Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe
-
Size
453KB
-
MD5
dd7649c02baf244834491bc6bbd2f640
-
SHA1
be2956ceb4d09374fdbeb52ae8cca20847d1063f
-
SHA256
a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000
-
SHA512
9b97924f241d736953fab5209d78da09bfd461e3407277a6ca43f4ac1d1008f6f38f0646c675fc9018684db94c94961c88ac761bd29df9573918d631a0541747
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeUQ:q7Tc2NYHUrAwfMp3CDUQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2384-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1604-141-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2008-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-176-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2604-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-248-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2840-253-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1592-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2460-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-345-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1048-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-407-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2324-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-446-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1652-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-542-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-556-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-714-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1780-837-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1052 ppjpv.exe 2912 5rrxffx.exe 2420 dvddj.exe 2656 rrflrxf.exe 2728 ppddp.exe 2852 xxxxllr.exe 2204 nhthtb.exe 2960 ddpvd.exe 2532 rllxxfr.exe 2456 tnbbhh.exe 1724 xxrrxxl.exe 324 hhthbt.exe 2340 7vdjp.exe 1604 xxfffxr.exe 2504 hhhtbh.exe 576 1rlrxlx.exe 2008 btnthn.exe 2604 vdpvv.exe 2096 lxxrffl.exe 376 tbbhtt.exe 916 xffxrlf.exe 2020 tnbtbb.exe 620 1dvdj.exe 1468 9tnnbt.exe 3052 jdpdp.exe 2292 pjpvd.exe 2840 ffrxrrf.exe 2832 5tthtt.exe 2116 ddvdj.exe 2396 lfrxflr.exe 1592 jdpjp.exe 2460 frlrxxx.exe 2412 jdjpv.exe 2044 vpjvj.exe 2688 rxfffxf.exe 2696 ttnhnt.exe 2796 jjjjj.exe 2844 pjvvv.exe 2716 xlrxrll.exe 2684 5btbhn.exe 2600 tbbhtt.exe 2668 vpvdd.exe 2920 3lffffr.exe 648 3nnhtt.exe 1048 bthnbt.exe 1412 jjdjp.exe 708 fxlxflx.exe 1588 nhbhnn.exe 2324 nhttbt.exe 1236 3ppvv.exe 1568 ffrxffx.exe 1692 rlfxlfr.exe 1572 1hbbbn.exe 2788 nbtbbn.exe 1964 3pvdj.exe 2212 7ffxflx.exe 376 nhhhnt.exe 1652 jdvvd.exe 1948 pvpvd.exe 1480 lxllrrx.exe 620 rlflrlr.exe 2432 hhbbnn.exe 844 pdvdj.exe 1548 dvvvv.exe -
resource yara_rule behavioral1/memory/2384-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-140-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2008-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-176-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2604-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-253-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1592-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-407-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2324-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-446-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1964-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-542-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1848-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-585-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2548-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-714-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2168-824-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1052 2384 a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe 31 PID 2384 wrote to memory of 1052 2384 a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe 31 PID 2384 wrote to memory of 1052 2384 a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe 31 PID 2384 wrote to memory of 1052 2384 a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe 31 PID 1052 wrote to memory of 2912 1052 ppjpv.exe 32 PID 1052 wrote to memory of 2912 1052 ppjpv.exe 32 PID 1052 wrote to memory of 2912 1052 ppjpv.exe 32 PID 1052 wrote to memory of 2912 1052 ppjpv.exe 32 PID 2912 wrote to memory of 2420 2912 5rrxffx.exe 33 PID 2912 wrote to memory of 2420 2912 5rrxffx.exe 33 PID 2912 wrote to memory of 2420 2912 5rrxffx.exe 33 PID 2912 wrote to memory of 2420 2912 5rrxffx.exe 33 PID 2420 wrote to memory of 2656 2420 dvddj.exe 34 PID 2420 wrote to memory of 2656 2420 dvddj.exe 34 PID 2420 wrote to memory of 2656 2420 dvddj.exe 34 PID 2420 wrote to memory of 2656 2420 dvddj.exe 34 PID 2656 wrote to memory of 2728 2656 rrflrxf.exe 35 PID 2656 wrote to memory of 2728 2656 rrflrxf.exe 35 PID 2656 wrote to memory of 2728 2656 rrflrxf.exe 35 PID 2656 wrote to memory of 2728 2656 rrflrxf.exe 35 PID 2728 wrote to memory of 2852 2728 ppddp.exe 36 PID 2728 wrote to memory of 2852 2728 ppddp.exe 36 PID 2728 wrote to memory of 2852 2728 ppddp.exe 36 PID 2728 wrote to memory of 2852 2728 ppddp.exe 36 PID 2852 wrote to memory of 2204 2852 xxxxllr.exe 37 PID 2852 wrote to memory of 2204 2852 xxxxllr.exe 37 PID 2852 wrote to memory of 2204 2852 xxxxllr.exe 37 PID 2852 wrote to memory of 2204 2852 xxxxllr.exe 37 PID 2204 wrote to memory of 2960 2204 nhthtb.exe 38 PID 2204 wrote to memory of 2960 2204 nhthtb.exe 38 PID 2204 wrote to memory of 2960 2204 nhthtb.exe 38 PID 2204 wrote to memory of 2960 2204 nhthtb.exe 38 PID 2960 wrote to memory of 2532 2960 ddpvd.exe 39 PID 2960 wrote to memory of 2532 2960 ddpvd.exe 39 PID 2960 wrote to memory of 2532 2960 ddpvd.exe 39 PID 2960 wrote to memory of 2532 2960 ddpvd.exe 39 PID 2532 wrote to memory of 2456 2532 rllxxfr.exe 40 PID 2532 wrote to memory of 2456 2532 rllxxfr.exe 40 PID 2532 wrote to memory of 2456 2532 rllxxfr.exe 40 PID 2532 wrote to memory of 2456 2532 rllxxfr.exe 40 PID 2456 wrote to memory of 1724 2456 tnbbhh.exe 41 PID 2456 wrote to memory of 1724 2456 tnbbhh.exe 41 PID 2456 wrote to memory of 1724 2456 tnbbhh.exe 41 PID 2456 wrote to memory of 1724 2456 tnbbhh.exe 41 PID 1724 wrote to memory of 324 1724 xxrrxxl.exe 42 PID 1724 wrote to memory of 324 1724 xxrrxxl.exe 42 PID 1724 wrote to memory of 324 1724 xxrrxxl.exe 42 PID 1724 wrote to memory of 324 1724 xxrrxxl.exe 42 PID 324 wrote to memory of 2340 324 hhthbt.exe 43 PID 324 wrote to memory of 2340 324 hhthbt.exe 43 PID 324 wrote to memory of 2340 324 hhthbt.exe 43 PID 324 wrote to memory of 2340 324 hhthbt.exe 43 PID 2340 wrote to memory of 1604 2340 7vdjp.exe 44 PID 2340 wrote to memory of 1604 2340 7vdjp.exe 44 PID 2340 wrote to memory of 1604 2340 7vdjp.exe 44 PID 2340 wrote to memory of 1604 2340 7vdjp.exe 44 PID 1604 wrote to memory of 2504 1604 xxfffxr.exe 45 PID 1604 wrote to memory of 2504 1604 xxfffxr.exe 45 PID 1604 wrote to memory of 2504 1604 xxfffxr.exe 45 PID 1604 wrote to memory of 2504 1604 xxfffxr.exe 45 PID 2504 wrote to memory of 576 2504 hhhtbh.exe 46 PID 2504 wrote to memory of 576 2504 hhhtbh.exe 46 PID 2504 wrote to memory of 576 2504 hhhtbh.exe 46 PID 2504 wrote to memory of 576 2504 hhhtbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe"C:\Users\Admin\AppData\Local\Temp\a397f607575490d21adcfc758d8d72035c5170a998ead56f9c4d36eb5bd6b000N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ppjpv.exec:\ppjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\5rrxffx.exec:\5rrxffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\dvddj.exec:\dvddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\rrflrxf.exec:\rrflrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ppddp.exec:\ppddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xxxxllr.exec:\xxxxllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nhthtb.exec:\nhthtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\ddpvd.exec:\ddpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rllxxfr.exec:\rllxxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tnbbhh.exec:\tnbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\hhthbt.exec:\hhthbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\7vdjp.exec:\7vdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\xxfffxr.exec:\xxfffxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\hhhtbh.exec:\hhhtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\1rlrxlx.exec:\1rlrxlx.exe17⤵
- Executes dropped EXE
PID:576 -
\??\c:\btnthn.exec:\btnthn.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vdpvv.exec:\vdpvv.exe19⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lxxrffl.exec:\lxxrffl.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tbbhtt.exec:\tbbhtt.exe21⤵
- Executes dropped EXE
PID:376 -
\??\c:\xffxrlf.exec:\xffxrlf.exe22⤵
- Executes dropped EXE
PID:916 -
\??\c:\tnbtbb.exec:\tnbtbb.exe23⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1dvdj.exec:\1dvdj.exe24⤵
- Executes dropped EXE
PID:620 -
\??\c:\9tnnbt.exec:\9tnnbt.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jdpdp.exec:\jdpdp.exe26⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pjpvd.exec:\pjpvd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\ffrxrrf.exec:\ffrxrrf.exe28⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5tthtt.exec:\5tthtt.exe29⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ddvdj.exec:\ddvdj.exe30⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lfrxflr.exec:\lfrxflr.exe31⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jdpjp.exec:\jdpjp.exe32⤵
- Executes dropped EXE
PID:1592 -
\??\c:\frlrxxx.exec:\frlrxxx.exe33⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jdjpv.exec:\jdjpv.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vpjvj.exec:\vpjvj.exe35⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rxfffxf.exec:\rxfffxf.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ttnhnt.exec:\ttnhnt.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jjjjj.exec:\jjjjj.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pjvvv.exec:\pjvvv.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xlrxrll.exec:\xlrxrll.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5btbhn.exec:\5btbhn.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tbbhtt.exec:\tbbhtt.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vpvdd.exec:\vpvdd.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3lffffr.exec:\3lffffr.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3nnhtt.exec:\3nnhtt.exe45⤵
- Executes dropped EXE
PID:648 -
\??\c:\bthnbt.exec:\bthnbt.exe46⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jjdjp.exec:\jjdjp.exe47⤵
- Executes dropped EXE
PID:1412 -
\??\c:\fxlxflx.exec:\fxlxflx.exe48⤵
- Executes dropped EXE
PID:708 -
\??\c:\nhbhnn.exec:\nhbhnn.exe49⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nhttbt.exec:\nhttbt.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
\??\c:\3ppvv.exec:\3ppvv.exe51⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ffrxffx.exec:\ffrxffx.exe52⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1hbbbn.exec:\1hbbbn.exe54⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nbtbbn.exec:\nbtbbn.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3pvdj.exec:\3pvdj.exe56⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7ffxflx.exec:\7ffxflx.exe57⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhhhnt.exec:\nhhhnt.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\jdvvd.exec:\jdvvd.exe59⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pvpvd.exec:\pvpvd.exe60⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lxllrrx.exec:\lxllrrx.exe61⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rlflrlr.exec:\rlflrlr.exe62⤵
- Executes dropped EXE
PID:620 -
\??\c:\hhbbnn.exec:\hhbbnn.exe63⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pdvdj.exec:\pdvdj.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\dvvvv.exec:\dvvvv.exe65⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xxrrxfr.exec:\xxrrxfr.exe66⤵PID:3000
-
\??\c:\hhnbtb.exec:\hhnbtb.exe67⤵PID:1736
-
\??\c:\hbnhnh.exec:\hbnhnh.exe68⤵PID:1424
-
\??\c:\dpddj.exec:\dpddj.exe69⤵PID:1848
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe70⤵PID:2056
-
\??\c:\nbttbb.exec:\nbttbb.exe71⤵PID:2416
-
\??\c:\1tthhh.exec:\1tthhh.exe72⤵PID:1592
-
\??\c:\vdjpv.exec:\vdjpv.exe73⤵PID:2944
-
\??\c:\rxlxllr.exec:\rxlxllr.exe74⤵PID:2424
-
\??\c:\bbhhtt.exec:\bbhhtt.exe75⤵PID:2420
-
\??\c:\7bnbht.exec:\7bnbht.exe76⤵PID:3008
-
\??\c:\jpjvd.exec:\jpjvd.exe77⤵PID:2656
-
\??\c:\1rlllrx.exec:\1rlllrx.exe78⤵PID:2744
-
\??\c:\fxrxfll.exec:\fxrxfll.exe79⤵PID:2772
-
\??\c:\5nhhtb.exec:\5nhhtb.exe80⤵PID:2548
-
\??\c:\1jdpd.exec:\1jdpd.exe81⤵PID:2708
-
\??\c:\pjjjj.exec:\pjjjj.exe82⤵PID:2712
-
\??\c:\xrlxffr.exec:\xrlxffr.exe83⤵PID:2924
-
\??\c:\ttnnbb.exec:\ttnnbb.exe84⤵PID:1912
-
\??\c:\hhtntb.exec:\hhtntb.exe85⤵PID:1624
-
\??\c:\vpjpd.exec:\vpjpd.exe86⤵PID:236
-
\??\c:\ffrflrf.exec:\ffrflrf.exe87⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\fxfrxxf.exec:\fxfrxxf.exe88⤵PID:1656
-
\??\c:\nbnnbt.exec:\nbnnbt.exe89⤵PID:708
-
\??\c:\nhhnbh.exec:\nhhnbh.exe90⤵PID:1604
-
\??\c:\1pjjp.exec:\1pjjp.exe91⤵PID:2016
-
\??\c:\rfxflrx.exec:\rfxflrx.exe92⤵PID:1932
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe93⤵PID:1740
-
\??\c:\ttntnn.exec:\ttntnn.exe94⤵PID:264
-
\??\c:\3pddd.exec:\3pddd.exe95⤵PID:1988
-
\??\c:\5jppp.exec:\5jppp.exe96⤵PID:2372
-
\??\c:\3rlxfrr.exec:\3rlxfrr.exe97⤵PID:1304
-
\??\c:\3tnntt.exec:\3tnntt.exe98⤵PID:2096
-
\??\c:\9nhnbb.exec:\9nhnbb.exe99⤵PID:1640
-
\??\c:\dvjjv.exec:\dvjjv.exe100⤵PID:1632
-
\??\c:\9rllxxf.exec:\9rllxxf.exe101⤵PID:2260
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe102⤵PID:2868
-
\??\c:\nhbnhh.exec:\nhbnhh.exe103⤵PID:620
-
\??\c:\jjdjd.exec:\jjdjd.exe104⤵PID:1732
-
\??\c:\1vjdv.exec:\1vjdv.exe105⤵PID:568
-
\??\c:\xrlrrrx.exec:\xrlrrrx.exe106⤵PID:2840
-
\??\c:\3bntbb.exec:\3bntbb.exe107⤵PID:1396
-
\??\c:\dvjjj.exec:\dvjjj.exe108⤵PID:1872
-
\??\c:\jdvdj.exec:\jdvdj.exe109⤵PID:2116
-
\??\c:\xlxrrll.exec:\xlxrrll.exe110⤵PID:1780
-
\??\c:\9tthnt.exec:\9tthnt.exe111⤵PID:2384
-
\??\c:\3nbbtt.exec:\3nbbtt.exe112⤵PID:2168
-
\??\c:\jdvvd.exec:\jdvvd.exe113⤵PID:2952
-
\??\c:\1lfxrlr.exec:\1lfxrlr.exe114⤵PID:3016
-
\??\c:\1lfllrx.exec:\1lfllrx.exe115⤵PID:3012
-
\??\c:\nhbbnn.exec:\nhbbnn.exe116⤵
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\ddvdj.exec:\ddvdj.exe117⤵PID:2748
-
\??\c:\9xrlfff.exec:\9xrlfff.exe118⤵PID:2720
-
\??\c:\lxfffxf.exec:\lxfffxf.exe119⤵PID:2792
-
\??\c:\hbnnnn.exec:\hbnnnn.exe120⤵PID:2844
-
\??\c:\nhbntn.exec:\nhbntn.exe121⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-