Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe
-
Size
454KB
-
MD5
3d0c3ede265f4941fe4e5f167541b992
-
SHA1
d26ace4e53a45ea92ba1155d2b01c67ffa19c327
-
SHA256
00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7
-
SHA512
b3c52103b699c67c26432baf4b84dbb5aab6e7bf6d28bfbea438aa629cd1b4272ead9243f8e0392dca9ef9529731299e93900aa873040758595154b7c922411f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbej:q7Tc2NYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-186-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1900-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-234-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/920-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-319-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-643-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-663-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-807-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2460-822-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2952-820-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 pjvdj.exe 2920 9bbbnt.exe 2824 3jdjj.exe 2556 nnbhnn.exe 2816 9xlllrl.exe 2604 thhntb.exe 3024 ppvdp.exe 1120 frfxllr.exe 2900 bbnnbb.exe 1896 5djdj.exe 604 llxrxxf.exe 1448 vjvpv.exe 2620 rlxxllx.exe 2004 1jvvv.exe 2720 5jjjj.exe 328 thbhnb.exe 1688 jvpvd.exe 2944 thtbhh.exe 1900 1hbthb.exe 2236 fxlxflr.exe 444 9rfxxxf.exe 1952 5vvvd.exe 1864 frxrffx.exe 920 jvvdd.exe 2508 rlxxrxx.exe 2444 5vddd.exe 2964 9xxffrr.exe 1556 nhnnnh.exe 904 vjvvd.exe 2460 nhttbb.exe 2928 pjvjv.exe 2540 9xrflrl.exe 2668 5bnntt.exe 2840 jdvpv.exe 2676 frfflrf.exe 2528 9bnhhb.exe 2816 jvddd.exe 2604 1vvdd.exe 2584 rfxfllf.exe 2760 7nbbbt.exe 2988 htnttt.exe 1416 vpvpv.exe 2104 7flffff.exe 2052 nnbntb.exe 760 bththh.exe 1624 jjvdd.exe 1636 lfrrxrf.exe 2764 9xrlrrx.exe 2732 bhttbt.exe 1252 5pjpp.exe 1108 5xfllrr.exe 2116 lrxrrll.exe 2156 5hbhtb.exe 2396 jvpvv.exe 2164 3fxxffl.exe 924 1lxrxxl.exe 2120 5ttnbb.exe 2340 9dvdd.exe 784 xrffffr.exe 560 xxrrrlx.exe 864 1nnnhb.exe 888 jvpjp.exe 984 dvjpv.exe 2924 fxlllrx.exe -
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-709-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2172-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-843-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2748 2112 00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe 31 PID 2112 wrote to memory of 2748 2112 00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe 31 PID 2112 wrote to memory of 2748 2112 00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe 31 PID 2112 wrote to memory of 2748 2112 00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe 31 PID 2748 wrote to memory of 2920 2748 pjvdj.exe 32 PID 2748 wrote to memory of 2920 2748 pjvdj.exe 32 PID 2748 wrote to memory of 2920 2748 pjvdj.exe 32 PID 2748 wrote to memory of 2920 2748 pjvdj.exe 32 PID 2920 wrote to memory of 2824 2920 9bbbnt.exe 33 PID 2920 wrote to memory of 2824 2920 9bbbnt.exe 33 PID 2920 wrote to memory of 2824 2920 9bbbnt.exe 33 PID 2920 wrote to memory of 2824 2920 9bbbnt.exe 33 PID 2824 wrote to memory of 2556 2824 3jdjj.exe 34 PID 2824 wrote to memory of 2556 2824 3jdjj.exe 34 PID 2824 wrote to memory of 2556 2824 3jdjj.exe 34 PID 2824 wrote to memory of 2556 2824 3jdjj.exe 34 PID 2556 wrote to memory of 2816 2556 nnbhnn.exe 35 PID 2556 wrote to memory of 2816 2556 nnbhnn.exe 35 PID 2556 wrote to memory of 2816 2556 nnbhnn.exe 35 PID 2556 wrote to memory of 2816 2556 nnbhnn.exe 35 PID 2816 wrote to memory of 2604 2816 9xlllrl.exe 36 PID 2816 wrote to memory of 2604 2816 9xlllrl.exe 36 PID 2816 wrote to memory of 2604 2816 9xlllrl.exe 36 PID 2816 wrote to memory of 2604 2816 9xlllrl.exe 36 PID 2604 wrote to memory of 3024 2604 thhntb.exe 37 PID 2604 wrote to memory of 3024 2604 thhntb.exe 37 PID 2604 wrote to memory of 3024 2604 thhntb.exe 37 PID 2604 wrote to memory of 3024 2604 thhntb.exe 37 PID 3024 wrote to memory of 1120 3024 ppvdp.exe 38 PID 3024 wrote to memory of 1120 3024 ppvdp.exe 38 PID 3024 wrote to memory of 1120 3024 ppvdp.exe 38 PID 3024 wrote to memory of 1120 3024 ppvdp.exe 38 PID 1120 wrote to memory of 2900 1120 frfxllr.exe 39 PID 1120 wrote to memory of 2900 1120 frfxllr.exe 39 PID 1120 wrote to memory of 2900 1120 frfxllr.exe 39 PID 1120 wrote to memory of 2900 1120 frfxllr.exe 39 PID 2900 wrote to memory of 1896 2900 bbnnbb.exe 40 PID 2900 wrote to memory of 1896 2900 bbnnbb.exe 40 PID 2900 wrote to memory of 1896 2900 bbnnbb.exe 40 PID 2900 wrote to memory of 1896 2900 bbnnbb.exe 40 PID 1896 wrote to memory of 604 1896 5djdj.exe 41 PID 1896 wrote to memory of 604 1896 5djdj.exe 41 PID 1896 wrote to memory of 604 1896 5djdj.exe 41 PID 1896 wrote to memory of 604 1896 5djdj.exe 41 PID 604 wrote to memory of 1448 604 llxrxxf.exe 42 PID 604 wrote to memory of 1448 604 llxrxxf.exe 42 PID 604 wrote to memory of 1448 604 llxrxxf.exe 42 PID 604 wrote to memory of 1448 604 llxrxxf.exe 42 PID 1448 wrote to memory of 2620 1448 vjvpv.exe 43 PID 1448 wrote to memory of 2620 1448 vjvpv.exe 43 PID 1448 wrote to memory of 2620 1448 vjvpv.exe 43 PID 1448 wrote to memory of 2620 1448 vjvpv.exe 43 PID 2620 wrote to memory of 2004 2620 rlxxllx.exe 44 PID 2620 wrote to memory of 2004 2620 rlxxllx.exe 44 PID 2620 wrote to memory of 2004 2620 rlxxllx.exe 44 PID 2620 wrote to memory of 2004 2620 rlxxllx.exe 44 PID 2004 wrote to memory of 2720 2004 1jvvv.exe 45 PID 2004 wrote to memory of 2720 2004 1jvvv.exe 45 PID 2004 wrote to memory of 2720 2004 1jvvv.exe 45 PID 2004 wrote to memory of 2720 2004 1jvvv.exe 45 PID 2720 wrote to memory of 328 2720 5jjjj.exe 46 PID 2720 wrote to memory of 328 2720 5jjjj.exe 46 PID 2720 wrote to memory of 328 2720 5jjjj.exe 46 PID 2720 wrote to memory of 328 2720 5jjjj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe"C:\Users\Admin\AppData\Local\Temp\00849b86e66ff522ebd9894fe696469cbdbfc5af86604cbd037656055cdc48d7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\pjvdj.exec:\pjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9bbbnt.exec:\9bbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\3jdjj.exec:\3jdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nnbhnn.exec:\nnbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9xlllrl.exec:\9xlllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\thhntb.exec:\thhntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ppvdp.exec:\ppvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\frfxllr.exec:\frfxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\bbnnbb.exec:\bbnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\5djdj.exec:\5djdj.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\llxrxxf.exec:\llxrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\vjvpv.exec:\vjvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\rlxxllx.exec:\rlxxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\1jvvv.exec:\1jvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\5jjjj.exec:\5jjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\thbhnb.exec:\thbhnb.exe17⤵
- Executes dropped EXE
PID:328 -
\??\c:\jvpvd.exec:\jvpvd.exe18⤵
- Executes dropped EXE
PID:1688 -
\??\c:\thtbhh.exec:\thtbhh.exe19⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1hbthb.exec:\1hbthb.exe20⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fxlxflr.exec:\fxlxflr.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\9rfxxxf.exec:\9rfxxxf.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\5vvvd.exec:\5vvvd.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\frxrffx.exec:\frxrffx.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jvvdd.exec:\jvvdd.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlxxrxx.exec:\rlxxrxx.exe26⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5vddd.exec:\5vddd.exe27⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9xxffrr.exec:\9xxffrr.exe28⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhnnnh.exec:\nhnnnh.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vjvvd.exec:\vjvvd.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\nhttbb.exec:\nhttbb.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjvjv.exec:\pjvjv.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2928 -
\??\c:\9xrflrl.exec:\9xrflrl.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5bnntt.exec:\5bnntt.exe34⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jdvpv.exec:\jdvpv.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\frfflrf.exec:\frfflrf.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9bnhhb.exec:\9bnhhb.exe37⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jvddd.exec:\jvddd.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1vvdd.exec:\1vvdd.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rfxfllf.exec:\rfxfllf.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7nbbbt.exec:\7nbbbt.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\htnttt.exec:\htnttt.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpvpv.exec:\vpvpv.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1416 -
\??\c:\7flffff.exec:\7flffff.exe44⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nnbntb.exec:\nnbntb.exe45⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bththh.exec:\bththh.exe46⤵
- Executes dropped EXE
PID:760 -
\??\c:\jjvdd.exec:\jjvdd.exe47⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9xrlrrx.exec:\9xrlrrx.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bhttbt.exec:\bhttbt.exe50⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5pjpp.exec:\5pjpp.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5xfllrr.exec:\5xfllrr.exe52⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lrxrrll.exec:\lrxrrll.exe53⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5hbhtb.exec:\5hbhtb.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jvpvv.exec:\jvpvv.exe55⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3fxxffl.exec:\3fxxffl.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1lxrxxl.exec:\1lxrxxl.exe57⤵
- Executes dropped EXE
PID:924 -
\??\c:\5ttnbb.exec:\5ttnbb.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9dvdd.exec:\9dvdd.exe59⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xrffffr.exec:\xrffffr.exe60⤵
- Executes dropped EXE
PID:784 -
\??\c:\xxrrrlx.exec:\xxrrrlx.exe61⤵
- Executes dropped EXE
PID:560 -
\??\c:\1nnnhb.exec:\1nnnhb.exe62⤵
- Executes dropped EXE
PID:864 -
\??\c:\jvpjp.exec:\jvpjp.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\dvjpv.exec:\dvjpv.exe64⤵
- Executes dropped EXE
PID:984 -
\??\c:\fxlllrx.exec:\fxlllrx.exe65⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9hhtbt.exec:\9hhtbt.exe66⤵PID:2444
-
\??\c:\3hnbth.exec:\3hnbth.exe67⤵PID:2292
-
\??\c:\dvjjp.exec:\dvjjp.exe68⤵PID:2320
-
\??\c:\1xrrxff.exec:\1xrrxff.exe69⤵PID:1992
-
\??\c:\7htnnh.exec:\7htnnh.exe70⤵PID:2700
-
\??\c:\bbtbhh.exec:\bbtbhh.exe71⤵PID:2832
-
\??\c:\vvpvd.exec:\vvpvd.exe72⤵PID:1524
-
\??\c:\rxllrff.exec:\rxllrff.exe73⤵PID:2540
-
\??\c:\5lfxffl.exec:\5lfxffl.exe74⤵PID:1632
-
\??\c:\nbhbhb.exec:\nbhbhb.exe75⤵
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\3jdpv.exec:\3jdpv.exe76⤵PID:2856
-
\??\c:\xxlrfrl.exec:\xxlrfrl.exe77⤵PID:2552
-
\??\c:\9hnnbb.exec:\9hnnbb.exe78⤵PID:3020
-
\??\c:\dvjjp.exec:\dvjjp.exe79⤵PID:640
-
\??\c:\lflfrxl.exec:\lflfrxl.exe80⤵PID:1216
-
\??\c:\lxxfflr.exec:\lxxfflr.exe81⤵PID:1932
-
\??\c:\nhtbnn.exec:\nhtbnn.exe82⤵PID:3000
-
\??\c:\7djjp.exec:\7djjp.exe83⤵PID:2384
-
\??\c:\llxxffl.exec:\llxxffl.exe84⤵PID:2392
-
\??\c:\1bnhtt.exec:\1bnhtt.exe85⤵PID:1000
-
\??\c:\nnbhnh.exec:\nnbhnh.exe86⤵PID:1852
-
\??\c:\jdjdp.exec:\jdjdp.exe87⤵PID:760
-
\??\c:\fffxffl.exec:\fffxffl.exe88⤵PID:1644
-
\??\c:\hhbbnn.exec:\hhbbnn.exe89⤵PID:2256
-
\??\c:\9nhnnn.exec:\9nhnnn.exe90⤵PID:1960
-
\??\c:\jvpvp.exec:\jvpvp.exe91⤵PID:2804
-
\??\c:\jdvdp.exec:\jdvdp.exe92⤵PID:1968
-
\??\c:\9lrllrr.exec:\9lrllrr.exe93⤵PID:2948
-
\??\c:\hbhhnn.exec:\hbhhnn.exe94⤵PID:2172
-
\??\c:\dddjd.exec:\dddjd.exe95⤵PID:2212
-
\??\c:\7fllllf.exec:\7fllllf.exe96⤵PID:2128
-
\??\c:\rxrxrrr.exec:\rxrxrrr.exe97⤵PID:2164
-
\??\c:\9hnnhb.exec:\9hnnhb.exe98⤵PID:1620
-
\??\c:\bbnbhn.exec:\bbnbhn.exe99⤵PID:2280
-
\??\c:\ddvjv.exec:\ddvjv.exe100⤵PID:2340
-
\??\c:\xlfrffr.exec:\xlfrffr.exe101⤵PID:784
-
\??\c:\hhttbt.exec:\hhttbt.exe102⤵PID:1208
-
\??\c:\nbntbh.exec:\nbntbh.exe103⤵PID:2592
-
\??\c:\vvpvd.exec:\vvpvd.exe104⤵PID:1740
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe105⤵PID:2452
-
\??\c:\bhtttt.exec:\bhtttt.exe106⤵PID:2032
-
\??\c:\htbnbn.exec:\htbnbn.exe107⤵PID:1720
-
\??\c:\vvpvd.exec:\vvpvd.exe108⤵PID:2952
-
\??\c:\xlflrxx.exec:\xlflrxx.exe109⤵PID:2056
-
\??\c:\lxrxxxf.exec:\lxrxxxf.exe110⤵PID:1424
-
\??\c:\9thhnn.exec:\9thhnn.exe111⤵PID:2460
-
\??\c:\pdpjp.exec:\pdpjp.exe112⤵PID:2812
-
\??\c:\5lffrxl.exec:\5lffrxl.exe113⤵PID:2068
-
\??\c:\nnbnbn.exec:\nnbnbn.exe114⤵PID:2820
-
\??\c:\3btttb.exec:\3btttb.exe115⤵PID:2568
-
\??\c:\vpddd.exec:\vpddd.exe116⤵PID:2848
-
\??\c:\rlxflll.exec:\rlxflll.exe117⤵PID:2580
-
\??\c:\7hbntb.exec:\7hbntb.exe118⤵PID:2528
-
\??\c:\5bbhtb.exec:\5bbhtb.exe119⤵PID:2576
-
\??\c:\ppddj.exec:\ppddj.exe120⤵PID:2260
-
\??\c:\rlxlxxr.exec:\rlxlxxr.exe121⤵PID:3024
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-