Analysis
- max time kernel
120s - max time network
16s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
26/12/2024, 00:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
- Target cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe
- Size 454KB
- Sample241226-bccnvssqa1
- SHA256 cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddc
- MD5 b0e5c87b20d70086fea853c98b9e9790
- SHA1 18184d94a3f353918a8a7860fa2725dcda561624
- SHA512 63e743f1d6b03d9851f6662078cfb269b02fd3124eb389e55e4c5cfd313c7ae16afce9d4d50dbc294debd52ac43212454509f741584fb9d1aa1e4e0f1abc6ec5
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2056-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-48-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2768-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-256-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/764-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-285-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-434-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-471-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/560-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-499-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-510-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1060-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-635-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-655-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-662-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2012-688-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-708-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-773-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1324-772-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2036-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-915-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2160-940-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-953-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2056 lxrrxxf.exe 2016 5dvpj.exe 2104 xrfxxxf.exe 3052 7bhhtt.exe 2768 9djjj.exe 2404 rlxfrfx.exe 2584 vdjdd.exe 2664 vvjpv.exe 1252 bnbhnt.exe 2596 ffrrllr.exe 3032 jdpjp.exe 1068 9dvvd.exe 1976 nhbhnn.exe 888 vjddd.exe 1936 frfflrl.exe 2900 7bbbnt.exe 1312 frxfllr.exe 3004 xlxxffr.exe 2200 pdvdp.exe 2264 lxllxfl.exe 1016 3ntnnn.exe 1088 ppjpj.exe 2616 xrlrxfl.exe 704 jjddp.exe 2180 5rrxxfl.exe 2412 nthbbt.exe 764 rflxlxf.exe 1032 btnntt.exe 792 dpjpp.exe 2356 rlxflrf.exe 2992 nhbhbb.exe 1060 pdvvd.exe 2032 vpdvv.exe 2720 hnhntn.exe 2700 pdjdj.exe 2776 lfrflxx.exe 2764 xxlxlxx.exe 2944 1nbtth.exe 2792 ddddd.exe 1592 3fxfffx.exe 2744 fxrlrrx.exe 1252 bbthbb.exe 3024 jddjv.exe 1212 vjvdj.exe 1792 fxxxlxf.exe 2904 5thhnn.exe 1856 9nbtbb.exe 2812 3dvvv.exe 2564 rlxxxxf.exe 2384 3xlfxxf.exe 1980 9tthtt.exe 2528 pdppp.exe 3020 pvppv.exe 3016 rrlrlxr.exe 2216 tnttbb.exe 2396 jvpvj.exe 2188 1ppvd.exe 1860 frffffl.exe 560 9lfxlfr.exe 640 3bnhnn.exe 680 pvjdj.exe 1868 9xfxrrr.exe 2360 fxrrrrx.exe 1672 bbhnbb.exe -
resource yara_rule behavioral1/memory/2056-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-105-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1068-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-498-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1608-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-655-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/376-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-900-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2056 2356 cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe 30 PID 2356 wrote to memory of 2056 2356 cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe 30 PID 2356 wrote to memory of 2056 2356 cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe 30 PID 2356 wrote to memory of 2056 2356 cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe 30 PID 2056 wrote to memory of 2016 2056 lxrrxxf.exe 31 PID 2056 wrote to memory of 2016 2056 lxrrxxf.exe 31 PID 2056 wrote to memory of 2016 2056 lxrrxxf.exe 31 PID 2056 wrote to memory of 2016 2056 lxrrxxf.exe 31 PID 2016 wrote to memory of 2104 2016 5dvpj.exe 32 PID 2016 wrote to memory of 2104 2016 5dvpj.exe 32 PID 2016 wrote to memory of 2104 2016 5dvpj.exe 32 PID 2016 wrote to memory of 2104 2016 5dvpj.exe 32 PID 2104 wrote to memory of 3052 2104 xrfxxxf.exe 33 PID 2104 wrote to memory of 3052 2104 xrfxxxf.exe 33 PID 2104 wrote to memory of 3052 2104 xrfxxxf.exe 33 PID 2104 wrote to memory of 3052 2104 xrfxxxf.exe 33 PID 3052 wrote to memory of 2768 3052 7bhhtt.exe 34 PID 3052 wrote to memory of 2768 3052 7bhhtt.exe 34 PID 3052 wrote to memory of 2768 3052 7bhhtt.exe 34 PID 3052 wrote to memory of 2768 3052 7bhhtt.exe 34 PID 2768 wrote to memory of 2404 2768 9djjj.exe 35 PID 2768 wrote to memory of 2404 2768 9djjj.exe 35 PID 2768 wrote to memory of 2404 2768 9djjj.exe 35 PID 2768 wrote to memory of 2404 2768 9djjj.exe 35 PID 2404 wrote to memory of 2584 2404 rlxfrfx.exe 36 PID 2404 wrote to memory of 2584 2404 rlxfrfx.exe 36 PID 2404 wrote to memory of 2584 2404 rlxfrfx.exe 36 PID 2404 wrote to memory of 2584 2404 rlxfrfx.exe 36 PID 2584 wrote to memory of 2664 2584 vdjdd.exe 37 PID 2584 wrote to memory of 2664 2584 vdjdd.exe 37 PID 2584 wrote to memory of 2664 2584 vdjdd.exe 37 PID 2584 wrote to memory of 2664 2584 vdjdd.exe 37 PID 2664 wrote to memory of 1252 2664 vvjpv.exe 38 PID 2664 wrote to memory of 1252 2664 vvjpv.exe 38 PID 2664 wrote to memory of 1252 2664 vvjpv.exe 38 PID 2664 wrote to memory of 1252 2664 vvjpv.exe 38 PID 1252 wrote to memory of 2596 1252 bnbhnt.exe 39 PID 1252 wrote to memory of 2596 1252 bnbhnt.exe 39 PID 1252 wrote to memory of 2596 1252 bnbhnt.exe 39 PID 1252 wrote to memory of 2596 1252 bnbhnt.exe 39 PID 2596 wrote to memory of 3032 2596 ffrrllr.exe 40 PID 2596 wrote to memory of 3032 2596 ffrrllr.exe 40 PID 2596 wrote to memory of 3032 2596 ffrrllr.exe 40 PID 2596 wrote to memory of 3032 2596 ffrrllr.exe 40 PID 3032 wrote to memory of 1068 3032 jdpjp.exe 41 PID 3032 wrote to memory of 1068 3032 jdpjp.exe 41 PID 3032 wrote to memory of 1068 3032 jdpjp.exe 41 PID 3032 wrote to memory of 1068 3032 jdpjp.exe 41 PID 1068 wrote to memory of 1976 1068 9dvvd.exe 42 PID 1068 wrote to memory of 1976 1068 9dvvd.exe 42 PID 1068 wrote to memory of 1976 1068 9dvvd.exe 42 PID 1068 wrote to memory of 1976 1068 9dvvd.exe 42 PID 1976 wrote to memory of 888 1976 nhbhnn.exe 43 PID 1976 wrote to memory of 888 1976 nhbhnn.exe 43 PID 1976 wrote to memory of 888 1976 nhbhnn.exe 43 PID 1976 wrote to memory of 888 1976 nhbhnn.exe 43 PID 888 wrote to memory of 1936 888 vjddd.exe 44 PID 888 wrote to memory of 1936 888 vjddd.exe 44 PID 888 wrote to memory of 1936 888 vjddd.exe 44 PID 888 wrote to memory of 1936 888 vjddd.exe 44 PID 1936 wrote to memory of 2900 1936 frfflrl.exe 45 PID 1936 wrote to memory of 2900 1936 frfflrl.exe 45 PID 1936 wrote to memory of 2900 1936 frfflrl.exe 45 PID 1936 wrote to memory of 2900 1936 frfflrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe"C:\Users\Admin\AppData\Local\Temp\cc35d69c6dbfb0fb0a7967e31c0a5f4f9dee3329039012b8b6271bdb416feddcN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5dvpj.exec:\5dvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7bhhtt.exec:\7bhhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\9djjj.exec:\9djjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rlxfrfx.exec:\rlxfrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vdjdd.exec:\vdjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vvjpv.exec:\vvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bnbhnt.exec:\bnbhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\ffrrllr.exec:\ffrrllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jdpjp.exec:\jdpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\9dvvd.exec:\9dvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\nhbhnn.exec:\nhbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vjddd.exec:\vjddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\frfflrl.exec:\frfflrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7bbbnt.exec:\7bbbnt.exe17⤵
- Executes dropped EXE
PID:2900 -
\??\c:\frxfllr.exec:\frxfllr.exe18⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xlxxffr.exec:\xlxxffr.exe19⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdvdp.exec:\pdvdp.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lxllxfl.exec:\lxllxfl.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3ntnnn.exec:\3ntnnn.exe22⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ppjpj.exec:\ppjpj.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe24⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjddp.exec:\jjddp.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\5rrxxfl.exec:\5rrxxfl.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nthbbt.exec:\nthbbt.exe27⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rflxlxf.exec:\rflxlxf.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\btnntt.exec:\btnntt.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dpjpp.exec:\dpjpp.exe30⤵
- Executes dropped EXE
PID:792 -
\??\c:\rlxflrf.exec:\rlxflrf.exe31⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nhbhbb.exec:\nhbhbb.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pdvvd.exec:\pdvvd.exe33⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vpdvv.exec:\vpdvv.exe34⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hnhntn.exec:\hnhntn.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pdjdj.exec:\pdjdj.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lfrflxx.exec:\lfrflxx.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xxlxlxx.exec:\xxlxlxx.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1nbtth.exec:\1nbtth.exe39⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ddddd.exec:\ddddd.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3fxfffx.exec:\3fxfffx.exe41⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bbthbb.exec:\bbthbb.exe43⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jddjv.exec:\jddjv.exe44⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vjvdj.exec:\vjvdj.exe45⤵
- Executes dropped EXE
PID:1212 -
\??\c:\fxxxlxf.exec:\fxxxlxf.exe46⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5thhnn.exec:\5thhnn.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9nbtbb.exec:\9nbtbb.exe48⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3dvvv.exec:\3dvvv.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe50⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3xlfxxf.exec:\3xlfxxf.exe51⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9tthtt.exec:\9tthtt.exe52⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pdppp.exec:\pdppp.exe53⤵
- Executes dropped EXE
PID:2528 -
\??\c:\pvppv.exec:\pvppv.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tnttbb.exec:\tnttbb.exe56⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jvpvj.exec:\jvpvj.exe57⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1ppvd.exec:\1ppvd.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frffffl.exec:\frffffl.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9lfxlfr.exec:\9lfxlfr.exe60⤵
- Executes dropped EXE
PID:560 -
\??\c:\3bnhnn.exec:\3bnhnn.exe61⤵
- Executes dropped EXE
PID:640 -
\??\c:\pvjdj.exec:\pvjdj.exe62⤵
- Executes dropped EXE
PID:680 -
\??\c:\9xfxrrr.exec:\9xfxrrr.exe63⤵
- Executes dropped EXE
PID:1868 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe64⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbhnbb.exec:\bbhnbb.exe65⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvjdd.exec:\dvjdd.exe66⤵PID:2168
-
\??\c:\9rxxxxx.exec:\9rxxxxx.exe67⤵PID:1512
-
\??\c:\rfxxxxl.exec:\rfxxxxl.exe68⤵PID:320
-
\??\c:\bntthh.exec:\bntthh.exe69⤵PID:2308
-
\??\c:\dvjdj.exec:\dvjdj.exe70⤵PID:2164
-
\??\c:\pjpvv.exec:\pjpvv.exe71⤵PID:1608
-
\??\c:\xrxrxrf.exec:\xrxrxrf.exe72⤵PID:3012
-
\??\c:\7tbttn.exec:\7tbttn.exe73⤵PID:2860
-
\??\c:\tnthtn.exec:\tnthtn.exe74⤵PID:1060
-
\??\c:\1dvvj.exec:\1dvvj.exe75⤵PID:2800
-
\??\c:\lfxrrxx.exec:\lfxrrxx.exe76⤵PID:2728
-
\??\c:\tntttn.exec:\tntttn.exe77⤵PID:2772
-
\??\c:\btttbb.exec:\btttbb.exe78⤵PID:2688
-
\??\c:\dvvjv.exec:\dvvjv.exe79⤵PID:2748
-
\??\c:\jdpvd.exec:\jdpvd.exe80⤵PID:2132
-
\??\c:\rfrrrlf.exec:\rfrrrlf.exe81⤵PID:2740
-
\??\c:\btnnnn.exec:\btnnnn.exe82⤵PID:2572
-
\??\c:\hhntbh.exec:\hhntbh.exe83⤵PID:2588
-
\??\c:\jvjjv.exec:\jvjjv.exe84⤵PID:2848
-
\??\c:\xlffffl.exec:\xlffffl.exe85⤵PID:2896
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe86⤵PID:2816
-
\??\c:\5btttb.exec:\5btttb.exe87⤵PID:1744
-
\??\c:\jdpvj.exec:\jdpvj.exe88⤵PID:756
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe89⤵PID:376
-
\??\c:\rfxxlxl.exec:\rfxxlxl.exe90⤵PID:1372
-
\??\c:\7bttbb.exec:\7bttbb.exe91⤵PID:2012
-
\??\c:\vjdvd.exec:\vjdvd.exe92⤵PID:2384
-
\??\c:\ppjvd.exec:\ppjvd.exe93⤵PID:1312
-
\??\c:\lfxxffl.exec:\lfxxffl.exe94⤵PID:2252
-
\??\c:\7fxxlxx.exec:\7fxxlxx.exe95⤵PID:2392
-
\??\c:\nhtnbb.exec:\nhtnbb.exe96⤵PID:1972
-
\??\c:\ppppp.exec:\ppppp.exe97⤵PID:1864
-
\??\c:\vpddj.exec:\vpddj.exe98⤵PID:1016
-
\??\c:\frlflxx.exec:\frlflxx.exe99⤵PID:584
-
\??\c:\hbtbnn.exec:\hbtbnn.exe100⤵PID:1804
-
\??\c:\dvpdp.exec:\dvpdp.exe101⤵PID:1324
-
\??\c:\jdvvd.exec:\jdvvd.exe102⤵PID:940
-
\??\c:\rlfffll.exec:\rlfffll.exe103⤵PID:2432
-
\??\c:\ffrlrlr.exec:\ffrlrlr.exe104⤵PID:1924
-
\??\c:\btntbb.exec:\btntbb.exe105⤵PID:744
-
\??\c:\dpjjp.exec:\dpjjp.exe106⤵PID:2452
-
\??\c:\9pjjj.exec:\9pjjj.exe107⤵PID:2036
-
\??\c:\frlrxfl.exec:\frlrxfl.exe108⤵PID:1612
-
\??\c:\9nbbhn.exec:\9nbbhn.exe109⤵PID:2156
-
\??\c:\hntntt.exec:\hntntt.exe110⤵PID:1616
-
\??\c:\5jjjj.exec:\5jjjj.exe111⤵PID:1916
-
\??\c:\5jvpv.exec:\5jvpv.exe112⤵PID:2056
-
\??\c:\xrfxfff.exec:\xrfxfff.exe113⤵PID:1056
-
\??\c:\9tbbnt.exec:\9tbbnt.exe114⤵PID:2784
-
\??\c:\hhtnnb.exec:\hhtnnb.exe115⤵PID:2152
-
\??\c:\dpdvp.exec:\dpdvp.exe116⤵
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\xlxllfl.exec:\xlxllfl.exe117⤵PID:2404
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe118⤵PID:2724
-
\??\c:\tnttbh.exec:\tnttbh.exe119⤵PID:2944
-
\??\c:\ttbbhh.exec:\ttbbhh.exe120⤵PID:2792
-
\??\c:\dvdvd.exec:\dvdvd.exe121⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-