Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe
-
Size
453KB
-
MD5
e2a29ffc1cb3699f4814ce88df1d0610
-
SHA1
b2ce5b90ef737bf83945bd4941f70f199c941e8b
-
SHA256
368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7b
-
SHA512
0419dee8b25b2b19452dfaec8abd9a086c28d93401e75d58a07f4432f66278bb401ea9fd196fb7f77039687c5a642fc17b0dbd230a2ecbb0d83acef52912142c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6:q7Tc2NYHUrAwfMp3CD6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/716-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/720-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-446-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/540-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-559-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2552-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-813-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2092-984-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2680 tttbnn.exe 2808 ttthtb.exe 2692 nhbnbb.exe 2812 jvpdv.exe 1296 vvjvd.exe 2640 7hhttb.exe 2748 dvjpv.exe 2908 5pvpd.exe 1276 1ppdp.exe 1780 1lxfxxl.exe 2988 5jdpd.exe 1132 bhtntb.exe 2928 vjppv.exe 2068 bhnbnh.exe 560 dddvj.exe 604 jjjdp.exe 1996 jjpjj.exe 1980 htbnhn.exe 2140 jppjd.exe 2992 hbnhnb.exe 960 vdpjj.exe 920 hhbnhn.exe 716 nhhnth.exe 2332 ffxlflx.exe 1368 5hbhtb.exe 1724 llxllxr.exe 2660 bhthht.exe 1244 9pvdv.exe 2460 lrrlflf.exe 720 djdjd.exe 1048 ffxfrxx.exe 1700 vvpvp.exe 2716 ffflxxr.exe 1596 hnbtth.exe 2780 dddvj.exe 2956 rxfrlff.exe 2612 hnntnb.exe 3052 pppdp.exe 2580 jjjvp.exe 2652 xxxrlfx.exe 1296 tbbbtn.exe 2620 dddvj.exe 2884 ddjpj.exe 1260 9llrlrr.exe 1112 bhttbn.exe 2560 vvvjv.exe 2984 lrxllxx.exe 2888 bhtthn.exe 2360 jvvjd.exe 2896 jjpdj.exe 1748 lrxxrll.exe 1960 ntntnt.exe 2132 1pdjv.exe 2252 rrxlfrl.exe 2196 xllxrff.exe 2384 3hhtnt.exe 1588 jvpdj.exe 2152 7llfrfx.exe 2264 tbbtbb.exe 540 5pppd.exe 628 7xxfflx.exe 280 xfllfxr.exe 600 bbhbbt.exe 2476 dppdd.exe -
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/720-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-446-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2264-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-950-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-1090-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlflf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2680 2244 368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe 30 PID 2244 wrote to memory of 2680 2244 368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe 30 PID 2244 wrote to memory of 2680 2244 368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe 30 PID 2244 wrote to memory of 2680 2244 368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe 30 PID 2680 wrote to memory of 2808 2680 tttbnn.exe 31 PID 2680 wrote to memory of 2808 2680 tttbnn.exe 31 PID 2680 wrote to memory of 2808 2680 tttbnn.exe 31 PID 2680 wrote to memory of 2808 2680 tttbnn.exe 31 PID 2808 wrote to memory of 2692 2808 ttthtb.exe 32 PID 2808 wrote to memory of 2692 2808 ttthtb.exe 32 PID 2808 wrote to memory of 2692 2808 ttthtb.exe 32 PID 2808 wrote to memory of 2692 2808 ttthtb.exe 32 PID 2692 wrote to memory of 2812 2692 nhbnbb.exe 33 PID 2692 wrote to memory of 2812 2692 nhbnbb.exe 33 PID 2692 wrote to memory of 2812 2692 nhbnbb.exe 33 PID 2692 wrote to memory of 2812 2692 nhbnbb.exe 33 PID 2812 wrote to memory of 1296 2812 jvpdv.exe 34 PID 2812 wrote to memory of 1296 2812 jvpdv.exe 34 PID 2812 wrote to memory of 1296 2812 jvpdv.exe 34 PID 2812 wrote to memory of 1296 2812 jvpdv.exe 34 PID 1296 wrote to memory of 2640 1296 vvjvd.exe 35 PID 1296 wrote to memory of 2640 1296 vvjvd.exe 35 PID 1296 wrote to memory of 2640 1296 vvjvd.exe 35 PID 1296 wrote to memory of 2640 1296 vvjvd.exe 35 PID 2640 wrote to memory of 2748 2640 7hhttb.exe 36 PID 2640 wrote to memory of 2748 2640 7hhttb.exe 36 PID 2640 wrote to memory of 2748 2640 7hhttb.exe 36 PID 2640 wrote to memory of 2748 2640 7hhttb.exe 36 PID 2748 wrote to memory of 2908 2748 dvjpv.exe 37 PID 2748 wrote to memory of 2908 2748 dvjpv.exe 37 PID 2748 wrote to memory of 2908 2748 dvjpv.exe 37 PID 2748 wrote to memory of 2908 2748 dvjpv.exe 37 PID 2908 wrote to memory of 1276 2908 5pvpd.exe 38 PID 2908 wrote to memory of 1276 2908 5pvpd.exe 38 PID 2908 wrote to memory of 1276 2908 5pvpd.exe 38 PID 2908 wrote to memory of 1276 2908 5pvpd.exe 38 PID 1276 wrote to memory of 1780 1276 1ppdp.exe 39 PID 1276 wrote to memory of 1780 1276 1ppdp.exe 39 PID 1276 wrote to memory of 1780 1276 1ppdp.exe 39 PID 1276 wrote to memory of 1780 1276 1ppdp.exe 39 PID 1780 wrote to memory of 2988 1780 1lxfxxl.exe 40 PID 1780 wrote to memory of 2988 1780 1lxfxxl.exe 40 PID 1780 wrote to memory of 2988 1780 1lxfxxl.exe 40 PID 1780 wrote to memory of 2988 1780 1lxfxxl.exe 40 PID 2988 wrote to memory of 1132 2988 5jdpd.exe 41 PID 2988 wrote to memory of 1132 2988 5jdpd.exe 41 PID 2988 wrote to memory of 1132 2988 5jdpd.exe 41 PID 2988 wrote to memory of 1132 2988 5jdpd.exe 41 PID 1132 wrote to memory of 2928 1132 bhtntb.exe 42 PID 1132 wrote to memory of 2928 1132 bhtntb.exe 42 PID 1132 wrote to memory of 2928 1132 bhtntb.exe 42 PID 1132 wrote to memory of 2928 1132 bhtntb.exe 42 PID 2928 wrote to memory of 2068 2928 vjppv.exe 43 PID 2928 wrote to memory of 2068 2928 vjppv.exe 43 PID 2928 wrote to memory of 2068 2928 vjppv.exe 43 PID 2928 wrote to memory of 2068 2928 vjppv.exe 43 PID 2068 wrote to memory of 560 2068 bhnbnh.exe 44 PID 2068 wrote to memory of 560 2068 bhnbnh.exe 44 PID 2068 wrote to memory of 560 2068 bhnbnh.exe 44 PID 2068 wrote to memory of 560 2068 bhnbnh.exe 44 PID 560 wrote to memory of 604 560 dddvj.exe 45 PID 560 wrote to memory of 604 560 dddvj.exe 45 PID 560 wrote to memory of 604 560 dddvj.exe 45 PID 560 wrote to memory of 604 560 dddvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe"C:\Users\Admin\AppData\Local\Temp\368a1d4a71a3060cc5374d61b50030d1eda2e9118a143f99e003923cbf9a5e7bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\tttbnn.exec:\tttbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ttthtb.exec:\ttthtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\nhbnbb.exec:\nhbnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jvpdv.exec:\jvpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vvjvd.exec:\vvjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\7hhttb.exec:\7hhttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\dvjpv.exec:\dvjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\5pvpd.exec:\5pvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\1ppdp.exec:\1ppdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\1lxfxxl.exec:\1lxfxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\5jdpd.exec:\5jdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\bhtntb.exec:\bhtntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\vjppv.exec:\vjppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\bhnbnh.exec:\bhnbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\dddvj.exec:\dddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\jjjdp.exec:\jjjdp.exe17⤵
- Executes dropped EXE
PID:604 -
\??\c:\jjpjj.exec:\jjpjj.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\htbnhn.exec:\htbnhn.exe19⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jppjd.exec:\jppjd.exe20⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbnhnb.exec:\hbnhnb.exe21⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vdpjj.exec:\vdpjj.exe22⤵
- Executes dropped EXE
PID:960 -
\??\c:\hhbnhn.exec:\hhbnhn.exe23⤵
- Executes dropped EXE
PID:920 -
\??\c:\nhhnth.exec:\nhhnth.exe24⤵
- Executes dropped EXE
PID:716 -
\??\c:\ffxlflx.exec:\ffxlflx.exe25⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5hbhtb.exec:\5hbhtb.exe26⤵
- Executes dropped EXE
PID:1368 -
\??\c:\llxllxr.exec:\llxllxr.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bhthht.exec:\bhthht.exe28⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9pvdv.exec:\9pvdv.exe29⤵
- Executes dropped EXE
PID:1244 -
\??\c:\lrrlflf.exec:\lrrlflf.exe30⤵
- Executes dropped EXE
PID:2460 -
\??\c:\djdjd.exec:\djdjd.exe31⤵
- Executes dropped EXE
PID:720 -
\??\c:\ffxfrxx.exec:\ffxfrxx.exe32⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vvpvp.exec:\vvpvp.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ffflxxr.exec:\ffflxxr.exe34⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hnbtth.exec:\hnbtth.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dddvj.exec:\dddvj.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rxfrlff.exec:\rxfrlff.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hnntnb.exec:\hnntnb.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pppdp.exec:\pppdp.exe39⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jjjvp.exec:\jjjvp.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tbbbtn.exec:\tbbbtn.exe42⤵
- Executes dropped EXE
PID:1296 -
\??\c:\dddvj.exec:\dddvj.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ddjpj.exec:\ddjpj.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
\??\c:\9llrlrr.exec:\9llrlrr.exe45⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bhttbn.exec:\bhttbn.exe46⤵
- Executes dropped EXE
PID:1112 -
\??\c:\vvvjv.exec:\vvvjv.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lrxllxx.exec:\lrxllxx.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\bhtthn.exec:\bhtthn.exe49⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jvvjd.exec:\jvvjd.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jjpdj.exec:\jjpdj.exe51⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lrxxrll.exec:\lrxxrll.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ntntnt.exec:\ntntnt.exe53⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1pdjv.exec:\1pdjv.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rrxlfrl.exec:\rrxlfrl.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xllxrff.exec:\xllxrff.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3hhtnt.exec:\3hhtnt.exe57⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jvpdj.exec:\jvpdj.exe58⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7llfrfx.exec:\7llfrfx.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tbbtbb.exec:\tbbtbb.exe60⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5pppd.exec:\5pppd.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\7xxfflx.exec:\7xxfflx.exe62⤵
- Executes dropped EXE
PID:628 -
\??\c:\xfllfxr.exec:\xfllfxr.exe63⤵
- Executes dropped EXE
PID:280 -
\??\c:\bbhbbt.exec:\bbhbbt.exe64⤵
- Executes dropped EXE
PID:600 -
\??\c:\dppdd.exec:\dppdd.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fffrfrr.exec:\fffrfrr.exe66⤵PID:2332
-
\??\c:\jpjvj.exec:\jpjvj.exe67⤵PID:1736
-
\??\c:\dpvjd.exec:\dpvjd.exe68⤵PID:1268
-
\??\c:\9lfrrfr.exec:\9lfrrfr.exe69⤵PID:2656
-
\??\c:\bntnnh.exec:\bntnnh.exe70⤵PID:652
-
\??\c:\ppdpp.exec:\ppdpp.exe71⤵PID:2052
-
\??\c:\fffffxx.exec:\fffffxx.exe72⤵PID:1636
-
\??\c:\nhhnhn.exec:\nhhnhn.exe73⤵PID:2336
-
\??\c:\jddvp.exec:\jddvp.exe74⤵PID:1760
-
\??\c:\rfxfrrl.exec:\rfxfrrl.exe75⤵PID:2428
-
\??\c:\7xxlfrl.exec:\7xxlfrl.exe76⤵PID:1700
-
\??\c:\bhhthh.exec:\bhhthh.exe77⤵PID:2796
-
\??\c:\vvpvp.exec:\vvpvp.exe78⤵PID:1604
-
\??\c:\lrrflxr.exec:\lrrflxr.exe79⤵PID:2584
-
\??\c:\7hbhtt.exec:\7hbhtt.exe80⤵PID:2840
-
\??\c:\hbbhbb.exec:\hbbhbb.exe81⤵PID:2604
-
\??\c:\pvjjd.exec:\pvjjd.exe82⤵PID:2612
-
\??\c:\llflxfx.exec:\llflxfx.exe83⤵
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\3hbnht.exec:\3hbnht.exe84⤵PID:2580
-
\??\c:\1vvvp.exec:\1vvvp.exe85⤵PID:1632
-
\??\c:\rflfrlx.exec:\rflfrlx.exe86⤵PID:3048
-
\??\c:\bbtnbn.exec:\bbtnbn.exe87⤵PID:2744
-
\??\c:\tnbhtb.exec:\tnbhtb.exe88⤵PID:2552
-
\??\c:\vvdjd.exec:\vvdjd.exe89⤵PID:2004
-
\??\c:\1rxxfxl.exec:\1rxxfxl.exe90⤵PID:1112
-
\??\c:\3ttnhn.exec:\3ttnhn.exe91⤵PID:2536
-
\??\c:\dpjdj.exec:\dpjdj.exe92⤵PID:2984
-
\??\c:\jppjj.exec:\jppjj.exe93⤵PID:1132
-
\??\c:\rxllllx.exec:\rxllllx.exe94⤵PID:2220
-
\??\c:\ttbtnt.exec:\ttbtnt.exe95⤵PID:1036
-
\??\c:\pddjv.exec:\pddjv.exe96⤵PID:692
-
\??\c:\djjpj.exec:\djjpj.exe97⤵PID:796
-
\??\c:\ffflfrf.exec:\ffflfrf.exe98⤵PID:1784
-
\??\c:\thhbhn.exec:\thhbhn.exe99⤵PID:2184
-
\??\c:\pdvpv.exec:\pdvpv.exe100⤵PID:2196
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe101⤵PID:2164
-
\??\c:\ntbtth.exec:\ntbtth.exe102⤵PID:2120
-
\??\c:\pvdvd.exec:\pvdvd.exe103⤵PID:1280
-
\??\c:\pvvdp.exec:\pvvdp.exe104⤵PID:1952
-
\??\c:\xxfllrx.exec:\xxfllrx.exe105⤵PID:2060
-
\??\c:\htnttb.exec:\htnttb.exe106⤵PID:2064
-
\??\c:\vvpdj.exec:\vvpdj.exe107⤵PID:2236
-
\??\c:\lflxxlf.exec:\lflxxlf.exe108⤵PID:716
-
\??\c:\3hbhnb.exec:\3hbhnb.exe109⤵PID:1544
-
\??\c:\vjvvj.exec:\vjvvj.exe110⤵PID:1556
-
\??\c:\rlllxrx.exec:\rlllxrx.exe111⤵PID:1820
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe112⤵PID:2500
-
\??\c:\bhhthb.exec:\bhhthb.exe113⤵PID:2300
-
\??\c:\ddjvd.exec:\ddjvd.exe114⤵PID:2112
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe115⤵PID:3068
-
\??\c:\nnnhnn.exec:\nnnhnn.exe116⤵PID:1744
-
\??\c:\jjdpj.exec:\jjdpj.exe117⤵PID:1052
-
\??\c:\flfxxrr.exec:\flfxxrr.exe118⤵PID:896
-
\??\c:\ffrflfl.exec:\ffrflfl.exe119⤵PID:2440
-
\??\c:\7hhhtb.exec:\7hhhtb.exe120⤵PID:2776
-
\??\c:\9ddvv.exec:\9ddvv.exe121⤵PID:2724
-
\??\c:\xrrlfrl.exec:\xrrlfrl.exe122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-