Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 00:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe
-
Size
453KB
-
MD5
09f71b43a2b4c441e7e5c42cdf6cefe0
-
SHA1
98fda3534bbf5f06ae1962ea3c8106c5a7eb853d
-
SHA256
08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07
-
SHA512
40e65507eed2c10bc31b4a0bbb35f3ed08d34bf30ade0ba8b93d9cff6c2defcf547970417286bd50665355d801948c53982160859e6c775f1267830f1344cbb9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/1780-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-40-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2816-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-98-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1720-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1292-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-245-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/980-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-388-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1964-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-433-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3004-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-561-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-695-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2420-724-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2112-763-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-834-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2556-883-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1744-936-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-957-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2232-1026-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2256-1052-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2468-1073-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2212-1102-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1780 vdjjd.exe 2216 xrlrxff.exe 2720 rrfrlrf.exe 2640 jddpd.exe 2816 xxrxlrl.exe 2784 vdvjv.exe 2804 5xlrlxl.exe 2752 jdvjp.exe 2600 bbbnnt.exe 2300 1pjpp.exe 1704 lfrflrl.exe 2288 bhbtth.exe 1720 vpvjd.exe 2280 btbnth.exe 1292 djjvp.exe 1320 btnhtb.exe 752 pjdjj.exe 852 dvvdj.exe 2848 lrlxlxl.exe 2716 3tnnbh.exe 444 9ppdv.exe 2028 bhbtht.exe 2712 rllxlrf.exe 1772 vdvpj.exe 1304 7rlllrr.exe 2976 hhhnhn.exe 2360 thtbbt.exe 980 xxllxxl.exe 1512 5btbnt.exe 2908 xrrxxfx.exe 1992 5pdpv.exe 1608 llfrxxf.exe 2904 btnntb.exe 2900 5vdpp.exe 2680 xrfxrxr.exe 2688 btnnbh.exe 2920 7nbbtb.exe 2544 jddjv.exe 2560 xrllxfl.exe 2804 7bbnth.exe 2548 nnnhbh.exe 2656 7pdvd.exe 2352 7rrxlrf.exe 1528 ttttbh.exe 1704 5btbnt.exe 1280 vpdpv.exe 860 xllrxfr.exe 1652 lfxfrxr.exe 1732 bnhnnh.exe 1488 jdjdj.exe 1964 pppdj.exe 1928 5rllrxx.exe 1764 ffrrlll.exe 1660 tttbnb.exe 668 vvvjv.exe 2124 xrxxlrf.exe 3004 rfflflx.exe 2936 nhhnbh.exe 2800 3ppjv.exe 1520 fxrlrxf.exe 2028 lllrlrl.exe 2944 9nnntn.exe 2220 jddpv.exe 3032 pdppv.exe -
resource yara_rule behavioral1/memory/1780-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-834-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2556-883-0x0000000000260000-0x000000000028A000-memory.dmp upx behavioral1/memory/1060-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-936-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-1026-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/444-1033-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2468-1073-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2212-1102-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/2344-1155-0x0000000000330000-0x000000000035A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 1780 1868 08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe 31 PID 1868 wrote to memory of 1780 1868 08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe 31 PID 1868 wrote to memory of 1780 1868 08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe 31 PID 1868 wrote to memory of 1780 1868 08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe 31 PID 1780 wrote to memory of 2216 1780 vdjjd.exe 32 PID 1780 wrote to memory of 2216 1780 vdjjd.exe 32 PID 1780 wrote to memory of 2216 1780 vdjjd.exe 32 PID 1780 wrote to memory of 2216 1780 vdjjd.exe 32 PID 2216 wrote to memory of 2720 2216 xrlrxff.exe 33 PID 2216 wrote to memory of 2720 2216 xrlrxff.exe 33 PID 2216 wrote to memory of 2720 2216 xrlrxff.exe 33 PID 2216 wrote to memory of 2720 2216 xrlrxff.exe 33 PID 2720 wrote to memory of 2640 2720 rrfrlrf.exe 34 PID 2720 wrote to memory of 2640 2720 rrfrlrf.exe 34 PID 2720 wrote to memory of 2640 2720 rrfrlrf.exe 34 PID 2720 wrote to memory of 2640 2720 rrfrlrf.exe 34 PID 2640 wrote to memory of 2816 2640 jddpd.exe 35 PID 2640 wrote to memory of 2816 2640 jddpd.exe 35 PID 2640 wrote to memory of 2816 2640 jddpd.exe 35 PID 2640 wrote to memory of 2816 2640 jddpd.exe 35 PID 2816 wrote to memory of 2784 2816 xxrxlrl.exe 36 PID 2816 wrote to memory of 2784 2816 xxrxlrl.exe 36 PID 2816 wrote to memory of 2784 2816 xxrxlrl.exe 36 PID 2816 wrote to memory of 2784 2816 xxrxlrl.exe 36 PID 2784 wrote to memory of 2804 2784 vdvjv.exe 37 PID 2784 wrote to memory of 2804 2784 vdvjv.exe 37 PID 2784 wrote to memory of 2804 2784 vdvjv.exe 37 PID 2784 wrote to memory of 2804 2784 vdvjv.exe 37 PID 2804 wrote to memory of 2752 2804 5xlrlxl.exe 38 PID 2804 wrote to memory of 2752 2804 5xlrlxl.exe 38 PID 2804 wrote to memory of 2752 2804 5xlrlxl.exe 38 PID 2804 wrote to memory of 2752 2804 5xlrlxl.exe 38 PID 2752 wrote to memory of 2600 2752 jdvjp.exe 39 PID 2752 wrote to memory of 2600 2752 jdvjp.exe 39 PID 2752 wrote to memory of 2600 2752 jdvjp.exe 39 PID 2752 wrote to memory of 2600 2752 jdvjp.exe 39 PID 2600 wrote to memory of 2300 2600 bbbnnt.exe 40 PID 2600 wrote to memory of 2300 2600 bbbnnt.exe 40 PID 2600 wrote to memory of 2300 2600 bbbnnt.exe 40 PID 2600 wrote to memory of 2300 2600 bbbnnt.exe 40 PID 2300 wrote to memory of 1704 2300 1pjpp.exe 41 PID 2300 wrote to memory of 1704 2300 1pjpp.exe 41 PID 2300 wrote to memory of 1704 2300 1pjpp.exe 41 PID 2300 wrote to memory of 1704 2300 1pjpp.exe 41 PID 1704 wrote to memory of 2288 1704 lfrflrl.exe 42 PID 1704 wrote to memory of 2288 1704 lfrflrl.exe 42 PID 1704 wrote to memory of 2288 1704 lfrflrl.exe 42 PID 1704 wrote to memory of 2288 1704 lfrflrl.exe 42 PID 2288 wrote to memory of 1720 2288 bhbtth.exe 43 PID 2288 wrote to memory of 1720 2288 bhbtth.exe 43 PID 2288 wrote to memory of 1720 2288 bhbtth.exe 43 PID 2288 wrote to memory of 1720 2288 bhbtth.exe 43 PID 1720 wrote to memory of 2280 1720 vpvjd.exe 44 PID 1720 wrote to memory of 2280 1720 vpvjd.exe 44 PID 1720 wrote to memory of 2280 1720 vpvjd.exe 44 PID 1720 wrote to memory of 2280 1720 vpvjd.exe 44 PID 2280 wrote to memory of 1292 2280 btbnth.exe 45 PID 2280 wrote to memory of 1292 2280 btbnth.exe 45 PID 2280 wrote to memory of 1292 2280 btbnth.exe 45 PID 2280 wrote to memory of 1292 2280 btbnth.exe 45 PID 1292 wrote to memory of 1320 1292 djjvp.exe 46 PID 1292 wrote to memory of 1320 1292 djjvp.exe 46 PID 1292 wrote to memory of 1320 1292 djjvp.exe 46 PID 1292 wrote to memory of 1320 1292 djjvp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe"C:\Users\Admin\AppData\Local\Temp\08271f8e13b04af3ca2ce4a21c7a6cb4e24ebe1c969737ddcca23b47bf744a07N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\vdjjd.exec:\vdjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xrlrxff.exec:\xrlrxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jddpd.exec:\jddpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vdvjv.exec:\vdvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\5xlrlxl.exec:\5xlrlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jdvjp.exec:\jdvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bbbnnt.exec:\bbbnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\1pjpp.exec:\1pjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\lfrflrl.exec:\lfrflrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\bhbtth.exec:\bhbtth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\vpvjd.exec:\vpvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\btbnth.exec:\btbnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\djjvp.exec:\djjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\btnhtb.exec:\btnhtb.exe17⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pjdjj.exec:\pjdjj.exe18⤵
- Executes dropped EXE
PID:752 -
\??\c:\dvvdj.exec:\dvvdj.exe19⤵
- Executes dropped EXE
PID:852 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe20⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3tnnbh.exec:\3tnnbh.exe21⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9ppdv.exec:\9ppdv.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\bhbtht.exec:\bhbtht.exe23⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rllxlrf.exec:\rllxlrf.exe24⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vdvpj.exec:\vdvpj.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7rlllrr.exec:\7rlllrr.exe26⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hhhnhn.exec:\hhhnhn.exe27⤵
- Executes dropped EXE
PID:2976 -
\??\c:\thtbbt.exec:\thtbbt.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xxllxxl.exec:\xxllxxl.exe29⤵
- Executes dropped EXE
PID:980 -
\??\c:\5btbnt.exec:\5btbnt.exe30⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xrrxxfx.exec:\xrrxxfx.exe31⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5pdpv.exec:\5pdpv.exe32⤵
- Executes dropped EXE
PID:1992 -
\??\c:\llfrxxf.exec:\llfrxxf.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\btnntb.exec:\btnntb.exe34⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5vdpp.exec:\5vdpp.exe35⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xrfxrxr.exec:\xrfxrxr.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\btnnbh.exec:\btnnbh.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7nbbtb.exec:\7nbbtb.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jddjv.exec:\jddjv.exe39⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrllxfl.exec:\xrllxfl.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7bbnth.exec:\7bbnth.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnnhbh.exec:\nnnhbh.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7pdvd.exec:\7pdvd.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7rrxlrf.exec:\7rrxlrf.exe44⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ttttbh.exec:\ttttbh.exe45⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5btbnt.exec:\5btbnt.exe46⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vpdpv.exec:\vpdpv.exe47⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xllrxfr.exec:\xllrxfr.exe48⤵
- Executes dropped EXE
PID:860 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe49⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bnhnnh.exec:\bnhnnh.exe50⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jdjdj.exec:\jdjdj.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pppdj.exec:\pppdj.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5rllrxx.exec:\5rllrxx.exe53⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ffrrlll.exec:\ffrrlll.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tttbnb.exec:\tttbnb.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vvvjv.exec:\vvvjv.exe56⤵
- Executes dropped EXE
PID:668 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rfflflx.exec:\rfflflx.exe58⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhhnbh.exec:\nhhnbh.exe59⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3ppjv.exec:\3ppjv.exe60⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fxrlrxf.exec:\fxrlrxf.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lllrlrl.exec:\lllrlrl.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9nnntn.exec:\9nnntn.exe63⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jddpv.exec:\jddpv.exe64⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pdppv.exec:\pdppv.exe65⤵
- Executes dropped EXE
PID:3032 -
\??\c:\llfxrfl.exec:\llfxrfl.exe66⤵PID:1900
-
\??\c:\nntbbn.exec:\nntbbn.exe67⤵PID:3044
-
\??\c:\9vjpv.exec:\9vjpv.exe68⤵PID:2924
-
\??\c:\jdddp.exec:\jdddp.exe69⤵PID:980
-
\??\c:\5lffffr.exec:\5lffffr.exe70⤵PID:1096
-
\??\c:\xrlrlxr.exec:\xrlrlxr.exe71⤵PID:1996
-
\??\c:\nnhnhn.exec:\nnhnhn.exe72⤵PID:2484
-
\??\c:\ddvdp.exec:\ddvdp.exe73⤵PID:1784
-
\??\c:\jjvpd.exec:\jjvpd.exe74⤵PID:1012
-
\??\c:\fllrllf.exec:\fllrllf.exe75⤵PID:2208
-
\??\c:\tnhhnt.exec:\tnhhnt.exe76⤵PID:2628
-
\??\c:\vjjpv.exec:\vjjpv.exe77⤵PID:2744
-
\??\c:\vdpvj.exec:\vdpvj.exe78⤵PID:2684
-
\??\c:\rlxfllf.exec:\rlxfllf.exe79⤵PID:2912
-
\??\c:\nnhtnt.exec:\nnhtnt.exe80⤵PID:2896
-
\??\c:\tthtnb.exec:\tthtnb.exe81⤵PID:2336
-
\??\c:\jjdjd.exec:\jjdjd.exe82⤵PID:2560
-
\??\c:\5rrxxfr.exec:\5rrxxfr.exe83⤵PID:2752
-
\??\c:\9hbhtb.exec:\9hbhtb.exe84⤵PID:2552
-
\??\c:\pjpvp.exec:\pjpvp.exe85⤵PID:2300
-
\??\c:\3lxrrfl.exec:\3lxrrfl.exe86⤵PID:2996
-
\??\c:\rlflrrf.exec:\rlflrrf.exe87⤵PID:1748
-
\??\c:\bhhnbh.exec:\bhhnbh.exe88⤵PID:536
-
\??\c:\jdvjd.exec:\jdvjd.exe89⤵PID:1280
-
\??\c:\3djvp.exec:\3djvp.exe90⤵PID:860
-
\??\c:\1nhthn.exec:\1nhthn.exe91⤵PID:1652
-
\??\c:\hnnttn.exec:\hnnttn.exe92⤵PID:1732
-
\??\c:\djdpv.exec:\djdpv.exe93⤵PID:1488
-
\??\c:\xrrfxfr.exec:\xrrfxfr.exe94⤵PID:808
-
\??\c:\rrlxxlx.exec:\rrlxxlx.exe95⤵PID:1960
-
\??\c:\9bnbtt.exec:\9bnbtt.exe96⤵PID:1764
-
\??\c:\dvdjj.exec:\dvdjj.exe97⤵PID:316
-
\??\c:\9rfrffx.exec:\9rfrffx.exe98⤵PID:668
-
\??\c:\lxrxflf.exec:\lxrxflf.exe99⤵PID:2420
-
\??\c:\tbnnhb.exec:\tbnnhb.exe100⤵PID:1188
-
\??\c:\5jjjp.exec:\5jjjp.exe101⤵PID:1140
-
\??\c:\9ppjv.exec:\9ppjv.exe102⤵PID:444
-
\??\c:\lfxfxfx.exec:\lfxfxfx.exe103⤵PID:2808
-
\??\c:\ntnnbt.exec:\ntnnbt.exe104⤵PID:2232
-
\??\c:\pvvjv.exec:\pvvjv.exe105⤵PID:2112
-
\??\c:\dddvj.exec:\dddvj.exe106⤵PID:1952
-
\??\c:\xxxrrxr.exec:\xxxrrxr.exe107⤵PID:3016
-
\??\c:\ttnhnn.exec:\ttnhnn.exe108⤵PID:2976
-
\??\c:\hhbhtb.exec:\hhbhtb.exe109⤵PID:2452
-
\??\c:\5dpvd.exec:\5dpvd.exe110⤵PID:992
-
\??\c:\rflrrxl.exec:\rflrrxl.exe111⤵PID:304
-
\??\c:\nbtnbb.exec:\nbtnbb.exe112⤵PID:2956
-
\??\c:\dvdjd.exec:\dvdjd.exe113⤵PID:1600
-
\??\c:\djddj.exec:\djddj.exe114⤵PID:2908
-
\??\c:\llrflxl.exec:\llrflxl.exe115⤵PID:2216
-
\??\c:\nhhtnt.exec:\nhhtnt.exe116⤵PID:3064
-
\??\c:\nnntnb.exec:\nnntnb.exe117⤵PID:2676
-
\??\c:\vpjpd.exec:\vpjpd.exe118⤵PID:2108
-
\??\c:\1fxllll.exec:\1fxllll.exe119⤵PID:2660
-
\??\c:\fxrxllx.exec:\fxrxllx.exe120⤵PID:2696
-
\??\c:\nhthnn.exec:\nhthnn.exe121⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-