Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe
-
Size
456KB
-
MD5
84ce0b4573e6eae484e4bdce36437ea0
-
SHA1
f1a33eba6ca3552df7e33e484b47e6b73946714e
-
SHA256
3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56
-
SHA512
88485372ecacb0244a94e7380e2df9b8a6cb3e5909947da55c2f676385d75916af9c2ad01a5dfcf6638fc0ef878f1c9a1e2c3f93fcdfc0f269c0763f89128fe7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRW:q7Tc2NYHUrAwfMp3CDRW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-110-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2808-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2416-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2416-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-288-0x0000000076C80000-0x0000000076D7A000-memory.dmp family_blackmoon behavioral1/memory/1752-287-0x0000000076D80000-0x0000000076E9F000-memory.dmp family_blackmoon behavioral1/memory/1212-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-319-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-533-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1752-562-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1212-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-584-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2088-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-796-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1932-827-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1892-964-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-1271-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1120-1302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 jjvdj.exe 836 xrrrxxr.exe 2552 hbbhth.exe 2488 5vddp.exe 2872 dpdpv.exe 2768 bthnbb.exe 2740 jdpvd.exe 2948 7frxflr.exe 2896 hbtthh.exe 2664 dpjjp.exe 2088 7xrxxff.exe 1592 tnbtbb.exe 2808 5vddd.exe 2924 xlxflfr.exe 2836 tnhhnn.exe 780 rxllfxl.exe 1088 rfxxffr.exe 1852 vvjpv.exe 1812 hbnnnt.exe 2344 9lfrfxf.exe 2416 5rffflr.exe 2588 vdppv.exe 2116 llllllx.exe 2604 bbthnt.exe 1552 xrfrxxl.exe 2228 hbnnbt.exe 2124 jvvdp.exe 2052 jpjjj.exe 2324 tnhnbh.exe 1440 9pjjp.exe 1752 9bnnbh.exe 2528 lflfllr.exe 1212 hnhnbh.exe 2592 rrrrffr.exe 2584 btbhnt.exe 2160 dpjjp.exe 2872 pjdjp.exe 2856 xrllrrx.exe 2724 hthntt.exe 2760 nnbtnt.exe 2800 vjvvd.exe 2632 vjddj.exe 2700 flflrrf.exe 2684 nnbbnt.exe 2356 nhbhhn.exe 476 3jvvd.exe 704 rfxrfxf.exe 1432 1fflrrf.exe 2916 nbnttt.exe 752 vpddd.exe 1324 vjvpv.exe 2032 3fxfffr.exe 2944 nhbhhh.exe 1088 btntbn.exe 2200 jjddj.exe 1120 9rfxlrx.exe 3000 hbbnbn.exe 1188 nhbtbb.exe 1656 5vvvp.exe 708 frrllfx.exe 1732 7hhntn.exe 1516 hbtbhn.exe 2604 dvpjj.exe 992 3rflrfx.exe -
resource yara_rule behavioral1/memory/2532-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-1302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-1339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-1352-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2008 2532 3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe 30 PID 2532 wrote to memory of 2008 2532 3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe 30 PID 2532 wrote to memory of 2008 2532 3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe 30 PID 2532 wrote to memory of 2008 2532 3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe 30 PID 2008 wrote to memory of 836 2008 jjvdj.exe 31 PID 2008 wrote to memory of 836 2008 jjvdj.exe 31 PID 2008 wrote to memory of 836 2008 jjvdj.exe 31 PID 2008 wrote to memory of 836 2008 jjvdj.exe 31 PID 836 wrote to memory of 2552 836 xrrrxxr.exe 32 PID 836 wrote to memory of 2552 836 xrrrxxr.exe 32 PID 836 wrote to memory of 2552 836 xrrrxxr.exe 32 PID 836 wrote to memory of 2552 836 xrrrxxr.exe 32 PID 2552 wrote to memory of 2488 2552 hbbhth.exe 33 PID 2552 wrote to memory of 2488 2552 hbbhth.exe 33 PID 2552 wrote to memory of 2488 2552 hbbhth.exe 33 PID 2552 wrote to memory of 2488 2552 hbbhth.exe 33 PID 2488 wrote to memory of 2872 2488 5vddp.exe 34 PID 2488 wrote to memory of 2872 2488 5vddp.exe 34 PID 2488 wrote to memory of 2872 2488 5vddp.exe 34 PID 2488 wrote to memory of 2872 2488 5vddp.exe 34 PID 2872 wrote to memory of 2768 2872 dpdpv.exe 35 PID 2872 wrote to memory of 2768 2872 dpdpv.exe 35 PID 2872 wrote to memory of 2768 2872 dpdpv.exe 35 PID 2872 wrote to memory of 2768 2872 dpdpv.exe 35 PID 2768 wrote to memory of 2740 2768 bthnbb.exe 36 PID 2768 wrote to memory of 2740 2768 bthnbb.exe 36 PID 2768 wrote to memory of 2740 2768 bthnbb.exe 36 PID 2768 wrote to memory of 2740 2768 bthnbb.exe 36 PID 2740 wrote to memory of 2948 2740 jdpvd.exe 37 PID 2740 wrote to memory of 2948 2740 jdpvd.exe 37 PID 2740 wrote to memory of 2948 2740 jdpvd.exe 37 PID 2740 wrote to memory of 2948 2740 jdpvd.exe 37 PID 2948 wrote to memory of 2896 2948 7frxflr.exe 38 PID 2948 wrote to memory of 2896 2948 7frxflr.exe 38 PID 2948 wrote to memory of 2896 2948 7frxflr.exe 38 PID 2948 wrote to memory of 2896 2948 7frxflr.exe 38 PID 2896 wrote to memory of 2664 2896 hbtthh.exe 39 PID 2896 wrote to memory of 2664 2896 hbtthh.exe 39 PID 2896 wrote to memory of 2664 2896 hbtthh.exe 39 PID 2896 wrote to memory of 2664 2896 hbtthh.exe 39 PID 2664 wrote to memory of 2088 2664 dpjjp.exe 40 PID 2664 wrote to memory of 2088 2664 dpjjp.exe 40 PID 2664 wrote to memory of 2088 2664 dpjjp.exe 40 PID 2664 wrote to memory of 2088 2664 dpjjp.exe 40 PID 2088 wrote to memory of 1592 2088 7xrxxff.exe 41 PID 2088 wrote to memory of 1592 2088 7xrxxff.exe 41 PID 2088 wrote to memory of 1592 2088 7xrxxff.exe 41 PID 2088 wrote to memory of 1592 2088 7xrxxff.exe 41 PID 1592 wrote to memory of 2808 1592 tnbtbb.exe 42 PID 1592 wrote to memory of 2808 1592 tnbtbb.exe 42 PID 1592 wrote to memory of 2808 1592 tnbtbb.exe 42 PID 1592 wrote to memory of 2808 1592 tnbtbb.exe 42 PID 2808 wrote to memory of 2924 2808 5vddd.exe 43 PID 2808 wrote to memory of 2924 2808 5vddd.exe 43 PID 2808 wrote to memory of 2924 2808 5vddd.exe 43 PID 2808 wrote to memory of 2924 2808 5vddd.exe 43 PID 2924 wrote to memory of 2836 2924 xlxflfr.exe 44 PID 2924 wrote to memory of 2836 2924 xlxflfr.exe 44 PID 2924 wrote to memory of 2836 2924 xlxflfr.exe 44 PID 2924 wrote to memory of 2836 2924 xlxflfr.exe 44 PID 2836 wrote to memory of 780 2836 tnhhnn.exe 45 PID 2836 wrote to memory of 780 2836 tnhhnn.exe 45 PID 2836 wrote to memory of 780 2836 tnhhnn.exe 45 PID 2836 wrote to memory of 780 2836 tnhhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe"C:\Users\Admin\AppData\Local\Temp\3197a6b246a95e8ccdf239712c21fabcea0c981d7980a7762f6b1ac017357c56N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjvdj.exec:\jjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\xrrrxxr.exec:\xrrrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\hbbhth.exec:\hbbhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5vddp.exec:\5vddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\dpdpv.exec:\dpdpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\bthnbb.exec:\bthnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jdpvd.exec:\jdpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7frxflr.exec:\7frxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hbtthh.exec:\hbtthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dpjjp.exec:\dpjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7xrxxff.exec:\7xrxxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\tnbtbb.exec:\tnbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\5vddd.exec:\5vddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xlxflfr.exec:\xlxflfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\tnhhnn.exec:\tnhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rxllfxl.exec:\rxllfxl.exe17⤵
- Executes dropped EXE
PID:780 -
\??\c:\rfxxffr.exec:\rfxxffr.exe18⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vvjpv.exec:\vvjpv.exe19⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hbnnnt.exec:\hbnnnt.exe20⤵
- Executes dropped EXE
PID:1812 -
\??\c:\9lfrfxf.exec:\9lfrfxf.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5rffflr.exec:\5rffflr.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vdppv.exec:\vdppv.exe23⤵
- Executes dropped EXE
PID:2588 -
\??\c:\llllllx.exec:\llllllx.exe24⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bbthnt.exec:\bbthnt.exe25⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hbnnbt.exec:\hbnnbt.exe27⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jvvdp.exec:\jvvdp.exe28⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jpjjj.exec:\jpjjj.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tnhnbh.exec:\tnhnbh.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9pjjp.exec:\9pjjp.exe31⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9bnnbh.exec:\9bnnbh.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dddvv.exec:\dddvv.exe33⤵PID:1524
-
\??\c:\lflfllr.exec:\lflfllr.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hnhnbh.exec:\hnhnbh.exe35⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rrrrffr.exec:\rrrrffr.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\btbhnt.exec:\btbhnt.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpjjp.exec:\dpjjp.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pjdjp.exec:\pjdjp.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xrllrrx.exec:\xrllrrx.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hthntt.exec:\hthntt.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nnbtnt.exec:\nnbtnt.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vjvvd.exec:\vjvvd.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vjddj.exec:\vjddj.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\flflrrf.exec:\flflrrf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700 -
\??\c:\nnbbnt.exec:\nnbbnt.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhbhhn.exec:\nhbhhn.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3jvvd.exec:\3jvvd.exe48⤵
- Executes dropped EXE
PID:476 -
\??\c:\rfxrfxf.exec:\rfxrfxf.exe49⤵
- Executes dropped EXE
PID:704 -
\??\c:\1fflrrf.exec:\1fflrrf.exe50⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nbnttt.exec:\nbnttt.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\vpddd.exec:\vpddd.exe52⤵
- Executes dropped EXE
PID:752 -
\??\c:\vjvpv.exec:\vjvpv.exe53⤵
- Executes dropped EXE
PID:1324 -
\??\c:\3fxfffr.exec:\3fxfffr.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhbhhh.exec:\nhbhhh.exe55⤵
- Executes dropped EXE
PID:2944 -
\??\c:\btntbn.exec:\btntbn.exe56⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jjddj.exec:\jjddj.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9rfxlrx.exec:\9rfxlrx.exe58⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hbbnbn.exec:\hbbnbn.exe59⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nhbtbb.exec:\nhbtbb.exe60⤵
- Executes dropped EXE
PID:1188 -
\??\c:\5vvvp.exec:\5vvvp.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\frrllfx.exec:\frrllfx.exe62⤵
- Executes dropped EXE
PID:708 -
\??\c:\7hhntn.exec:\7hhntn.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbtbhn.exec:\hbtbhn.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvpjj.exec:\dvpjj.exe65⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3rflrfx.exec:\3rflrfx.exe66⤵
- Executes dropped EXE
PID:992 -
\??\c:\3xlllxf.exec:\3xlllxf.exe67⤵PID:2228
-
\??\c:\5thnth.exec:\5thnth.exe68⤵PID:904
-
\??\c:\7vpdv.exec:\7vpdv.exe69⤵PID:2436
-
\??\c:\7ddpd.exec:\7ddpd.exe70⤵PID:1864
-
\??\c:\xrflrxl.exec:\xrflrxl.exe71⤵PID:2360
-
\??\c:\nhbtbt.exec:\nhbtbt.exe72⤵PID:1932
-
\??\c:\pjvdj.exec:\pjvdj.exe73⤵PID:1956
-
\??\c:\frllllx.exec:\frllllx.exe74⤵PID:1752
-
\??\c:\htbbbb.exec:\htbbbb.exe75⤵PID:1252
-
\??\c:\bbthnn.exec:\bbthnn.exe76⤵PID:1960
-
\??\c:\jpdvp.exec:\jpdvp.exe77⤵PID:1212
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe78⤵PID:2940
-
\??\c:\xlrxffl.exec:\xlrxffl.exe79⤵PID:2864
-
\??\c:\tntnth.exec:\tntnth.exe80⤵PID:2868
-
\??\c:\vvdjv.exec:\vvdjv.exe81⤵PID:2756
-
\??\c:\pjvjp.exec:\pjvjp.exe82⤵PID:2880
-
\??\c:\frxxfxf.exec:\frxxfxf.exe83⤵PID:2740
-
\??\c:\fxllrfr.exec:\fxllrfr.exe84⤵PID:2520
-
\??\c:\nnnbtb.exec:\nnnbtb.exe85⤵PID:2956
-
\??\c:\pdjjp.exec:\pdjjp.exe86⤵PID:2844
-
\??\c:\vvdjp.exec:\vvdjp.exe87⤵PID:1952
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe88⤵PID:2640
-
\??\c:\nbhhhn.exec:\nbhhhn.exe89⤵PID:2088
-
\??\c:\dpddj.exec:\dpddj.exe90⤵PID:676
-
\??\c:\rfrxxff.exec:\rfrxxff.exe91⤵PID:2808
-
\??\c:\xlrlrrf.exec:\xlrlrrf.exe92⤵PID:1416
-
\??\c:\nhntbb.exec:\nhntbb.exe93⤵PID:2924
-
\??\c:\hnntnn.exec:\hnntnn.exe94⤵PID:756
-
\??\c:\9djjj.exec:\9djjj.exe95⤵PID:1896
-
\??\c:\pjvvp.exec:\pjvvp.exe96⤵PID:2028
-
\??\c:\9rlrrll.exec:\9rlrrll.exe97⤵PID:1568
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe98⤵PID:1860
-
\??\c:\tthbnh.exec:\tthbnh.exe99⤵PID:2036
-
\??\c:\hbhnth.exec:\hbhnth.exe100⤵PID:3008
-
\??\c:\vdpjp.exec:\vdpjp.exe101⤵PID:2320
-
\??\c:\vvjpd.exec:\vvjpd.exe102⤵PID:1012
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe103⤵PID:1660
-
\??\c:\nbntbb.exec:\nbntbb.exe104⤵PID:1656
-
\??\c:\nbhbbt.exec:\nbhbbt.exe105⤵PID:708
-
\??\c:\jdjdd.exec:\jdjdd.exe106⤵PID:3052
-
\??\c:\dvjpv.exec:\dvjpv.exe107⤵PID:2216
-
\??\c:\5rrlxff.exec:\5rrlxff.exe108⤵PID:2840
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe109⤵PID:3056
-
\??\c:\btbbnn.exec:\btbbnn.exe110⤵PID:3068
-
\??\c:\vjvpv.exec:\vjvpv.exe111⤵PID:884
-
\??\c:\fxllrrx.exec:\fxllrrx.exe112⤵PID:1872
-
\??\c:\rllrxxf.exec:\rllrxxf.exe113⤵PID:2464
-
\??\c:\7bhnth.exec:\7bhnth.exe114⤵PID:1876
-
\??\c:\hbbbbt.exec:\hbbbbt.exe115⤵PID:1932
-
\??\c:\pjdpd.exec:\pjdpd.exe116⤵PID:2012
-
\??\c:\dpdpp.exec:\dpdpp.exe117⤵PID:2008
-
\??\c:\1flrxxx.exec:\1flrxxx.exe118⤵PID:1688
-
\??\c:\fxrrrll.exec:\fxrrrll.exe119⤵PID:2540
-
\??\c:\thbbhb.exec:\thbbhb.exe120⤵PID:2552
-
\??\c:\dvvjv.exec:\dvvjv.exe121⤵PID:2940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-