Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe
-
Size
454KB
-
MD5
0a89748e243f601b1128f7725b4944d0
-
SHA1
12f2e4a1b67e1ce2375f8b866e36c8a49dab3ca1
-
SHA256
7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046
-
SHA512
63ce7a9b8fa0282cf377a18124ad4604a4c29ed06cf9cb0d4aaa8cbfb9c9d776b7e2cc296612de9f1545b1ee754a9e39745e0664e65f01062f4eb2c680e2a257
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1WH:q7Tc2NYHUrAwfMp3CD1WH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3300-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 408 3dvjd.exe 180 5nbtnt.exe 1496 3jdpp.exe 1020 9jjvp.exe 1608 fllfrrl.exe 4600 7dpjv.exe 620 xfxlxrf.exe 4480 jppjv.exe 364 btthnh.exe 2380 tnhtnh.exe 2764 5flxllx.exe 2744 5bttnt.exe 2448 djpdp.exe 2584 htnbth.exe 1820 fllxrlx.exe 1228 1frrllf.exe 1868 vvjdj.exe 628 5nnbbb.exe 1976 dvpvp.exe 3244 9xxlfxr.exe 4656 tnnhbt.exe 3980 lflrrff.exe 792 htnbnb.exe 1372 pppdv.exe 4616 thbnbh.exe 3324 7pdpd.exe 460 flrlxrl.exe 3228 fffrfxl.exe 2940 nnnhnh.exe 5108 llxrfxl.exe 5068 thbnbt.exe 676 dddpd.exe 2436 lflxxll.exe 3032 xxrlxxl.exe 3292 ntbthb.exe 3084 jvdvd.exe 4204 xrflxlf.exe 2168 llrxxrl.exe 3464 btbnhh.exe 1580 9jjjv.exe 1928 rflfrrr.exe 2180 htnbnh.exe 3484 hhhbhh.exe 208 5pjvj.exe 4452 lrxfrlf.exe 3524 5lfrfxr.exe 4872 9nnbbn.exe 388 pjjdv.exe 3284 1rxllfx.exe 2412 hbhbtt.exe 3068 dvvpd.exe 4488 5lrflfr.exe 3088 hhbnht.exe 3300 nbbttt.exe 408 jvpvj.exe 180 rrfxfxr.exe 3024 tthbtb.exe 1528 jjpjv.exe 4512 rlfrfxl.exe 2948 rxrfxrl.exe 3540 httnhb.exe 4600 dvvpd.exe 1100 vvvpj.exe 3964 1xllflf.exe -
resource yara_rule behavioral2/memory/3300-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-649-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3300 wrote to memory of 408 3300 7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe 82 PID 3300 wrote to memory of 408 3300 7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe 82 PID 3300 wrote to memory of 408 3300 7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe 82 PID 408 wrote to memory of 180 408 3dvjd.exe 83 PID 408 wrote to memory of 180 408 3dvjd.exe 83 PID 408 wrote to memory of 180 408 3dvjd.exe 83 PID 180 wrote to memory of 1496 180 5nbtnt.exe 84 PID 180 wrote to memory of 1496 180 5nbtnt.exe 84 PID 180 wrote to memory of 1496 180 5nbtnt.exe 84 PID 1496 wrote to memory of 1020 1496 3jdpp.exe 85 PID 1496 wrote to memory of 1020 1496 3jdpp.exe 85 PID 1496 wrote to memory of 1020 1496 3jdpp.exe 85 PID 1020 wrote to memory of 1608 1020 9jjvp.exe 86 PID 1020 wrote to memory of 1608 1020 9jjvp.exe 86 PID 1020 wrote to memory of 1608 1020 9jjvp.exe 86 PID 1608 wrote to memory of 4600 1608 fllfrrl.exe 87 PID 1608 wrote to memory of 4600 1608 fllfrrl.exe 87 PID 1608 wrote to memory of 4600 1608 fllfrrl.exe 87 PID 4600 wrote to memory of 620 4600 7dpjv.exe 88 PID 4600 wrote to memory of 620 4600 7dpjv.exe 88 PID 4600 wrote to memory of 620 4600 7dpjv.exe 88 PID 620 wrote to memory of 4480 620 xfxlxrf.exe 89 PID 620 wrote to memory of 4480 620 xfxlxrf.exe 89 PID 620 wrote to memory of 4480 620 xfxlxrf.exe 89 PID 4480 wrote to memory of 364 4480 jppjv.exe 90 PID 4480 wrote to memory of 364 4480 jppjv.exe 90 PID 4480 wrote to memory of 364 4480 jppjv.exe 90 PID 364 wrote to memory of 2380 364 btthnh.exe 91 PID 364 wrote to memory of 2380 364 btthnh.exe 91 PID 364 wrote to memory of 2380 364 btthnh.exe 91 PID 2380 wrote to memory of 2764 2380 tnhtnh.exe 92 PID 2380 wrote to memory of 2764 2380 tnhtnh.exe 92 PID 2380 wrote to memory of 2764 2380 tnhtnh.exe 92 PID 2764 wrote to memory of 2744 2764 5flxllx.exe 93 PID 2764 wrote to memory of 2744 2764 5flxllx.exe 93 PID 2764 wrote to memory of 2744 2764 5flxllx.exe 93 PID 2744 wrote to memory of 2448 2744 5bttnt.exe 94 PID 2744 wrote to memory of 2448 2744 5bttnt.exe 94 PID 2744 wrote to memory of 2448 2744 5bttnt.exe 94 PID 2448 wrote to memory of 2584 2448 djpdp.exe 95 PID 2448 wrote to memory of 2584 2448 djpdp.exe 95 PID 2448 wrote to memory of 2584 2448 djpdp.exe 95 PID 2584 wrote to memory of 1820 2584 htnbth.exe 96 PID 2584 wrote to memory of 1820 2584 htnbth.exe 96 PID 2584 wrote to memory of 1820 2584 htnbth.exe 96 PID 1820 wrote to memory of 1228 1820 fllxrlx.exe 97 PID 1820 wrote to memory of 1228 1820 fllxrlx.exe 97 PID 1820 wrote to memory of 1228 1820 fllxrlx.exe 97 PID 1228 wrote to memory of 1868 1228 1frrllf.exe 98 PID 1228 wrote to memory of 1868 1228 1frrllf.exe 98 PID 1228 wrote to memory of 1868 1228 1frrllf.exe 98 PID 1868 wrote to memory of 628 1868 vvjdj.exe 99 PID 1868 wrote to memory of 628 1868 vvjdj.exe 99 PID 1868 wrote to memory of 628 1868 vvjdj.exe 99 PID 628 wrote to memory of 1976 628 5nnbbb.exe 100 PID 628 wrote to memory of 1976 628 5nnbbb.exe 100 PID 628 wrote to memory of 1976 628 5nnbbb.exe 100 PID 1976 wrote to memory of 3244 1976 dvpvp.exe 101 PID 1976 wrote to memory of 3244 1976 dvpvp.exe 101 PID 1976 wrote to memory of 3244 1976 dvpvp.exe 101 PID 3244 wrote to memory of 4656 3244 9xxlfxr.exe 102 PID 3244 wrote to memory of 4656 3244 9xxlfxr.exe 102 PID 3244 wrote to memory of 4656 3244 9xxlfxr.exe 102 PID 4656 wrote to memory of 3980 4656 tnnhbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe"C:\Users\Admin\AppData\Local\Temp\7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\3dvjd.exec:\3dvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\5nbtnt.exec:\5nbtnt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:180 -
\??\c:\3jdpp.exec:\3jdpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\9jjvp.exec:\9jjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\fllfrrl.exec:\fllfrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\7dpjv.exec:\7dpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\xfxlxrf.exec:\xfxlxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\jppjv.exec:\jppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\btthnh.exec:\btthnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\tnhtnh.exec:\tnhtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\5flxllx.exec:\5flxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5bttnt.exec:\5bttnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\djpdp.exec:\djpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\htnbth.exec:\htnbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\fllxrlx.exec:\fllxrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\1frrllf.exec:\1frrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\vvjdj.exec:\vvjdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\5nnbbb.exec:\5nnbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\dvpvp.exec:\dvpvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\9xxlfxr.exec:\9xxlfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\tnnhbt.exec:\tnnhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\lflrrff.exec:\lflrrff.exe23⤵
- Executes dropped EXE
PID:3980 -
\??\c:\htnbnb.exec:\htnbnb.exe24⤵
- Executes dropped EXE
PID:792 -
\??\c:\pppdv.exec:\pppdv.exe25⤵
- Executes dropped EXE
PID:1372 -
\??\c:\thbnbh.exec:\thbnbh.exe26⤵
- Executes dropped EXE
PID:4616 -
\??\c:\7pdpd.exec:\7pdpd.exe27⤵
- Executes dropped EXE
PID:3324 -
\??\c:\flrlxrl.exec:\flrlxrl.exe28⤵
- Executes dropped EXE
PID:460 -
\??\c:\fffrfxl.exec:\fffrfxl.exe29⤵
- Executes dropped EXE
PID:3228 -
\??\c:\nnnhnh.exec:\nnnhnh.exe30⤵
- Executes dropped EXE
PID:2940 -
\??\c:\llxrfxl.exec:\llxrfxl.exe31⤵
- Executes dropped EXE
PID:5108 -
\??\c:\thbnbt.exec:\thbnbt.exe32⤵
- Executes dropped EXE
PID:5068 -
\??\c:\dddpd.exec:\dddpd.exe33⤵
- Executes dropped EXE
PID:676 -
\??\c:\lflxxll.exec:\lflxxll.exe34⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ntbthb.exec:\ntbthb.exe36⤵
- Executes dropped EXE
PID:3292 -
\??\c:\jvdvd.exec:\jvdvd.exe37⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xrflxlf.exec:\xrflxlf.exe38⤵
- Executes dropped EXE
PID:4204 -
\??\c:\llrxxrl.exec:\llrxxrl.exe39⤵
- Executes dropped EXE
PID:2168 -
\??\c:\btbnhh.exec:\btbnhh.exe40⤵
- Executes dropped EXE
PID:3464 -
\??\c:\9jjjv.exec:\9jjjv.exe41⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rflfrrr.exec:\rflfrrr.exe42⤵
- Executes dropped EXE
PID:1928 -
\??\c:\htnbnh.exec:\htnbnh.exe43⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hhhbhh.exec:\hhhbhh.exe44⤵
- Executes dropped EXE
PID:3484 -
\??\c:\5pjvj.exec:\5pjvj.exe45⤵
- Executes dropped EXE
PID:208 -
\??\c:\lrxfrlf.exec:\lrxfrlf.exe46⤵
- Executes dropped EXE
PID:4452 -
\??\c:\5lfrfxr.exec:\5lfrfxr.exe47⤵
- Executes dropped EXE
PID:3524 -
\??\c:\9nnbbn.exec:\9nnbbn.exe48⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pjjdv.exec:\pjjdv.exe49⤵
- Executes dropped EXE
PID:388 -
\??\c:\1rxllfx.exec:\1rxllfx.exe50⤵
- Executes dropped EXE
PID:3284 -
\??\c:\hbhbtt.exec:\hbhbtt.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dvvpd.exec:\dvvpd.exe52⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5lrflfr.exec:\5lrflfr.exe53⤵
- Executes dropped EXE
PID:4488 -
\??\c:\hhbnht.exec:\hhbnht.exe54⤵
- Executes dropped EXE
PID:3088 -
\??\c:\nbbttt.exec:\nbbttt.exe55⤵
- Executes dropped EXE
PID:3300 -
\??\c:\jvpvj.exec:\jvpvj.exe56⤵
- Executes dropped EXE
PID:408 -
\??\c:\rrfxfxr.exec:\rrfxfxr.exe57⤵
- Executes dropped EXE
PID:180 -
\??\c:\tthbtb.exec:\tthbtb.exe58⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jjpjv.exec:\jjpjv.exe59⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe60⤵
- Executes dropped EXE
PID:4512 -
\??\c:\rxrfxrl.exec:\rxrfxrl.exe61⤵
- Executes dropped EXE
PID:2948 -
\??\c:\httnhb.exec:\httnhb.exe62⤵
- Executes dropped EXE
PID:3540 -
\??\c:\dvvpd.exec:\dvvpd.exe63⤵
- Executes dropped EXE
PID:4600 -
\??\c:\vvvpj.exec:\vvvpj.exe64⤵
- Executes dropped EXE
PID:1100 -
\??\c:\1xllflf.exec:\1xllflf.exe65⤵
- Executes dropped EXE
PID:3964 -
\??\c:\nbtbnh.exec:\nbtbnh.exe66⤵PID:4668
-
\??\c:\jdjdv.exec:\jdjdv.exe67⤵PID:3104
-
\??\c:\3xrfrrf.exec:\3xrfrrf.exe68⤵PID:1156
-
\??\c:\7llfxrl.exec:\7llfxrl.exe69⤵PID:1352
-
\??\c:\hbhbbt.exec:\hbhbbt.exe70⤵PID:3736
-
\??\c:\pvddp.exec:\pvddp.exe71⤵PID:2744
-
\??\c:\rllfxrr.exec:\rllfxrr.exe72⤵PID:3372
-
\??\c:\thhbtn.exec:\thhbtn.exe73⤵PID:848
-
\??\c:\dvvpj.exec:\dvvpj.exe74⤵
- System Location Discovery: System Language Discovery
PID:396 -
\??\c:\pdvvj.exec:\pdvvj.exe75⤵PID:5064
-
\??\c:\7rlxrlx.exec:\7rlxrlx.exe76⤵PID:3164
-
\??\c:\ttnhtt.exec:\ttnhtt.exe77⤵PID:4200
-
\??\c:\pdjvv.exec:\pdjvv.exe78⤵PID:3644
-
\??\c:\lfllffx.exec:\lfllffx.exe79⤵PID:3112
-
\??\c:\7hhhbb.exec:\7hhhbb.exe80⤵
- System Location Discovery: System Language Discovery
PID:4328 -
\??\c:\3ddpp.exec:\3ddpp.exe81⤵PID:628
-
\??\c:\7rlrfrl.exec:\7rlrfrl.exe82⤵PID:4964
-
\??\c:\nbthbt.exec:\nbthbt.exe83⤵PID:4444
-
\??\c:\dvjdd.exec:\dvjdd.exe84⤵PID:4252
-
\??\c:\fxfxlll.exec:\fxfxlll.exe85⤵PID:2320
-
\??\c:\bhtbnt.exec:\bhtbnt.exe86⤵PID:3980
-
\??\c:\vjdpp.exec:\vjdpp.exe87⤵PID:1144
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe88⤵PID:3052
-
\??\c:\bbtnbt.exec:\bbtnbt.exe89⤵PID:2184
-
\??\c:\nbtnbb.exec:\nbtnbb.exe90⤵PID:2252
-
\??\c:\jpppd.exec:\jpppd.exe91⤵PID:4720
-
\??\c:\xfxlrxl.exec:\xfxlrxl.exe92⤵PID:2644
-
\??\c:\7ntnnt.exec:\7ntnnt.exe93⤵PID:4240
-
\??\c:\7hhtnh.exec:\7hhtnh.exe94⤵PID:4688
-
\??\c:\pjdvp.exec:\pjdvp.exe95⤵PID:3352
-
\??\c:\rfrflrf.exec:\rfrflrf.exe96⤵PID:4016
-
\??\c:\1hbnbt.exec:\1hbnbt.exe97⤵PID:3704
-
\??\c:\thnhhb.exec:\thnhhb.exe98⤵PID:3900
-
\??\c:\vjvpd.exec:\vjvpd.exe99⤵
- System Location Discovery: System Language Discovery
PID:1980 -
\??\c:\xlfxllf.exec:\xlfxllf.exe100⤵PID:1468
-
\??\c:\thbhbh.exec:\thbhbh.exe101⤵PID:3852
-
\??\c:\vvvpd.exec:\vvvpd.exe102⤵PID:452
-
\??\c:\ppjdv.exec:\ppjdv.exe103⤵PID:5104
-
\??\c:\frrfrlx.exec:\frrfrlx.exe104⤵PID:3084
-
\??\c:\nttnbt.exec:\nttnbt.exe105⤵PID:4204
-
\??\c:\3nhbnh.exec:\3nhbnh.exe106⤵PID:2168
-
\??\c:\jvdpd.exec:\jvdpd.exe107⤵PID:3456
-
\??\c:\lffrxxl.exec:\lffrxxl.exe108⤵PID:1580
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe109⤵PID:3724
-
\??\c:\ntthtn.exec:\ntthtn.exe110⤵PID:4704
-
\??\c:\pjjdj.exec:\pjjdj.exe111⤵PID:4404
-
\??\c:\xrllxxl.exec:\xrllxxl.exe112⤵PID:3536
-
\??\c:\btnhbt.exec:\btnhbt.exe113⤵PID:4124
-
\??\c:\jvvjd.exec:\jvvjd.exe114⤵PID:2952
-
\??\c:\lffrlrl.exec:\lffrlrl.exe115⤵PID:3904
-
\??\c:\ntbbtn.exec:\ntbbtn.exe116⤵PID:4872
-
\??\c:\1dvdp.exec:\1dvdp.exe117⤵PID:5088
-
\??\c:\pdjjd.exec:\pdjjd.exe118⤵PID:2736
-
\??\c:\5hbbnn.exec:\5hbbnn.exe119⤵PID:3688
-
\??\c:\nbbnbt.exec:\nbbnbt.exe120⤵PID:4696
-
\??\c:\pjvdd.exec:\pjvdd.exe121⤵PID:3516
-
\??\c:\xlrffxr.exec:\xlrffxr.exe122⤵PID:1116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-