Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe
-
Size
453KB
-
MD5
e5211139ca110e1840e72ef2c22cd410
-
SHA1
c19cbf1998925420adfefc8d43f596288498bc21
-
SHA256
945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83e
-
SHA512
f5603afb7e4fcbfc64ea0d6e505327a05aeb67bb03bfe5e82ac00cb2e7275424af489e1977e237d7d0b5c1d6093db3023310f83e991ea15f6a769ea7720c9d18
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/324-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-238-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2004-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-291-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2028-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-293-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2872-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-481-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2068-479-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/468-549-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2536-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-576-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2608-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-802-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-909-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-964-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/268-983-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-1341-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2556-1372-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1320 xxrxrxl.exe 2540 nnbnnn.exe 2116 xxxfxxl.exe 2092 hbnthn.exe 2872 3nbttt.exe 2740 9jvdj.exe 2716 dvjjd.exe 1272 5vvdj.exe 2600 ppjvj.exe 2676 pdvvd.exe 2160 7rflllx.exe 2820 jjjvv.exe 2796 1xlrxxl.exe 1580 tbttbh.exe 2792 pjjdd.exe 2656 lfxflrl.exe 2120 nbttbb.exe 1996 1hbtbt.exe 2072 nbnnnn.exe 332 5dppp.exe 2980 3bntbh.exe 1468 jjvvj.exe 1952 lrlrlrf.exe 324 nnnhbh.exe 2224 7rllxxf.exe 1636 7xrfxfx.exe 2004 xrrrfxl.exe 344 3nhntt.exe 2180 lxffrrx.exe 300 jvjpp.exe 2028 llffrff.exe 2556 hbtntt.exe 1864 1pjjp.exe 2540 hbthnt.exe 2264 thtnnb.exe 2352 ppdpd.exe 2860 9ddjj.exe 1832 rrrlxxl.exe 2872 ttbbtt.exe 2760 bbnthn.exe 2924 jvjjj.exe 1272 rlfrrxl.exe 2612 rlflxxl.exe 2908 btnthh.exe 2204 dvpvj.exe 2156 7jpvj.exe 2812 lrxxfrx.exe 756 nnbbnn.exe 2976 5thtbb.exe 2688 jvjjp.exe 2800 llffflr.exe 1308 nnhttt.exe 844 nhhhtb.exe 1416 jdvjv.exe 1176 rxxlflx.exe 2292 xrlrffr.exe 2064 bthhnh.exe 320 3dvdj.exe 948 3jdpp.exe 2068 llflxff.exe 1792 hbthbh.exe 2468 dvvpv.exe 1660 lrrxflf.exe 1768 lfrrxxl.exe -
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-111-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2820-120-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2796-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-167-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1996-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-291-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2028-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-549-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2536-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-864-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2148-1045-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-1127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-1170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-1213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-1247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-1301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-1322-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2556-1371-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1320 2508 945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe 30 PID 2508 wrote to memory of 1320 2508 945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe 30 PID 2508 wrote to memory of 1320 2508 945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe 30 PID 2508 wrote to memory of 1320 2508 945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe 30 PID 1320 wrote to memory of 2540 1320 xxrxrxl.exe 31 PID 1320 wrote to memory of 2540 1320 xxrxrxl.exe 31 PID 1320 wrote to memory of 2540 1320 xxrxrxl.exe 31 PID 1320 wrote to memory of 2540 1320 xxrxrxl.exe 31 PID 2540 wrote to memory of 2116 2540 nnbnnn.exe 32 PID 2540 wrote to memory of 2116 2540 nnbnnn.exe 32 PID 2540 wrote to memory of 2116 2540 nnbnnn.exe 32 PID 2540 wrote to memory of 2116 2540 nnbnnn.exe 32 PID 2116 wrote to memory of 2092 2116 xxxfxxl.exe 33 PID 2116 wrote to memory of 2092 2116 xxxfxxl.exe 33 PID 2116 wrote to memory of 2092 2116 xxxfxxl.exe 33 PID 2116 wrote to memory of 2092 2116 xxxfxxl.exe 33 PID 2092 wrote to memory of 2872 2092 hbnthn.exe 34 PID 2092 wrote to memory of 2872 2092 hbnthn.exe 34 PID 2092 wrote to memory of 2872 2092 hbnthn.exe 34 PID 2092 wrote to memory of 2872 2092 hbnthn.exe 34 PID 2872 wrote to memory of 2740 2872 3nbttt.exe 35 PID 2872 wrote to memory of 2740 2872 3nbttt.exe 35 PID 2872 wrote to memory of 2740 2872 3nbttt.exe 35 PID 2872 wrote to memory of 2740 2872 3nbttt.exe 35 PID 2740 wrote to memory of 2716 2740 9jvdj.exe 36 PID 2740 wrote to memory of 2716 2740 9jvdj.exe 36 PID 2740 wrote to memory of 2716 2740 9jvdj.exe 36 PID 2740 wrote to memory of 2716 2740 9jvdj.exe 36 PID 2716 wrote to memory of 1272 2716 dvjjd.exe 37 PID 2716 wrote to memory of 1272 2716 dvjjd.exe 37 PID 2716 wrote to memory of 1272 2716 dvjjd.exe 37 PID 2716 wrote to memory of 1272 2716 dvjjd.exe 37 PID 1272 wrote to memory of 2600 1272 5vvdj.exe 38 PID 1272 wrote to memory of 2600 1272 5vvdj.exe 38 PID 1272 wrote to memory of 2600 1272 5vvdj.exe 38 PID 1272 wrote to memory of 2600 1272 5vvdj.exe 38 PID 2600 wrote to memory of 2676 2600 ppjvj.exe 39 PID 2600 wrote to memory of 2676 2600 ppjvj.exe 39 PID 2600 wrote to memory of 2676 2600 ppjvj.exe 39 PID 2600 wrote to memory of 2676 2600 ppjvj.exe 39 PID 2676 wrote to memory of 2160 2676 pdvvd.exe 40 PID 2676 wrote to memory of 2160 2676 pdvvd.exe 40 PID 2676 wrote to memory of 2160 2676 pdvvd.exe 40 PID 2676 wrote to memory of 2160 2676 pdvvd.exe 40 PID 2160 wrote to memory of 2820 2160 7rflllx.exe 41 PID 2160 wrote to memory of 2820 2160 7rflllx.exe 41 PID 2160 wrote to memory of 2820 2160 7rflllx.exe 41 PID 2160 wrote to memory of 2820 2160 7rflllx.exe 41 PID 2820 wrote to memory of 2796 2820 jjjvv.exe 42 PID 2820 wrote to memory of 2796 2820 jjjvv.exe 42 PID 2820 wrote to memory of 2796 2820 jjjvv.exe 42 PID 2820 wrote to memory of 2796 2820 jjjvv.exe 42 PID 2796 wrote to memory of 1580 2796 1xlrxxl.exe 43 PID 2796 wrote to memory of 1580 2796 1xlrxxl.exe 43 PID 2796 wrote to memory of 1580 2796 1xlrxxl.exe 43 PID 2796 wrote to memory of 1580 2796 1xlrxxl.exe 43 PID 1580 wrote to memory of 2792 1580 tbttbh.exe 44 PID 1580 wrote to memory of 2792 1580 tbttbh.exe 44 PID 1580 wrote to memory of 2792 1580 tbttbh.exe 44 PID 1580 wrote to memory of 2792 1580 tbttbh.exe 44 PID 2792 wrote to memory of 2656 2792 pjjdd.exe 45 PID 2792 wrote to memory of 2656 2792 pjjdd.exe 45 PID 2792 wrote to memory of 2656 2792 pjjdd.exe 45 PID 2792 wrote to memory of 2656 2792 pjjdd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe"C:\Users\Admin\AppData\Local\Temp\945f8995c638b331510bd7a5fc6cfc13993fbe04d01e07eb83fab6a0a7c1a83eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\nnbnnn.exec:\nnbnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xxxfxxl.exec:\xxxfxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hbnthn.exec:\hbnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3nbttt.exec:\3nbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9jvdj.exec:\9jvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dvjjd.exec:\dvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5vvdj.exec:\5vvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\ppjvj.exec:\ppjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pdvvd.exec:\pdvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\7rflllx.exec:\7rflllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\jjjvv.exec:\jjjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1xlrxxl.exec:\1xlrxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tbttbh.exec:\tbttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\pjjdd.exec:\pjjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lfxflrl.exec:\lfxflrl.exe17⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nbttbb.exec:\nbttbb.exe18⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1hbtbt.exec:\1hbtbt.exe19⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nbnnnn.exec:\nbnnnn.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5dppp.exec:\5dppp.exe21⤵
- Executes dropped EXE
PID:332 -
\??\c:\3bntbh.exec:\3bntbh.exe22⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jjvvj.exec:\jjvvj.exe23⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nnnhbh.exec:\nnnhbh.exe25⤵
- Executes dropped EXE
PID:324 -
\??\c:\7rllxxf.exec:\7rllxxf.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7xrfxfx.exec:\7xrfxfx.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrrrfxl.exec:\xrrrfxl.exe28⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3nhntt.exec:\3nhntt.exe29⤵
- Executes dropped EXE
PID:344 -
\??\c:\lxffrrx.exec:\lxffrrx.exe30⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jvjpp.exec:\jvjpp.exe31⤵
- Executes dropped EXE
PID:300 -
\??\c:\llffrff.exec:\llffrff.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hbtntt.exec:\hbtntt.exe33⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1pjjp.exec:\1pjjp.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1864 -
\??\c:\hbthnt.exec:\hbthnt.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\thtnnb.exec:\thtnnb.exe36⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ppdpd.exec:\ppdpd.exe37⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9ddjj.exec:\9ddjj.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rrrlxxl.exec:\rrrlxxl.exe39⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ttbbtt.exec:\ttbbtt.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bbnthn.exec:\bbnthn.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jvjjj.exec:\jvjjj.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlfrrxl.exec:\rlfrrxl.exe43⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rlflxxl.exec:\rlflxxl.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\btnthh.exec:\btnthh.exe45⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dvpvj.exec:\dvpvj.exe46⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7jpvj.exec:\7jpvj.exe47⤵
- Executes dropped EXE
PID:2156 -
\??\c:\lrxxfrx.exec:\lrxxfrx.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nnbbnn.exec:\nnbbnn.exe49⤵
- Executes dropped EXE
PID:756 -
\??\c:\5thtbb.exec:\5thtbb.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jvjjp.exec:\jvjjp.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llffflr.exec:\llffflr.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nnhttt.exec:\nnhttt.exe53⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nhhhtb.exec:\nhhhtb.exe54⤵
- Executes dropped EXE
PID:844 -
\??\c:\jdvjv.exec:\jdvjv.exe55⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rxxlflx.exec:\rxxlflx.exe56⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xrlrffr.exec:\xrlrffr.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bthhnh.exec:\bthhnh.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3dvdj.exec:\3dvdj.exe59⤵
- Executes dropped EXE
PID:320 -
\??\c:\3jdpp.exec:\3jdpp.exe60⤵
- Executes dropped EXE
PID:948 -
\??\c:\llflxff.exec:\llflxff.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hbthbh.exec:\hbthbh.exe62⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvvpv.exec:\dvvpv.exe63⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lrrxflf.exec:\lrrxflf.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1bbbhn.exec:\1bbbhn.exe66⤵PID:2428
-
\??\c:\vdvjv.exec:\vdvjv.exe67⤵PID:2080
-
\??\c:\1frrrxl.exec:\1frrrxl.exe68⤵PID:1680
-
\??\c:\7rlllxl.exec:\7rlllxl.exe69⤵
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\nnbhnt.exec:\nnbhnt.exe70⤵PID:344
-
\??\c:\pjjdj.exec:\pjjdj.exe71⤵PID:1496
-
\??\c:\jjdjd.exec:\jjdjd.exe72⤵PID:468
-
\??\c:\llllrxl.exec:\llllrxl.exe73⤵PID:1696
-
\??\c:\bhtbnb.exec:\bhtbnb.exe74⤵PID:2536
-
\??\c:\ddjvp.exec:\ddjvp.exe75⤵PID:2028
-
\??\c:\5dvpv.exec:\5dvpv.exe76⤵PID:1824
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe77⤵PID:1736
-
\??\c:\5bbntb.exec:\5bbntb.exe78⤵PID:1852
-
\??\c:\9djpv.exec:\9djpv.exe79⤵PID:2168
-
\??\c:\jjdvv.exec:\jjdvv.exe80⤵PID:2876
-
\??\c:\rxxxrxf.exec:\rxxxrxf.exe81⤵PID:2856
-
\??\c:\3nhnbb.exec:\3nhnbb.exe82⤵PID:2284
-
\??\c:\tnhtbn.exec:\tnhtbn.exe83⤵PID:2632
-
\??\c:\dvppd.exec:\dvppd.exe84⤵PID:2016
-
\??\c:\frrllxx.exec:\frrllxx.exe85⤵PID:1288
-
\??\c:\rlflrxf.exec:\rlflrxf.exe86⤵PID:2608
-
\??\c:\nnbhbn.exec:\nnbhbn.exe87⤵PID:2712
-
\??\c:\jdjjv.exec:\jdjjv.exe88⤵PID:2212
-
\??\c:\llxxffr.exec:\llxxffr.exe89⤵PID:1892
-
\??\c:\5lffxlr.exec:\5lffxlr.exe90⤵PID:2032
-
\??\c:\tnbhnn.exec:\tnbhnn.exe91⤵PID:668
-
\??\c:\7pjpd.exec:\7pjpd.exe92⤵PID:2700
-
\??\c:\lfxxffr.exec:\lfxxffr.exe93⤵PID:2824
-
\??\c:\5rlrrlf.exec:\5rlrrlf.exe94⤵PID:1580
-
\??\c:\bnhnnt.exec:\bnhnnt.exe95⤵PID:1040
-
\??\c:\vpjpp.exec:\vpjpp.exe96⤵PID:1172
-
\??\c:\vvpvd.exec:\vvpvd.exe97⤵PID:1432
-
\??\c:\lfflrrf.exec:\lfflrrf.exe98⤵PID:1740
-
\??\c:\9nbbhn.exec:\9nbbhn.exe99⤵PID:2308
-
\??\c:\hbthtt.exec:\hbthtt.exe100⤵PID:2084
-
\??\c:\jdpvd.exec:\jdpvd.exe101⤵PID:700
-
\??\c:\pdpvv.exec:\pdpvv.exe102⤵PID:2072
-
\??\c:\rxflffx.exec:\rxflffx.exe103⤵PID:2452
-
\??\c:\thnnth.exec:\thnnth.exe104⤵PID:1284
-
\??\c:\1hbbbb.exec:\1hbbbb.exe105⤵PID:2528
-
\??\c:\1pdjp.exec:\1pdjp.exe106⤵PID:1792
-
\??\c:\7xxfrxl.exec:\7xxfrxl.exe107⤵PID:1364
-
\??\c:\7nbbhh.exec:\7nbbhh.exe108⤵PID:2148
-
\??\c:\hhtbhh.exec:\hhtbhh.exe109⤵PID:1768
-
\??\c:\vvpdv.exec:\vvpdv.exe110⤵PID:1764
-
\??\c:\rrlxllx.exec:\rrlxllx.exe111⤵PID:2080
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe112⤵PID:1680
-
\??\c:\tbtntn.exec:\tbtntn.exe113⤵PID:2996
-
\??\c:\7pjdd.exec:\7pjdd.exe114⤵PID:2192
-
\??\c:\ddvdj.exec:\ddvdj.exe115⤵PID:1820
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe116⤵PID:2216
-
\??\c:\ttbhnt.exec:\ttbhnt.exe117⤵PID:2404
-
\??\c:\hnhhth.exec:\hnhhth.exe118⤵
- System Location Discovery: System Language Discovery
PID:2096 -
\??\c:\jjddj.exec:\jjddj.exe119⤵PID:2400
-
\??\c:\lllrxfr.exec:\lllrxfr.exe120⤵PID:1824
-
\??\c:\xrfrxlr.exec:\xrfrxlr.exe121⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-