Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 00:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe
-
Size
456KB
-
MD5
3b3a8cb0393e0bbb49f75058007b4bd0
-
SHA1
901f768409e841a41b1a32a6bf7796b0fb4d7cb7
-
SHA256
880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9
-
SHA512
1829740b2eb8afbe249c8d39156c570b1865904720a8b3c7165587567a84155641bfcbd0369fcce9bc327fd068ff1f74acb9eec66298f34e05fcff6d55da6a40
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2648-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1184-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-112-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2164-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-147-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2732-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-166-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2088-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-178-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2652-192-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2652-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-210-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1708-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-256-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-267-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1312-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-272-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2380-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-382-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2440-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-428-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2388-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1324-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-636-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 9nhthh.exe 2812 1pdvv.exe 2204 jvdjj.exe 2816 3xlxfxf.exe 2764 pjvjp.exe 2568 lxfrrrf.exe 2972 1pjpd.exe 1092 3dvdp.exe 1184 btnttb.exe 2196 dvpdd.exe 2164 1hbbnb.exe 2852 pjdjp.exe 2384 jpdpd.exe 2528 lllrfrl.exe 2792 jjvdp.exe 2040 3dvdv.exe 2732 pjdjv.exe 2088 vpddj.exe 1032 vpddj.exe 2652 jdppv.exe 1684 bnhntt.exe 548 9ththb.exe 836 5rffflx.exe 824 nhbhnn.exe 1696 xlxxllx.exe 1708 7nhntb.exe 916 5jpvd.exe 1312 nbnnnt.exe 2300 7jpjj.exe 2380 1xlrlrx.exe 888 9dvvd.exe 2664 llxrfrf.exe 2760 9dvdj.exe 2704 xxllrlx.exe 2896 btnnbb.exe 2892 vjddd.exe 2740 9pdpj.exe 2860 xlfxxff.exe 2612 1bhbhh.exe 2676 tnhnbb.exe 2320 ppjjd.exe 1476 fxrxflr.exe 1244 hthbbt.exe 2172 9pjpp.exe 2440 rlxflrf.exe 2196 xrflxfr.exe 2848 hhtbnh.exe 1764 9vpvp.exe 1892 1lxxfxf.exe 1664 7thbbb.exe 2772 1hbbbn.exe 2244 jjjjv.exe 1988 fxfflrx.exe 2420 tnhhtb.exe 2388 ddvpd.exe 1812 vpjpv.exe 1036 xlxfrlr.exe 2124 btbbhn.exe 572 pjdpv.exe 2112 ffxfllr.exe 2108 rfxflfl.exe 1324 hbttbb.exe 1048 jdvjj.exe 1652 1lxxrrl.exe -
resource yara_rule behavioral1/memory/2648-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-27-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2812-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-141-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2528-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-190-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1696-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-421-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1036-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-627-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1476-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-771-0x00000000001E0000-0x000000000020A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2268 2648 880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe 30 PID 2648 wrote to memory of 2268 2648 880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe 30 PID 2648 wrote to memory of 2268 2648 880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe 30 PID 2648 wrote to memory of 2268 2648 880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe 30 PID 2268 wrote to memory of 2812 2268 9nhthh.exe 31 PID 2268 wrote to memory of 2812 2268 9nhthh.exe 31 PID 2268 wrote to memory of 2812 2268 9nhthh.exe 31 PID 2268 wrote to memory of 2812 2268 9nhthh.exe 31 PID 2812 wrote to memory of 2204 2812 1pdvv.exe 32 PID 2812 wrote to memory of 2204 2812 1pdvv.exe 32 PID 2812 wrote to memory of 2204 2812 1pdvv.exe 32 PID 2812 wrote to memory of 2204 2812 1pdvv.exe 32 PID 2204 wrote to memory of 2816 2204 jvdjj.exe 33 PID 2204 wrote to memory of 2816 2204 jvdjj.exe 33 PID 2204 wrote to memory of 2816 2204 jvdjj.exe 33 PID 2204 wrote to memory of 2816 2204 jvdjj.exe 33 PID 2816 wrote to memory of 2764 2816 3xlxfxf.exe 34 PID 2816 wrote to memory of 2764 2816 3xlxfxf.exe 34 PID 2816 wrote to memory of 2764 2816 3xlxfxf.exe 34 PID 2816 wrote to memory of 2764 2816 3xlxfxf.exe 34 PID 2764 wrote to memory of 2568 2764 pjvjp.exe 35 PID 2764 wrote to memory of 2568 2764 pjvjp.exe 35 PID 2764 wrote to memory of 2568 2764 pjvjp.exe 35 PID 2764 wrote to memory of 2568 2764 pjvjp.exe 35 PID 2568 wrote to memory of 2972 2568 lxfrrrf.exe 36 PID 2568 wrote to memory of 2972 2568 lxfrrrf.exe 36 PID 2568 wrote to memory of 2972 2568 lxfrrrf.exe 36 PID 2568 wrote to memory of 2972 2568 lxfrrrf.exe 36 PID 2972 wrote to memory of 1092 2972 1pjpd.exe 37 PID 2972 wrote to memory of 1092 2972 1pjpd.exe 37 PID 2972 wrote to memory of 1092 2972 1pjpd.exe 37 PID 2972 wrote to memory of 1092 2972 1pjpd.exe 37 PID 1092 wrote to memory of 1184 1092 3dvdp.exe 38 PID 1092 wrote to memory of 1184 1092 3dvdp.exe 38 PID 1092 wrote to memory of 1184 1092 3dvdp.exe 38 PID 1092 wrote to memory of 1184 1092 3dvdp.exe 38 PID 1184 wrote to memory of 2196 1184 btnttb.exe 39 PID 1184 wrote to memory of 2196 1184 btnttb.exe 39 PID 1184 wrote to memory of 2196 1184 btnttb.exe 39 PID 1184 wrote to memory of 2196 1184 btnttb.exe 39 PID 2196 wrote to memory of 2164 2196 dvpdd.exe 40 PID 2196 wrote to memory of 2164 2196 dvpdd.exe 40 PID 2196 wrote to memory of 2164 2196 dvpdd.exe 40 PID 2196 wrote to memory of 2164 2196 dvpdd.exe 40 PID 2164 wrote to memory of 2852 2164 1hbbnb.exe 41 PID 2164 wrote to memory of 2852 2164 1hbbnb.exe 41 PID 2164 wrote to memory of 2852 2164 1hbbnb.exe 41 PID 2164 wrote to memory of 2852 2164 1hbbnb.exe 41 PID 2852 wrote to memory of 2384 2852 pjdjp.exe 42 PID 2852 wrote to memory of 2384 2852 pjdjp.exe 42 PID 2852 wrote to memory of 2384 2852 pjdjp.exe 42 PID 2852 wrote to memory of 2384 2852 pjdjp.exe 42 PID 2384 wrote to memory of 2528 2384 jpdpd.exe 43 PID 2384 wrote to memory of 2528 2384 jpdpd.exe 43 PID 2384 wrote to memory of 2528 2384 jpdpd.exe 43 PID 2384 wrote to memory of 2528 2384 jpdpd.exe 43 PID 2528 wrote to memory of 2792 2528 lllrfrl.exe 44 PID 2528 wrote to memory of 2792 2528 lllrfrl.exe 44 PID 2528 wrote to memory of 2792 2528 lllrfrl.exe 44 PID 2528 wrote to memory of 2792 2528 lllrfrl.exe 44 PID 2792 wrote to memory of 2040 2792 jjvdp.exe 45 PID 2792 wrote to memory of 2040 2792 jjvdp.exe 45 PID 2792 wrote to memory of 2040 2792 jjvdp.exe 45 PID 2792 wrote to memory of 2040 2792 jjvdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe"C:\Users\Admin\AppData\Local\Temp\880d3da2436d556704633c68487ed9432712a51cdfca6f93021c9b829e0331f9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9nhthh.exec:\9nhthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\1pdvv.exec:\1pdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jvdjj.exec:\jvdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\3xlxfxf.exec:\3xlxfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pjvjp.exec:\pjvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lxfrrrf.exec:\lxfrrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\1pjpd.exec:\1pjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\3dvdp.exec:\3dvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\btnttb.exec:\btnttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\dvpdd.exec:\dvpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\1hbbnb.exec:\1hbbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\pjdjp.exec:\pjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jpdpd.exec:\jpdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\lllrfrl.exec:\lllrfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jjvdp.exec:\jjvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\3dvdv.exec:\3dvdv.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pjdjv.exec:\pjdjv.exe18⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vpddj.exec:\vpddj.exe19⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vpddj.exec:\vpddj.exe20⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jdppv.exec:\jdppv.exe21⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bnhntt.exec:\bnhntt.exe22⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9ththb.exec:\9ththb.exe23⤵
- Executes dropped EXE
PID:548 -
\??\c:\5rffflx.exec:\5rffflx.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\nhbhnn.exec:\nhbhnn.exe25⤵
- Executes dropped EXE
PID:824 -
\??\c:\xlxxllx.exec:\xlxxllx.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7nhntb.exec:\7nhntb.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5jpvd.exec:\5jpvd.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\nbnnnt.exec:\nbnnnt.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7jpjj.exec:\7jpjj.exe30⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1xlrlrx.exec:\1xlrlrx.exe31⤵
- Executes dropped EXE
PID:2380 -
\??\c:\9dvvd.exec:\9dvvd.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\llxrfrf.exec:\llxrfrf.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9dvdj.exec:\9dvdj.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xxllrlx.exec:\xxllrlx.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\btnnbb.exec:\btnnbb.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vjddd.exec:\vjddd.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9pdpj.exec:\9pdpj.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xlfxxff.exec:\xlfxxff.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1bhbhh.exec:\1bhbhh.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnhnbb.exec:\tnhnbb.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ppjjd.exec:\ppjjd.exe42⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fxrxflr.exec:\fxrxflr.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1476 -
\??\c:\hthbbt.exec:\hthbbt.exe44⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9pjpp.exec:\9pjpp.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rlxflrf.exec:\rlxflrf.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrflxfr.exec:\xrflxfr.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hhtbnh.exec:\hhtbnh.exe48⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9vpvp.exec:\9vpvp.exe49⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1lxxfxf.exec:\1lxxfxf.exe50⤵
- Executes dropped EXE
PID:1892 -
\??\c:\7thbbb.exec:\7thbbb.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1hbbbn.exec:\1hbbbn.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jjjjv.exec:\jjjjv.exe53⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fxfflrx.exec:\fxfflrx.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnhhtb.exec:\tnhhtb.exe55⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ddvpd.exec:\ddvpd.exe56⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpjpv.exec:\vpjpv.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xlxfrlr.exec:\xlxfrlr.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\btbbhn.exec:\btbbhn.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjdpv.exec:\pjdpv.exe60⤵
- Executes dropped EXE
PID:572 -
\??\c:\ffxfllr.exec:\ffxfllr.exe61⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rfxflfl.exec:\rfxflfl.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hbttbb.exec:\hbttbb.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jdvjj.exec:\jdvjj.exe64⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1lxxrrl.exec:\1lxxrrl.exe65⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7flflfl.exec:\7flflfl.exe66⤵PID:2008
-
\??\c:\bnbbhb.exec:\bnbbhb.exe67⤵PID:904
-
\??\c:\jvvpp.exec:\jvvpp.exe68⤵PID:564
-
\??\c:\frxxxrx.exec:\frxxxrx.exe69⤵PID:1636
-
\??\c:\hhtthb.exec:\hhtthb.exe70⤵PID:1312
-
\??\c:\pjvjv.exec:\pjvjv.exe71⤵PID:976
-
\??\c:\jvjdd.exec:\jvjdd.exe72⤵PID:1928
-
\??\c:\rfrlrfl.exec:\rfrlrfl.exe73⤵PID:612
-
\??\c:\thbttb.exec:\thbttb.exe74⤵PID:1588
-
\??\c:\pdjjj.exec:\pdjjj.exe75⤵PID:2520
-
\??\c:\dpdvj.exec:\dpdvj.exe76⤵PID:2684
-
\??\c:\5xllfff.exec:\5xllfff.exe77⤵PID:2708
-
\??\c:\nbnnbh.exec:\nbnnbh.exe78⤵PID:2812
-
\??\c:\7pjdp.exec:\7pjdp.exe79⤵PID:2264
-
\??\c:\9flfrrx.exec:\9flfrrx.exe80⤵PID:1508
-
\??\c:\xrlrflr.exec:\xrlrflr.exe81⤵PID:2724
-
\??\c:\bbtbbh.exec:\bbtbbh.exe82⤵PID:2600
-
\??\c:\ddppd.exec:\ddppd.exe83⤵PID:2968
-
\??\c:\5rllllr.exec:\5rllllr.exe84⤵PID:2980
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe85⤵PID:2320
-
\??\c:\bbnnbb.exec:\bbnnbb.exe86⤵PID:1476
-
\??\c:\9ppjp.exec:\9ppjp.exe87⤵PID:2156
-
\??\c:\lxlflfr.exec:\lxlflfr.exe88⤵PID:2084
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe89⤵PID:2340
-
\??\c:\bnbbhh.exec:\bnbbhh.exe90⤵PID:2196
-
\??\c:\dpdjj.exec:\dpdjj.exe91⤵PID:2396
-
\??\c:\lxllrrx.exec:\lxllrrx.exe92⤵PID:1764
-
\??\c:\9nhntn.exec:\9nhntn.exe93⤵PID:828
-
\??\c:\1bbnhh.exec:\1bbnhh.exe94⤵PID:1664
-
\??\c:\jvvvv.exec:\jvvvv.exe95⤵PID:2772
-
\??\c:\3xlffxf.exec:\3xlffxf.exe96⤵PID:2244
-
\??\c:\9frxxxf.exec:\9frxxxf.exe97⤵PID:1988
-
\??\c:\nhhntt.exec:\nhhntt.exe98⤵PID:2420
-
\??\c:\vpjpv.exec:\vpjpv.exe99⤵PID:2208
-
\??\c:\xrlfllx.exec:\xrlfllx.exe100⤵PID:1044
-
\??\c:\lxrfrrf.exec:\lxrfrrf.exe101⤵PID:864
-
\??\c:\nbthhh.exec:\nbthhh.exe102⤵PID:1096
-
\??\c:\pdjpp.exec:\pdjpp.exe103⤵PID:3056
-
\??\c:\lfxxflr.exec:\lfxxflr.exe104⤵PID:444
-
\??\c:\rflllff.exec:\rflllff.exe105⤵PID:1996
-
\??\c:\hbhnbb.exec:\hbhnbb.exe106⤵PID:1848
-
\??\c:\9dppp.exec:\9dppp.exe107⤵PID:1528
-
\??\c:\7pjdd.exec:\7pjdd.exe108⤵PID:1696
-
\??\c:\3frrrlr.exec:\3frrrlr.exe109⤵PID:2068
-
\??\c:\nbhhnt.exec:\nbhhnt.exe110⤵PID:604
-
\??\c:\9nbhbt.exec:\9nbhbt.exe111⤵PID:2488
-
\??\c:\9pjjp.exec:\9pjjp.exe112⤵PID:2640
-
\??\c:\lllxfrr.exec:\lllxfrr.exe113⤵PID:2996
-
\??\c:\hbnnbb.exec:\hbnnbb.exe114⤵PID:2360
-
\??\c:\jjddp.exec:\jjddp.exe115⤵PID:896
-
\??\c:\rrffllx.exec:\rrffllx.exe116⤵PID:2464
-
\??\c:\7rrrfxl.exec:\7rrrfxl.exe117⤵PID:2168
-
\??\c:\7btbhh.exec:\7btbhh.exe118⤵PID:2808
-
\??\c:\3vjjp.exec:\3vjjp.exe119⤵PID:2784
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe120⤵PID:2712
-
\??\c:\rlfffxx.exec:\rlfffxx.exe121⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-