Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe
-
Size
454KB
-
MD5
877fbcfb32c08c5eadef9863fb56ea10
-
SHA1
57ec43b1ab45f7fa3cbe67b05ed5552673301149
-
SHA256
9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90
-
SHA512
c7027eeae7f1a5effbe46c49cc2e79d47e6d37ebd847c64e908471a5f90357c9695f7ee5576bb4a0083e4d3f817fae6c45adc3d7689145dbf0bb103def5ccc0c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-15-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2328-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-72-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2924-70-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2908-89-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-117-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2032-120-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/868-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/868-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-149-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2944-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-154-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1308-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-174-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2060-188-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-232-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/324-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-298-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-306-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1860-318-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2328-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-418-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/844-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-634-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2624-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-654-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1956-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-926-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-951-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1788-957-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2396-1015-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-1028-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1468-1047-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1320 1rfffxr.exe 2540 3hntnt.exe 2328 xrffrlr.exe 2168 lfrrxfx.exe 2880 hbntbb.exe 2724 1pdjj.exe 2924 thntnn.exe 2992 3rflllx.exe 2908 lxrrffl.exe 2660 xxrxllf.exe 2432 5vppv.exe 2032 lxrxrrf.exe 868 ffxfflx.exe 2824 1ddpv.exe 2944 nhbbbt.exe 1308 jvjpv.exe 2120 rfflxfr.exe 1564 xfrflrr.exe 2060 xxfrxfl.exe 536 lfrfllr.exe 2528 nntnnt.exe 3032 ddppj.exe 672 1bnthh.exe 324 lrlrxfl.exe 2572 hhhntb.exe 2276 7rllfll.exe 2464 3tnhth.exe 580 djddj.exe 2636 3rxxxrx.exe 1032 ddvjv.exe 2216 lffxlrx.exe 2404 vdvjp.exe 1860 xfxrlrx.exe 2116 bthhnn.exe 2328 ppjvd.exe 1852 lflllfl.exe 2876 bbthnt.exe 1900 ppdvv.exe 2724 3vdpv.exe 2624 rrxffrx.exe 2772 bbbhhn.exe 2884 vjjpp.exe 2496 dvdvp.exe 2204 7xrxfll.exe 2648 nnbhbh.exe 1788 pddjv.exe 2796 jjdjd.exe 2816 lflrrxf.exe 2804 flxfllx.exe 2940 1htbbb.exe 1844 vjvvd.exe 844 xfrrlxr.exe 1432 xfxfxfx.exe 1176 ttbhtb.exe 2344 dvpvd.exe 1564 vjvvd.exe 1208 1rlxrrl.exe 1088 bnttbb.exe 2172 thtbhh.exe 3028 vdppd.exe 1772 3fxrrrx.exe 2468 flfrxfr.exe 672 tnhtbh.exe 1764 ddjpv.exe -
resource yara_rule behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-120-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/868-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-138-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1308-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-149-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2944-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-306-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2328-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-654-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2884-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-990-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1320 2508 9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe 30 PID 2508 wrote to memory of 1320 2508 9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe 30 PID 2508 wrote to memory of 1320 2508 9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe 30 PID 2508 wrote to memory of 1320 2508 9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe 30 PID 1320 wrote to memory of 2540 1320 1rfffxr.exe 31 PID 1320 wrote to memory of 2540 1320 1rfffxr.exe 31 PID 1320 wrote to memory of 2540 1320 1rfffxr.exe 31 PID 1320 wrote to memory of 2540 1320 1rfffxr.exe 31 PID 2540 wrote to memory of 2328 2540 3hntnt.exe 32 PID 2540 wrote to memory of 2328 2540 3hntnt.exe 32 PID 2540 wrote to memory of 2328 2540 3hntnt.exe 32 PID 2540 wrote to memory of 2328 2540 3hntnt.exe 32 PID 2328 wrote to memory of 2168 2328 xrffrlr.exe 33 PID 2328 wrote to memory of 2168 2328 xrffrlr.exe 33 PID 2328 wrote to memory of 2168 2328 xrffrlr.exe 33 PID 2328 wrote to memory of 2168 2328 xrffrlr.exe 33 PID 2168 wrote to memory of 2880 2168 lfrrxfx.exe 34 PID 2168 wrote to memory of 2880 2168 lfrrxfx.exe 34 PID 2168 wrote to memory of 2880 2168 lfrrxfx.exe 34 PID 2168 wrote to memory of 2880 2168 lfrrxfx.exe 34 PID 2880 wrote to memory of 2724 2880 hbntbb.exe 35 PID 2880 wrote to memory of 2724 2880 hbntbb.exe 35 PID 2880 wrote to memory of 2724 2880 hbntbb.exe 35 PID 2880 wrote to memory of 2724 2880 hbntbb.exe 35 PID 2724 wrote to memory of 2924 2724 1pdjj.exe 36 PID 2724 wrote to memory of 2924 2724 1pdjj.exe 36 PID 2724 wrote to memory of 2924 2724 1pdjj.exe 36 PID 2724 wrote to memory of 2924 2724 1pdjj.exe 36 PID 2924 wrote to memory of 2992 2924 thntnn.exe 37 PID 2924 wrote to memory of 2992 2924 thntnn.exe 37 PID 2924 wrote to memory of 2992 2924 thntnn.exe 37 PID 2924 wrote to memory of 2992 2924 thntnn.exe 37 PID 2992 wrote to memory of 2908 2992 3rflllx.exe 38 PID 2992 wrote to memory of 2908 2992 3rflllx.exe 38 PID 2992 wrote to memory of 2908 2992 3rflllx.exe 38 PID 2992 wrote to memory of 2908 2992 3rflllx.exe 38 PID 2908 wrote to memory of 2660 2908 lxrrffl.exe 39 PID 2908 wrote to memory of 2660 2908 lxrrffl.exe 39 PID 2908 wrote to memory of 2660 2908 lxrrffl.exe 39 PID 2908 wrote to memory of 2660 2908 lxrrffl.exe 39 PID 2660 wrote to memory of 2432 2660 xxrxllf.exe 40 PID 2660 wrote to memory of 2432 2660 xxrxllf.exe 40 PID 2660 wrote to memory of 2432 2660 xxrxllf.exe 40 PID 2660 wrote to memory of 2432 2660 xxrxllf.exe 40 PID 2432 wrote to memory of 2032 2432 5vppv.exe 41 PID 2432 wrote to memory of 2032 2432 5vppv.exe 41 PID 2432 wrote to memory of 2032 2432 5vppv.exe 41 PID 2432 wrote to memory of 2032 2432 5vppv.exe 41 PID 2032 wrote to memory of 868 2032 lxrxrrf.exe 42 PID 2032 wrote to memory of 868 2032 lxrxrrf.exe 42 PID 2032 wrote to memory of 868 2032 lxrxrrf.exe 42 PID 2032 wrote to memory of 868 2032 lxrxrrf.exe 42 PID 868 wrote to memory of 2824 868 ffxfflx.exe 43 PID 868 wrote to memory of 2824 868 ffxfflx.exe 43 PID 868 wrote to memory of 2824 868 ffxfflx.exe 43 PID 868 wrote to memory of 2824 868 ffxfflx.exe 43 PID 2824 wrote to memory of 2944 2824 1ddpv.exe 44 PID 2824 wrote to memory of 2944 2824 1ddpv.exe 44 PID 2824 wrote to memory of 2944 2824 1ddpv.exe 44 PID 2824 wrote to memory of 2944 2824 1ddpv.exe 44 PID 2944 wrote to memory of 1308 2944 nhbbbt.exe 45 PID 2944 wrote to memory of 1308 2944 nhbbbt.exe 45 PID 2944 wrote to memory of 1308 2944 nhbbbt.exe 45 PID 2944 wrote to memory of 1308 2944 nhbbbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe"C:\Users\Admin\AppData\Local\Temp\9fccd5daa4568e4c14289380687b5e23921db283bc2965efc747fe2ed611aa90N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\1rfffxr.exec:\1rfffxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\3hntnt.exec:\3hntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xrffrlr.exec:\xrffrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\lfrrxfx.exec:\lfrrxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hbntbb.exec:\hbntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\1pdjj.exec:\1pdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\thntnn.exec:\thntnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\3rflllx.exec:\3rflllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lxrrffl.exec:\lxrrffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\xxrxllf.exec:\xxrxllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\5vppv.exec:\5vppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\lxrxrrf.exec:\lxrxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\ffxfflx.exec:\ffxfflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\1ddpv.exec:\1ddpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nhbbbt.exec:\nhbbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jvjpv.exec:\jvjpv.exe17⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rfflxfr.exec:\rfflxfr.exe18⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xfrflrr.exec:\xfrflrr.exe19⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xxfrxfl.exec:\xxfrxfl.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lfrfllr.exec:\lfrfllr.exe21⤵
- Executes dropped EXE
PID:536 -
\??\c:\nntnnt.exec:\nntnnt.exe22⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ddppj.exec:\ddppj.exe23⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1bnthh.exec:\1bnthh.exe24⤵
- Executes dropped EXE
PID:672 -
\??\c:\lrlrxfl.exec:\lrlrxfl.exe25⤵
- Executes dropped EXE
PID:324 -
\??\c:\hhhntb.exec:\hhhntb.exe26⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7rllfll.exec:\7rllfll.exe27⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3tnhth.exec:\3tnhth.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\djddj.exec:\djddj.exe29⤵
- Executes dropped EXE
PID:580 -
\??\c:\3rxxxrx.exec:\3rxxxrx.exe30⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ddvjv.exec:\ddvjv.exe31⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lffxlrx.exec:\lffxlrx.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vdvjp.exec:\vdvjp.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xfxrlrx.exec:\xfxrlrx.exe34⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bthhnn.exec:\bthhnn.exe35⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ppjvd.exec:\ppjvd.exe36⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lflllfl.exec:\lflllfl.exe37⤵
- Executes dropped EXE
PID:1852 -
\??\c:\bbthnt.exec:\bbthnt.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ppdvv.exec:\ppdvv.exe39⤵
- Executes dropped EXE
PID:1900 -
\??\c:\3vdpv.exec:\3vdpv.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rrxffrx.exec:\rrxffrx.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bbbhhn.exec:\bbbhhn.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vjjpp.exec:\vjjpp.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dvdvp.exec:\dvdvp.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7xrxfll.exec:\7xrxfll.exe45⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nnbhbh.exec:\nnbhbh.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pddjv.exec:\pddjv.exe47⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jjdjd.exec:\jjdjd.exe48⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lflrrxf.exec:\lflrrxf.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\flxfllx.exec:\flxfllx.exe50⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1htbbb.exec:\1htbbb.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vjvvd.exec:\vjvvd.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844 -
\??\c:\xfrrlxr.exec:\xfrrlxr.exe53⤵
- Executes dropped EXE
PID:844 -
\??\c:\xfxfxfx.exec:\xfxfxfx.exe54⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ttbhtb.exec:\ttbhtb.exe55⤵
- Executes dropped EXE
PID:1176 -
\??\c:\dvpvd.exec:\dvpvd.exe56⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vjvvd.exec:\vjvvd.exe57⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1rlxrrl.exec:\1rlxrrl.exe58⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bnttbb.exec:\bnttbb.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\thtbhh.exec:\thtbhh.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vdppd.exec:\vdppd.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3fxrrrx.exec:\3fxrrrx.exe62⤵
- Executes dropped EXE
PID:1772 -
\??\c:\flfrxfr.exec:\flfrxfr.exe63⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tnhtbh.exec:\tnhtbh.exe64⤵
- Executes dropped EXE
PID:672 -
\??\c:\ddjpv.exec:\ddjpv.exe65⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7xrxlxl.exec:\7xrxlxl.exe66⤵PID:768
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe67⤵PID:2572
-
\??\c:\bbbhnb.exec:\bbbhnb.exe68⤵PID:1884
-
\??\c:\vvpjp.exec:\vvpjp.exe69⤵PID:3064
-
\??\c:\fflxxfr.exec:\fflxxfr.exe70⤵PID:2036
-
\??\c:\3fxxffl.exec:\3fxxffl.exe71⤵PID:2076
-
\??\c:\nhhtbn.exec:\nhhtbn.exe72⤵PID:2636
-
\??\c:\pppdv.exec:\pppdv.exe73⤵PID:880
-
\??\c:\ddvdj.exec:\ddvdj.exe74⤵PID:1816
-
\??\c:\rlxxfff.exec:\rlxxfff.exe75⤵PID:1560
-
\??\c:\nhbhtb.exec:\nhbhtb.exe76⤵PID:2352
-
\??\c:\tnhnbb.exec:\tnhnbb.exe77⤵PID:2540
-
\??\c:\7dpvd.exec:\7dpvd.exe78⤵PID:2692
-
\??\c:\lfrrrlr.exec:\lfrrrlr.exe79⤵PID:2704
-
\??\c:\fxrrxlr.exec:\fxrrxlr.exe80⤵PID:2860
-
\??\c:\tnnnhb.exec:\tnnnhb.exe81⤵PID:2604
-
\??\c:\pdjvp.exec:\pdjvp.exe82⤵PID:2856
-
\??\c:\vdpdj.exec:\vdpdj.exe83⤵PID:2760
-
\??\c:\ffxfrxx.exec:\ffxfrxx.exe84⤵PID:2992
-
\??\c:\tnbhtt.exec:\tnbhtt.exe85⤵PID:2624
-
\??\c:\jjdvj.exec:\jjdvj.exe86⤵PID:2652
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe87⤵PID:2884
-
\??\c:\1frlllf.exec:\1frlllf.exe88⤵PID:2160
-
\??\c:\1ttntt.exec:\1ttntt.exe89⤵PID:1408
-
\??\c:\vppdv.exec:\vppdv.exe90⤵
- System Location Discovery: System Language Discovery
PID:668 -
\??\c:\pjddv.exec:\pjddv.exe91⤵PID:2700
-
\??\c:\5frrxff.exec:\5frrxff.exe92⤵PID:2776
-
\??\c:\nhbhnt.exec:\nhbhnt.exe93⤵PID:2828
-
\??\c:\hbnbbh.exec:\hbnbbh.exe94⤵PID:1040
-
\??\c:\ddpdj.exec:\ddpdj.exe95⤵PID:1080
-
\??\c:\xlflllr.exec:\xlflllr.exe96⤵PID:1544
-
\??\c:\xrfflrf.exec:\xrfflrf.exe97⤵PID:1956
-
\??\c:\ttnthh.exec:\ttnthh.exe98⤵PID:268
-
\??\c:\dvppd.exec:\dvppd.exe99⤵PID:2072
-
\??\c:\lxrxxxf.exec:\lxrxxxf.exe100⤵PID:1120
-
\??\c:\lxrlllr.exec:\lxrlllr.exe101⤵PID:2560
-
\??\c:\bththh.exec:\bththh.exe102⤵PID:948
-
\??\c:\bbnnbt.exec:\bbnnbt.exe103⤵PID:2376
-
\??\c:\jvjjp.exec:\jvjjp.exe104⤵PID:2172
-
\??\c:\fxfflfr.exec:\fxfflfr.exe105⤵PID:1600
-
\??\c:\xlfxlxx.exec:\xlfxlxx.exe106⤵
- System Location Discovery: System Language Discovery
PID:1772 -
\??\c:\hthhhh.exec:\hthhhh.exe107⤵PID:1372
-
\??\c:\vpddj.exec:\vpddj.exe108⤵PID:1768
-
\??\c:\jdpjj.exec:\jdpjj.exe109⤵PID:1764
-
\??\c:\5lrrffr.exec:\5lrrffr.exe110⤵PID:1680
-
\??\c:\tbhhth.exec:\tbhhth.exe111⤵PID:2004
-
\??\c:\tnhhtn.exec:\tnhhtn.exe112⤵PID:2332
-
\??\c:\jjvdd.exec:\jjvdd.exe113⤵PID:2464
-
\??\c:\rfxxllf.exec:\rfxxllf.exe114⤵PID:2248
-
\??\c:\rlllxxl.exec:\rlllxxl.exe115⤵PID:292
-
\??\c:\hbntbb.exec:\hbntbb.exe116⤵PID:2636
-
\??\c:\jdvpv.exec:\jdvpv.exe117⤵PID:1032
-
\??\c:\pvdvd.exec:\pvdvd.exe118⤵PID:2384
-
\??\c:\5rllrxf.exec:\5rllrxf.exe119⤵PID:1824
-
\??\c:\hbttnh.exec:\hbttnh.exe120⤵PID:2404
-
\??\c:\1tbbtb.exec:\1tbbtb.exe121⤵PID:2540
-
\??\c:\ppvdj.exec:\ppvdj.exe122⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-