Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe
-
Size
453KB
-
MD5
04fc4f3237ec8bfb841a240dd4235a2c
-
SHA1
a70ee0996f9b06cf76ba95f19de28126c2c78bf1
-
SHA256
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48
-
SHA512
2ea2754785469ee527d7398cb05a7f7cbb49c6660963a6b906a7133aba47ff75b31099ce8f01e910bf8545a721cc74c46f560dcc295c696d1bc9f76e72f855f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-76-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-85-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2848-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1868-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-117-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1952-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-136-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-310-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2472-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-513-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-553-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1544-591-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-611-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1868-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-741-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1768 xrfflfr.exe 1268 nbnhnh.exe 3056 jdjjv.exe 2980 thnhnt.exe 2724 7pjpp.exe 2688 rrlxlrf.exe 2656 jjdjj.exe 2848 7lfrxrx.exe 2856 hbhhbt.exe 2552 ffxxffl.exe 1868 htnbnb.exe 1952 pjjvp.exe 1884 fflfrlr.exe 1948 btbbtt.exe 1152 dvjdv.exe 2772 1tntbb.exe 1748 thhnhn.exe 1752 1rfflxl.exe 2952 pdjjp.exe 2572 xrfrxfl.exe 1436 thtbnn.exe 2296 pjvdd.exe 1120 htbtbt.exe 1712 5dppp.exe 2008 tbtthh.exe 268 tnbtbb.exe 1700 9frfffl.exe 1628 btnnbt.exe 2216 lflfrxr.exe 876 hhtbhn.exe 1392 ppjvd.exe 2472 nhhhnn.exe 1548 9vjdd.exe 2012 7fxfrrx.exe 3036 fxfffxl.exe 700 hbnnnn.exe 2712 9pddj.exe 2640 lxrflll.exe 2660 bbtbhh.exe 768 bthntn.exe 2620 pdpjv.exe 2848 rfrrxxf.exe 2528 7rllrrr.exe 2544 3bnntb.exe 2144 5pddd.exe 1328 ffrrxrx.exe 2776 xrrrxxf.exe 1324 nhtntt.exe 2940 vjvpv.exe 1452 9vjdd.exe 2436 lxlfrlx.exe 1192 hthhht.exe 2836 1thhht.exe 1224 1pdvv.exe 2968 3llllfl.exe 1756 frfllfl.exe 2372 hhnbhh.exe 2020 pjvjd.exe 2096 pjdjd.exe 956 xfrllff.exe 2296 tbnhhh.exe 992 bbnnnh.exe 108 vvddd.exe 1608 xxlxflx.exe -
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-726-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1768 2328 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 30 PID 2328 wrote to memory of 1768 2328 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 30 PID 2328 wrote to memory of 1768 2328 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 30 PID 2328 wrote to memory of 1768 2328 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 30 PID 1768 wrote to memory of 1268 1768 xrfflfr.exe 31 PID 1768 wrote to memory of 1268 1768 xrfflfr.exe 31 PID 1768 wrote to memory of 1268 1768 xrfflfr.exe 31 PID 1768 wrote to memory of 1268 1768 xrfflfr.exe 31 PID 1268 wrote to memory of 3056 1268 nbnhnh.exe 32 PID 1268 wrote to memory of 3056 1268 nbnhnh.exe 32 PID 1268 wrote to memory of 3056 1268 nbnhnh.exe 32 PID 1268 wrote to memory of 3056 1268 nbnhnh.exe 32 PID 3056 wrote to memory of 2980 3056 jdjjv.exe 33 PID 3056 wrote to memory of 2980 3056 jdjjv.exe 33 PID 3056 wrote to memory of 2980 3056 jdjjv.exe 33 PID 3056 wrote to memory of 2980 3056 jdjjv.exe 33 PID 2980 wrote to memory of 2724 2980 thnhnt.exe 34 PID 2980 wrote to memory of 2724 2980 thnhnt.exe 34 PID 2980 wrote to memory of 2724 2980 thnhnt.exe 34 PID 2980 wrote to memory of 2724 2980 thnhnt.exe 34 PID 2724 wrote to memory of 2688 2724 7pjpp.exe 35 PID 2724 wrote to memory of 2688 2724 7pjpp.exe 35 PID 2724 wrote to memory of 2688 2724 7pjpp.exe 35 PID 2724 wrote to memory of 2688 2724 7pjpp.exe 35 PID 2688 wrote to memory of 2656 2688 rrlxlrf.exe 36 PID 2688 wrote to memory of 2656 2688 rrlxlrf.exe 36 PID 2688 wrote to memory of 2656 2688 rrlxlrf.exe 36 PID 2688 wrote to memory of 2656 2688 rrlxlrf.exe 36 PID 2656 wrote to memory of 2848 2656 jjdjj.exe 37 PID 2656 wrote to memory of 2848 2656 jjdjj.exe 37 PID 2656 wrote to memory of 2848 2656 jjdjj.exe 37 PID 2656 wrote to memory of 2848 2656 jjdjj.exe 37 PID 2848 wrote to memory of 2856 2848 7lfrxrx.exe 38 PID 2848 wrote to memory of 2856 2848 7lfrxrx.exe 38 PID 2848 wrote to memory of 2856 2848 7lfrxrx.exe 38 PID 2848 wrote to memory of 2856 2848 7lfrxrx.exe 38 PID 2856 wrote to memory of 2552 2856 hbhhbt.exe 39 PID 2856 wrote to memory of 2552 2856 hbhhbt.exe 39 PID 2856 wrote to memory of 2552 2856 hbhhbt.exe 39 PID 2856 wrote to memory of 2552 2856 hbhhbt.exe 39 PID 2552 wrote to memory of 1868 2552 ffxxffl.exe 40 PID 2552 wrote to memory of 1868 2552 ffxxffl.exe 40 PID 2552 wrote to memory of 1868 2552 ffxxffl.exe 40 PID 2552 wrote to memory of 1868 2552 ffxxffl.exe 40 PID 1868 wrote to memory of 1952 1868 htnbnb.exe 41 PID 1868 wrote to memory of 1952 1868 htnbnb.exe 41 PID 1868 wrote to memory of 1952 1868 htnbnb.exe 41 PID 1868 wrote to memory of 1952 1868 htnbnb.exe 41 PID 1952 wrote to memory of 1884 1952 pjjvp.exe 42 PID 1952 wrote to memory of 1884 1952 pjjvp.exe 42 PID 1952 wrote to memory of 1884 1952 pjjvp.exe 42 PID 1952 wrote to memory of 1884 1952 pjjvp.exe 42 PID 1884 wrote to memory of 1948 1884 fflfrlr.exe 43 PID 1884 wrote to memory of 1948 1884 fflfrlr.exe 43 PID 1884 wrote to memory of 1948 1884 fflfrlr.exe 43 PID 1884 wrote to memory of 1948 1884 fflfrlr.exe 43 PID 1948 wrote to memory of 1152 1948 btbbtt.exe 44 PID 1948 wrote to memory of 1152 1948 btbbtt.exe 44 PID 1948 wrote to memory of 1152 1948 btbbtt.exe 44 PID 1948 wrote to memory of 1152 1948 btbbtt.exe 44 PID 1152 wrote to memory of 2772 1152 dvjdv.exe 45 PID 1152 wrote to memory of 2772 1152 dvjdv.exe 45 PID 1152 wrote to memory of 2772 1152 dvjdv.exe 45 PID 1152 wrote to memory of 2772 1152 dvjdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe"C:\Users\Admin\AppData\Local\Temp\17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\xrfflfr.exec:\xrfflfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\nbnhnh.exec:\nbnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\jdjjv.exec:\jdjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\thnhnt.exec:\thnhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7pjpp.exec:\7pjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jjdjj.exec:\jjdjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7lfrxrx.exec:\7lfrxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hbhhbt.exec:\hbhhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ffxxffl.exec:\ffxxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\htnbnb.exec:\htnbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\pjjvp.exec:\pjjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\fflfrlr.exec:\fflfrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\btbbtt.exec:\btbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\dvjdv.exec:\dvjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\1tntbb.exec:\1tntbb.exe17⤵
- Executes dropped EXE
PID:2772 -
\??\c:\thhnhn.exec:\thhnhn.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1rfflxl.exec:\1rfflxl.exe19⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pdjjp.exec:\pdjjp.exe20⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe21⤵
- Executes dropped EXE
PID:2572 -
\??\c:\thtbnn.exec:\thtbnn.exe22⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pjvdd.exec:\pjvdd.exe23⤵
- Executes dropped EXE
PID:2296 -
\??\c:\htbtbt.exec:\htbtbt.exe24⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5dppp.exec:\5dppp.exe25⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tbtthh.exec:\tbtthh.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tnbtbb.exec:\tnbtbb.exe27⤵
- Executes dropped EXE
PID:268 -
\??\c:\9frfffl.exec:\9frfffl.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\btnnbt.exec:\btnnbt.exe29⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lflfrxr.exec:\lflfrxr.exe30⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hhtbhn.exec:\hhtbhn.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\ppjvd.exec:\ppjvd.exe32⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nhhhnn.exec:\nhhhnn.exe33⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9vjdd.exec:\9vjdd.exe34⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7fxfrrx.exec:\7fxfrrx.exe35⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fxfffxl.exec:\fxfffxl.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hbnnnn.exec:\hbnnnn.exe37⤵
- Executes dropped EXE
PID:700 -
\??\c:\9pddj.exec:\9pddj.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lxrflll.exec:\lxrflll.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bbtbhh.exec:\bbtbhh.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bthntn.exec:\bthntn.exe41⤵
- Executes dropped EXE
PID:768 -
\??\c:\pdpjv.exec:\pdpjv.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7rllrrr.exec:\7rllrrr.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3bnntb.exec:\3bnntb.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5pddd.exec:\5pddd.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ffrrxrx.exec:\ffrrxrx.exe47⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nhtntt.exec:\nhtntt.exe49⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vjvpv.exec:\vjvpv.exe50⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9vjdd.exec:\9vjdd.exe51⤵
- Executes dropped EXE
PID:1452 -
\??\c:\lxlfrlx.exec:\lxlfrlx.exe52⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hthhht.exec:\hthhht.exe53⤵
- Executes dropped EXE
PID:1192 -
\??\c:\1thhht.exec:\1thhht.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1pdvv.exec:\1pdvv.exe55⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3llllfl.exec:\3llllfl.exe56⤵
- Executes dropped EXE
PID:2968 -
\??\c:\frfllfl.exec:\frfllfl.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hhnbhh.exec:\hhnbhh.exe58⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pjvjd.exec:\pjvjd.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pjdjd.exec:\pjdjd.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2096 -
\??\c:\xfrllff.exec:\xfrllff.exe61⤵
- Executes dropped EXE
PID:956 -
\??\c:\tbnhhh.exec:\tbnhhh.exe62⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bbnnnh.exec:\bbnnnh.exe63⤵
- Executes dropped EXE
PID:992 -
\??\c:\vvddd.exec:\vvddd.exe64⤵
- Executes dropped EXE
PID:108 -
\??\c:\xxlxflx.exec:\xxlxflx.exe65⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lxllxxr.exec:\lxllxxr.exe66⤵PID:2132
-
\??\c:\nbnnhb.exec:\nbnnhb.exe67⤵PID:2324
-
\??\c:\djdvd.exec:\djdvd.exe68⤵PID:1700
-
\??\c:\jvdjv.exec:\jvdjv.exe69⤵PID:712
-
\??\c:\lxflllr.exec:\lxflllr.exe70⤵PID:1088
-
\??\c:\nhtbbb.exec:\nhtbbb.exe71⤵PID:1904
-
\??\c:\1bhnnn.exec:\1bhnnn.exe72⤵PID:2456
-
\??\c:\jvjdd.exec:\jvjdd.exe73⤵PID:1992
-
\??\c:\rlrxrfl.exec:\rlrxrfl.exe74⤵PID:1544
-
\??\c:\xlrrrll.exec:\xlrrrll.exe75⤵PID:1672
-
\??\c:\9bhtbb.exec:\9bhtbb.exe76⤵PID:1944
-
\??\c:\9pddv.exec:\9pddv.exe77⤵PID:2440
-
\??\c:\dpjjv.exec:\dpjjv.exe78⤵PID:3044
-
\??\c:\xxflxlr.exec:\xxflxlr.exe79⤵PID:3040
-
\??\c:\btnnbb.exec:\btnnbb.exe80⤵PID:2980
-
\??\c:\htnnnh.exec:\htnnnh.exe81⤵PID:2636
-
\??\c:\jvddj.exec:\jvddj.exe82⤵PID:3000
-
\??\c:\rfxxxff.exec:\rfxxxff.exe83⤵PID:2752
-
\??\c:\lxrffrx.exec:\lxrffrx.exe84⤵PID:2556
-
\??\c:\thnthh.exec:\thnthh.exe85⤵PID:2824
-
\??\c:\nbnbhb.exec:\nbnbhb.exe86⤵PID:2596
-
\??\c:\jdpjv.exec:\jdpjv.exe87⤵PID:2576
-
\??\c:\rlflxrf.exec:\rlflxrf.exe88⤵PID:2704
-
\??\c:\frxrxrr.exec:\frxrxrr.exe89⤵PID:1868
-
\??\c:\hbntbb.exec:\hbntbb.exe90⤵PID:2880
-
\??\c:\jvvvd.exec:\jvvvd.exe91⤵PID:2892
-
\??\c:\dvdvd.exec:\dvdvd.exe92⤵PID:2908
-
\??\c:\5lrrlll.exec:\5lrrlll.exe93⤵PID:1948
-
\??\c:\xlrllfr.exec:\xlrllfr.exe94⤵PID:2796
-
\??\c:\9ntbbb.exec:\9ntbbb.exe95⤵PID:1152
-
\??\c:\jjvvd.exec:\jjvvd.exe96⤵PID:1724
-
\??\c:\frffffl.exec:\frffffl.exe97⤵PID:2772
-
\??\c:\thbbnt.exec:\thbbnt.exe98⤵PID:2920
-
\??\c:\bntbhb.exec:\bntbhb.exe99⤵PID:2364
-
\??\c:\1jvpp.exec:\1jvpp.exe100⤵PID:1756
-
\??\c:\lfffffx.exec:\lfffffx.exe101⤵PID:2572
-
\??\c:\rrffflr.exec:\rrffflr.exe102⤵PID:1436
-
\??\c:\9hnhhh.exec:\9hnhhh.exe103⤵PID:288
-
\??\c:\ppvdp.exec:\ppvdp.exe104⤵PID:1804
-
\??\c:\vdddv.exec:\vdddv.exe105⤵PID:2296
-
\??\c:\3rflrxl.exec:\3rflrxl.exe106⤵PID:596
-
\??\c:\tnbnnn.exec:\tnbnnn.exe107⤵PID:1000
-
\??\c:\3tnhbb.exec:\3tnhbb.exe108⤵PID:332
-
\??\c:\7jpjp.exec:\7jpjp.exe109⤵PID:580
-
\??\c:\xrflrrl.exec:\xrflrrl.exe110⤵PID:1656
-
\??\c:\xlrllll.exec:\xlrllll.exe111⤵PID:2128
-
\??\c:\bhbtnh.exec:\bhbtnh.exe112⤵PID:712
-
\??\c:\9djvv.exec:\9djvv.exe113⤵PID:1088
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe114⤵PID:1904
-
\??\c:\lxxffxx.exec:\lxxffxx.exe115⤵PID:1392
-
\??\c:\ttnntb.exec:\ttnntb.exe116⤵PID:1652
-
\??\c:\vpppd.exec:\vpppd.exe117⤵PID:1544
-
\??\c:\dppvv.exec:\dppvv.exe118⤵PID:1672
-
\??\c:\1frrrrr.exec:\1frrrrr.exe119⤵PID:1944
-
\??\c:\3hhttt.exec:\3hhttt.exe120⤵PID:340
-
\??\c:\tnbbbh.exec:\tnbbbh.exe121⤵PID:2976
-
\??\c:\pjddd.exec:\pjddd.exe122⤵PID:700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-