Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe
-
Size
455KB
-
MD5
24f04bb30cbf3762188937d9f1b3a110
-
SHA1
5d4d321db9f9fbc3982aedb27223fb23a023d297
-
SHA256
12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdc
-
SHA512
403ca14c49f1919332d1a5c60bd5b70ac5915c4605fce5f24b69ad2a8ef0154d405f180288288f881f603658d8a399641e2185fa781de42ae6923fb856397659
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRF:q7Tc2NYHUrAwfMp3CDRF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-134-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1936-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-150-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/804-171-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/804-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-202-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-239-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-245-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-308-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3032-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1488-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-486-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2464-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-747-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1036-760-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1756-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-780-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1548-819-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1448-817-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2700-914-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2264 ntthbb.exe 3000 3vpvd.exe 2868 jdvvj.exe 2716 1rlfffr.exe 2856 jdjvv.exe 2708 3pjvj.exe 2612 7jpvd.exe 2624 3xrxllx.exe 2620 7pddd.exe 2828 btnhnh.exe 1536 1dpvd.exe 1388 rrlrflx.exe 2792 vdvvj.exe 1720 7nhntt.exe 1936 9dpvd.exe 1884 fxrrxxf.exe 804 llxflrf.exe 772 bhbbhh.exe 2248 5lffllx.exe 2440 jjdjv.exe 1012 fxfffxf.exe 1200 hthbbt.exe 2468 fxrrxfr.exe 1608 thtntt.exe 1652 5rxxflx.exe 936 3lxfllr.exe 2348 rrffrll.exe 1912 3bhntt.exe 2100 lxrrxxl.exe 352 xrfxfrx.exe 2284 7pdjd.exe 1504 5xlrxxf.exe 2288 nhttbt.exe 2264 7jpdj.exe 3032 fllfxxr.exe 2684 1flfllr.exe 1488 1nnhhh.exe 2276 dvjpv.exe 2436 xrxxxxx.exe 2692 hbbhhh.exe 2988 5nbhbh.exe 2824 jvvdv.exe 2592 jdppp.exe 2972 xxflrrx.exe 2536 5nbbbt.exe 1568 nbnhnn.exe 1152 vjpjp.exe 324 xlrrrrx.exe 1840 bnthhb.exe 2128 nbnntn.exe 1892 pjpvd.exe 1560 xffxfxx.exe 1820 bthbbb.exe 2504 nbtntt.exe 2812 pjjjp.exe 2676 frlffff.exe 1036 fxfflfl.exe 584 5tbbhh.exe 1260 pjvvv.exe 2444 pdpvv.exe 2804 rfllllr.exe 1524 bnbthb.exe 1200 btbbhh.exe 836 5jppp.exe -
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-486-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2804-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-635-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2716-649-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2536-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-914-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2264 2496 12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe 30 PID 2496 wrote to memory of 2264 2496 12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe 30 PID 2496 wrote to memory of 2264 2496 12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe 30 PID 2496 wrote to memory of 2264 2496 12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe 30 PID 2264 wrote to memory of 3000 2264 ntthbb.exe 31 PID 2264 wrote to memory of 3000 2264 ntthbb.exe 31 PID 2264 wrote to memory of 3000 2264 ntthbb.exe 31 PID 2264 wrote to memory of 3000 2264 ntthbb.exe 31 PID 3000 wrote to memory of 2868 3000 3vpvd.exe 32 PID 3000 wrote to memory of 2868 3000 3vpvd.exe 32 PID 3000 wrote to memory of 2868 3000 3vpvd.exe 32 PID 3000 wrote to memory of 2868 3000 3vpvd.exe 32 PID 2868 wrote to memory of 2716 2868 jdvvj.exe 33 PID 2868 wrote to memory of 2716 2868 jdvvj.exe 33 PID 2868 wrote to memory of 2716 2868 jdvvj.exe 33 PID 2868 wrote to memory of 2716 2868 jdvvj.exe 33 PID 2716 wrote to memory of 2856 2716 1rlfffr.exe 34 PID 2716 wrote to memory of 2856 2716 1rlfffr.exe 34 PID 2716 wrote to memory of 2856 2716 1rlfffr.exe 34 PID 2716 wrote to memory of 2856 2716 1rlfffr.exe 34 PID 2856 wrote to memory of 2708 2856 jdjvv.exe 35 PID 2856 wrote to memory of 2708 2856 jdjvv.exe 35 PID 2856 wrote to memory of 2708 2856 jdjvv.exe 35 PID 2856 wrote to memory of 2708 2856 jdjvv.exe 35 PID 2708 wrote to memory of 2612 2708 3pjvj.exe 36 PID 2708 wrote to memory of 2612 2708 3pjvj.exe 36 PID 2708 wrote to memory of 2612 2708 3pjvj.exe 36 PID 2708 wrote to memory of 2612 2708 3pjvj.exe 36 PID 2612 wrote to memory of 2624 2612 7jpvd.exe 37 PID 2612 wrote to memory of 2624 2612 7jpvd.exe 37 PID 2612 wrote to memory of 2624 2612 7jpvd.exe 37 PID 2612 wrote to memory of 2624 2612 7jpvd.exe 37 PID 2624 wrote to memory of 2620 2624 3xrxllx.exe 38 PID 2624 wrote to memory of 2620 2624 3xrxllx.exe 38 PID 2624 wrote to memory of 2620 2624 3xrxllx.exe 38 PID 2624 wrote to memory of 2620 2624 3xrxllx.exe 38 PID 2620 wrote to memory of 2828 2620 7pddd.exe 39 PID 2620 wrote to memory of 2828 2620 7pddd.exe 39 PID 2620 wrote to memory of 2828 2620 7pddd.exe 39 PID 2620 wrote to memory of 2828 2620 7pddd.exe 39 PID 2828 wrote to memory of 1536 2828 btnhnh.exe 40 PID 2828 wrote to memory of 1536 2828 btnhnh.exe 40 PID 2828 wrote to memory of 1536 2828 btnhnh.exe 40 PID 2828 wrote to memory of 1536 2828 btnhnh.exe 40 PID 1536 wrote to memory of 1388 1536 1dpvd.exe 41 PID 1536 wrote to memory of 1388 1536 1dpvd.exe 41 PID 1536 wrote to memory of 1388 1536 1dpvd.exe 41 PID 1536 wrote to memory of 1388 1536 1dpvd.exe 41 PID 1388 wrote to memory of 2792 1388 rrlrflx.exe 42 PID 1388 wrote to memory of 2792 1388 rrlrflx.exe 42 PID 1388 wrote to memory of 2792 1388 rrlrflx.exe 42 PID 1388 wrote to memory of 2792 1388 rrlrflx.exe 42 PID 2792 wrote to memory of 1720 2792 vdvvj.exe 43 PID 2792 wrote to memory of 1720 2792 vdvvj.exe 43 PID 2792 wrote to memory of 1720 2792 vdvvj.exe 43 PID 2792 wrote to memory of 1720 2792 vdvvj.exe 43 PID 1720 wrote to memory of 1936 1720 7nhntt.exe 44 PID 1720 wrote to memory of 1936 1720 7nhntt.exe 44 PID 1720 wrote to memory of 1936 1720 7nhntt.exe 44 PID 1720 wrote to memory of 1936 1720 7nhntt.exe 44 PID 1936 wrote to memory of 1884 1936 9dpvd.exe 45 PID 1936 wrote to memory of 1884 1936 9dpvd.exe 45 PID 1936 wrote to memory of 1884 1936 9dpvd.exe 45 PID 1936 wrote to memory of 1884 1936 9dpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe"C:\Users\Admin\AppData\Local\Temp\12238a06c3efc0f2ddb13446e77f7fe2102d2fba3f4242579afed23518f43bdcN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ntthbb.exec:\ntthbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\3vpvd.exec:\3vpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jdvvj.exec:\jdvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\1rlfffr.exec:\1rlfffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jdjvv.exec:\jdjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\3pjvj.exec:\3pjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7jpvd.exec:\7jpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\3xrxllx.exec:\3xrxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\7pddd.exec:\7pddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\btnhnh.exec:\btnhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1dpvd.exec:\1dpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\rrlrflx.exec:\rrlrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\vdvvj.exec:\vdvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7nhntt.exec:\7nhntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\9dpvd.exec:\9dpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe17⤵
- Executes dropped EXE
PID:1884 -
\??\c:\llxflrf.exec:\llxflrf.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\bhbbhh.exec:\bhbbhh.exe19⤵
- Executes dropped EXE
PID:772 -
\??\c:\5lffllx.exec:\5lffllx.exe20⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jjdjv.exec:\jjdjv.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fxfffxf.exec:\fxfffxf.exe22⤵
- Executes dropped EXE
PID:1012 -
\??\c:\hthbbt.exec:\hthbbt.exe23⤵
- Executes dropped EXE
PID:1200 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\thtntt.exec:\thtntt.exe25⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5rxxflx.exec:\5rxxflx.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3lxfllr.exec:\3lxfllr.exe27⤵
- Executes dropped EXE
PID:936 -
\??\c:\rrffrll.exec:\rrffrll.exe28⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3bhntt.exec:\3bhntt.exe29⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xrfxfrx.exec:\xrfxfrx.exe31⤵
- Executes dropped EXE
PID:352 -
\??\c:\7pdjd.exec:\7pdjd.exe32⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5xlrxxf.exec:\5xlrxxf.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nhttbt.exec:\nhttbt.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7jpdj.exec:\7jpdj.exe35⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fllfxxr.exec:\fllfxxr.exe36⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1flfllr.exec:\1flfllr.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1nnhhh.exec:\1nnhhh.exe38⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dvjpv.exec:\dvjpv.exe39⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe40⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbbhhh.exec:\hbbhhh.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5nbhbh.exec:\5nbhbh.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jvvdv.exec:\jvvdv.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jdppp.exec:\jdppp.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxflrrx.exec:\xxflrrx.exe45⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5nbbbt.exec:\5nbbbt.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nbnhnn.exec:\nbnhnn.exe47⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vjpjp.exec:\vjpjp.exe48⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe49⤵
- Executes dropped EXE
PID:324 -
\??\c:\bnthhb.exec:\bnthhb.exe50⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nbnntn.exec:\nbnntn.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjpvd.exec:\pjpvd.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\xffxfxx.exec:\xffxfxx.exe53⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bthbbb.exec:\bthbbb.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nbtntt.exec:\nbtntt.exe55⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pjjjp.exec:\pjjjp.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\frlffff.exec:\frlffff.exe57⤵
- Executes dropped EXE
PID:2676 -
\??\c:\fxfflfl.exec:\fxfflfl.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5tbbhh.exec:\5tbbhh.exe59⤵
- Executes dropped EXE
PID:584 -
\??\c:\pjvvv.exec:\pjvvv.exe60⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pdpvv.exec:\pdpvv.exe61⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rfllllr.exec:\rfllllr.exe62⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bnbthb.exec:\bnbthb.exe63⤵
- Executes dropped EXE
PID:1524 -
\??\c:\btbbhh.exec:\btbbhh.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\5jppp.exec:\5jppp.exe65⤵
- Executes dropped EXE
PID:836 -
\??\c:\1xlfffr.exec:\1xlfffr.exe66⤵PID:1472
-
\??\c:\bntntt.exec:\bntntt.exe67⤵PID:904
-
\??\c:\1pdjv.exec:\1pdjv.exe68⤵PID:1400
-
\??\c:\9vpjv.exec:\9vpjv.exe69⤵PID:2464
-
\??\c:\rflfxxx.exec:\rflfxxx.exe70⤵PID:344
-
\??\c:\7ntnnn.exec:\7ntnnn.exe71⤵PID:732
-
\??\c:\5vjjp.exec:\5vjjp.exe72⤵PID:2404
-
\??\c:\pdjvd.exec:\pdjvd.exe73⤵PID:2144
-
\??\c:\rrfxxfl.exec:\rrfxxfl.exe74⤵PID:1860
-
\??\c:\tnhhhh.exec:\tnhhhh.exe75⤵PID:1512
-
\??\c:\thtnnn.exec:\thtnnn.exe76⤵PID:1484
-
\??\c:\vpdvp.exec:\vpdvp.exe77⤵PID:2992
-
\??\c:\lxfffff.exec:\lxfffff.exe78⤵PID:2384
-
\??\c:\rfrrfxf.exec:\rfrrfxf.exe79⤵PID:2948
-
\??\c:\nbtttn.exec:\nbtttn.exe80⤵PID:3032
-
\??\c:\5dpdv.exec:\5dpdv.exe81⤵PID:2816
-
\??\c:\1jddv.exec:\1jddv.exe82⤵PID:2716
-
\??\c:\fxfffff.exec:\fxfffff.exe83⤵PID:2584
-
\??\c:\3thhhh.exec:\3thhhh.exe84⤵PID:2892
-
\??\c:\bnnbth.exec:\bnnbth.exe85⤵PID:2604
-
\??\c:\3jppj.exec:\3jppj.exe86⤵PID:2740
-
\??\c:\xrfxllx.exec:\xrfxllx.exe87⤵PID:2608
-
\??\c:\9bnhnh.exec:\9bnhnh.exe88⤵PID:2596
-
\??\c:\1dvjd.exec:\1dvjd.exe89⤵PID:1632
-
\??\c:\5vddd.exec:\5vddd.exe90⤵PID:2536
-
\??\c:\lxllxrf.exec:\lxllxrf.exe91⤵PID:2976
-
\??\c:\1hthbt.exec:\1hthbt.exe92⤵PID:2024
-
\??\c:\nbtbbb.exec:\nbtbbb.exe93⤵PID:1636
-
\??\c:\vpvdd.exec:\vpvdd.exe94⤵PID:2792
-
\??\c:\9dppp.exec:\9dppp.exe95⤵PID:1824
-
\??\c:\rlxrrll.exec:\rlxrrll.exe96⤵PID:1728
-
\??\c:\bnbbnt.exec:\bnbbnt.exe97⤵PID:856
-
\??\c:\jdddj.exec:\jdddj.exe98⤵PID:1844
-
\??\c:\jpvvd.exec:\jpvvd.exe99⤵PID:320
-
\??\c:\xrffrrf.exec:\xrffrrf.exe100⤵PID:2812
-
\??\c:\hbntbt.exec:\hbntbt.exe101⤵PID:2216
-
\??\c:\nbhhnt.exec:\nbhhnt.exe102⤵PID:1036
-
\??\c:\vjjjp.exec:\vjjjp.exe103⤵PID:584
-
\??\c:\llfxllx.exec:\llfxllx.exe104⤵PID:1756
-
\??\c:\9thhtb.exec:\9thhtb.exe105⤵PID:2444
-
\??\c:\3hthhb.exec:\3hthhb.exe106⤵PID:2636
-
\??\c:\9vpjj.exec:\9vpjj.exe107⤵PID:2560
-
\??\c:\1frlflr.exec:\1frlflr.exe108⤵PID:1448
-
\??\c:\lxlffxf.exec:\lxlffxf.exe109⤵PID:872
-
\??\c:\7nbtbh.exec:\7nbtbh.exe110⤵PID:1472
-
\??\c:\ppdjd.exec:\ppdjd.exe111⤵PID:1548
-
\??\c:\xrlxffr.exec:\xrlxffr.exe112⤵PID:540
-
\??\c:\7lxfxxf.exec:\7lxfxxf.exe113⤵PID:2464
-
\??\c:\bbttnn.exec:\bbttnn.exe114⤵PID:344
-
\??\c:\ddppd.exec:\ddppd.exe115⤵PID:2800
-
\??\c:\jjjvj.exec:\jjjvj.exe116⤵PID:2404
-
\??\c:\lxrrllr.exec:\lxrrllr.exe117⤵PID:1780
-
\??\c:\rlfrxrx.exec:\rlfrxrx.exe118⤵PID:1860
-
\??\c:\nbtbnn.exec:\nbtbnn.exe119⤵PID:2508
-
\??\c:\lxrrxfl.exec:\lxrrxfl.exe120⤵PID:2996
-
\??\c:\rfxfxxf.exec:\rfxfxxf.exe121⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-