Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe
-
Size
456KB
-
MD5
656dc348691e88993ace2835252d4ac1
-
SHA1
481a28d2dbedaf72d434cfae0c5406fbb9836160
-
SHA256
dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f
-
SHA512
a1323ae911c9546573b5ccb7c08ca36e3ad6c2d2c252b0d983e5d319ab4850d6b7fbb970861d5911945b117c1ec42b98c144005e0180581201dde2b4f64fab05
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLe:q7Tc2NYHUrAwfMp3CDLe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2624-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-48-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/596-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-67-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1064-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-462-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1720-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-543-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2444-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-675-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1624-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-753-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2216-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1288-838-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2440-849-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2440-868-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1448-987-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2368-1222-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-1251-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1544-1345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2624 8684006.exe 2516 bnnhhb.exe 3060 lxfffxr.exe 596 64628.exe 2808 8648822.exe 2752 6464666.exe 2108 fxxrrll.exe 2716 0844400.exe 2560 thhhhb.exe 320 60020.exe 1064 824688.exe 2848 602228.exe 2056 3flfrrr.exe 2868 602840.exe 852 608680.exe 3028 0484668.exe 2164 5fffxxl.exe 2512 02480.exe 1312 7jdvv.exe 1112 6422840.exe 1672 bnnnnh.exe 2180 pvdvj.exe 2028 frlrflx.exe 1836 420622.exe 1348 ddpdp.exe 2120 q64462.exe 2992 hhbhtt.exe 1060 rxrrlrx.exe 2188 hhbntb.exe 1056 042860.exe 316 1vjpv.exe 2184 48264.exe 1588 jjdpd.exe 2256 rlxrxff.exe 2276 q04060.exe 2416 fxlxfll.exe 2288 tnthbh.exe 2968 4868662.exe 2740 ffxfrrl.exe 2572 426622.exe 2896 8288442.exe 2656 k60240.exe 2576 m2620.exe 2564 nhnbhh.exe 2168 hhtbnn.exe 2000 828844.exe 2644 rlfrffl.exe 1764 828466.exe 1964 thtbhn.exe 2776 i640224.exe 1232 8200668.exe 1136 9bnbbn.exe 2928 rfrxfll.exe 2084 1thnbh.exe 2420 s6024.exe 2372 5rfflrf.exe 1816 vpjpv.exe 2384 dvpjv.exe 1088 20828.exe 1628 60464.exe 1720 fxrrxxl.exe 1744 pdvdv.exe 2028 g4002.exe 688 jjdpd.exe -
resource yara_rule behavioral1/memory/2624-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-436-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2372-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-1137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-1345-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8206006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m6680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 004688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4262884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o084624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 806668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrxfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 784 wrote to memory of 2624 784 dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe 31 PID 784 wrote to memory of 2624 784 dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe 31 PID 784 wrote to memory of 2624 784 dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe 31 PID 784 wrote to memory of 2624 784 dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe 31 PID 2624 wrote to memory of 2516 2624 8684006.exe 32 PID 2624 wrote to memory of 2516 2624 8684006.exe 32 PID 2624 wrote to memory of 2516 2624 8684006.exe 32 PID 2624 wrote to memory of 2516 2624 8684006.exe 32 PID 2516 wrote to memory of 3060 2516 bnnhhb.exe 33 PID 2516 wrote to memory of 3060 2516 bnnhhb.exe 33 PID 2516 wrote to memory of 3060 2516 bnnhhb.exe 33 PID 2516 wrote to memory of 3060 2516 bnnhhb.exe 33 PID 3060 wrote to memory of 596 3060 lxfffxr.exe 34 PID 3060 wrote to memory of 596 3060 lxfffxr.exe 34 PID 3060 wrote to memory of 596 3060 lxfffxr.exe 34 PID 3060 wrote to memory of 596 3060 lxfffxr.exe 34 PID 596 wrote to memory of 2808 596 64628.exe 35 PID 596 wrote to memory of 2808 596 64628.exe 35 PID 596 wrote to memory of 2808 596 64628.exe 35 PID 596 wrote to memory of 2808 596 64628.exe 35 PID 2808 wrote to memory of 2752 2808 8648822.exe 36 PID 2808 wrote to memory of 2752 2808 8648822.exe 36 PID 2808 wrote to memory of 2752 2808 8648822.exe 36 PID 2808 wrote to memory of 2752 2808 8648822.exe 36 PID 2752 wrote to memory of 2108 2752 6464666.exe 37 PID 2752 wrote to memory of 2108 2752 6464666.exe 37 PID 2752 wrote to memory of 2108 2752 6464666.exe 37 PID 2752 wrote to memory of 2108 2752 6464666.exe 37 PID 2108 wrote to memory of 2716 2108 fxxrrll.exe 38 PID 2108 wrote to memory of 2716 2108 fxxrrll.exe 38 PID 2108 wrote to memory of 2716 2108 fxxrrll.exe 38 PID 2108 wrote to memory of 2716 2108 fxxrrll.exe 38 PID 2716 wrote to memory of 2560 2716 0844400.exe 39 PID 2716 wrote to memory of 2560 2716 0844400.exe 39 PID 2716 wrote to memory of 2560 2716 0844400.exe 39 PID 2716 wrote to memory of 2560 2716 0844400.exe 39 PID 2560 wrote to memory of 320 2560 thhhhb.exe 40 PID 2560 wrote to memory of 320 2560 thhhhb.exe 40 PID 2560 wrote to memory of 320 2560 thhhhb.exe 40 PID 2560 wrote to memory of 320 2560 thhhhb.exe 40 PID 320 wrote to memory of 1064 320 60020.exe 41 PID 320 wrote to memory of 1064 320 60020.exe 41 PID 320 wrote to memory of 1064 320 60020.exe 41 PID 320 wrote to memory of 1064 320 60020.exe 41 PID 1064 wrote to memory of 2848 1064 824688.exe 42 PID 1064 wrote to memory of 2848 1064 824688.exe 42 PID 1064 wrote to memory of 2848 1064 824688.exe 42 PID 1064 wrote to memory of 2848 1064 824688.exe 42 PID 2848 wrote to memory of 2056 2848 602228.exe 43 PID 2848 wrote to memory of 2056 2848 602228.exe 43 PID 2848 wrote to memory of 2056 2848 602228.exe 43 PID 2848 wrote to memory of 2056 2848 602228.exe 43 PID 2056 wrote to memory of 2868 2056 3flfrrr.exe 44 PID 2056 wrote to memory of 2868 2056 3flfrrr.exe 44 PID 2056 wrote to memory of 2868 2056 3flfrrr.exe 44 PID 2056 wrote to memory of 2868 2056 3flfrrr.exe 44 PID 2868 wrote to memory of 852 2868 602840.exe 45 PID 2868 wrote to memory of 852 2868 602840.exe 45 PID 2868 wrote to memory of 852 2868 602840.exe 45 PID 2868 wrote to memory of 852 2868 602840.exe 45 PID 852 wrote to memory of 3028 852 608680.exe 46 PID 852 wrote to memory of 3028 852 608680.exe 46 PID 852 wrote to memory of 3028 852 608680.exe 46 PID 852 wrote to memory of 3028 852 608680.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe"C:\Users\Admin\AppData\Local\Temp\dd7d5b2aa1fccd3b9d5a05806a9e91cd1554143edcf4dea4e2eaf338ff25db2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\8684006.exec:\8684006.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bnnhhb.exec:\bnnhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lxfffxr.exec:\lxfffxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\64628.exec:\64628.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\8648822.exec:\8648822.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\6464666.exec:\6464666.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\fxxrrll.exec:\fxxrrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\0844400.exec:\0844400.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\thhhhb.exec:\thhhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\60020.exec:\60020.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\824688.exec:\824688.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\602228.exec:\602228.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3flfrrr.exec:\3flfrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\602840.exec:\602840.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\608680.exec:\608680.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\0484668.exec:\0484668.exe17⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5fffxxl.exec:\5fffxxl.exe18⤵
- Executes dropped EXE
PID:2164 -
\??\c:\02480.exec:\02480.exe19⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7jdvv.exec:\7jdvv.exe20⤵
- Executes dropped EXE
PID:1312 -
\??\c:\6422840.exec:\6422840.exe21⤵
- Executes dropped EXE
PID:1112 -
\??\c:\bnnnnh.exec:\bnnnnh.exe22⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pvdvj.exec:\pvdvj.exe23⤵
- Executes dropped EXE
PID:2180 -
\??\c:\frlrflx.exec:\frlrflx.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\420622.exec:\420622.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836 -
\??\c:\ddpdp.exec:\ddpdp.exe26⤵
- Executes dropped EXE
PID:1348 -
\??\c:\q64462.exec:\q64462.exe27⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hhbhtt.exec:\hhbhtt.exe28⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rxrrlrx.exec:\rxrrlrx.exe29⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hhbntb.exec:\hhbntb.exe30⤵
- Executes dropped EXE
PID:2188 -
\??\c:\042860.exec:\042860.exe31⤵
- Executes dropped EXE
PID:1056 -
\??\c:\1vjpv.exec:\1vjpv.exe32⤵
- Executes dropped EXE
PID:316 -
\??\c:\48264.exec:\48264.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jjdpd.exec:\jjdpd.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rlxrxff.exec:\rlxrxff.exe35⤵
- Executes dropped EXE
PID:2256 -
\??\c:\q04060.exec:\q04060.exe36⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxlxfll.exec:\fxlxfll.exe37⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tnthbh.exec:\tnthbh.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\4868662.exec:\4868662.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\426622.exec:\426622.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\8288442.exec:\8288442.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\k60240.exec:\k60240.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\m2620.exec:\m2620.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nhnbhh.exec:\nhnbhh.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hhtbnn.exec:\hhtbnn.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\828844.exec:\828844.exe47⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rlfrffl.exec:\rlfrffl.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\828466.exec:\828466.exe49⤵
- Executes dropped EXE
PID:1764 -
\??\c:\thtbhn.exec:\thtbhn.exe50⤵
- Executes dropped EXE
PID:1964 -
\??\c:\i640224.exec:\i640224.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\8200668.exec:\8200668.exe52⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9bnbbn.exec:\9bnbbn.exe53⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rfrxfll.exec:\rfrxfll.exe54⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1thnbh.exec:\1thnbh.exe55⤵
- Executes dropped EXE
PID:2084 -
\??\c:\s6024.exec:\s6024.exe56⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5rfflrf.exec:\5rfflrf.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpjpv.exec:\vpjpv.exe58⤵
- Executes dropped EXE
PID:1816 -
\??\c:\dvpjv.exec:\dvpjv.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\20828.exec:\20828.exe60⤵
- Executes dropped EXE
PID:1088 -
\??\c:\60464.exec:\60464.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe62⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pdvdv.exec:\pdvdv.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\g4002.exec:\g4002.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjdpd.exec:\jjdpd.exe65⤵
- Executes dropped EXE
PID:688 -
\??\c:\tntttt.exec:\tntttt.exe66⤵PID:1992
-
\??\c:\820088.exec:\820088.exe67⤵PID:1572
-
\??\c:\nhbnbh.exec:\nhbnbh.exe68⤵PID:2212
-
\??\c:\ddvjd.exec:\ddvjd.exe69⤵PID:2112
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:1988
-
\??\c:\vjvvp.exec:\vjvvp.exe71⤵PID:2204
-
\??\c:\q86244.exec:\q86244.exe72⤵PID:1324
-
\??\c:\60802.exec:\60802.exe73⤵PID:2444
-
\??\c:\i088468.exec:\i088468.exe74⤵PID:2284
-
\??\c:\0806284.exec:\0806284.exe75⤵PID:1788
-
\??\c:\422400.exec:\422400.exe76⤵PID:2900
-
\??\c:\602202.exec:\602202.exe77⤵PID:1588
-
\??\c:\dvjjv.exec:\dvjjv.exe78⤵PID:1820
-
\??\c:\60880.exec:\60880.exe79⤵PID:1712
-
\??\c:\2622240.exec:\2622240.exe80⤵PID:2784
-
\??\c:\9pjpv.exec:\9pjpv.exe81⤵PID:2684
-
\??\c:\20440.exec:\20440.exe82⤵PID:2552
-
\??\c:\6084220.exec:\6084220.exe83⤵PID:2688
-
\??\c:\vvppv.exec:\vvppv.exe84⤵PID:2760
-
\??\c:\vppvj.exec:\vppvj.exe85⤵PID:2572
-
\??\c:\dvdjp.exec:\dvdjp.exe86⤵PID:2708
-
\??\c:\5bbhht.exec:\5bbhht.exe87⤵PID:292
-
\??\c:\lfrflrx.exec:\lfrflrx.exe88⤵PID:2716
-
\??\c:\q82428.exec:\q82428.exe89⤵PID:2564
-
\??\c:\1vvdj.exec:\1vvdj.exe90⤵PID:2168
-
\??\c:\xxxfrrf.exec:\xxxfrrf.exe91⤵PID:992
-
\??\c:\2602884.exec:\2602884.exe92⤵PID:2644
-
\??\c:\rfflxfl.exec:\rfflxfl.exe93⤵PID:1072
-
\??\c:\04002.exec:\04002.exe94⤵PID:2056
-
\??\c:\nhttbb.exec:\nhttbb.exe95⤵PID:1624
-
\??\c:\dvpdp.exec:\dvpdp.exe96⤵PID:2912
-
\??\c:\5vjjv.exec:\5vjjv.exe97⤵PID:1256
-
\??\c:\pvdjp.exec:\pvdjp.exe98⤵PID:3028
-
\??\c:\024806.exec:\024806.exe99⤵PID:2892
-
\??\c:\20280.exec:\20280.exe100⤵PID:2420
-
\??\c:\2622862.exec:\2622862.exe101⤵PID:408
-
\??\c:\lfxfllx.exec:\lfxfllx.exe102⤵PID:1816
-
\??\c:\46060.exec:\46060.exe103⤵PID:1036
-
\??\c:\ddvvd.exec:\ddvvd.exe104⤵PID:1088
-
\??\c:\1lfxfxr.exec:\1lfxfxr.exe105⤵PID:872
-
\??\c:\m4224.exec:\m4224.exe106⤵PID:1720
-
\??\c:\6046886.exec:\6046886.exe107⤵PID:2216
-
\??\c:\8066266.exec:\8066266.exe108⤵PID:1560
-
\??\c:\bbnthh.exec:\bbnthh.exe109⤵PID:1104
-
\??\c:\xlffxxr.exec:\xlffxxr.exe110⤵PID:1564
-
\??\c:\q02806.exec:\q02806.exe111⤵PID:3000
-
\??\c:\0828884.exec:\0828884.exe112⤵PID:2212
-
\??\c:\048462.exec:\048462.exe113⤵PID:3012
-
\??\c:\k22406.exec:\k22406.exe114⤵PID:344
-
\??\c:\4822068.exec:\4822068.exe115⤵PID:1272
-
\??\c:\3pdvv.exec:\3pdvv.exe116⤵PID:1316
-
\??\c:\hthhnt.exec:\hthhnt.exe117⤵PID:1288
-
\??\c:\k86288.exec:\k86288.exe118⤵PID:2440
-
\??\c:\btntbh.exec:\btntbh.exe119⤵PID:2320
-
\??\c:\80660.exec:\80660.exe120⤵PID:1612
-
\??\c:\k64022.exec:\k64022.exe121⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-