Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe
-
Size
454KB
-
MD5
1473e792116bb9e4d6b3f4743850321b
-
SHA1
68d45f1e626f51647bdfb0514c6a09fcace5d417
-
SHA256
3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af
-
SHA512
b8cfe6ae57e3da358702c057a425738f6e108c4b8f0ba046a5e1c4b5a248515d97a68f0b8e2c5a41f017ae65d3c2512c0edd720989e673c1f9e8d568b2466cff
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2228-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-42-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1380-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-292-0x00000000774B0000-0x00000000775CF000-memory.dmp family_blackmoon behavioral1/memory/2496-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-452-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2608-459-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-522-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2160-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2160 nbnhhh.exe 2652 ppdpd.exe 2844 llrrrxx.exe 2708 1nttnt.exe 2816 dvjdd.exe 2860 3xllllr.exe 2836 jjpdv.exe 2736 lxxlfrx.exe 2588 nbhbhb.exe 624 3dppj.exe 2760 rlllrfr.exe 288 djdpp.exe 2852 jjvvd.exe 2464 3bnhbh.exe 2120 5vjjv.exe 1380 rlxrxxf.exe 2924 btbbbb.exe 2872 jpvjd.exe 1776 bthnnn.exe 1460 3frxffl.exe 1128 btbhbt.exe 1608 pdvvp.exe 2444 lfrxffl.exe 1328 httnnh.exe 1728 fxlxlrx.exe 1892 1rxxrrr.exe 2504 fxxxfff.exe 2156 tnbbbt.exe 3024 dppdd.exe 2496 9lrffxf.exe 2256 xlxrxxx.exe 2384 dpddj.exe 2792 lxxxrlx.exe 2224 hbhntt.exe 2692 hbhntb.exe 744 dvjdj.exe 2700 7lxlllr.exe 2920 5xfrlff.exe 2624 bntttn.exe 2688 jpvpp.exe 2592 jjpjj.exe 2572 xlrrxrf.exe 1900 hnbbbb.exe 2312 1ntnhn.exe 2756 dppjp.exe 288 5rxxxrl.exe 1256 9rflfxf.exe 2748 5btnbh.exe 2940 3dddd.exe 2984 dpjjp.exe 2964 5rrxrrr.exe 2608 fxllrlr.exe 1304 5hbhnh.exe 340 1pvpp.exe 1776 vjdvp.exe 772 xlxxxxf.exe 2416 7hnhhh.exe 1932 nbbtnh.exe 1624 1jppp.exe 1072 9xlfllx.exe 1648 1xllllx.exe 1048 thnhnh.exe 568 nbbttt.exe 1504 jjvvd.exe -
resource yara_rule behavioral1/memory/2228-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-452-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1304-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-659-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2160 2228 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 31 PID 2228 wrote to memory of 2160 2228 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 31 PID 2228 wrote to memory of 2160 2228 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 31 PID 2228 wrote to memory of 2160 2228 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 31 PID 2160 wrote to memory of 2652 2160 nbnhhh.exe 32 PID 2160 wrote to memory of 2652 2160 nbnhhh.exe 32 PID 2160 wrote to memory of 2652 2160 nbnhhh.exe 32 PID 2160 wrote to memory of 2652 2160 nbnhhh.exe 32 PID 2652 wrote to memory of 2844 2652 ppdpd.exe 33 PID 2652 wrote to memory of 2844 2652 ppdpd.exe 33 PID 2652 wrote to memory of 2844 2652 ppdpd.exe 33 PID 2652 wrote to memory of 2844 2652 ppdpd.exe 33 PID 2844 wrote to memory of 2708 2844 llrrrxx.exe 34 PID 2844 wrote to memory of 2708 2844 llrrrxx.exe 34 PID 2844 wrote to memory of 2708 2844 llrrrxx.exe 34 PID 2844 wrote to memory of 2708 2844 llrrrxx.exe 34 PID 2708 wrote to memory of 2816 2708 1nttnt.exe 35 PID 2708 wrote to memory of 2816 2708 1nttnt.exe 35 PID 2708 wrote to memory of 2816 2708 1nttnt.exe 35 PID 2708 wrote to memory of 2816 2708 1nttnt.exe 35 PID 2816 wrote to memory of 2860 2816 dvjdd.exe 36 PID 2816 wrote to memory of 2860 2816 dvjdd.exe 36 PID 2816 wrote to memory of 2860 2816 dvjdd.exe 36 PID 2816 wrote to memory of 2860 2816 dvjdd.exe 36 PID 2860 wrote to memory of 2836 2860 3xllllr.exe 37 PID 2860 wrote to memory of 2836 2860 3xllllr.exe 37 PID 2860 wrote to memory of 2836 2860 3xllllr.exe 37 PID 2860 wrote to memory of 2836 2860 3xllllr.exe 37 PID 2836 wrote to memory of 2736 2836 jjpdv.exe 38 PID 2836 wrote to memory of 2736 2836 jjpdv.exe 38 PID 2836 wrote to memory of 2736 2836 jjpdv.exe 38 PID 2836 wrote to memory of 2736 2836 jjpdv.exe 38 PID 2736 wrote to memory of 2588 2736 lxxlfrx.exe 39 PID 2736 wrote to memory of 2588 2736 lxxlfrx.exe 39 PID 2736 wrote to memory of 2588 2736 lxxlfrx.exe 39 PID 2736 wrote to memory of 2588 2736 lxxlfrx.exe 39 PID 2588 wrote to memory of 624 2588 nbhbhb.exe 40 PID 2588 wrote to memory of 624 2588 nbhbhb.exe 40 PID 2588 wrote to memory of 624 2588 nbhbhb.exe 40 PID 2588 wrote to memory of 624 2588 nbhbhb.exe 40 PID 624 wrote to memory of 2760 624 3dppj.exe 41 PID 624 wrote to memory of 2760 624 3dppj.exe 41 PID 624 wrote to memory of 2760 624 3dppj.exe 41 PID 624 wrote to memory of 2760 624 3dppj.exe 41 PID 2760 wrote to memory of 288 2760 rlllrfr.exe 42 PID 2760 wrote to memory of 288 2760 rlllrfr.exe 42 PID 2760 wrote to memory of 288 2760 rlllrfr.exe 42 PID 2760 wrote to memory of 288 2760 rlllrfr.exe 42 PID 288 wrote to memory of 2852 288 djdpp.exe 43 PID 288 wrote to memory of 2852 288 djdpp.exe 43 PID 288 wrote to memory of 2852 288 djdpp.exe 43 PID 288 wrote to memory of 2852 288 djdpp.exe 43 PID 2852 wrote to memory of 2464 2852 jjvvd.exe 44 PID 2852 wrote to memory of 2464 2852 jjvvd.exe 44 PID 2852 wrote to memory of 2464 2852 jjvvd.exe 44 PID 2852 wrote to memory of 2464 2852 jjvvd.exe 44 PID 2464 wrote to memory of 2120 2464 3bnhbh.exe 45 PID 2464 wrote to memory of 2120 2464 3bnhbh.exe 45 PID 2464 wrote to memory of 2120 2464 3bnhbh.exe 45 PID 2464 wrote to memory of 2120 2464 3bnhbh.exe 45 PID 2120 wrote to memory of 1380 2120 5vjjv.exe 46 PID 2120 wrote to memory of 1380 2120 5vjjv.exe 46 PID 2120 wrote to memory of 1380 2120 5vjjv.exe 46 PID 2120 wrote to memory of 1380 2120 5vjjv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe"C:\Users\Admin\AppData\Local\Temp\3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\nbnhhh.exec:\nbnhhh.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\ppdpd.exec:\ppdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\llrrrxx.exec:\llrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1nttnt.exec:\1nttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dvjdd.exec:\dvjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3xllllr.exec:\3xllllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jjpdv.exec:\jjpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\lxxlfrx.exec:\lxxlfrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nbhbhb.exec:\nbhbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\3dppj.exec:\3dppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\rlllrfr.exec:\rlllrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\djdpp.exec:\djdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\jjvvd.exec:\jjvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3bnhbh.exec:\3bnhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\5vjjv.exec:\5vjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe17⤵
- Executes dropped EXE
PID:1380 -
\??\c:\btbbbb.exec:\btbbbb.exe18⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jpvjd.exec:\jpvjd.exe19⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bthnnn.exec:\bthnnn.exe20⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3frxffl.exec:\3frxffl.exe21⤵
- Executes dropped EXE
PID:1460 -
\??\c:\btbhbt.exec:\btbhbt.exe22⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pdvvp.exec:\pdvvp.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lfrxffl.exec:\lfrxffl.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\httnnh.exec:\httnnh.exe25⤵
- Executes dropped EXE
PID:1328 -
\??\c:\fxlxlrx.exec:\fxlxlrx.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1rxxrrr.exec:\1rxxrrr.exe27⤵
- Executes dropped EXE
PID:1892 -
\??\c:\fxxxfff.exec:\fxxxfff.exe28⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbbbt.exec:\tnbbbt.exe29⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dppdd.exec:\dppdd.exe30⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9lrffxf.exec:\9lrffxf.exe31⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7jpvd.exec:\7jpvd.exe32⤵PID:2184
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe33⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dpddj.exec:\dpddj.exe34⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lxxxrlx.exec:\lxxxrlx.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hbhntt.exec:\hbhntt.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hbhntb.exec:\hbhntb.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dvjdj.exec:\dvjdj.exe38⤵
- Executes dropped EXE
PID:744 -
\??\c:\7lxlllr.exec:\7lxlllr.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5xfrlff.exec:\5xfrlff.exe40⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bntttn.exec:\bntttn.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jpvpp.exec:\jpvpp.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jjpjj.exec:\jjpjj.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xlrrxrf.exec:\xlrrxrf.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hnbbbb.exec:\hnbbbb.exe45⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1ntnhn.exec:\1ntnhn.exe46⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dppjp.exec:\dppjp.exe47⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5rxxxrl.exec:\5rxxxrl.exe48⤵
- Executes dropped EXE
PID:288 -
\??\c:\9rflfxf.exec:\9rflfxf.exe49⤵
- Executes dropped EXE
PID:1256 -
\??\c:\5btnbh.exec:\5btnbh.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3dddd.exec:\3dddd.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dpjjp.exec:\dpjjp.exe52⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5rrxrrr.exec:\5rrxrrr.exe53⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fxllrlr.exec:\fxllrlr.exe54⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5hbhnh.exec:\5hbhnh.exe55⤵
- Executes dropped EXE
PID:1304 -
\??\c:\1pvpp.exec:\1pvpp.exe56⤵
- Executes dropped EXE
PID:340 -
\??\c:\vjdvp.exec:\vjdvp.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe58⤵
- Executes dropped EXE
PID:772 -
\??\c:\7hnhhh.exec:\7hnhhh.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nbbtnh.exec:\nbbtnh.exe60⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1jppp.exec:\1jppp.exe61⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9xlfllx.exec:\9xlfllx.exe62⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1xllllx.exec:\1xllllx.exe63⤵
- Executes dropped EXE
PID:1648 -
\??\c:\thnhnh.exec:\thnhnh.exe64⤵
- Executes dropped EXE
PID:1048 -
\??\c:\nbbttt.exec:\nbbttt.exe65⤵
- Executes dropped EXE
PID:568 -
\??\c:\jjvvd.exec:\jjvvd.exe66⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lfllrlr.exec:\lfllrlr.exe67⤵PID:2304
-
\??\c:\xlxxffl.exec:\xlxxffl.exe68⤵PID:1588
-
\??\c:\1bnnhb.exec:\1bnnhb.exe69⤵PID:1412
-
\??\c:\5jvpp.exec:\5jvpp.exe70⤵PID:2344
-
\??\c:\dpjdd.exec:\dpjdd.exe71⤵PID:2472
-
\??\c:\5xxrlrr.exec:\5xxrlrr.exe72⤵PID:2160
-
\??\c:\bbnthh.exec:\bbnthh.exe73⤵PID:1548
-
\??\c:\hbhbhb.exec:\hbhbhb.exe74⤵PID:1464
-
\??\c:\ppdpp.exec:\ppdpp.exe75⤵PID:1636
-
\??\c:\pjpjj.exec:\pjpjj.exe76⤵PID:2800
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe77⤵PID:784
-
\??\c:\thbtbb.exec:\thbtbb.exe78⤵PID:2692
-
\??\c:\pdjdp.exec:\pdjdp.exe79⤵PID:2812
-
\??\c:\pjpvd.exec:\pjpvd.exe80⤵PID:2700
-
\??\c:\5ffrrrr.exec:\5ffrrrr.exe81⤵PID:2820
-
\??\c:\1thhtn.exec:\1thhtn.exe82⤵PID:2640
-
\??\c:\tnbbhn.exec:\tnbbhn.exe83⤵PID:976
-
\??\c:\vpddd.exec:\vpddd.exe84⤵PID:2612
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe85⤵PID:2292
-
\??\c:\3ntnnn.exec:\3ntnnn.exe86⤵PID:2032
-
\??\c:\3pjpp.exec:\3pjpp.exe87⤵PID:2668
-
\??\c:\vjvpv.exec:\vjvpv.exe88⤵PID:1660
-
\??\c:\lfxxllr.exec:\lfxxllr.exe89⤵PID:2896
-
\??\c:\xxrfllr.exec:\xxrfllr.exe90⤵PID:2096
-
\??\c:\3nbtbh.exec:\3nbtbh.exe91⤵PID:1148
-
\??\c:\9vppp.exec:\9vppp.exe92⤵PID:1880
-
\??\c:\pdpjp.exec:\pdpjp.exe93⤵PID:1424
-
\??\c:\5rlxxff.exec:\5rlxxff.exe94⤵PID:2972
-
\??\c:\bnnhhh.exec:\bnnhhh.exe95⤵PID:2964
-
\??\c:\thtntn.exec:\thtntn.exe96⤵PID:2280
-
\??\c:\dvdjj.exec:\dvdjj.exe97⤵PID:1964
-
\??\c:\xxlrflr.exec:\xxlrflr.exe98⤵PID:2872
-
\??\c:\rxxxxrr.exec:\rxxxxrr.exe99⤵PID:2108
-
\??\c:\htbthh.exec:\htbthh.exe100⤵PID:2552
-
\??\c:\5pvjj.exec:\5pvjj.exe101⤵PID:836
-
\??\c:\vjvjj.exec:\vjvjj.exe102⤵PID:2416
-
\??\c:\7lrllll.exec:\7lrllll.exe103⤵PID:1932
-
\??\c:\3hhttb.exec:\3hhttb.exe104⤵PID:1624
-
\??\c:\thnhnh.exec:\thnhnh.exe105⤵PID:2084
-
\??\c:\dvvdp.exec:\dvvdp.exe106⤵PID:1648
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe107⤵PID:1048
-
\??\c:\5rfffff.exec:\5rfffff.exe108⤵PID:568
-
\??\c:\thbbhh.exec:\thbbhh.exe109⤵PID:1676
-
\??\c:\thbhnh.exec:\thbhnh.exe110⤵PID:2504
-
\??\c:\vjpvd.exec:\vjpvd.exe111⤵PID:1948
-
\??\c:\flxllll.exec:\flxllll.exe112⤵PID:864
-
\??\c:\ffflrrx.exec:\ffflrrx.exe113⤵PID:3024
-
\??\c:\9nbhnn.exec:\9nbhnn.exe114⤵PID:1584
-
\??\c:\ppddp.exec:\ppddp.exe115⤵PID:2100
-
\??\c:\dppvd.exec:\dppvd.exe116⤵PID:2208
-
\??\c:\3xfxxxx.exec:\3xfxxxx.exe117⤵PID:2716
-
\??\c:\nhbbhh.exec:\nhbbhh.exe118⤵PID:1472
-
\??\c:\vpvdv.exec:\vpvdv.exe119⤵PID:2844
-
\??\c:\dvjjv.exec:\dvjjv.exe120⤵PID:2660
-
\??\c:\fxfxlll.exec:\fxfxlll.exe121⤵PID:2816
-
\??\c:\3lrrxxf.exec:\3lrrxxf.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-