Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe
-
Size
452KB
-
MD5
791638acb24c6978a7e96a9f4eb9ee90
-
SHA1
435eedee2bc5e96377084dc3d2e35cff07879e9e
-
SHA256
7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708
-
SHA512
913e4ac0c8b7d87253c8b150ca0beeb01a0c3bed617b1cabe9fcea8ab8c8499d2492fc668a83b84fd9346b311a7638241003b1c39577cf0fd330dbb6e3992d0f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2684-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-186-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1896-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-737-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2260-957-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-1020-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1804-1033-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/564-1046-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2172-1133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-1275-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1636-1307-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1888-1356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 pjpjj.exe 2716 jpdpd.exe 2876 rflrxxl.exe 2740 7flllfl.exe 2788 vvvpv.exe 2140 hhhhbh.exe 2600 9jjjp.exe 2676 hhbtbh.exe 3060 1dpjj.exe 1680 rlflrlf.exe 1608 tnnbbt.exe 2988 vvvpj.exe 536 xfllrrf.exe 3064 dvjdj.exe 2664 flrrxxx.exe 2432 tnnntb.exe 2080 xfrrxfl.exe 592 nnttbb.exe 1252 fxxlllf.exe 2436 rllfxrr.exe 1956 pjjdd.exe 2192 tntnth.exe 1896 dvddd.exe 2028 nhhhhh.exe 2008 vppdd.exe 1716 btbbtt.exe 2292 jjppv.exe 2304 xxflrlr.exe 1220 bhtttn.exe 288 9lrlrll.exe 2548 hbbtnn.exe 2124 rlrllll.exe 1692 rfrrrrr.exe 2756 hbbtnn.exe 2872 jdjjj.exe 2820 rrlffxx.exe 2804 tntbbb.exe 2692 jjppv.exe 2788 ddjjj.exe 2884 9rrrxxf.exe 2636 5nbbbb.exe 2728 5bnttn.exe 320 5pddp.exe 2944 rrrrxll.exe 2376 hnhhbt.exe 1996 hbttbb.exe 2992 5pdpp.exe 1904 xxfllff.exe 2952 tbhbtt.exe 2372 ppvpv.exe 2904 ddjjv.exe 1276 xxfrlrl.exe 2420 nnbbhh.exe 2412 3jjdv.exe 2796 vjvdd.exe 1788 xrrflxx.exe 2560 tthhhh.exe 752 jdjdv.exe 2144 vvvpp.exe 2184 9xffffx.exe 2040 9ntbhh.exe 1640 vpjdv.exe 1960 vvvpp.exe 564 xrrllff.exe -
resource yara_rule behavioral1/memory/2684-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-165-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/592-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-594-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2568-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-737-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/824-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-1202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-1282-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1636-1307-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1888-1356-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2956 2684 7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe 30 PID 2684 wrote to memory of 2956 2684 7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe 30 PID 2684 wrote to memory of 2956 2684 7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe 30 PID 2684 wrote to memory of 2956 2684 7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe 30 PID 2956 wrote to memory of 2716 2956 pjpjj.exe 31 PID 2956 wrote to memory of 2716 2956 pjpjj.exe 31 PID 2956 wrote to memory of 2716 2956 pjpjj.exe 31 PID 2956 wrote to memory of 2716 2956 pjpjj.exe 31 PID 2716 wrote to memory of 2876 2716 jpdpd.exe 32 PID 2716 wrote to memory of 2876 2716 jpdpd.exe 32 PID 2716 wrote to memory of 2876 2716 jpdpd.exe 32 PID 2716 wrote to memory of 2876 2716 jpdpd.exe 32 PID 2876 wrote to memory of 2740 2876 rflrxxl.exe 33 PID 2876 wrote to memory of 2740 2876 rflrxxl.exe 33 PID 2876 wrote to memory of 2740 2876 rflrxxl.exe 33 PID 2876 wrote to memory of 2740 2876 rflrxxl.exe 33 PID 2740 wrote to memory of 2788 2740 7flllfl.exe 34 PID 2740 wrote to memory of 2788 2740 7flllfl.exe 34 PID 2740 wrote to memory of 2788 2740 7flllfl.exe 34 PID 2740 wrote to memory of 2788 2740 7flllfl.exe 34 PID 2788 wrote to memory of 2140 2788 vvvpv.exe 35 PID 2788 wrote to memory of 2140 2788 vvvpv.exe 35 PID 2788 wrote to memory of 2140 2788 vvvpv.exe 35 PID 2788 wrote to memory of 2140 2788 vvvpv.exe 35 PID 2140 wrote to memory of 2600 2140 hhhhbh.exe 36 PID 2140 wrote to memory of 2600 2140 hhhhbh.exe 36 PID 2140 wrote to memory of 2600 2140 hhhhbh.exe 36 PID 2140 wrote to memory of 2600 2140 hhhhbh.exe 36 PID 2600 wrote to memory of 2676 2600 9jjjp.exe 37 PID 2600 wrote to memory of 2676 2600 9jjjp.exe 37 PID 2600 wrote to memory of 2676 2600 9jjjp.exe 37 PID 2600 wrote to memory of 2676 2600 9jjjp.exe 37 PID 2676 wrote to memory of 3060 2676 hhbtbh.exe 38 PID 2676 wrote to memory of 3060 2676 hhbtbh.exe 38 PID 2676 wrote to memory of 3060 2676 hhbtbh.exe 38 PID 2676 wrote to memory of 3060 2676 hhbtbh.exe 38 PID 3060 wrote to memory of 1680 3060 1dpjj.exe 39 PID 3060 wrote to memory of 1680 3060 1dpjj.exe 39 PID 3060 wrote to memory of 1680 3060 1dpjj.exe 39 PID 3060 wrote to memory of 1680 3060 1dpjj.exe 39 PID 1680 wrote to memory of 1608 1680 rlflrlf.exe 40 PID 1680 wrote to memory of 1608 1680 rlflrlf.exe 40 PID 1680 wrote to memory of 1608 1680 rlflrlf.exe 40 PID 1680 wrote to memory of 1608 1680 rlflrlf.exe 40 PID 1608 wrote to memory of 2988 1608 tnnbbt.exe 41 PID 1608 wrote to memory of 2988 1608 tnnbbt.exe 41 PID 1608 wrote to memory of 2988 1608 tnnbbt.exe 41 PID 1608 wrote to memory of 2988 1608 tnnbbt.exe 41 PID 2988 wrote to memory of 536 2988 vvvpj.exe 42 PID 2988 wrote to memory of 536 2988 vvvpj.exe 42 PID 2988 wrote to memory of 536 2988 vvvpj.exe 42 PID 2988 wrote to memory of 536 2988 vvvpj.exe 42 PID 536 wrote to memory of 3064 536 xfllrrf.exe 43 PID 536 wrote to memory of 3064 536 xfllrrf.exe 43 PID 536 wrote to memory of 3064 536 xfllrrf.exe 43 PID 536 wrote to memory of 3064 536 xfllrrf.exe 43 PID 3064 wrote to memory of 2664 3064 dvjdj.exe 44 PID 3064 wrote to memory of 2664 3064 dvjdj.exe 44 PID 3064 wrote to memory of 2664 3064 dvjdj.exe 44 PID 3064 wrote to memory of 2664 3064 dvjdj.exe 44 PID 2664 wrote to memory of 2432 2664 flrrxxx.exe 45 PID 2664 wrote to memory of 2432 2664 flrrxxx.exe 45 PID 2664 wrote to memory of 2432 2664 flrrxxx.exe 45 PID 2664 wrote to memory of 2432 2664 flrrxxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe"C:\Users\Admin\AppData\Local\Temp\7bac2e79ee2f15773681b450edc0b847aefeaf78c8f970658b93af0da8ded708N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pjpjj.exec:\pjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jpdpd.exec:\jpdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rflrxxl.exec:\rflrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7flllfl.exec:\7flllfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vvvpv.exec:\vvvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hhhhbh.exec:\hhhhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\9jjjp.exec:\9jjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hhbtbh.exec:\hhbtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1dpjj.exec:\1dpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rlflrlf.exec:\rlflrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\tnnbbt.exec:\tnnbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\vvvpj.exec:\vvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\xfllrrf.exec:\xfllrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\dvjdj.exec:\dvjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\flrrxxx.exec:\flrrxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tnnntb.exec:\tnnntb.exe17⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe18⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nnttbb.exec:\nnttbb.exe19⤵
- Executes dropped EXE
PID:592 -
\??\c:\fxxlllf.exec:\fxxlllf.exe20⤵
- Executes dropped EXE
PID:1252 -
\??\c:\rllfxrr.exec:\rllfxrr.exe21⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pjjdd.exec:\pjjdd.exe22⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tntnth.exec:\tntnth.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dvddd.exec:\dvddd.exe24⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nhhhhh.exec:\nhhhhh.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vppdd.exec:\vppdd.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\btbbtt.exec:\btbbtt.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\jjppv.exec:\jjppv.exe28⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xxflrlr.exec:\xxflrlr.exe29⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bhtttn.exec:\bhtttn.exe30⤵
- Executes dropped EXE
PID:1220 -
\??\c:\9lrlrll.exec:\9lrlrll.exe31⤵
- Executes dropped EXE
PID:288 -
\??\c:\hbbtnn.exec:\hbbtnn.exe32⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rlrllll.exec:\rlrllll.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe34⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbbtnn.exec:\hbbtnn.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jdjjj.exec:\jdjjj.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rrlffxx.exec:\rrlffxx.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tntbbb.exec:\tntbbb.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jjppv.exec:\jjppv.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ddjjj.exec:\ddjjj.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9rrrxxf.exec:\9rrrxxf.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5nbbbb.exec:\5nbbbb.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5bnttn.exec:\5bnttn.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5pddp.exec:\5pddp.exe44⤵
- Executes dropped EXE
PID:320 -
\??\c:\rrrrxll.exec:\rrrrxll.exe45⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hnhhbt.exec:\hnhhbt.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hbttbb.exec:\hbttbb.exe47⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5pdpp.exec:\5pdpp.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xxfllff.exec:\xxfllff.exe49⤵
- Executes dropped EXE
PID:1904 -
\??\c:\tbhbtt.exec:\tbhbtt.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ppvpv.exec:\ppvpv.exe51⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ddjjv.exec:\ddjjv.exe52⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xxfrlrl.exec:\xxfrlrl.exe53⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nnbbhh.exec:\nnbbhh.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3jjdv.exec:\3jjdv.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vjvdd.exec:\vjvdd.exe56⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrrflxx.exec:\xrrflxx.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tthhhh.exec:\tthhhh.exe58⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jdjdv.exec:\jdjdv.exe59⤵
- Executes dropped EXE
PID:752 -
\??\c:\vvvpp.exec:\vvvpp.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9xffffx.exec:\9xffffx.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\9ntbhh.exec:\9ntbhh.exe62⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vpjdv.exec:\vpjdv.exe63⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvvpp.exec:\vvvpp.exe64⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrrllff.exec:\xrrllff.exe65⤵
- Executes dropped EXE
PID:564 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe66⤵PID:824
-
\??\c:\9nhhnn.exec:\9nhhnn.exe67⤵PID:1700
-
\??\c:\jjpdv.exec:\jjpdv.exe68⤵PID:1716
-
\??\c:\llrrrrl.exec:\llrrrrl.exe69⤵PID:2160
-
\??\c:\llrllff.exec:\llrllff.exe70⤵PID:1068
-
\??\c:\hhnhhh.exec:\hhnhhh.exe71⤵PID:1888
-
\??\c:\5vjdd.exec:\5vjdd.exe72⤵PID:1720
-
\??\c:\jdddd.exec:\jdddd.exe73⤵PID:2528
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe74⤵PID:468
-
\??\c:\lffxxrr.exec:\lffxxrr.exe75⤵PID:2548
-
\??\c:\1nhntn.exec:\1nhntn.exe76⤵PID:2516
-
\??\c:\3vdpj.exec:\3vdpj.exe77⤵PID:1480
-
\??\c:\jjjjj.exec:\jjjjj.exe78⤵PID:2760
-
\??\c:\frrrrrr.exec:\frrrrrr.exe79⤵PID:2828
-
\??\c:\nhnntn.exec:\nhnntn.exe80⤵PID:2612
-
\??\c:\9djdj.exec:\9djdj.exe81⤵PID:2892
-
\??\c:\ddvjj.exec:\ddvjj.exe82⤵PID:2968
-
\??\c:\lfrffxf.exec:\lfrffxf.exe83⤵PID:2776
-
\??\c:\bbbtbt.exec:\bbbtbt.exe84⤵PID:2884
-
\??\c:\hhhbbb.exec:\hhhbbb.exe85⤵PID:3052
-
\??\c:\5vdvp.exec:\5vdvp.exe86⤵PID:2096
-
\??\c:\3vjdj.exec:\3vjdj.exe87⤵PID:2024
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe88⤵PID:2568
-
\??\c:\3hbntt.exec:\3hbntt.exe89⤵PID:2376
-
\??\c:\vvddd.exec:\vvddd.exe90⤵PID:2148
-
\??\c:\9pjdp.exec:\9pjdp.exe91⤵PID:2992
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe92⤵PID:3068
-
\??\c:\tttbnb.exec:\tttbnb.exe93⤵PID:2180
-
\??\c:\nbhbbb.exec:\nbhbbb.exe94⤵PID:2704
-
\??\c:\5dvvv.exec:\5dvvv.exe95⤵PID:672
-
\??\c:\5rlffxf.exec:\5rlffxf.exe96⤵PID:2432
-
\??\c:\rrxflrr.exec:\rrxflrr.exe97⤵PID:648
-
\??\c:\nthhbh.exec:\nthhbh.exe98⤵PID:496
-
\??\c:\vjvvd.exec:\vjvvd.exe99⤵PID:592
-
\??\c:\ffffxxr.exec:\ffffxxr.exe100⤵PID:1192
-
\??\c:\rxfffrr.exec:\rxfffrr.exe101⤵PID:1512
-
\??\c:\bbhhtt.exec:\bbhhtt.exe102⤵PID:752
-
\??\c:\jpdjj.exec:\jpdjj.exe103⤵PID:2200
-
\??\c:\jpvvd.exec:\jpvvd.exe104⤵PID:2184
-
\??\c:\rxrxfff.exec:\rxrxfff.exe105⤵PID:2040
-
\??\c:\7nthhh.exec:\7nthhh.exe106⤵PID:1640
-
\??\c:\3dppp.exec:\3dppp.exe107⤵PID:1960
-
\??\c:\vvvpp.exec:\vvvpp.exe108⤵PID:1524
-
\??\c:\lrrflrr.exec:\lrrflrr.exe109⤵PID:824
-
\??\c:\hhtbhh.exec:\hhtbhh.exe110⤵PID:1592
-
\??\c:\htbbbt.exec:\htbbbt.exe111⤵PID:1716
-
\??\c:\vpvpp.exec:\vpvpp.exe112⤵PID:1268
-
\??\c:\5lxxffl.exec:\5lxxffl.exe113⤵PID:1068
-
\??\c:\5fxrxff.exec:\5fxrxff.exe114⤵PID:1888
-
\??\c:\nhtthh.exec:\nhtthh.exe115⤵PID:1720
-
\??\c:\ppvpv.exec:\ppvpv.exe116⤵PID:2528
-
\??\c:\djpjp.exec:\djpjp.exe117⤵PID:1656
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe118⤵PID:1992
-
\??\c:\nbntbh.exec:\nbntbh.exe119⤵PID:1416
-
\??\c:\bnbttt.exec:\bnbttt.exe120⤵PID:1480
-
\??\c:\jdvpp.exec:\jdvpp.exe121⤵PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-