Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe
-
Size
453KB
-
MD5
4355f0fd7e30d13bdc88167bcf586e70
-
SHA1
75b4d927b179b8da1a80cf9c95cc941438075467
-
SHA256
7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9b
-
SHA512
83df090fee1444c28cafdaa6654919f7bdb4f6010e8529d7f35fe77d069c70dc584fd418e35519710e881e01766644621a7feec9804e37cad2314c07a5326aed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1668-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-80-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-98-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2664-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-119-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-170-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-496-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-560-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-596-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2664-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-689-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2036-714-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2820-856-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-870-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1124-928-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-998-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-1015-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1768-1022-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2796-1110-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2536 4046682.exe 1824 264422.exe 1664 pjvdj.exe 2720 dvppv.exe 2860 nhnthn.exe 2736 bbbnhn.exe 2800 dvjvd.exe 2852 lrxxxll.exe 2660 xrllrrl.exe 2664 6080628.exe 2084 820688.exe 1608 fxffrrf.exe 2952 42040.exe 2680 3jjjv.exe 2052 s0228.exe 2912 pddvj.exe 1788 vjvpv.exe 2096 lxrrxfr.exe 304 fflrrlx.exe 2040 426828.exe 1356 60888.exe 1636 nhnttt.exe 840 1fxrxff.exe 1520 bnbttb.exe 1340 5xrllrf.exe 2208 0806224.exe 1720 pjvjp.exe 976 08044.exe 652 8244062.exe 1740 1flflrf.exe 2420 o040846.exe 1548 bbntbh.exe 2536 ffrrrff.exe 2120 68806.exe 2988 lrrlflx.exe 2740 6800662.exe 2464 2420284.exe 2744 vppjp.exe 2736 frlllrf.exe 2896 pvpdj.exe 1532 k44022.exe 2612 i460606.exe 2608 86406.exe 2628 xxlrxfr.exe 1672 200062.exe 1616 1vjjp.exe 2960 3jvpv.exe 2952 vpdjj.exe 2924 8686666.exe 2360 bnthnh.exe 1908 dpvvd.exe 2500 1xxfllr.exe 2492 42440.exe 2544 086688.exe 408 s4628.exe 1256 0866228.exe 1860 06000.exe 2224 2022828.exe 3028 48062.exe 1032 0824620.exe 2388 ppddp.exe 1716 4262828.exe 1360 6800660.exe 2196 826244.exe -
resource yara_rule behavioral1/memory/1668-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-714-0x0000000001C60000-0x0000000001C8A000-memory.dmp upx behavioral1/memory/1520-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-870-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2616-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-928-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2932-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-1110-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2776-1141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-1144-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s8628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0462824.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u840284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w82466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u226882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u040242.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 664028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2536 1668 7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe 31 PID 1668 wrote to memory of 2536 1668 7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe 31 PID 1668 wrote to memory of 2536 1668 7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe 31 PID 1668 wrote to memory of 2536 1668 7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe 31 PID 2536 wrote to memory of 1824 2536 4046682.exe 32 PID 2536 wrote to memory of 1824 2536 4046682.exe 32 PID 2536 wrote to memory of 1824 2536 4046682.exe 32 PID 2536 wrote to memory of 1824 2536 4046682.exe 32 PID 1824 wrote to memory of 1664 1824 264422.exe 33 PID 1824 wrote to memory of 1664 1824 264422.exe 33 PID 1824 wrote to memory of 1664 1824 264422.exe 33 PID 1824 wrote to memory of 1664 1824 264422.exe 33 PID 1664 wrote to memory of 2720 1664 pjvdj.exe 34 PID 1664 wrote to memory of 2720 1664 pjvdj.exe 34 PID 1664 wrote to memory of 2720 1664 pjvdj.exe 34 PID 1664 wrote to memory of 2720 1664 pjvdj.exe 34 PID 2720 wrote to memory of 2860 2720 dvppv.exe 35 PID 2720 wrote to memory of 2860 2720 dvppv.exe 35 PID 2720 wrote to memory of 2860 2720 dvppv.exe 35 PID 2720 wrote to memory of 2860 2720 dvppv.exe 35 PID 2860 wrote to memory of 2736 2860 nhnthn.exe 36 PID 2860 wrote to memory of 2736 2860 nhnthn.exe 36 PID 2860 wrote to memory of 2736 2860 nhnthn.exe 36 PID 2860 wrote to memory of 2736 2860 nhnthn.exe 36 PID 2736 wrote to memory of 2800 2736 bbbnhn.exe 37 PID 2736 wrote to memory of 2800 2736 bbbnhn.exe 37 PID 2736 wrote to memory of 2800 2736 bbbnhn.exe 37 PID 2736 wrote to memory of 2800 2736 bbbnhn.exe 37 PID 2800 wrote to memory of 2852 2800 dvjvd.exe 38 PID 2800 wrote to memory of 2852 2800 dvjvd.exe 38 PID 2800 wrote to memory of 2852 2800 dvjvd.exe 38 PID 2800 wrote to memory of 2852 2800 dvjvd.exe 38 PID 2852 wrote to memory of 2660 2852 lrxxxll.exe 39 PID 2852 wrote to memory of 2660 2852 lrxxxll.exe 39 PID 2852 wrote to memory of 2660 2852 lrxxxll.exe 39 PID 2852 wrote to memory of 2660 2852 lrxxxll.exe 39 PID 2660 wrote to memory of 2664 2660 xrllrrl.exe 114 PID 2660 wrote to memory of 2664 2660 xrllrrl.exe 114 PID 2660 wrote to memory of 2664 2660 xrllrrl.exe 114 PID 2660 wrote to memory of 2664 2660 xrllrrl.exe 114 PID 2664 wrote to memory of 2084 2664 6080628.exe 41 PID 2664 wrote to memory of 2084 2664 6080628.exe 41 PID 2664 wrote to memory of 2084 2664 6080628.exe 41 PID 2664 wrote to memory of 2084 2664 6080628.exe 41 PID 2084 wrote to memory of 1608 2084 820688.exe 42 PID 2084 wrote to memory of 1608 2084 820688.exe 42 PID 2084 wrote to memory of 1608 2084 820688.exe 42 PID 2084 wrote to memory of 1608 2084 820688.exe 42 PID 1608 wrote to memory of 2952 1608 fxffrrf.exe 119 PID 1608 wrote to memory of 2952 1608 fxffrrf.exe 119 PID 1608 wrote to memory of 2952 1608 fxffrrf.exe 119 PID 1608 wrote to memory of 2952 1608 fxffrrf.exe 119 PID 2952 wrote to memory of 2680 2952 42040.exe 44 PID 2952 wrote to memory of 2680 2952 42040.exe 44 PID 2952 wrote to memory of 2680 2952 42040.exe 44 PID 2952 wrote to memory of 2680 2952 42040.exe 44 PID 2680 wrote to memory of 2052 2680 3jjjv.exe 45 PID 2680 wrote to memory of 2052 2680 3jjjv.exe 45 PID 2680 wrote to memory of 2052 2680 3jjjv.exe 45 PID 2680 wrote to memory of 2052 2680 3jjjv.exe 45 PID 2052 wrote to memory of 2912 2052 s0228.exe 46 PID 2052 wrote to memory of 2912 2052 s0228.exe 46 PID 2052 wrote to memory of 2912 2052 s0228.exe 46 PID 2052 wrote to memory of 2912 2052 s0228.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe"C:\Users\Admin\AppData\Local\Temp\7fec050a290195cbf196bc875f9b6dd618e1d232d20d4d956bad262fec8a3d9bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\4046682.exec:\4046682.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\264422.exec:\264422.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\pjvdj.exec:\pjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\dvppv.exec:\dvppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhnthn.exec:\nhnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bbbnhn.exec:\bbbnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\dvjvd.exec:\dvjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\lrxxxll.exec:\lrxxxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xrllrrl.exec:\xrllrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\6080628.exec:\6080628.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\820688.exec:\820688.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\fxffrrf.exec:\fxffrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\42040.exec:\42040.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\3jjjv.exec:\3jjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\s0228.exec:\s0228.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\pddvj.exec:\pddvj.exe17⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vjvpv.exec:\vjvpv.exe18⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxrrxfr.exec:\lxrrxfr.exe19⤵
- Executes dropped EXE
PID:2096 -
\??\c:\fflrrlx.exec:\fflrrlx.exe20⤵
- Executes dropped EXE
PID:304 -
\??\c:\426828.exec:\426828.exe21⤵
- Executes dropped EXE
PID:2040 -
\??\c:\60888.exec:\60888.exe22⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nhnttt.exec:\nhnttt.exe23⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1fxrxff.exec:\1fxrxff.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\bnbttb.exec:\bnbttb.exe25⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5xrllrf.exec:\5xrllrf.exe26⤵
- Executes dropped EXE
PID:1340 -
\??\c:\0806224.exec:\0806224.exe27⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pjvjp.exec:\pjvjp.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\08044.exec:\08044.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\8244062.exec:\8244062.exe30⤵
- Executes dropped EXE
PID:652 -
\??\c:\1flflrf.exec:\1flflrf.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\o040846.exec:\o040846.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bbntbh.exec:\bbntbh.exe33⤵
- Executes dropped EXE
PID:1548 -
\??\c:\ffrrrff.exec:\ffrrrff.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\68806.exec:\68806.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lrrlflx.exec:\lrrlflx.exe36⤵
- Executes dropped EXE
PID:2988 -
\??\c:\6800662.exec:\6800662.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\2420284.exec:\2420284.exe38⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vppjp.exec:\vppjp.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\frlllrf.exec:\frlllrf.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pvpdj.exec:\pvpdj.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\k44022.exec:\k44022.exe42⤵
- Executes dropped EXE
PID:1532 -
\??\c:\i460606.exec:\i460606.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\86406.exec:\86406.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\200062.exec:\200062.exe46⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1vjjp.exec:\1vjjp.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3jvpv.exec:\3jvpv.exe48⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vpdjj.exec:\vpdjj.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\8686666.exec:\8686666.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bnthnh.exec:\bnthnh.exe51⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dpvvd.exec:\dpvvd.exe52⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1xxfllr.exec:\1xxfllr.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\42440.exec:\42440.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\086688.exec:\086688.exe55⤵
- Executes dropped EXE
PID:2544 -
\??\c:\s4628.exec:\s4628.exe56⤵
- Executes dropped EXE
PID:408 -
\??\c:\0866228.exec:\0866228.exe57⤵
- Executes dropped EXE
PID:1256 -
\??\c:\06000.exec:\06000.exe58⤵
- Executes dropped EXE
PID:1860 -
\??\c:\2022828.exec:\2022828.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\48062.exec:\48062.exe60⤵
- Executes dropped EXE
PID:3028 -
\??\c:\0824620.exec:\0824620.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ppddp.exec:\ppddp.exe62⤵
- Executes dropped EXE
PID:2388 -
\??\c:\4262828.exec:\4262828.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\6800660.exec:\6800660.exe64⤵
- Executes dropped EXE
PID:1360 -
\??\c:\826244.exec:\826244.exe65⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vjddj.exec:\vjddj.exe66⤵PID:1980
-
\??\c:\3lxxrrx.exec:\3lxxrrx.exe67⤵PID:1720
-
\??\c:\thtbhh.exec:\thtbhh.exe68⤵PID:1596
-
\??\c:\82406.exec:\82406.exe69⤵PID:1500
-
\??\c:\k68800.exec:\k68800.exe70⤵PID:1676
-
\??\c:\fxrfllf.exec:\fxrfllf.exe71⤵PID:1648
-
\??\c:\hbnhnt.exec:\hbnhnt.exe72⤵PID:1692
-
\??\c:\bntttt.exec:\bntttt.exe73⤵PID:1660
-
\??\c:\ppppv.exec:\ppppv.exe74⤵PID:2396
-
\??\c:\008688.exec:\008688.exe75⤵PID:2796
-
\??\c:\w20682.exec:\w20682.exe76⤵PID:2200
-
\??\c:\g0288.exec:\g0288.exe77⤵PID:2768
-
\??\c:\3bntth.exec:\3bntth.exe78⤵PID:2872
-
\??\c:\264088.exec:\264088.exe79⤵PID:2828
-
\??\c:\rlxxffr.exec:\rlxxffr.exe80⤵PID:2812
-
\??\c:\5vdjd.exec:\5vdjd.exe81⤵PID:2808
-
\??\c:\lflrxfr.exec:\lflrxfr.exe82⤵PID:2668
-
\??\c:\6240624.exec:\6240624.exe83⤵PID:1532
-
\??\c:\pdvjp.exec:\pdvjp.exe84⤵PID:2616
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe85⤵PID:2664
-
\??\c:\u400062.exec:\u400062.exe86⤵PID:2628
-
\??\c:\264026.exec:\264026.exe87⤵PID:1672
-
\??\c:\q20622.exec:\q20622.exe88⤵PID:1616
-
\??\c:\4206886.exec:\4206886.exe89⤵PID:2960
-
\??\c:\bnbbhh.exec:\bnbbhh.exe90⤵PID:2952
-
\??\c:\k02448.exec:\k02448.exe91⤵PID:1948
-
\??\c:\620028.exec:\620028.exe92⤵PID:764
-
\??\c:\5vvdv.exec:\5vvdv.exe93⤵PID:2912
-
\??\c:\608024.exec:\608024.exe94⤵PID:2508
-
\??\c:\00464.exec:\00464.exe95⤵PID:2284
-
\??\c:\fflxxrf.exec:\fflxxrf.exe96⤵PID:2840
-
\??\c:\4262402.exec:\4262402.exe97⤵PID:2036
-
\??\c:\rrxrxrl.exec:\rrxrxrl.exe98⤵PID:688
-
\??\c:\204640.exec:\204640.exe99⤵PID:2352
-
\??\c:\9jdjp.exec:\9jdjp.exe100⤵PID:1744
-
\??\c:\tnnbht.exec:\tnnbht.exe101⤵PID:604
-
\??\c:\0484006.exec:\0484006.exe102⤵PID:840
-
\??\c:\u040242.exec:\u040242.exe103⤵
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\nhhnbn.exec:\nhhnbn.exe104⤵PID:1520
-
\??\c:\64842.exec:\64842.exe105⤵PID:1512
-
\??\c:\042840.exec:\042840.exe106⤵PID:1788
-
\??\c:\82280.exec:\82280.exe107⤵PID:280
-
\??\c:\g2242.exec:\g2242.exe108⤵PID:2176
-
\??\c:\48242.exec:\48242.exe109⤵PID:2596
-
\??\c:\86402.exec:\86402.exe110⤵PID:2316
-
\??\c:\82824.exec:\82824.exe111⤵PID:652
-
\??\c:\880404.exec:\880404.exe112⤵PID:2276
-
\??\c:\frlrfxr.exec:\frlrfxr.exe113⤵PID:2300
-
\??\c:\vdvjv.exec:\vdvjv.exe114⤵PID:2516
-
\??\c:\q22480.exec:\q22480.exe115⤵PID:316
-
\??\c:\vpdpv.exec:\vpdpv.exe116⤵PID:1656
-
\??\c:\hhhthh.exec:\hhhthh.exe117⤵PID:2252
-
\??\c:\04242.exec:\04242.exe118⤵PID:868
-
\??\c:\2684002.exec:\2684002.exe119⤵PID:2620
-
\??\c:\xlxrffx.exec:\xlxrffx.exe120⤵PID:2820
-
\??\c:\nhhtnt.exec:\nhhtnt.exe121⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-