Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe
-
Size
452KB
-
MD5
7b434dc381b5a737263c719962e86440
-
SHA1
3c7ba530cc310322cb46b1d88ac62038a5ae1260
-
SHA256
9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702
-
SHA512
b7b1e1b9d13d13cfcad09bdef10a422cf6d560b922b6d3e46f5ab51e6558ce581198b3f290f756c814875a923050f337f6c03bff05041dbe83014a3a30a462f8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-102-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2872-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-232-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/600-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-481-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1856-522-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-782-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1748-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-887-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-980-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-1029-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1660 nbbhtb.exe 1652 pjppd.exe 2184 jdvvj.exe 1416 ddvdj.exe 2904 nhtbhb.exe 1904 1vjpp.exe 2648 bhtbbb.exe 2732 lxllxxf.exe 2664 bnbhnh.exe 2672 vpjvd.exe 2872 7dvpp.exe 1516 bhtnnb.exe 2180 jjdjp.exe 2952 bbhntb.exe 2856 9jdjj.exe 1640 pjdpv.exe 1832 ffrflfl.exe 1688 3vddd.exe 2424 xxlrxxr.exe 332 ddppv.exe 2544 nhbnhh.exe 1464 9jvjd.exe 1788 7bttht.exe 1248 vpjvd.exe 1612 7xxlrxl.exe 1420 nnhbth.exe 2360 5rlrxxr.exe 600 9thhhn.exe 2084 vjdjv.exe 1448 1llrrxx.exe 3032 nnbnhh.exe 2392 9xlrxrx.exe 1984 7pvdv.exe 2384 5jdpv.exe 2328 llxrxfl.exe 2932 hhnthn.exe 2844 jvpjp.exe 2776 xxxxllx.exe 3004 frfrrll.exe 2944 bnbbhb.exe 2756 9vvdp.exe 2616 xrrxlrx.exe 2732 rlfxllr.exe 2072 tbhtbt.exe 988 vvjpp.exe 852 pvpvj.exe 1408 ffxxlxf.exe 2960 5htbhn.exe 2180 dpjdj.exe 2608 flxrlff.exe 2000 rflxffl.exe 2856 tnttbb.exe 2504 pjvdj.exe 1404 lfrxflx.exe 2112 fxxxffr.exe 2108 1nbbhh.exe 588 jjdjv.exe 1036 jvpvv.exe 1424 rlxxrrx.exe 544 hthhnt.exe 2164 pjdjp.exe 1696 dvppd.exe 1580 rlxlxrx.exe 1856 tbbbhb.exe -
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-121-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2856-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-315-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2776-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-782-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1748-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-980-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1660 2540 9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe 30 PID 2540 wrote to memory of 1660 2540 9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe 30 PID 2540 wrote to memory of 1660 2540 9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe 30 PID 2540 wrote to memory of 1660 2540 9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe 30 PID 1660 wrote to memory of 1652 1660 nbbhtb.exe 31 PID 1660 wrote to memory of 1652 1660 nbbhtb.exe 31 PID 1660 wrote to memory of 1652 1660 nbbhtb.exe 31 PID 1660 wrote to memory of 1652 1660 nbbhtb.exe 31 PID 1652 wrote to memory of 2184 1652 pjppd.exe 32 PID 1652 wrote to memory of 2184 1652 pjppd.exe 32 PID 1652 wrote to memory of 2184 1652 pjppd.exe 32 PID 1652 wrote to memory of 2184 1652 pjppd.exe 32 PID 2184 wrote to memory of 1416 2184 jdvvj.exe 33 PID 2184 wrote to memory of 1416 2184 jdvvj.exe 33 PID 2184 wrote to memory of 1416 2184 jdvvj.exe 33 PID 2184 wrote to memory of 1416 2184 jdvvj.exe 33 PID 1416 wrote to memory of 2904 1416 ddvdj.exe 34 PID 1416 wrote to memory of 2904 1416 ddvdj.exe 34 PID 1416 wrote to memory of 2904 1416 ddvdj.exe 34 PID 1416 wrote to memory of 2904 1416 ddvdj.exe 34 PID 2904 wrote to memory of 1904 2904 nhtbhb.exe 35 PID 2904 wrote to memory of 1904 2904 nhtbhb.exe 35 PID 2904 wrote to memory of 1904 2904 nhtbhb.exe 35 PID 2904 wrote to memory of 1904 2904 nhtbhb.exe 35 PID 1904 wrote to memory of 2648 1904 1vjpp.exe 36 PID 1904 wrote to memory of 2648 1904 1vjpp.exe 36 PID 1904 wrote to memory of 2648 1904 1vjpp.exe 36 PID 1904 wrote to memory of 2648 1904 1vjpp.exe 36 PID 2648 wrote to memory of 2732 2648 bhtbbb.exe 37 PID 2648 wrote to memory of 2732 2648 bhtbbb.exe 37 PID 2648 wrote to memory of 2732 2648 bhtbbb.exe 37 PID 2648 wrote to memory of 2732 2648 bhtbbb.exe 37 PID 2732 wrote to memory of 2664 2732 lxllxxf.exe 38 PID 2732 wrote to memory of 2664 2732 lxllxxf.exe 38 PID 2732 wrote to memory of 2664 2732 lxllxxf.exe 38 PID 2732 wrote to memory of 2664 2732 lxllxxf.exe 38 PID 2664 wrote to memory of 2672 2664 bnbhnh.exe 39 PID 2664 wrote to memory of 2672 2664 bnbhnh.exe 39 PID 2664 wrote to memory of 2672 2664 bnbhnh.exe 39 PID 2664 wrote to memory of 2672 2664 bnbhnh.exe 39 PID 2672 wrote to memory of 2872 2672 vpjvd.exe 40 PID 2672 wrote to memory of 2872 2672 vpjvd.exe 40 PID 2672 wrote to memory of 2872 2672 vpjvd.exe 40 PID 2672 wrote to memory of 2872 2672 vpjvd.exe 40 PID 2872 wrote to memory of 1516 2872 7dvpp.exe 41 PID 2872 wrote to memory of 1516 2872 7dvpp.exe 41 PID 2872 wrote to memory of 1516 2872 7dvpp.exe 41 PID 2872 wrote to memory of 1516 2872 7dvpp.exe 41 PID 1516 wrote to memory of 2180 1516 bhtnnb.exe 42 PID 1516 wrote to memory of 2180 1516 bhtnnb.exe 42 PID 1516 wrote to memory of 2180 1516 bhtnnb.exe 42 PID 1516 wrote to memory of 2180 1516 bhtnnb.exe 42 PID 2180 wrote to memory of 2952 2180 jjdjp.exe 43 PID 2180 wrote to memory of 2952 2180 jjdjp.exe 43 PID 2180 wrote to memory of 2952 2180 jjdjp.exe 43 PID 2180 wrote to memory of 2952 2180 jjdjp.exe 43 PID 2952 wrote to memory of 2856 2952 bbhntb.exe 44 PID 2952 wrote to memory of 2856 2952 bbhntb.exe 44 PID 2952 wrote to memory of 2856 2952 bbhntb.exe 44 PID 2952 wrote to memory of 2856 2952 bbhntb.exe 44 PID 2856 wrote to memory of 1640 2856 9jdjj.exe 45 PID 2856 wrote to memory of 1640 2856 9jdjj.exe 45 PID 2856 wrote to memory of 1640 2856 9jdjj.exe 45 PID 2856 wrote to memory of 1640 2856 9jdjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe"C:\Users\Admin\AppData\Local\Temp\9c059894896c499cadf8ca3265ba39dd7bec47b1f2d21e62cdea37fef5267702N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nbbhtb.exec:\nbbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\pjppd.exec:\pjppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\jdvvj.exec:\jdvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\ddvdj.exec:\ddvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\nhtbhb.exec:\nhtbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1vjpp.exec:\1vjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\bhtbbb.exec:\bhtbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lxllxxf.exec:\lxllxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bnbhnh.exec:\bnbhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpjvd.exec:\vpjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\7dvpp.exec:\7dvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\bhtnnb.exec:\bhtnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\jjdjp.exec:\jjdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bbhntb.exec:\bbhntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\9jdjj.exec:\9jdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pjdpv.exec:\pjdpv.exe17⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ffrflfl.exec:\ffrflfl.exe18⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3vddd.exec:\3vddd.exe19⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxlrxxr.exec:\xxlrxxr.exe20⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ddppv.exec:\ddppv.exe21⤵
- Executes dropped EXE
PID:332 -
\??\c:\nhbnhh.exec:\nhbnhh.exe22⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9jvjd.exec:\9jvjd.exe23⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7bttht.exec:\7bttht.exe24⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vpjvd.exec:\vpjvd.exe25⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7xxlrxl.exec:\7xxlrxl.exe26⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nnhbth.exec:\nnhbth.exe27⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5rlrxxr.exec:\5rlrxxr.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9thhhn.exec:\9thhhn.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\vjdjv.exec:\vjdjv.exe30⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1llrrxx.exec:\1llrrxx.exe31⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nnbnhh.exec:\nnbnhh.exe32⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9xlrxrx.exec:\9xlrxrx.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7pvdv.exec:\7pvdv.exe34⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5jdpv.exec:\5jdpv.exe35⤵
- Executes dropped EXE
PID:2384 -
\??\c:\llxrxfl.exec:\llxrxfl.exe36⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hhnthn.exec:\hhnthn.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jvpjp.exec:\jvpjp.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xxxxllx.exec:\xxxxllx.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\frfrrll.exec:\frfrrll.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bnbbhb.exec:\bnbbhb.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9vvdp.exec:\9vvdp.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xrrxlrx.exec:\xrrxlrx.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rlfxllr.exec:\rlfxllr.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tbhtbt.exec:\tbhtbt.exe45⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vvjpp.exec:\vvjpp.exe46⤵
- Executes dropped EXE
PID:988 -
\??\c:\pvpvj.exec:\pvpvj.exe47⤵
- Executes dropped EXE
PID:852 -
\??\c:\ffxxlxf.exec:\ffxxlxf.exe48⤵
- Executes dropped EXE
PID:1408 -
\??\c:\5htbhn.exec:\5htbhn.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dpjdj.exec:\dpjdj.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\flxrlff.exec:\flxrlff.exe51⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rflxffl.exec:\rflxffl.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tnttbb.exec:\tnttbb.exe53⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pjvdj.exec:\pjvdj.exe54⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfrxflx.exec:\lfrxflx.exe55⤵
- Executes dropped EXE
PID:1404 -
\??\c:\fxxxffr.exec:\fxxxffr.exe56⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1nbbhh.exec:\1nbbhh.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jjdjv.exec:\jjdjv.exe58⤵
- Executes dropped EXE
PID:588 -
\??\c:\jvpvv.exec:\jvpvv.exe59⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hthhnt.exec:\hthhnt.exe61⤵
- Executes dropped EXE
PID:544 -
\??\c:\pjdjp.exec:\pjdjp.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dvppd.exec:\dvppd.exe63⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlxlxrx.exec:\rlxlxrx.exe64⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tbbbhb.exec:\tbbbhb.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3thhhn.exec:\3thhhn.exe66⤵PID:748
-
\??\c:\5jvjv.exec:\5jvjv.exe67⤵PID:1420
-
\??\c:\lxlrxff.exec:\lxlrxff.exe68⤵PID:2360
-
\??\c:\thnnbt.exec:\thnnbt.exe69⤵PID:1672
-
\??\c:\3hnhbb.exec:\3hnhbb.exe70⤵PID:1792
-
\??\c:\ppvpv.exec:\ppvpv.exe71⤵PID:872
-
\??\c:\rfxxfxl.exec:\rfxxfxl.exe72⤵PID:2532
-
\??\c:\hhhhtb.exec:\hhhhtb.exe73⤵PID:2332
-
\??\c:\nnhbnh.exec:\nnhbnh.exe74⤵PID:1980
-
\??\c:\vpdjp.exec:\vpdjp.exe75⤵PID:1496
-
\??\c:\xxrxlxr.exec:\xxrxlxr.exe76⤵PID:1984
-
\??\c:\xrlfrxr.exec:\xrlfrxr.exe77⤵PID:2760
-
\??\c:\tbnbhh.exec:\tbnbhh.exe78⤵PID:2328
-
\??\c:\ddvvj.exec:\ddvvj.exe79⤵PID:2848
-
\??\c:\pjvdp.exec:\pjvdp.exe80⤵PID:2772
-
\??\c:\fxrxffr.exec:\fxrxffr.exe81⤵PID:2736
-
\??\c:\3bttbh.exec:\3bttbh.exe82⤵PID:2916
-
\??\c:\3vjpv.exec:\3vjpv.exe83⤵PID:2644
-
\??\c:\dpdjj.exec:\dpdjj.exe84⤵PID:2676
-
\??\c:\ffrfxll.exec:\ffrfxll.exe85⤵PID:2640
-
\??\c:\nnhthn.exec:\nnhthn.exe86⤵PID:1872
-
\??\c:\1htttt.exec:\1htttt.exe87⤵
- System Location Discovery: System Language Discovery
PID:2152 -
\??\c:\djvdv.exec:\djvdv.exe88⤵PID:1776
-
\??\c:\fflrxfx.exec:\fflrxfx.exe89⤵PID:1124
-
\??\c:\5xrrxxl.exec:\5xrrxxl.exe90⤵PID:852
-
\??\c:\hhnbtt.exec:\hhnbtt.exe91⤵PID:2300
-
\??\c:\vpdjv.exec:\vpdjv.exe92⤵PID:2232
-
\??\c:\vddjd.exec:\vddjd.exe93⤵PID:2688
-
\??\c:\1llrrxl.exec:\1llrrxl.exe94⤵PID:2936
-
\??\c:\bnbhbb.exec:\bnbhbb.exe95⤵PID:2976
-
\??\c:\nnbbhh.exec:\nnbbhh.exe96⤵PID:2508
-
\??\c:\vjdjv.exec:\vjdjv.exe97⤵PID:1376
-
\??\c:\rfrxllr.exec:\rfrxllr.exe98⤵PID:2504
-
\??\c:\htbthb.exec:\htbthb.exe99⤵PID:2140
-
\??\c:\5nbttt.exec:\5nbttt.exe100⤵PID:1112
-
\??\c:\vpjpp.exec:\vpjpp.exe101⤵PID:2972
-
\??\c:\lffrffr.exec:\lffrffr.exe102⤵PID:772
-
\??\c:\9ffrrll.exec:\9ffrrll.exe103⤵PID:596
-
\??\c:\nbtthn.exec:\nbtthn.exe104⤵PID:2144
-
\??\c:\dddjd.exec:\dddjd.exe105⤵PID:2256
-
\??\c:\lxlllrf.exec:\lxlllrf.exe106⤵PID:1440
-
\??\c:\lfxxlfr.exec:\lfxxlfr.exe107⤵PID:992
-
\??\c:\nhbnbh.exec:\nhbnbh.exe108⤵PID:1748
-
\??\c:\ppjvd.exec:\ppjvd.exe109⤵PID:936
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe110⤵PID:2036
-
\??\c:\fxllxfl.exec:\fxllxfl.exe111⤵PID:2572
-
\??\c:\thbbnn.exec:\thbbnn.exe112⤵PID:2468
-
\??\c:\5dpjj.exec:\5dpjj.exe113⤵PID:984
-
\??\c:\pdpjd.exec:\pdpjd.exe114⤵PID:884
-
\??\c:\fffrfxl.exec:\fffrfxl.exe115⤵PID:1436
-
\??\c:\nbtbnt.exec:\nbtbnt.exe116⤵PID:3008
-
\??\c:\nhbntb.exec:\nhbntb.exe117⤵PID:2248
-
\??\c:\7vpvv.exec:\7vpvv.exe118⤵PID:2392
-
\??\c:\7xrfrxf.exec:\7xrfrxf.exe119⤵PID:1528
-
\??\c:\5fxxffl.exec:\5fxxffl.exe120⤵PID:2336
-
\??\c:\tnbntt.exec:\tnbntt.exe121⤵PID:2804
-
\??\c:\lrllflf.exec:\lrllflf.exe122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-