Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe
-
Size
453KB
-
MD5
7f36f13f2aa2a43da3458c44b3f19b40
-
SHA1
d6a5964b07bd3d3cca415aa8b7547a3ad17b751a
-
SHA256
2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867
-
SHA512
13ee582fd27bcda4cdf06d5f7fb6df521aa2bea0cb57370dad11f4e9a3f46c0448517cb9fec4d41482af1398d0f1757a4f2dce8ac1b30951e5e5f9164d2f3b3e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2696-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-93-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-169-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1612-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-392-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-399-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/388-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-527-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1252-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-708-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-775-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1872-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-942-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-1111-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2948-1295-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 3vpjd.exe 1128 rrlxrxr.exe 1376 fffffll.exe 2348 jppjv.exe 2856 rlxflxr.exe 2768 vddpp.exe 2336 jddjd.exe 2720 ppjpv.exe 2732 rxrflrl.exe 2648 nnntth.exe 2472 pdvdp.exe 1524 9xlflfx.exe 1668 9jvvv.exe 1708 xxflxxl.exe 2432 nhtbnb.exe 1540 lfrflxf.exe 2024 7hhhhh.exe 1920 tbnnnb.exe 1612 frlrxxf.exe 2484 jdpjj.exe 2944 lfxfrxl.exe 696 bthnnn.exe 1808 5btntb.exe 1452 1rrfxxr.exe 2464 tnthhh.exe 108 ppdjv.exe 2256 1rxxxfr.exe 1744 vdvjd.exe 2440 rrfxflx.exe 2360 dvjpv.exe 1636 lfllrxl.exe 2396 nnhnbn.exe 3044 dvjpv.exe 2104 flflfll.exe 2420 thbbhh.exe 2964 5pdjv.exe 2540 xlllxfl.exe 2844 nhthnt.exe 2908 1hhntt.exe 2724 5jjvj.exe 2768 1xffrlf.exe 2924 nhtbnn.exe 2336 1httbb.exe 2720 dvddd.exe 2636 xrflllf.exe 2668 1lrrrrf.exe 3064 1nbthn.exe 388 dvpvj.exe 1216 5xllrxx.exe 2148 bthhtt.exe 2076 bbbntb.exe 2436 3jvvv.exe 1772 frllxrx.exe 1608 9httbh.exe 2028 hbnthb.exe 1040 5vpvd.exe 576 vvjpp.exe 2676 xrrrrrx.exe 596 3nbntt.exe 1692 tbttbb.exe 1916 3pddp.exe 1516 xrlxlrr.exe 1456 rrlxfxl.exe 1328 hnhhnn.exe -
resource yara_rule behavioral1/memory/2696-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-148-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1540-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-167-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/2484-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-392-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/388-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-527-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1252-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-1007-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-1302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-1327-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2916 2696 2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe 30 PID 2696 wrote to memory of 2916 2696 2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe 30 PID 2696 wrote to memory of 2916 2696 2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe 30 PID 2696 wrote to memory of 2916 2696 2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe 30 PID 2916 wrote to memory of 1128 2916 3vpjd.exe 31 PID 2916 wrote to memory of 1128 2916 3vpjd.exe 31 PID 2916 wrote to memory of 1128 2916 3vpjd.exe 31 PID 2916 wrote to memory of 1128 2916 3vpjd.exe 31 PID 1128 wrote to memory of 1376 1128 rrlxrxr.exe 32 PID 1128 wrote to memory of 1376 1128 rrlxrxr.exe 32 PID 1128 wrote to memory of 1376 1128 rrlxrxr.exe 32 PID 1128 wrote to memory of 1376 1128 rrlxrxr.exe 32 PID 1376 wrote to memory of 2348 1376 fffffll.exe 33 PID 1376 wrote to memory of 2348 1376 fffffll.exe 33 PID 1376 wrote to memory of 2348 1376 fffffll.exe 33 PID 1376 wrote to memory of 2348 1376 fffffll.exe 33 PID 2348 wrote to memory of 2856 2348 jppjv.exe 34 PID 2348 wrote to memory of 2856 2348 jppjv.exe 34 PID 2348 wrote to memory of 2856 2348 jppjv.exe 34 PID 2348 wrote to memory of 2856 2348 jppjv.exe 34 PID 2856 wrote to memory of 2768 2856 rlxflxr.exe 35 PID 2856 wrote to memory of 2768 2856 rlxflxr.exe 35 PID 2856 wrote to memory of 2768 2856 rlxflxr.exe 35 PID 2856 wrote to memory of 2768 2856 rlxflxr.exe 35 PID 2768 wrote to memory of 2336 2768 vddpp.exe 36 PID 2768 wrote to memory of 2336 2768 vddpp.exe 36 PID 2768 wrote to memory of 2336 2768 vddpp.exe 36 PID 2768 wrote to memory of 2336 2768 vddpp.exe 36 PID 2336 wrote to memory of 2720 2336 jddjd.exe 37 PID 2336 wrote to memory of 2720 2336 jddjd.exe 37 PID 2336 wrote to memory of 2720 2336 jddjd.exe 37 PID 2336 wrote to memory of 2720 2336 jddjd.exe 37 PID 2720 wrote to memory of 2732 2720 ppjpv.exe 38 PID 2720 wrote to memory of 2732 2720 ppjpv.exe 38 PID 2720 wrote to memory of 2732 2720 ppjpv.exe 38 PID 2720 wrote to memory of 2732 2720 ppjpv.exe 38 PID 2732 wrote to memory of 2648 2732 rxrflrl.exe 39 PID 2732 wrote to memory of 2648 2732 rxrflrl.exe 39 PID 2732 wrote to memory of 2648 2732 rxrflrl.exe 39 PID 2732 wrote to memory of 2648 2732 rxrflrl.exe 39 PID 2648 wrote to memory of 2472 2648 nnntth.exe 40 PID 2648 wrote to memory of 2472 2648 nnntth.exe 40 PID 2648 wrote to memory of 2472 2648 nnntth.exe 40 PID 2648 wrote to memory of 2472 2648 nnntth.exe 40 PID 2472 wrote to memory of 1524 2472 pdvdp.exe 41 PID 2472 wrote to memory of 1524 2472 pdvdp.exe 41 PID 2472 wrote to memory of 1524 2472 pdvdp.exe 41 PID 2472 wrote to memory of 1524 2472 pdvdp.exe 41 PID 1524 wrote to memory of 1668 1524 9xlflfx.exe 42 PID 1524 wrote to memory of 1668 1524 9xlflfx.exe 42 PID 1524 wrote to memory of 1668 1524 9xlflfx.exe 42 PID 1524 wrote to memory of 1668 1524 9xlflfx.exe 42 PID 1668 wrote to memory of 1708 1668 9jvvv.exe 43 PID 1668 wrote to memory of 1708 1668 9jvvv.exe 43 PID 1668 wrote to memory of 1708 1668 9jvvv.exe 43 PID 1668 wrote to memory of 1708 1668 9jvvv.exe 43 PID 1708 wrote to memory of 2432 1708 xxflxxl.exe 44 PID 1708 wrote to memory of 2432 1708 xxflxxl.exe 44 PID 1708 wrote to memory of 2432 1708 xxflxxl.exe 44 PID 1708 wrote to memory of 2432 1708 xxflxxl.exe 44 PID 2432 wrote to memory of 1540 2432 nhtbnb.exe 45 PID 2432 wrote to memory of 1540 2432 nhtbnb.exe 45 PID 2432 wrote to memory of 1540 2432 nhtbnb.exe 45 PID 2432 wrote to memory of 1540 2432 nhtbnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe"C:\Users\Admin\AppData\Local\Temp\2cc950ee1a73bd99739406309befec41b994084048a1a44cfb1c8b7df045d867N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3vpjd.exec:\3vpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rrlxrxr.exec:\rrlxrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\fffffll.exec:\fffffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\jppjv.exec:\jppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rlxflxr.exec:\rlxflxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vddpp.exec:\vddpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jddjd.exec:\jddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\ppjpv.exec:\ppjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rxrflrl.exec:\rxrflrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nnntth.exec:\nnntth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pdvdp.exec:\pdvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\9xlflfx.exec:\9xlflfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\9jvvv.exec:\9jvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\xxflxxl.exec:\xxflxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\nhtbnb.exec:\nhtbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\lfrflxf.exec:\lfrflxf.exe17⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7hhhhh.exec:\7hhhhh.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tbnnnb.exec:\tbnnnb.exe19⤵
- Executes dropped EXE
PID:1920 -
\??\c:\frlrxxf.exec:\frlrxxf.exe20⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jdpjj.exec:\jdpjj.exe21⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe22⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bthnnn.exec:\bthnnn.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\5btntb.exec:\5btntb.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1rrfxxr.exec:\1rrfxxr.exe25⤵
- Executes dropped EXE
PID:1452 -
\??\c:\tnthhh.exec:\tnthhh.exe26⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ppdjv.exec:\ppdjv.exe27⤵
- Executes dropped EXE
PID:108 -
\??\c:\1rxxxfr.exec:\1rxxxfr.exe28⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vdvjd.exec:\vdvjd.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rrfxflx.exec:\rrfxflx.exe30⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dvjpv.exec:\dvjpv.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lfllrxl.exec:\lfllrxl.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nnhnbn.exec:\nnhnbn.exe33⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dvjpv.exec:\dvjpv.exe34⤵
- Executes dropped EXE
PID:3044 -
\??\c:\flflfll.exec:\flflfll.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\thbbhh.exec:\thbbhh.exe36⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5pdjv.exec:\5pdjv.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\xlllxfl.exec:\xlllxfl.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nhthnt.exec:\nhthnt.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1hhntt.exec:\1hhntt.exe40⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5jjvj.exec:\5jjvj.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1xffrlf.exec:\1xffrlf.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhtbnn.exec:\nhtbnn.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1httbb.exec:\1httbb.exe44⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dvddd.exec:\dvddd.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xrflllf.exec:\xrflllf.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1lrrrrf.exec:\1lrrrrf.exe47⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1nbthn.exec:\1nbthn.exe48⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dvpvj.exec:\dvpvj.exe49⤵
- Executes dropped EXE
PID:388 -
\??\c:\5xllrxx.exec:\5xllrxx.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\bthhtt.exec:\bthhtt.exe51⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bbbntb.exec:\bbbntb.exe52⤵
- Executes dropped EXE
PID:2076 -
\??\c:\3jvvv.exec:\3jvvv.exe53⤵
- Executes dropped EXE
PID:2436 -
\??\c:\frllxrx.exec:\frllxrx.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
\??\c:\9httbh.exec:\9httbh.exe55⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbnthb.exec:\hbnthb.exe56⤵
- Executes dropped EXE
PID:2028 -
\??\c:\5vpvd.exec:\5vpvd.exe57⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vvjpp.exec:\vvjpp.exe58⤵
- Executes dropped EXE
PID:576 -
\??\c:\xrrrrrx.exec:\xrrrrrx.exe59⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3nbntt.exec:\3nbntt.exe60⤵
- Executes dropped EXE
PID:596 -
\??\c:\tbttbb.exec:\tbttbb.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3pddp.exec:\3pddp.exe62⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xrlxlrr.exec:\xrlxlrr.exe63⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rrlxfxl.exec:\rrlxfxl.exe64⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hnhhnn.exec:\hnhhnn.exe65⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jjpdp.exec:\jjpdp.exe66⤵PID:1232
-
\??\c:\dpppv.exec:\dpppv.exe67⤵PID:1428
-
\??\c:\flffflr.exec:\flffflr.exe68⤵PID:2464
-
\??\c:\hhttbb.exec:\hhttbb.exe69⤵PID:1544
-
\??\c:\vdpvd.exec:\vdpvd.exe70⤵PID:1728
-
\??\c:\7pjpp.exec:\7pjpp.exe71⤵PID:372
-
\??\c:\xflrlff.exec:\xflrlff.exe72⤵PID:1252
-
\??\c:\ttbhtb.exec:\ttbhtb.exe73⤵PID:708
-
\??\c:\vvppd.exec:\vvppd.exe74⤵PID:2360
-
\??\c:\9vjjp.exec:\9vjjp.exe75⤵PID:2068
-
\??\c:\3fxflrf.exec:\3fxflrf.exe76⤵PID:2124
-
\??\c:\bnhhhb.exec:\bnhhhb.exe77⤵PID:3068
-
\??\c:\tttttb.exec:\tttttb.exe78⤵PID:1504
-
\??\c:\dvjdp.exec:\dvjdp.exe79⤵
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\xrllxxl.exec:\xrllxxl.exe80⤵PID:2108
-
\??\c:\xrlxffr.exec:\xrlxffr.exe81⤵PID:2920
-
\??\c:\5thnnn.exec:\5thnnn.exe82⤵PID:1936
-
\??\c:\vvvdp.exec:\vvvdp.exe83⤵PID:2240
-
\??\c:\dpjdj.exec:\dpjdj.exe84⤵PID:2852
-
\??\c:\rfrrflx.exec:\rfrrflx.exe85⤵PID:2908
-
\??\c:\tnbbnn.exec:\tnbbnn.exe86⤵
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\hbtbhh.exec:\hbtbhh.exe87⤵PID:2812
-
\??\c:\1pvdv.exec:\1pvdv.exe88⤵PID:2652
-
\??\c:\fxxflrf.exec:\fxxflrf.exe89⤵PID:2872
-
\??\c:\7tnbht.exec:\7tnbht.exe90⤵PID:2720
-
\??\c:\hhhtnb.exec:\hhhtnb.exe91⤵PID:2648
-
\??\c:\jdvpj.exec:\jdvpj.exe92⤵PID:2072
-
\??\c:\7lfrrfx.exec:\7lfrrfx.exe93⤵PID:2516
-
\??\c:\lfflrrl.exec:\lfflrrl.exe94⤵PID:1584
-
\??\c:\1bbnbt.exec:\1bbnbt.exe95⤵PID:944
-
\??\c:\vvdvp.exec:\vvdvp.exe96⤵PID:1216
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe97⤵PID:1536
-
\??\c:\lffxxrl.exec:\lffxxrl.exe98⤵PID:2036
-
\??\c:\htbnhb.exec:\htbnhb.exe99⤵PID:1528
-
\??\c:\vddvp.exec:\vddvp.exe100⤵PID:1684
-
\??\c:\9ddpd.exec:\9ddpd.exe101⤵PID:2052
-
\??\c:\7rrfxll.exec:\7rrfxll.exe102⤵PID:808
-
\??\c:\hnthbt.exec:\hnthbt.exe103⤵PID:1040
-
\??\c:\nnbnbn.exec:\nnbnbn.exe104⤵PID:576
-
\??\c:\jppdp.exec:\jppdp.exe105⤵PID:2676
-
\??\c:\7xlxrll.exec:\7xlxrll.exe106⤵PID:596
-
\??\c:\thhhth.exec:\thhhth.exe107⤵PID:1692
-
\??\c:\7btbtb.exec:\7btbtb.exe108⤵PID:1872
-
\??\c:\jvjpj.exec:\jvjpj.exe109⤵PID:1516
-
\??\c:\9rxlxfx.exec:\9rxlxfx.exe110⤵PID:1960
-
\??\c:\hthtnb.exec:\hthtnb.exe111⤵PID:1452
-
\??\c:\hhbnhn.exec:\hhbnhn.exe112⤵PID:1760
-
\??\c:\pdvpv.exec:\pdvpv.exe113⤵PID:2212
-
\??\c:\xxxfrxx.exec:\xxxfrxx.exe114⤵PID:916
-
\??\c:\5fflxfr.exec:\5fflxfr.exe115⤵PID:2384
-
\??\c:\tttbnt.exec:\tttbnt.exe116⤵PID:1728
-
\??\c:\ppjpj.exec:\ppjpj.exe117⤵PID:2404
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe118⤵
- System Location Discovery: System Language Discovery
PID:1852 -
\??\c:\1ffrxfx.exec:\1ffrxfx.exe119⤵PID:1888
-
\??\c:\btttnb.exec:\btttnb.exe120⤵PID:2360
-
\??\c:\5jvdv.exec:\5jvdv.exe121⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-