Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe
-
Size
453KB
-
MD5
05cc8c9b93771edbff5e58349ed98780
-
SHA1
930a593528ebce93b103df9377f6943d14a72a8b
-
SHA256
78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17
-
SHA512
2dacbd7dd930434c1da44d6595b5498388d678d236f3c7cf034eb62b984d821c92d85149db1cdc556cf6b0a9aa1b70424bff1e30af9a4882085bfabc27ab1372
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2300-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-76-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2728-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-151-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1568-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-236-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/836-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-255-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2268-275-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2420-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-438-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/828-505-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1048-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1048-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-541-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2412-580-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1216-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-687-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2984-694-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1040-804-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3012-843-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1592-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-1006-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-1051-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-1090-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-1104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-1171-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2740-1178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-1209-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2248-1259-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-1297-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 vdvdv.exe 2456 fxflxxl.exe 2844 llfrfrf.exe 2768 hhbhtb.exe 2772 pjvdp.exe 2896 3ntnnt.exe 2796 xrffllr.exe 2728 rlfxflr.exe 2568 tnbnnn.exe 2992 llrxxxl.exe 540 jdpvj.exe 1728 lfxlrxl.exe 2544 pjdpj.exe 760 5fxfxfx.exe 572 vvjvj.exe 1056 ppjpd.exe 1568 hbthtt.exe 628 1vpdp.exe 1388 ddjdv.exe 2072 dpdjp.exe 2192 ntnnbb.exe 328 9jddj.exe 1044 ntnbnn.exe 924 3hbhbb.exe 2008 ffxrfxl.exe 836 tnnnbh.exe 1320 dddvj.exe 2528 ffxxflx.exe 2252 7vpdp.exe 2268 rlflllf.exe 2420 vvddp.exe 996 jdvdj.exe 868 lfrrflx.exe 2952 rfxxflx.exe 2352 rlxxllx.exe 2460 1hhhnt.exe 1592 vvjvd.exe 2504 7fxlflr.exe 2780 lflrxfl.exe 2664 tbhtht.exe 2700 3djdp.exe 2772 9dvpd.exe 2356 rrllxxf.exe 2736 tnhhtb.exe 2692 htnhnb.exe 2724 jjdpd.exe 2976 ffxlxlx.exe 2156 thtbnb.exe 1604 7ppdj.exe 2616 vvvjd.exe 1188 fxflfrf.exe 536 bthtbb.exe 764 3bntbh.exe 1052 ppjvj.exe 1064 9fxfffx.exe 2792 tthnhh.exe 1424 ttnttb.exe 2876 3pdjd.exe 2116 lfxxrxr.exe 2216 nnbbtb.exe 2128 tnntbb.exe 1988 ppvvj.exe 2536 9lflxrx.exe 664 5frrxxf.exe -
resource yara_rule behavioral1/memory/2300-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-151-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1568-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-182-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2072-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-529-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1048-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-580-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1216-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-694-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1696-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-804-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2024-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-843-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1976-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-1006-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1500-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-1178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-1209-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2572-1240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-1259-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2020-1297-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1424-1316-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2300 2280 78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe 31 PID 2280 wrote to memory of 2300 2280 78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe 31 PID 2280 wrote to memory of 2300 2280 78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe 31 PID 2280 wrote to memory of 2300 2280 78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe 31 PID 2300 wrote to memory of 2456 2300 vdvdv.exe 32 PID 2300 wrote to memory of 2456 2300 vdvdv.exe 32 PID 2300 wrote to memory of 2456 2300 vdvdv.exe 32 PID 2300 wrote to memory of 2456 2300 vdvdv.exe 32 PID 2456 wrote to memory of 2844 2456 fxflxxl.exe 33 PID 2456 wrote to memory of 2844 2456 fxflxxl.exe 33 PID 2456 wrote to memory of 2844 2456 fxflxxl.exe 33 PID 2456 wrote to memory of 2844 2456 fxflxxl.exe 33 PID 2844 wrote to memory of 2768 2844 llfrfrf.exe 34 PID 2844 wrote to memory of 2768 2844 llfrfrf.exe 34 PID 2844 wrote to memory of 2768 2844 llfrfrf.exe 34 PID 2844 wrote to memory of 2768 2844 llfrfrf.exe 34 PID 2768 wrote to memory of 2772 2768 hhbhtb.exe 35 PID 2768 wrote to memory of 2772 2768 hhbhtb.exe 35 PID 2768 wrote to memory of 2772 2768 hhbhtb.exe 35 PID 2768 wrote to memory of 2772 2768 hhbhtb.exe 35 PID 2772 wrote to memory of 2896 2772 pjvdp.exe 36 PID 2772 wrote to memory of 2896 2772 pjvdp.exe 36 PID 2772 wrote to memory of 2896 2772 pjvdp.exe 36 PID 2772 wrote to memory of 2896 2772 pjvdp.exe 36 PID 2896 wrote to memory of 2796 2896 3ntnnt.exe 37 PID 2896 wrote to memory of 2796 2896 3ntnnt.exe 37 PID 2896 wrote to memory of 2796 2896 3ntnnt.exe 37 PID 2896 wrote to memory of 2796 2896 3ntnnt.exe 37 PID 2796 wrote to memory of 2728 2796 xrffllr.exe 38 PID 2796 wrote to memory of 2728 2796 xrffllr.exe 38 PID 2796 wrote to memory of 2728 2796 xrffllr.exe 38 PID 2796 wrote to memory of 2728 2796 xrffllr.exe 38 PID 2728 wrote to memory of 2568 2728 rlfxflr.exe 39 PID 2728 wrote to memory of 2568 2728 rlfxflr.exe 39 PID 2728 wrote to memory of 2568 2728 rlfxflr.exe 39 PID 2728 wrote to memory of 2568 2728 rlfxflr.exe 39 PID 2568 wrote to memory of 2992 2568 tnbnnn.exe 40 PID 2568 wrote to memory of 2992 2568 tnbnnn.exe 40 PID 2568 wrote to memory of 2992 2568 tnbnnn.exe 40 PID 2568 wrote to memory of 2992 2568 tnbnnn.exe 40 PID 2992 wrote to memory of 540 2992 llrxxxl.exe 41 PID 2992 wrote to memory of 540 2992 llrxxxl.exe 41 PID 2992 wrote to memory of 540 2992 llrxxxl.exe 41 PID 2992 wrote to memory of 540 2992 llrxxxl.exe 41 PID 540 wrote to memory of 1728 540 jdpvj.exe 42 PID 540 wrote to memory of 1728 540 jdpvj.exe 42 PID 540 wrote to memory of 1728 540 jdpvj.exe 42 PID 540 wrote to memory of 1728 540 jdpvj.exe 42 PID 1728 wrote to memory of 2544 1728 lfxlrxl.exe 43 PID 1728 wrote to memory of 2544 1728 lfxlrxl.exe 43 PID 1728 wrote to memory of 2544 1728 lfxlrxl.exe 43 PID 1728 wrote to memory of 2544 1728 lfxlrxl.exe 43 PID 2544 wrote to memory of 760 2544 pjdpj.exe 44 PID 2544 wrote to memory of 760 2544 pjdpj.exe 44 PID 2544 wrote to memory of 760 2544 pjdpj.exe 44 PID 2544 wrote to memory of 760 2544 pjdpj.exe 44 PID 760 wrote to memory of 572 760 5fxfxfx.exe 45 PID 760 wrote to memory of 572 760 5fxfxfx.exe 45 PID 760 wrote to memory of 572 760 5fxfxfx.exe 45 PID 760 wrote to memory of 572 760 5fxfxfx.exe 45 PID 572 wrote to memory of 1056 572 vvjvj.exe 46 PID 572 wrote to memory of 1056 572 vvjvj.exe 46 PID 572 wrote to memory of 1056 572 vvjvj.exe 46 PID 572 wrote to memory of 1056 572 vvjvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe"C:\Users\Admin\AppData\Local\Temp\78eb4210ce27ca7e8ba760cbb540b29a89ed1edc1f09cada067124a9c7ef0c17N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vdvdv.exec:\vdvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\fxflxxl.exec:\fxflxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\llfrfrf.exec:\llfrfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hhbhtb.exec:\hhbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\pjvdp.exec:\pjvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3ntnnt.exec:\3ntnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\xrffllr.exec:\xrffllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\rlfxflr.exec:\rlfxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tnbnnn.exec:\tnbnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\llrxxxl.exec:\llrxxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jdpvj.exec:\jdpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\pjdpj.exec:\pjdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\5fxfxfx.exec:\5fxfxfx.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\vvjvj.exec:\vvjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\ppjpd.exec:\ppjpd.exe17⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hbthtt.exec:\hbthtt.exe18⤵
- Executes dropped EXE
PID:1568 -
\??\c:\1vpdp.exec:\1vpdp.exe19⤵
- Executes dropped EXE
PID:628 -
\??\c:\ddjdv.exec:\ddjdv.exe20⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dpdjp.exec:\dpdjp.exe21⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ntnnbb.exec:\ntnnbb.exe22⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9jddj.exec:\9jddj.exe23⤵
- Executes dropped EXE
PID:328 -
\??\c:\ntnbnn.exec:\ntnbnn.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\3hbhbb.exec:\3hbhbb.exe25⤵
- Executes dropped EXE
PID:924 -
\??\c:\ffxrfxl.exec:\ffxrfxl.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tnnnbh.exec:\tnnnbh.exe27⤵
- Executes dropped EXE
PID:836 -
\??\c:\dddvj.exec:\dddvj.exe28⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ffxxflx.exec:\ffxxflx.exe29⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7vpdp.exec:\7vpdp.exe30⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rlflllf.exec:\rlflllf.exe31⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vvddp.exec:\vvddp.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jdvdj.exec:\jdvdj.exe33⤵
- Executes dropped EXE
PID:996 -
\??\c:\lfrrflx.exec:\lfrrflx.exe34⤵
- Executes dropped EXE
PID:868 -
\??\c:\rfxxflx.exec:\rfxxflx.exe35⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rlxxllx.exec:\rlxxllx.exe36⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1hhhnt.exec:\1hhhnt.exe37⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vvjvd.exec:\vvjvd.exe38⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7fxlflr.exec:\7fxlflr.exe39⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lflrxfl.exec:\lflrxfl.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tbhtht.exec:\tbhtht.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3djdp.exec:\3djdp.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9dvpd.exec:\9dvpd.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rrllxxf.exec:\rrllxxf.exe44⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tnhhtb.exec:\tnhhtb.exe45⤵
- Executes dropped EXE
PID:2736 -
\??\c:\htnhnb.exec:\htnhnb.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjdpd.exec:\jjdpd.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ffxlxlx.exec:\ffxlxlx.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\thtbnb.exec:\thtbnb.exe49⤵
- Executes dropped EXE
PID:2156 -
\??\c:\7ppdj.exec:\7ppdj.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vvvjd.exec:\vvvjd.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxflfrf.exec:\fxflfrf.exe52⤵
- Executes dropped EXE
PID:1188 -
\??\c:\bthtbb.exec:\bthtbb.exe53⤵
- Executes dropped EXE
PID:536 -
\??\c:\3bntbh.exec:\3bntbh.exe54⤵
- Executes dropped EXE
PID:764 -
\??\c:\ppjvj.exec:\ppjvj.exe55⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9fxfffx.exec:\9fxfffx.exe56⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tthnhh.exec:\tthnhh.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ttnttb.exec:\ttnttb.exe58⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3pdjd.exec:\3pdjd.exe59⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lfxxrxr.exec:\lfxxrxr.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nnbbtb.exec:\nnbbtb.exe61⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tnntbb.exec:\tnntbb.exe62⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ppvvj.exec:\ppvvj.exe63⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9lflxrx.exec:\9lflxrx.exe64⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5frrxxf.exec:\5frrxxf.exe65⤵
- Executes dropped EXE
PID:664 -
\??\c:\7tnthn.exec:\7tnthn.exe66⤵PID:828
-
\??\c:\pjdpd.exec:\pjdpd.exe67⤵PID:1648
-
\??\c:\7xrrlrf.exec:\7xrrlrf.exe68⤵PID:1620
-
\??\c:\llffrxl.exec:\llffrxl.exe69⤵PID:896
-
\??\c:\btnbnn.exec:\btnbnn.exe70⤵PID:1048
-
\??\c:\vvppd.exec:\vvppd.exe71⤵PID:1848
-
\??\c:\xffffrx.exec:\xffffrx.exe72⤵PID:1536
-
\??\c:\tbtbnn.exec:\tbtbnn.exe73⤵PID:1972
-
\??\c:\7pjpd.exec:\7pjpd.exe74⤵PID:2432
-
\??\c:\3vpdp.exec:\3vpdp.exe75⤵PID:2516
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe76⤵PID:2396
-
\??\c:\tbhtht.exec:\tbhtht.exe77⤵PID:2412
-
\??\c:\vpvpd.exec:\vpvpd.exe78⤵PID:1748
-
\??\c:\1dpvv.exec:\1dpvv.exe79⤵PID:1216
-
\??\c:\1rlllrl.exec:\1rlllrl.exe80⤵PID:1996
-
\??\c:\ttnnbh.exec:\ttnnbh.exe81⤵PID:2300
-
\??\c:\tnhntt.exec:\tnhntt.exe82⤵PID:1584
-
\??\c:\3jjdp.exec:\3jjdp.exe83⤵PID:2456
-
\??\c:\rlffrxl.exec:\rlffrxl.exe84⤵PID:2804
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe85⤵PID:2780
-
\??\c:\9hhnbb.exec:\9hhnbb.exe86⤵PID:2696
-
\??\c:\3dvpv.exec:\3dvpv.exe87⤵PID:2700
-
\??\c:\9lffllr.exec:\9lffllr.exe88⤵PID:2772
-
\??\c:\hbthtt.exec:\hbthtt.exe89⤵PID:2592
-
\??\c:\9nbbnn.exec:\9nbbnn.exe90⤵PID:2736
-
\??\c:\1pjpd.exec:\1pjpd.exe91⤵PID:2572
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe92⤵PID:2980
-
\??\c:\ttnbnn.exec:\ttnbnn.exe93⤵PID:2976
-
\??\c:\5bbbth.exec:\5bbbth.exe94⤵PID:2984
-
\??\c:\vvddp.exec:\vvddp.exe95⤵PID:1604
-
\??\c:\fxffxfl.exec:\fxffxfl.exe96⤵PID:1728
-
\??\c:\1lrfrxr.exec:\1lrfrxr.exe97⤵PID:2060
-
\??\c:\tbnbth.exec:\tbnbth.exe98⤵
- System Location Discovery: System Language Discovery
PID:1856 -
\??\c:\vjvvd.exec:\vjvvd.exe99⤵PID:2020
-
\??\c:\jjvdj.exec:\jjvdj.exe100⤵PID:1072
-
\??\c:\1fxrxfl.exec:\1fxrxfl.exe101⤵PID:1204
-
\??\c:\1rffxxx.exec:\1rffxxx.exe102⤵PID:1568
-
\??\c:\1tbtbt.exec:\1tbtbt.exe103⤵PID:2832
-
\??\c:\7vpjv.exec:\7vpjv.exe104⤵PID:628
-
\??\c:\pjdpp.exec:\pjdpp.exe105⤵PID:1388
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe106⤵PID:2212
-
\??\c:\bhbbhn.exec:\bhbbhn.exe107⤵PID:1696
-
\??\c:\9tthbn.exec:\9tthbn.exe108⤵PID:448
-
\??\c:\vpvdp.exec:\vpvdp.exe109⤵PID:2596
-
\??\c:\7xflffl.exec:\7xflffl.exe110⤵PID:2436
-
\??\c:\bbbhtt.exec:\bbbhtt.exe111⤵PID:1068
-
\??\c:\tnnthn.exec:\tnnthn.exe112⤵PID:1040
-
\??\c:\3dvvd.exec:\3dvvd.exe113⤵PID:1920
-
\??\c:\fxrxllx.exec:\fxrxllx.exe114⤵PID:2024
-
\??\c:\9rrxlxr.exec:\9rrxlxr.exe115⤵PID:720
-
\??\c:\ttbhbh.exec:\ttbhbh.exe116⤵PID:268
-
\??\c:\jpdpv.exec:\jpdpv.exe117⤵PID:776
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe118⤵PID:3012
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe119⤵PID:2384
-
\??\c:\hnhthn.exec:\hnhthn.exe120⤵
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\jjjjd.exec:\jjjjd.exe121⤵PID:620
-
\??\c:\vdpdj.exec:\vdpdj.exe122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-