eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe 30 PID 2348 wrote to memory of 1364 2348 eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe 30 PID 2348 wrote to memory of 1364 2348 eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe 30 PID 1364 wrote to memory of 2524 1364 djddd.exe 31 PID 1364 wrote to memory of 2524 1364 djddd.exe 31 PID 1364 wrote to memory of 2524 1364 djddd.exe 31 PID 1364 wrote to memory of 2524 1364 djddd.exe 31 PID 2524 wrote to memory of 2260 2524 fxrflxl.exe 32 PID 2524 wrote to memory of 2260 2524 fxrflxl.exe 32 PID 2524 wrote to memory of 2260 2524 fxrflxl.exe 32 PID 2524 wrote to memory of 2260 2524 fxrflxl.exe 32 PID 2260 wrote to memory of 2696 2260 7pjjv.exe 33 PID 2260 wrote to memory of 2696 2260 7pjjv.exe 33 PID 2260 wrote to memory of 2696 2260 7pjjv.exe 33 PID 2260 wrote to memory of 2696 2260 7pjjv.exe 33 PID 2696 wrote to memory of 2748 2696 flfrffr.exe 34 PID 2696 wrote to memory of 2748 2696 flfrffr.exe 34 PID 2696 wrote to memory of 2748 2696 flfrffr.exe 34 PID 2696 wrote to memory of 2748 2696 flfrffr.exe 34 PID 2748 wrote to memory of 2752 2748 7bnttb.exe 35 PID 2748 wrote to memory of 2752 2748 7bnttb.exe 35 PID 2748 wrote to memory of 2752 2748 7bnttb.exe 35 PID 2748 wrote to memory of 2752 2748 7bnttb.exe 35 PID 2752 wrote to memory of 1736 2752 jddjd.exe 36 PID 2752 wrote to memory of 1736 2752 jddjd.exe 36 PID 2752 wrote to memory of 1736 2752 jddjd.exe 36 PID 2752 wrote to memory of 1736 2752 jddjd.exe 36 PID 1736 wrote to memory of 2632 1736 ffffrrf.exe 37 PID 1736 wrote to memory of 2632 1736 ffffrrf.exe 37 PID 1736 wrote to memory of 2632 1736 ffffrrf.exe 37 PID 1736 wrote to memory of 2632 1736 ffffrrf.exe 37 PID 2632 wrote to memory of 2924 2632 1jddd.exe 38 PID 2632 wrote to memory of 2924 2632 1jddd.exe 38 PID 2632 wrote to memory of 2924 2632 1jddd.exe 38 PID 2632 wrote to memory of 2924 2632 1jddd.exe 38 PID 2924 wrote to memory of 2676 2924 1lrxrxx.exe 39 PID 2924 wrote to memory of 2676 2924 1lrxrxx.exe 39 PID 2924 wrote to memory of 2676 2924 1lrxrxx.exe 39 PID 2924 wrote to memory of 2676 2924 1lrxrxx.exe 39 PID 2676 wrote to memory of 2328 2676 nhtbnn.exe 40 PID 2676 wrote to memory of 2328 2676 nhtbnn.exe 40 PID 2676 wrote to memory of 2328 2676 nhtbnn.exe 40 PID 2676 wrote to memory of 2328 2676 nhtbnn.exe 40 PID 2328 wrote to memory of 316 2328 vdvpd.exe 41 PID 2328 wrote to memory of 316 2328 vdvpd.exe 41 PID 2328 wrote to memory of 316 2328 vdvpd.exe 41 PID 2328 wrote to memory of 316 2328 vdvpd.exe 41 PID 316 wrote to memory of 2796 316 tthnbh.exe 42 PID 316 wrote to memory of 2796 316 tthnbh.exe 42 PID 316 wrote to memory of 2796 316 tthnbh.exe 42 PID 316 wrote to memory of 2796 316 tthnbh.exe 42 PID 2796 wrote to memory of 1956 2796 tnbthn.exe 43 PID 2796 wrote to memory of 1956 2796 tnbthn.exe 43 PID 2796 wrote to memory of 1956 2796 tnbthn.exe 43 PID 2796 wrote to memory of 1956 2796 tnbthn.exe 43 PID 1956 wrote to memory of 592 1956 lrflxff.exe 44 PID 1956 wrote to memory of 592 1956 lrflxff.exe 44 PID 1956 wrote to memory of 592 1956 lrflxff.exe 44 PID 1956 wrote to memory of 592 1956 lrflxff.exe 44 PID 592 wrote to memory of 2864 592 rrrfrxf.exe 45 PID 592 wrote to memory of 2864 592 rrrfrxf.exe 45 PID 592 wrote to memory of 2864 592 rrrfrxf.exe 45 PID 592 wrote to memory of 2864 592 rrrfrxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe"C:\Users\Admin\AppData\Local\Temp\eebac63f027bf26bb45e8a17c126247e46c1d03ba78275d854f40b0f2c27dd0aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\djddd.exec:\djddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\fxrflxl.exec:\fxrflxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7pjjv.exec:\7pjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\flfrffr.exec:\flfrffr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7bnttb.exec:\7bnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jddjd.exec:\jddjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ffffrrf.exec:\ffffrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\1jddd.exec:\1jddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\1lrxrxx.exec:\1lrxrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nhtbnn.exec:\nhtbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vdvpd.exec:\vdvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\tthnbh.exec:\tthnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\tnbthn.exec:\tnbthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\lrflxff.exec:\lrflxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rrrfrxf.exec:\rrrfrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\1jdvd.exec:\1jdvd.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\xfxrxfx.exec:\xfxrxfx.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7lxlrxl.exec:\7lxlrxl.exe19⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vdvdv.exec:\vdvdv.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lfxlrrr.exec:\lfxlrrr.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7hhhhb.exec:\7hhhhb.exe22⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hhtbbh.exec:\hhtbbh.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7dvvj.exec:\7dvvj.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\thnnhh.exec:\thnnhh.exe25⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pjvvd.exec:\pjvvd.exe26⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ntntbn.exec:\ntntbn.exe27⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vdjvp.exec:\vdjvp.exe28⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xxlfrfl.exec:\xxlfrfl.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3thnbb.exec:\3thnbb.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:900 -
\??\c:\fflxrfx.exec:\fflxrfx.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lrxfrrx.exec:\lrxfrrx.exe32⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hnhnbh.exec:\hnhnbh.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dppvj.exec:\dppvj.exe34⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lllxlxx.exec:\lllxlxx.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\tthnht.exec:\tthnht.exe36⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vdvjp.exec:\vdvjp.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vvppd.exec:\vvppd.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxrfrrl.exec:\xxrfrrl.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xxxfxxr.exec:\xxxfxxr.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hnhhbb.exec:\hnhhbb.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pppvv.exec:\pppvv.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ffxfxrr.exec:\ffxfxrr.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lrlxlrr.exec:\lrlxlrr.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bbtnbh.exec:\bbtnbh.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7vpjd.exec:\7vpjd.exe46⤵
- Executes dropped EXE
PID:1404 -
\??\c:\djjjv.exec:\djjjv.exe47⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5rrxfxl.exec:\5rrxfxl.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\9hhhnh.exec:\9hhhnh.exe49⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3jdvd.exec:\3jdvd.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jvjdv.exec:\jvjdv.exe51⤵
- Executes dropped EXE
PID:320 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe52⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nhtbnt.exec:\nhtbnt.exe53⤵
- Executes dropped EXE
PID:908 -
\??\c:\ttnbbh.exec:\ttnbbh.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvpdv.exec:\dvpdv.exe55⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rxrlxlf.exec:\rxrlxlf.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rffrlrl.exec:\rffrlrl.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5htbnt.exec:\5htbnt.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvjpd.exec:\dvjpd.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ddvjv.exec:\ddvjv.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxxxfrf.exec:\fxxxfrf.exe61⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bbtbnt.exec:\bbtbnt.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbhhth.exec:\hbhhth.exe63⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7vjpv.exec:\7vjpv.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\vvvdp.exec:\vvvdp.exe65⤵
- Executes dropped EXE
PID:556 -
\??\c:\7lrfrfx.exec:\7lrfrfx.exe66⤵PID:2144
-
\??\c:\thhhth.exec:\thhhth.exe67⤵PID:2224
-
\??\c:\5btttb.exec:\5btttb.exe68⤵PID:2484
-
\??\c:\pvvdv.exec:\pvvdv.exe69⤵PID:2360
-
\??\c:\fffrlfx.exec:\fffrlfx.exe70⤵PID:1924
-
\??\c:\1rrllxx.exec:\1rrllxx.exe71⤵PID:2012
-
\??\c:\tbthbh.exec:\tbthbh.exe72⤵PID:2468
-
\??\c:\vvvjp.exec:\vvvjp.exe73⤵PID:1528
-
\??\c:\vddvj.exec:\vddvj.exe74⤵PID:2388
-
\??\c:\7fxfllx.exec:\7fxfllx.exe75⤵PID:2088
-
\??\c:\htthbn.exec:\htthbn.exe76⤵PID:1184
-
\??\c:\tthnhn.exec:\tthnhn.exe77⤵PID:2516
-
\??\c:\9vjvv.exec:\9vjvv.exe78⤵PID:2920
-
\??\c:\xxffrxl.exec:\xxffrxl.exe79⤵PID:1972
-
\??\c:\nnhtth.exec:\nnhtth.exe80⤵PID:2740
-
\??\c:\ttnbnb.exec:\ttnbnb.exe81⤵PID:2748
-
\??\c:\jdvdv.exec:\jdvdv.exe82⤵PID:2916
-
\??\c:\9lfrrrr.exec:\9lfrrrr.exe83⤵PID:2776
-
\??\c:\3rllflx.exec:\3rllflx.exe84⤵PID:2728
-
\??\c:\9thhtt.exec:\9thhtt.exe85⤵PID:2600
-
\??\c:\9pjpd.exec:\9pjpd.exe86⤵PID:2636
-
\??\c:\xrlxlrl.exec:\xrlxlrl.exe87⤵PID:2720
-
\??\c:\fxrxflx.exec:\fxrxflx.exe88⤵PID:2768
-
\??\c:\nhhnbb.exec:\nhhnbb.exe89⤵PID:2000
-
\??\c:\9vjpv.exec:\9vjpv.exe90⤵PID:532
-
\??\c:\lflrlrx.exec:\lflrlrx.exe91⤵PID:388
-
\??\c:\9rrxlxf.exec:\9rrxlxf.exe92⤵PID:1412
-
\??\c:\nnnbnt.exec:\nnnbnt.exe93⤵PID:1456
-
\??\c:\btbbnn.exec:\btbbnn.exe94⤵PID:2844
-
\??\c:\ddjpv.exec:\ddjpv.exe95⤵PID:2504
-
\??\c:\fllxrfx.exec:\fllxrfx.exe96⤵PID:908
-
\??\c:\3rlrlrf.exec:\3rlrlrf.exe97⤵PID:1016
-
\??\c:\tnnhbb.exec:\tnnhbb.exe98⤵PID:2168
-
\??\c:\jdjpd.exec:\jdjpd.exe99⤵PID:3056
-
\??\c:\vppdp.exec:\vppdp.exe100⤵PID:3040
-
\??\c:\xrfllrx.exec:\xrfllrx.exe101⤵PID:2520
-
\??\c:\thnthh.exec:\thnthh.exe102⤵PID:348
-
\??\c:\hhhtbn.exec:\hhhtbn.exe103⤵PID:3060
-
\??\c:\jjdjv.exec:\jjdjv.exe104⤵PID:2176
-
\??\c:\ffxflrr.exec:\ffxflrr.exe105⤵PID:2996
-
\??\c:\fflxrxf.exec:\fflxrxf.exe106⤵PID:2784
-
\??\c:\3hthhn.exec:\3hthhn.exe107⤵PID:1284
-
\??\c:\dddpp.exec:\dddpp.exe108⤵PID:1476
-
\??\c:\vvppd.exec:\vvppd.exe109⤵PID:2144
-
\??\c:\7llxlrf.exec:\7llxlrf.exe110⤵PID:3004
-
\??\c:\hbtbnt.exec:\hbtbnt.exe111⤵PID:1948
-
\??\c:\bbbbth.exec:\bbbbth.exe112⤵PID:2264
-
\??\c:\vpdvv.exec:\vpdvv.exe113⤵PID:1960
-
\??\c:\lrfrfrf.exec:\lrfrfrf.exe114⤵PID:2060
-
\??\c:\rffrfrr.exec:\rffrfrr.exe115⤵PID:2132
-
\??\c:\bttbtb.exec:\bttbtb.exe116⤵PID:1620
-
\??\c:\pvvjp.exec:\pvvjp.exe117⤵PID:2572
-
\??\c:\7pjvp.exec:\7pjvp.exe118⤵PID:2096
-
\??\c:\llfxffl.exec:\llfxffl.exe119⤵PID:2028
-
\??\c:\flxfrlx.exec:\flxfrlx.exe120⤵PID:1532
-
\??\c:\ntbnhn.exec:\ntbnhn.exe121⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-