Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe
-
Size
454KB
-
MD5
d7dd789d286593186c5c95703b026a90
-
SHA1
0fb0d076b4711a9a2beda85a118fb7771de1e4ec
-
SHA256
9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2
-
SHA512
b27eb294d7ce18a7d1c02e441a2b8f6585720b202abf6fdb232cb9155a5fe46c57c29b4982cb95227efc956549015ce5a161602025c17f16b749e07909f37eff
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1760-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-39-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-313-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-498-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2544-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-573-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-919-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-928-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-1166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-1261-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-1322-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1072-1381-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1496 7dvvp.exe 1436 vdjvj.exe 2796 1frxlrf.exe 2752 bbntbh.exe 2880 3xllrrx.exe 2684 bhbhnb.exe 2872 lfrxlxl.exe 2628 1fffrrf.exe 2244 3xffrlr.exe 2532 xlxxfrl.exe 2072 fflrfff.exe 1676 1jpdj.exe 1964 rrxxxff.exe 1728 vvjvp.exe 3004 llxxfrf.exe 1424 1nhhhn.exe 2468 pvvdj.exe 572 nnbhhh.exe 1492 vpvdv.exe 2964 fxfxrlx.exe 2220 bnttbt.exe 836 7dvvj.exe 2852 tthbht.exe 1504 lrfxffr.exe 1528 ttthth.exe 2352 vvjpv.exe 2112 rrxlxxx.exe 1048 bbhbhn.exe 1136 jppjj.exe 1576 nntbhn.exe 764 jdppv.exe 1880 thnntt.exe 1760 bhhbhn.exe 1720 9frxlff.exe 2888 llrrffx.exe 2724 5hnnhn.exe 2816 5vdvv.exe 2820 rrxxflx.exe 2720 7htthh.exe 2840 tttbtb.exe 2844 pjpjp.exe 2832 lllrxrx.exe 2616 tntbhh.exe 2068 pjpjv.exe 2972 jvvvv.exe 1580 7fxrrff.exe 316 ntbnnn.exe 1840 ppddd.exe 1512 pdddp.exe 1976 xlllxff.exe 1704 bbbbbb.exe 2412 hhtbbn.exe 2636 djddj.exe 2480 xlxrffl.exe 2116 btbbhb.exe 1744 thnbhn.exe 572 vvpjp.exe 264 1xrxflr.exe 2388 tbhbhh.exe 2192 djddp.exe 2220 xxfxxxl.exe 2196 9xflrrf.exe 2544 hbhhnh.exe 2852 5vppd.exe -
resource yara_rule behavioral1/memory/1760-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-67-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2872-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-928-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2068-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-1166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-1323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-1354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-1381-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrlxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1496 1760 9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe 30 PID 1760 wrote to memory of 1496 1760 9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe 30 PID 1760 wrote to memory of 1496 1760 9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe 30 PID 1760 wrote to memory of 1496 1760 9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe 30 PID 1496 wrote to memory of 1436 1496 7dvvp.exe 31 PID 1496 wrote to memory of 1436 1496 7dvvp.exe 31 PID 1496 wrote to memory of 1436 1496 7dvvp.exe 31 PID 1496 wrote to memory of 1436 1496 7dvvp.exe 31 PID 1436 wrote to memory of 2796 1436 vdjvj.exe 32 PID 1436 wrote to memory of 2796 1436 vdjvj.exe 32 PID 1436 wrote to memory of 2796 1436 vdjvj.exe 32 PID 1436 wrote to memory of 2796 1436 vdjvj.exe 32 PID 2796 wrote to memory of 2752 2796 1frxlrf.exe 33 PID 2796 wrote to memory of 2752 2796 1frxlrf.exe 33 PID 2796 wrote to memory of 2752 2796 1frxlrf.exe 33 PID 2796 wrote to memory of 2752 2796 1frxlrf.exe 33 PID 2752 wrote to memory of 2880 2752 bbntbh.exe 34 PID 2752 wrote to memory of 2880 2752 bbntbh.exe 34 PID 2752 wrote to memory of 2880 2752 bbntbh.exe 34 PID 2752 wrote to memory of 2880 2752 bbntbh.exe 34 PID 2880 wrote to memory of 2684 2880 3xllrrx.exe 35 PID 2880 wrote to memory of 2684 2880 3xllrrx.exe 35 PID 2880 wrote to memory of 2684 2880 3xllrrx.exe 35 PID 2880 wrote to memory of 2684 2880 3xllrrx.exe 35 PID 2684 wrote to memory of 2872 2684 bhbhnb.exe 36 PID 2684 wrote to memory of 2872 2684 bhbhnb.exe 36 PID 2684 wrote to memory of 2872 2684 bhbhnb.exe 36 PID 2684 wrote to memory of 2872 2684 bhbhnb.exe 36 PID 2872 wrote to memory of 2628 2872 lfrxlxl.exe 37 PID 2872 wrote to memory of 2628 2872 lfrxlxl.exe 37 PID 2872 wrote to memory of 2628 2872 lfrxlxl.exe 37 PID 2872 wrote to memory of 2628 2872 lfrxlxl.exe 37 PID 2628 wrote to memory of 2244 2628 1fffrrf.exe 38 PID 2628 wrote to memory of 2244 2628 1fffrrf.exe 38 PID 2628 wrote to memory of 2244 2628 1fffrrf.exe 38 PID 2628 wrote to memory of 2244 2628 1fffrrf.exe 38 PID 2244 wrote to memory of 2532 2244 3xffrlr.exe 39 PID 2244 wrote to memory of 2532 2244 3xffrlr.exe 39 PID 2244 wrote to memory of 2532 2244 3xffrlr.exe 39 PID 2244 wrote to memory of 2532 2244 3xffrlr.exe 39 PID 2532 wrote to memory of 2072 2532 xlxxfrl.exe 40 PID 2532 wrote to memory of 2072 2532 xlxxfrl.exe 40 PID 2532 wrote to memory of 2072 2532 xlxxfrl.exe 40 PID 2532 wrote to memory of 2072 2532 xlxxfrl.exe 40 PID 2072 wrote to memory of 1676 2072 fflrfff.exe 41 PID 2072 wrote to memory of 1676 2072 fflrfff.exe 41 PID 2072 wrote to memory of 1676 2072 fflrfff.exe 41 PID 2072 wrote to memory of 1676 2072 fflrfff.exe 41 PID 1676 wrote to memory of 1964 1676 1jpdj.exe 42 PID 1676 wrote to memory of 1964 1676 1jpdj.exe 42 PID 1676 wrote to memory of 1964 1676 1jpdj.exe 42 PID 1676 wrote to memory of 1964 1676 1jpdj.exe 42 PID 1964 wrote to memory of 1728 1964 rrxxxff.exe 43 PID 1964 wrote to memory of 1728 1964 rrxxxff.exe 43 PID 1964 wrote to memory of 1728 1964 rrxxxff.exe 43 PID 1964 wrote to memory of 1728 1964 rrxxxff.exe 43 PID 1728 wrote to memory of 3004 1728 vvjvp.exe 44 PID 1728 wrote to memory of 3004 1728 vvjvp.exe 44 PID 1728 wrote to memory of 3004 1728 vvjvp.exe 44 PID 1728 wrote to memory of 3004 1728 vvjvp.exe 44 PID 3004 wrote to memory of 1424 3004 llxxfrf.exe 45 PID 3004 wrote to memory of 1424 3004 llxxfrf.exe 45 PID 3004 wrote to memory of 1424 3004 llxxfrf.exe 45 PID 3004 wrote to memory of 1424 3004 llxxfrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe"C:\Users\Admin\AppData\Local\Temp\9621967e88f22f0e5995c8b05017479c5d62b1777a13bae78e9eedf39f7ae4f2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\7dvvp.exec:\7dvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\vdjvj.exec:\vdjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\1frxlrf.exec:\1frxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bbntbh.exec:\bbntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3xllrrx.exec:\3xllrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bhbhnb.exec:\bhbhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lfrxlxl.exec:\lfrxlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1fffrrf.exec:\1fffrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3xffrlr.exec:\3xffrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xlxxfrl.exec:\xlxxfrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\fflrfff.exec:\fflrfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\1jpdj.exec:\1jpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\rrxxxff.exec:\rrxxxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\vvjvp.exec:\vvjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\llxxfrf.exec:\llxxfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\1nhhhn.exec:\1nhhhn.exe17⤵
- Executes dropped EXE
PID:1424 -
\??\c:\pvvdj.exec:\pvvdj.exe18⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nnbhhh.exec:\nnbhhh.exe19⤵
- Executes dropped EXE
PID:572 -
\??\c:\vpvdv.exec:\vpvdv.exe20⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxfxrlx.exec:\fxfxrlx.exe21⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bnttbt.exec:\bnttbt.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7dvvj.exec:\7dvvj.exe23⤵
- Executes dropped EXE
PID:836 -
\??\c:\tthbht.exec:\tthbht.exe24⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lrfxffr.exec:\lrfxffr.exe25⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ttthth.exec:\ttthth.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vvjpv.exec:\vvjpv.exe27⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rrxlxxx.exec:\rrxlxxx.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bbhbhn.exec:\bbhbhn.exe29⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jppjj.exec:\jppjj.exe30⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nntbhn.exec:\nntbhn.exe31⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jdppv.exec:\jdppv.exe32⤵
- Executes dropped EXE
PID:764 -
\??\c:\thnntt.exec:\thnntt.exe33⤵
- Executes dropped EXE
PID:1880 -
\??\c:\bhhbhn.exec:\bhhbhn.exe34⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9frxlff.exec:\9frxlff.exe35⤵
- Executes dropped EXE
PID:1720 -
\??\c:\llrrffx.exec:\llrrffx.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5hnnhn.exec:\5hnnhn.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5vdvv.exec:\5vdvv.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rrxxflx.exec:\rrxxflx.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7htthh.exec:\7htthh.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tttbtb.exec:\tttbtb.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\pjpjp.exec:\pjpjp.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lllrxrx.exec:\lllrxrx.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tntbhh.exec:\tntbhh.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjpjv.exec:\pjpjv.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jvvvv.exec:\jvvvv.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7fxrrff.exec:\7fxrrff.exe47⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ntbnnn.exec:\ntbnnn.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\ppddd.exec:\ppddd.exe49⤵
- Executes dropped EXE
PID:1840 -
\??\c:\pdddp.exec:\pdddp.exe50⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xlllxff.exec:\xlllxff.exe51⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bbbbbb.exec:\bbbbbb.exe52⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hhtbbn.exec:\hhtbbn.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\djddj.exec:\djddj.exe54⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xlxrffl.exec:\xlxrffl.exe55⤵
- Executes dropped EXE
PID:2480 -
\??\c:\btbbhb.exec:\btbbhb.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\thnbhn.exec:\thnbhn.exe57⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vvpjp.exec:\vvpjp.exe58⤵
- Executes dropped EXE
PID:572 -
\??\c:\1xrxflr.exec:\1xrxflr.exe59⤵
- Executes dropped EXE
PID:264 -
\??\c:\tbhbhh.exec:\tbhbhh.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\djddp.exec:\djddp.exe61⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxfxxxl.exec:\xxfxxxl.exe62⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9xflrrf.exec:\9xflrrf.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hbhhnh.exec:\hbhhnh.exe64⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5vppd.exec:\5vppd.exe65⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lllflrx.exec:\lllflrx.exe66⤵PID:1660
-
\??\c:\hnhntt.exec:\hnhntt.exe67⤵PID:1476
-
\??\c:\3tnbnt.exec:\3tnbnt.exe68⤵PID:1748
-
\??\c:\vjdjj.exec:\vjdjj.exe69⤵PID:820
-
\??\c:\5frrlxf.exec:\5frrlxf.exe70⤵PID:2916
-
\??\c:\tnbttb.exec:\tnbttb.exe71⤵PID:556
-
\??\c:\djvdj.exec:\djvdj.exe72⤵PID:2904
-
\??\c:\jjjjv.exec:\jjjjv.exe73⤵PID:2336
-
\??\c:\fxlxflx.exec:\fxlxflx.exe74⤵PID:1896
-
\??\c:\7hhbhb.exec:\7hhbhb.exe75⤵PID:1732
-
\??\c:\pjdvd.exec:\pjdvd.exe76⤵PID:1604
-
\??\c:\ddvdd.exec:\ddvdd.exe77⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\rrflxlr.exec:\rrflxlr.exe78⤵PID:1496
-
\??\c:\1btnhb.exec:\1btnhb.exe79⤵PID:2776
-
\??\c:\7dvjp.exec:\7dvjp.exe80⤵PID:2808
-
\??\c:\jpjvj.exec:\jpjvj.exe81⤵PID:2828
-
\??\c:\lffxllx.exec:\lffxllx.exe82⤵PID:3032
-
\??\c:\5bttbb.exec:\5bttbb.exe83⤵PID:3016
-
\??\c:\dvjdj.exec:\dvjdj.exe84⤵PID:2624
-
\??\c:\pvddd.exec:\pvddd.exe85⤵PID:2708
-
\??\c:\9xrflrf.exec:\9xrflrf.exe86⤵PID:2760
-
\??\c:\ttntbn.exec:\ttntbn.exe87⤵PID:2872
-
\??\c:\ddjdj.exec:\ddjdj.exe88⤵PID:2616
-
\??\c:\jjpvv.exec:\jjpvv.exe89⤵PID:2988
-
\??\c:\fxxfxfl.exec:\fxxfxfl.exe90⤵PID:2548
-
\??\c:\bthbbb.exec:\bthbbb.exe91⤵PID:1716
-
\??\c:\tbnntn.exec:\tbnntn.exe92⤵PID:316
-
\??\c:\jpjpd.exec:\jpjpd.exe93⤵PID:2696
-
\??\c:\1fllxfl.exec:\1fllxfl.exe94⤵PID:1512
-
\??\c:\nnbtnn.exec:\nnbtnn.exe95⤵PID:1940
-
\??\c:\bhtntb.exec:\bhtntb.exe96⤵PID:1932
-
\??\c:\7jddv.exec:\7jddv.exe97⤵PID:1860
-
\??\c:\rrxfrxf.exec:\rrxfrxf.exe98⤵PID:2992
-
\??\c:\hhnnbh.exec:\hhnnbh.exe99⤵PID:776
-
\??\c:\jdjdv.exec:\jdjdv.exe100⤵PID:1420
-
\??\c:\5pdpj.exec:\5pdpj.exe101⤵PID:1132
-
\??\c:\lrxfxfx.exec:\lrxfxfx.exe102⤵PID:1492
-
\??\c:\hnbhtb.exec:\hnbhtb.exe103⤵PID:2964
-
\??\c:\btnnth.exec:\btnnth.exe104⤵PID:2496
-
\??\c:\1dvpv.exec:\1dvpv.exe105⤵PID:840
-
\??\c:\fxlllrf.exec:\fxlllrf.exe106⤵PID:1696
-
\??\c:\nnnhnn.exec:\nnnhnn.exe107⤵PID:2000
-
\??\c:\hhhhbb.exec:\hhhhbb.exe108⤵PID:1452
-
\??\c:\pjjvj.exec:\pjjvj.exe109⤵PID:2564
-
\??\c:\lrfrxfl.exec:\lrfrxfl.exe110⤵PID:1968
-
\??\c:\rxlrxlx.exec:\rxlrxlx.exe111⤵PID:624
-
\??\c:\ntbhnb.exec:\ntbhnb.exe112⤵PID:2200
-
\??\c:\vdvvp.exec:\vdvvp.exe113⤵PID:2064
-
\??\c:\dvjjj.exec:\dvjjj.exe114⤵PID:1640
-
\??\c:\7xfrfrf.exec:\7xfrfrf.exe115⤵PID:1316
-
\??\c:\hnbhtt.exec:\hnbhtt.exe116⤵PID:1996
-
\??\c:\vjjvv.exec:\vjjvv.exe117⤵
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\xrxxrxf.exec:\xrxxrxf.exe118⤵PID:876
-
\??\c:\7btnbh.exec:\7btnbh.exe119⤵PID:1732
-
\??\c:\tnntnn.exec:\tnntnn.exe120⤵PID:1608
-
\??\c:\ddjvj.exec:\ddjvj.exe121⤵PID:2304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-