Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe
-
Size
453KB
-
MD5
fc7b93dbd66e828432c3a505895ed990
-
SHA1
463c1a1419477edc9cb14574b93e586c3d47ec1d
-
SHA256
09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50
-
SHA512
a75b5c69126dc64949b7547d0f89e8a14741ab64f9899d4cdecf58e55e4ab39efff5e300d7b29d8f0dd2394b4a2220115e87ef72df83eb64f0b8c0d0ab1d12ea
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-79-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2944-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-161-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1664-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1512-312-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1512-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-525-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2468-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-653-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2680-668-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2868-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 jdddj.exe 1940 rrlrrfl.exe 1772 btnthn.exe 2212 vvvvj.exe 2736 rflrrrr.exe 2760 7vddp.exe 2872 fxrfrrf.exe 2944 5btbtt.exe 2660 bbbhnt.exe 2684 rfrxllx.exe 2160 nhhnbb.exe 1520 fllxllx.exe 2592 rrlrfrx.exe 476 dvddd.exe 1420 rlfxxxf.exe 1364 3bbtbb.exe 1452 7dvjp.exe 2928 lrxrllx.exe 1664 hththh.exe 2112 vvpvj.exe 1824 tthntb.exe 1324 dvdjp.exe 1124 1flllrr.exe 1968 7vpvv.exe 1844 ddvdp.exe 2460 fxxfrrf.exe 1652 jvppp.exe 1416 xrfrfxf.exe 1804 htnntn.exe 1776 ppvvj.exe 1032 bnbhbh.exe 2532 3fxflrx.exe 1512 5frrxfl.exe 2408 jjddv.exe 2316 ppjjd.exe 1616 nhhtbb.exe 2816 pvppd.exe 2732 frxflrr.exe 2612 bthhnn.exe 2992 xxflxfx.exe 2652 7fflrlf.exe 2600 jjvvj.exe 3056 vvjjv.exe 2148 3xlrfrx.exe 1208 5bbtbn.exe 2160 ddpvj.exe 2512 9lxxllx.exe 592 9xlxffl.exe 1632 tnbnnn.exe 476 ppvjp.exe 1736 9jjjp.exe 624 rflfxrl.exe 852 5tnttb.exe 2892 5hbhbb.exe 2788 dpjpv.exe 2088 rfllllr.exe 2356 xlxxrxf.exe 2112 3ntnbt.exe 3048 3jjdj.exe 816 djvdd.exe 2584 lffflrx.exe 856 bnnttb.exe 820 hbnbtt.exe 2108 ddppv.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-312-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1512-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-446-0x0000000001C60000-0x0000000001C8A000-memory.dmp upx behavioral1/memory/2892-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-819-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbnth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2520 2100 09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe 30 PID 2100 wrote to memory of 2520 2100 09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe 30 PID 2100 wrote to memory of 2520 2100 09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe 30 PID 2100 wrote to memory of 2520 2100 09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe 30 PID 2520 wrote to memory of 1940 2520 jdddj.exe 31 PID 2520 wrote to memory of 1940 2520 jdddj.exe 31 PID 2520 wrote to memory of 1940 2520 jdddj.exe 31 PID 2520 wrote to memory of 1940 2520 jdddj.exe 31 PID 1940 wrote to memory of 1772 1940 rrlrrfl.exe 32 PID 1940 wrote to memory of 1772 1940 rrlrrfl.exe 32 PID 1940 wrote to memory of 1772 1940 rrlrrfl.exe 32 PID 1940 wrote to memory of 1772 1940 rrlrrfl.exe 32 PID 1772 wrote to memory of 2212 1772 btnthn.exe 33 PID 1772 wrote to memory of 2212 1772 btnthn.exe 33 PID 1772 wrote to memory of 2212 1772 btnthn.exe 33 PID 1772 wrote to memory of 2212 1772 btnthn.exe 33 PID 2212 wrote to memory of 2736 2212 vvvvj.exe 34 PID 2212 wrote to memory of 2736 2212 vvvvj.exe 34 PID 2212 wrote to memory of 2736 2212 vvvvj.exe 34 PID 2212 wrote to memory of 2736 2212 vvvvj.exe 34 PID 2736 wrote to memory of 2760 2736 rflrrrr.exe 35 PID 2736 wrote to memory of 2760 2736 rflrrrr.exe 35 PID 2736 wrote to memory of 2760 2736 rflrrrr.exe 35 PID 2736 wrote to memory of 2760 2736 rflrrrr.exe 35 PID 2760 wrote to memory of 2872 2760 7vddp.exe 36 PID 2760 wrote to memory of 2872 2760 7vddp.exe 36 PID 2760 wrote to memory of 2872 2760 7vddp.exe 36 PID 2760 wrote to memory of 2872 2760 7vddp.exe 36 PID 2872 wrote to memory of 2944 2872 fxrfrrf.exe 37 PID 2872 wrote to memory of 2944 2872 fxrfrrf.exe 37 PID 2872 wrote to memory of 2944 2872 fxrfrrf.exe 37 PID 2872 wrote to memory of 2944 2872 fxrfrrf.exe 37 PID 2944 wrote to memory of 2660 2944 5btbtt.exe 38 PID 2944 wrote to memory of 2660 2944 5btbtt.exe 38 PID 2944 wrote to memory of 2660 2944 5btbtt.exe 38 PID 2944 wrote to memory of 2660 2944 5btbtt.exe 38 PID 2660 wrote to memory of 2684 2660 bbbhnt.exe 39 PID 2660 wrote to memory of 2684 2660 bbbhnt.exe 39 PID 2660 wrote to memory of 2684 2660 bbbhnt.exe 39 PID 2660 wrote to memory of 2684 2660 bbbhnt.exe 39 PID 2684 wrote to memory of 2160 2684 rfrxllx.exe 40 PID 2684 wrote to memory of 2160 2684 rfrxllx.exe 40 PID 2684 wrote to memory of 2160 2684 rfrxllx.exe 40 PID 2684 wrote to memory of 2160 2684 rfrxllx.exe 40 PID 2160 wrote to memory of 1520 2160 nhhnbb.exe 41 PID 2160 wrote to memory of 1520 2160 nhhnbb.exe 41 PID 2160 wrote to memory of 1520 2160 nhhnbb.exe 41 PID 2160 wrote to memory of 1520 2160 nhhnbb.exe 41 PID 1520 wrote to memory of 2592 1520 fllxllx.exe 42 PID 1520 wrote to memory of 2592 1520 fllxllx.exe 42 PID 1520 wrote to memory of 2592 1520 fllxllx.exe 42 PID 1520 wrote to memory of 2592 1520 fllxllx.exe 42 PID 2592 wrote to memory of 476 2592 rrlrfrx.exe 43 PID 2592 wrote to memory of 476 2592 rrlrfrx.exe 43 PID 2592 wrote to memory of 476 2592 rrlrfrx.exe 43 PID 2592 wrote to memory of 476 2592 rrlrfrx.exe 43 PID 476 wrote to memory of 1420 476 dvddd.exe 44 PID 476 wrote to memory of 1420 476 dvddd.exe 44 PID 476 wrote to memory of 1420 476 dvddd.exe 44 PID 476 wrote to memory of 1420 476 dvddd.exe 44 PID 1420 wrote to memory of 1364 1420 rlfxxxf.exe 45 PID 1420 wrote to memory of 1364 1420 rlfxxxf.exe 45 PID 1420 wrote to memory of 1364 1420 rlfxxxf.exe 45 PID 1420 wrote to memory of 1364 1420 rlfxxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe"C:\Users\Admin\AppData\Local\Temp\09b27f95fbc34aa014ec03547b9d8c14bc02ceb2e757e92f90b6e9b23dc58d50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jdddj.exec:\jdddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rrlrrfl.exec:\rrlrrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\btnthn.exec:\btnthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vvvvj.exec:\vvvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\rflrrrr.exec:\rflrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\7vddp.exec:\7vddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\5btbtt.exec:\5btbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bbbhnt.exec:\bbbhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\rfrxllx.exec:\rfrxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nhhnbb.exec:\nhhnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\fllxllx.exec:\fllxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rrlrfrx.exec:\rrlrfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\dvddd.exec:\dvddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\3bbtbb.exec:\3bbtbb.exe17⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7dvjp.exec:\7dvjp.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\lrxrllx.exec:\lrxrllx.exe19⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hththh.exec:\hththh.exe20⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tthntb.exec:\tthntb.exe22⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dvdjp.exec:\dvdjp.exe23⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1flllrr.exec:\1flllrr.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\7vpvv.exec:\7vpvv.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ddvdp.exec:\ddvdp.exe26⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fxxfrrf.exec:\fxxfrrf.exe27⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jvppp.exec:\jvppp.exe28⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe29⤵
- Executes dropped EXE
PID:1416 -
\??\c:\htnntn.exec:\htnntn.exe30⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ppvvj.exec:\ppvvj.exe31⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bnbhbh.exec:\bnbhbh.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3fxflrx.exec:\3fxflrx.exe33⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5frrxfl.exec:\5frrxfl.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jjddv.exec:\jjddv.exe35⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppjjd.exec:\ppjjd.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nhhtbb.exec:\nhhtbb.exe37⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pvppd.exec:\pvppd.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frxflrr.exec:\frxflrr.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bthhnn.exec:\bthhnn.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xxflxfx.exec:\xxflxfx.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7fflrlf.exec:\7fflrlf.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jjvvj.exec:\jjvvj.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vvjjv.exec:\vvjjv.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3xlrfrx.exec:\3xlrfrx.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5bbtbn.exec:\5bbtbn.exe46⤵
- Executes dropped EXE
PID:1208 -
\??\c:\ddpvj.exec:\ddpvj.exe47⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9lxxllx.exec:\9lxxllx.exe48⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9xlxffl.exec:\9xlxffl.exe49⤵
- Executes dropped EXE
PID:592 -
\??\c:\tnbnnn.exec:\tnbnnn.exe50⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ppvjp.exec:\ppvjp.exe51⤵
- Executes dropped EXE
PID:476 -
\??\c:\9jjjp.exec:\9jjjp.exe52⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rflfxrl.exec:\rflfxrl.exe53⤵
- Executes dropped EXE
PID:624 -
\??\c:\5tnttb.exec:\5tnttb.exe54⤵
- Executes dropped EXE
PID:852 -
\??\c:\5hbhbb.exec:\5hbhbb.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dpjpv.exec:\dpjpv.exe56⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rfllllr.exec:\rfllllr.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xlxxrxf.exec:\xlxxrxf.exe58⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3ntnbt.exec:\3ntnbt.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3jjdj.exec:\3jjdj.exe60⤵
- Executes dropped EXE
PID:3048 -
\??\c:\djvdd.exec:\djvdd.exe61⤵
- Executes dropped EXE
PID:816 -
\??\c:\lffflrx.exec:\lffflrx.exe62⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bnnttb.exec:\bnnttb.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\hbnbtt.exec:\hbnbtt.exe64⤵
- Executes dropped EXE
PID:820 -
\??\c:\ddppv.exec:\ddppv.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fxlrxxr.exec:\fxlrxxr.exe66⤵PID:1844
-
\??\c:\bhbtht.exec:\bhbtht.exe67⤵PID:2460
-
\??\c:\3ppvd.exec:\3ppvd.exe68⤵PID:2948
-
\??\c:\vvpvj.exec:\vvpvj.exe69⤵PID:2468
-
\??\c:\xlfrrff.exec:\xlfrrff.exe70⤵PID:1808
-
\??\c:\bnbhnn.exec:\bnbhnn.exe71⤵PID:1436
-
\??\c:\bnbbhh.exec:\bnbbhh.exe72⤵PID:1624
-
\??\c:\jvvpd.exec:\jvvpd.exe73⤵PID:2100
-
\??\c:\1lrxlrx.exec:\1lrxlrx.exe74⤵PID:2528
-
\??\c:\nhbhnn.exec:\nhbhnn.exe75⤵PID:1992
-
\??\c:\hbbntb.exec:\hbbntb.exe76⤵PID:2920
-
\??\c:\pdjjp.exec:\pdjjp.exe77⤵PID:2380
-
\??\c:\lfflrfl.exec:\lfflrfl.exe78⤵PID:2472
-
\??\c:\xrrfrfx.exec:\xrrfrfx.exe79⤵PID:1616
-
\??\c:\5hbnbb.exec:\5hbnbb.exe80⤵PID:2824
-
\??\c:\vpjpd.exec:\vpjpd.exe81⤵PID:2764
-
\??\c:\jdvjd.exec:\jdvjd.exe82⤵PID:2364
-
\??\c:\lfrlxxx.exec:\lfrlxxx.exe83⤵PID:2744
-
\??\c:\thtthn.exec:\thtthn.exe84⤵PID:2944
-
\??\c:\vpddj.exec:\vpddj.exe85⤵PID:2940
-
\??\c:\djjpp.exec:\djjpp.exe86⤵PID:2720
-
\??\c:\lxxxrff.exec:\lxxxrff.exe87⤵PID:2680
-
\??\c:\3bthnb.exec:\3bthnb.exe88⤵PID:1644
-
\??\c:\jdpvv.exec:\jdpvv.exe89⤵PID:2636
-
\??\c:\pjdjd.exec:\pjdjd.exe90⤵PID:1468
-
\??\c:\9lrxllr.exec:\9lrxllr.exe91⤵PID:1260
-
\??\c:\nhthbb.exec:\nhthbb.exe92⤵PID:1584
-
\??\c:\bthntt.exec:\bthntt.exe93⤵PID:532
-
\??\c:\pppdp.exec:\pppdp.exe94⤵PID:1752
-
\??\c:\rlffxfr.exec:\rlffxfr.exe95⤵PID:1736
-
\??\c:\rrlrllr.exec:\rrlrllr.exe96⤵PID:624
-
\??\c:\vvjdd.exec:\vvjdd.exe97⤵PID:2912
-
\??\c:\pppdp.exec:\pppdp.exe98⤵PID:2132
-
\??\c:\lfflrrx.exec:\lfflrrx.exe99⤵PID:2868
-
\??\c:\hnbnnn.exec:\hnbnnn.exe100⤵PID:2088
-
\??\c:\bnhntt.exec:\bnhntt.exe101⤵PID:2076
-
\??\c:\5pppv.exec:\5pppv.exe102⤵PID:2112
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe103⤵PID:2464
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe104⤵PID:816
-
\??\c:\bnbhtt.exec:\bnbhtt.exe105⤵
- System Location Discovery: System Language Discovery
PID:1836 -
\??\c:\thtbhh.exec:\thtbhh.exe106⤵PID:1968
-
\??\c:\vjpjv.exec:\vjpjv.exe107⤵PID:2036
-
\??\c:\xfflrxl.exec:\xfflrxl.exe108⤵PID:1288
-
\??\c:\lxfllrr.exec:\lxfllrr.exe109⤵PID:2304
-
\??\c:\hbnnbt.exec:\hbnnbt.exe110⤵PID:3044
-
\??\c:\jddjv.exec:\jddjv.exe111⤵PID:2236
-
\??\c:\vpjvj.exec:\vpjvj.exe112⤵PID:556
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe113⤵PID:1416
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe114⤵PID:1796
-
\??\c:\5nnbnb.exec:\5nnbnb.exe115⤵PID:840
-
\??\c:\dvvvj.exec:\dvvvj.exe116⤵PID:3016
-
\??\c:\ffxlrrf.exec:\ffxlrrf.exe117⤵PID:2100
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe118⤵PID:1944
-
\??\c:\tnhnbb.exec:\tnhnbb.exe119⤵PID:2348
-
\??\c:\3dpvp.exec:\3dpvp.exe120⤵PID:1912
-
\??\c:\pvdvv.exec:\pvdvv.exe121⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-