Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe
-
Size
454KB
-
MD5
6c9bbd257c57fa6f04250b0d070e08c0
-
SHA1
d606b48211f5c4cb8df46f21fac238809e22edf0
-
SHA256
9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2f
-
SHA512
484fb0663b375515dfa7e54c594a963312dc6b2f25f92dc9c9fa662ff4f74561ee1e0b2ba1e5526a66ca9c8de21dca1e0c6cb246adb17346f3cbdf2c1dfdf6a3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2180-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-16-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-37-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1804-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-353-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1708-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-422-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-505-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-860-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-898-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/324-983-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-1087-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-1234-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 9dvpd.exe 2772 vvvjv.exe 2656 frxlrrl.exe 2564 7thhtb.exe 1804 ffflffl.exe 2612 1hhthn.exe 2328 rlxfrxl.exe 1776 vjpvv.exe 2044 xlxxflr.exe 2928 jjvpd.exe 2104 ffxlxfx.exe 2112 pvvjp.exe 2904 fxxlxfr.exe 2368 ddvvd.exe 2812 3frfxfr.exe 2056 vvjpj.exe 984 xffxxll.exe 380 dpjjp.exe 2132 xlflxlr.exe 956 tbhtnt.exe 844 1xrxfxf.exe 1100 vpddj.exe 2220 5xflxxf.exe 1352 1dvjp.exe 1672 1djdj.exe 1652 9hbbnn.exe 2312 pvdvd.exe 1076 xlxlxxf.exe 2288 hbhhnn.exe 1612 rlxxxfl.exe 1740 hbttnn.exe 2648 fflxrfr.exe 2696 hbbhbh.exe 2776 ppvdp.exe 2692 dpvjv.exe 2756 xlrxllr.exe 2700 1tnbhn.exe 2208 7vdpj.exe 2552 lfxrfxf.exe 1804 hhtthh.exe 1708 nhtbhn.exe 3060 7pvvv.exe 2084 5lrrrlr.exe 2640 9nbtbb.exe 804 jvjjv.exe 2520 7fxffrf.exe 672 hbntbb.exe 2116 1thhnh.exe 2856 1jvvd.exe 2932 1rfrxxf.exe 2904 1nttbt.exe 2888 dpddp.exe 2644 jdpvj.exe 2304 1frxfxf.exe 376 nhthhh.exe 536 9jdjv.exe 2108 lxrrxxf.exe 2976 9rfrffl.exe 2132 bbntbh.exe 2404 jpdpv.exe 1484 vjdjp.exe 1860 ffxfllx.exe 2876 thhbbh.exe 1508 pdddj.exe -
resource yara_rule behavioral1/memory/2180-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-983-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2972 2180 9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe 30 PID 2180 wrote to memory of 2972 2180 9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe 30 PID 2180 wrote to memory of 2972 2180 9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe 30 PID 2180 wrote to memory of 2972 2180 9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe 30 PID 2972 wrote to memory of 2772 2972 9dvpd.exe 31 PID 2972 wrote to memory of 2772 2972 9dvpd.exe 31 PID 2972 wrote to memory of 2772 2972 9dvpd.exe 31 PID 2972 wrote to memory of 2772 2972 9dvpd.exe 31 PID 2772 wrote to memory of 2656 2772 vvvjv.exe 32 PID 2772 wrote to memory of 2656 2772 vvvjv.exe 32 PID 2772 wrote to memory of 2656 2772 vvvjv.exe 32 PID 2772 wrote to memory of 2656 2772 vvvjv.exe 32 PID 2656 wrote to memory of 2564 2656 frxlrrl.exe 33 PID 2656 wrote to memory of 2564 2656 frxlrrl.exe 33 PID 2656 wrote to memory of 2564 2656 frxlrrl.exe 33 PID 2656 wrote to memory of 2564 2656 frxlrrl.exe 33 PID 2564 wrote to memory of 1804 2564 7thhtb.exe 34 PID 2564 wrote to memory of 1804 2564 7thhtb.exe 34 PID 2564 wrote to memory of 1804 2564 7thhtb.exe 34 PID 2564 wrote to memory of 1804 2564 7thhtb.exe 34 PID 1804 wrote to memory of 2612 1804 ffflffl.exe 35 PID 1804 wrote to memory of 2612 1804 ffflffl.exe 35 PID 1804 wrote to memory of 2612 1804 ffflffl.exe 35 PID 1804 wrote to memory of 2612 1804 ffflffl.exe 35 PID 2612 wrote to memory of 2328 2612 1hhthn.exe 36 PID 2612 wrote to memory of 2328 2612 1hhthn.exe 36 PID 2612 wrote to memory of 2328 2612 1hhthn.exe 36 PID 2612 wrote to memory of 2328 2612 1hhthn.exe 36 PID 2328 wrote to memory of 1776 2328 rlxfrxl.exe 37 PID 2328 wrote to memory of 1776 2328 rlxfrxl.exe 37 PID 2328 wrote to memory of 1776 2328 rlxfrxl.exe 37 PID 2328 wrote to memory of 1776 2328 rlxfrxl.exe 37 PID 1776 wrote to memory of 2044 1776 vjpvv.exe 38 PID 1776 wrote to memory of 2044 1776 vjpvv.exe 38 PID 1776 wrote to memory of 2044 1776 vjpvv.exe 38 PID 1776 wrote to memory of 2044 1776 vjpvv.exe 38 PID 2044 wrote to memory of 2928 2044 xlxxflr.exe 39 PID 2044 wrote to memory of 2928 2044 xlxxflr.exe 39 PID 2044 wrote to memory of 2928 2044 xlxxflr.exe 39 PID 2044 wrote to memory of 2928 2044 xlxxflr.exe 39 PID 2928 wrote to memory of 2104 2928 jjvpd.exe 40 PID 2928 wrote to memory of 2104 2928 jjvpd.exe 40 PID 2928 wrote to memory of 2104 2928 jjvpd.exe 40 PID 2928 wrote to memory of 2104 2928 jjvpd.exe 40 PID 2104 wrote to memory of 2112 2104 ffxlxfx.exe 41 PID 2104 wrote to memory of 2112 2104 ffxlxfx.exe 41 PID 2104 wrote to memory of 2112 2104 ffxlxfx.exe 41 PID 2104 wrote to memory of 2112 2104 ffxlxfx.exe 41 PID 2112 wrote to memory of 2904 2112 pvvjp.exe 42 PID 2112 wrote to memory of 2904 2112 pvvjp.exe 42 PID 2112 wrote to memory of 2904 2112 pvvjp.exe 42 PID 2112 wrote to memory of 2904 2112 pvvjp.exe 42 PID 2904 wrote to memory of 2368 2904 fxxlxfr.exe 43 PID 2904 wrote to memory of 2368 2904 fxxlxfr.exe 43 PID 2904 wrote to memory of 2368 2904 fxxlxfr.exe 43 PID 2904 wrote to memory of 2368 2904 fxxlxfr.exe 43 PID 2368 wrote to memory of 2812 2368 ddvvd.exe 44 PID 2368 wrote to memory of 2812 2368 ddvvd.exe 44 PID 2368 wrote to memory of 2812 2368 ddvvd.exe 44 PID 2368 wrote to memory of 2812 2368 ddvvd.exe 44 PID 2812 wrote to memory of 2056 2812 3frfxfr.exe 45 PID 2812 wrote to memory of 2056 2812 3frfxfr.exe 45 PID 2812 wrote to memory of 2056 2812 3frfxfr.exe 45 PID 2812 wrote to memory of 2056 2812 3frfxfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe"C:\Users\Admin\AppData\Local\Temp\9c52779d593a00c358f4295d271f3d56b8cce5bc4a1af8d27ca96b212041ab2fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\9dvpd.exec:\9dvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vvvjv.exec:\vvvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\frxlrrl.exec:\frxlrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7thhtb.exec:\7thhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ffflffl.exec:\ffflffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\1hhthn.exec:\1hhthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\vjpvv.exec:\vjpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\xlxxflr.exec:\xlxxflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jjvpd.exec:\jjvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pvvjp.exec:\pvvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ddvvd.exec:\ddvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\3frfxfr.exec:\3frfxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vvjpj.exec:\vvjpj.exe17⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xffxxll.exec:\xffxxll.exe18⤵
- Executes dropped EXE
PID:984 -
\??\c:\dpjjp.exec:\dpjjp.exe19⤵
- Executes dropped EXE
PID:380 -
\??\c:\xlflxlr.exec:\xlflxlr.exe20⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tbhtnt.exec:\tbhtnt.exe21⤵
- Executes dropped EXE
PID:956 -
\??\c:\1xrxfxf.exec:\1xrxfxf.exe22⤵
- Executes dropped EXE
PID:844 -
\??\c:\vpddj.exec:\vpddj.exe23⤵
- Executes dropped EXE
PID:1100 -
\??\c:\5xflxxf.exec:\5xflxxf.exe24⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1dvjp.exec:\1dvjp.exe25⤵
- Executes dropped EXE
PID:1352 -
\??\c:\1djdj.exec:\1djdj.exe26⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9hbbnn.exec:\9hbbnn.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pvdvd.exec:\pvdvd.exe28⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xlxlxxf.exec:\xlxlxxf.exe29⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hbhhnn.exec:\hbhhnn.exe30⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe31⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hbttnn.exec:\hbttnn.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fflxrfr.exec:\fflxrfr.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbbhbh.exec:\hbbhbh.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ppvdp.exec:\ppvdp.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dpvjv.exec:\dpvjv.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlrxllr.exec:\xlrxllr.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1tnbhn.exec:\1tnbhn.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7vdpj.exec:\7vdpj.exe39⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lfxrfxf.exec:\lfxrfxf.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hhtthh.exec:\hhtthh.exe41⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nhtbhn.exec:\nhtbhn.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7pvvv.exec:\7pvvv.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5lrrrlr.exec:\5lrrrlr.exe44⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9nbtbb.exec:\9nbtbb.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jvjjv.exec:\jvjjv.exe46⤵
- Executes dropped EXE
PID:804 -
\??\c:\7fxffrf.exec:\7fxffrf.exe47⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbntbb.exec:\hbntbb.exe48⤵
- Executes dropped EXE
PID:672 -
\??\c:\1thhnh.exec:\1thhnh.exe49⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1jvvd.exec:\1jvvd.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1rfrxxf.exec:\1rfrxxf.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1nttbt.exec:\1nttbt.exe52⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dpddp.exec:\dpddp.exe53⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdpvj.exec:\jdpvj.exe54⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1frxfxf.exec:\1frxfxf.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhthhh.exec:\nhthhh.exe56⤵
- Executes dropped EXE
PID:376 -
\??\c:\9jdjv.exec:\9jdjv.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\9rfrffl.exec:\9rfrffl.exe59⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bbntbh.exec:\bbntbh.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jpdpv.exec:\jpdpv.exe61⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vjdjp.exec:\vjdjp.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ffxfllx.exec:\ffxfllx.exe63⤵
- Executes dropped EXE
PID:1860 -
\??\c:\thhbbh.exec:\thhbbh.exe64⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pdddj.exec:\pdddj.exe65⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe66⤵PID:1524
-
\??\c:\fxlrflx.exec:\fxlrflx.exe67⤵PID:1944
-
\??\c:\hhnnbt.exec:\hhnnbt.exe68⤵PID:2516
-
\??\c:\pdvdj.exec:\pdvdj.exe69⤵PID:1652
-
\??\c:\xlfxllr.exec:\xlfxllr.exe70⤵PID:1736
-
\??\c:\hbnhtt.exec:\hbnhtt.exe71⤵PID:2428
-
\??\c:\tnhntn.exec:\tnhntn.exe72⤵PID:1268
-
\??\c:\jdvdj.exec:\jdvdj.exe73⤵PID:2284
-
\??\c:\5lfrxrx.exec:\5lfrxrx.exe74⤵PID:1612
-
\??\c:\5bntnt.exec:\5bntnt.exe75⤵PID:1980
-
\??\c:\pvpvp.exec:\pvpvp.exe76⤵PID:2444
-
\??\c:\7rlrffl.exec:\7rlrffl.exe77⤵PID:1548
-
\??\c:\llflxfr.exec:\llflxfr.exe78⤵PID:1572
-
\??\c:\tthtnb.exec:\tthtnb.exe79⤵PID:2736
-
\??\c:\1djpj.exec:\1djpj.exe80⤵PID:2576
-
\??\c:\llrfxfx.exec:\llrfxfx.exe81⤵PID:2832
-
\??\c:\hhbhbb.exec:\hhbhbb.exe82⤵PID:2720
-
\??\c:\pjjpv.exec:\pjjpv.exe83⤵PID:2536
-
\??\c:\lllxffr.exec:\lllxffr.exe84⤵PID:528
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe85⤵PID:2612
-
\??\c:\nhtthh.exec:\nhtthh.exe86⤵PID:1664
-
\??\c:\3pddj.exec:\3pddj.exe87⤵PID:2328
-
\??\c:\llxlrrf.exec:\llxlrrf.exe88⤵PID:2860
-
\??\c:\hthnbt.exec:\hthnbt.exe89⤵PID:1780
-
\??\c:\3pdpj.exec:\3pdpj.exe90⤵PID:2384
-
\??\c:\pdppp.exec:\pdppp.exe91⤵
- System Location Discovery: System Language Discovery
PID:2988 -
\??\c:\1fxrxxl.exec:\1fxrxxl.exe92⤵PID:2788
-
\??\c:\btbtbt.exec:\btbtbt.exe93⤵PID:2884
-
\??\c:\jdpdp.exec:\jdpdp.exe94⤵PID:2924
-
\??\c:\xllrrrx.exec:\xllrrrx.exe95⤵PID:2944
-
\??\c:\3rffrrx.exec:\3rffrrx.exe96⤵PID:3064
-
\??\c:\thnntn.exec:\thnntn.exe97⤵PID:2816
-
\??\c:\ddppj.exec:\ddppj.exe98⤵PID:2600
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe99⤵PID:588
-
\??\c:\5hnhhh.exec:\5hnhhh.exe100⤵PID:540
-
\??\c:\bnthhh.exec:\bnthhh.exe101⤵PID:1792
-
\??\c:\5ppdd.exec:\5ppdd.exe102⤵PID:2380
-
\??\c:\rrllrxf.exec:\rrllrxf.exe103⤵PID:1768
-
\??\c:\3bhhnn.exec:\3bhhnn.exe104⤵PID:1216
-
\??\c:\hbttbh.exec:\hbttbh.exe105⤵PID:2432
-
\??\c:\vpvdd.exec:\vpvdd.exe106⤵PID:1716
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe107⤵PID:1100
-
\??\c:\bthntt.exec:\bthntt.exe108⤵PID:1760
-
\??\c:\3jvpv.exec:\3jvpv.exe109⤵PID:2512
-
\??\c:\jvjjv.exec:\jvjjv.exe110⤵PID:268
-
\??\c:\7lxfllx.exec:\7lxfllx.exe111⤵PID:2476
-
\??\c:\jddjv.exec:\jddjv.exe112⤵PID:2372
-
\??\c:\fxllrlr.exec:\fxllrlr.exe113⤵PID:764
-
\??\c:\htbhnh.exec:\htbhnh.exe114⤵PID:1468
-
\??\c:\vpdjj.exec:\vpdjj.exe115⤵PID:2428
-
\??\c:\5djjp.exec:\5djjp.exe116⤵PID:1904
-
\??\c:\rrlrrrx.exec:\rrlrrrx.exe117⤵PID:1808
-
\??\c:\9ntntt.exec:\9ntntt.exe118⤵PID:2956
-
\??\c:\vvjvj.exec:\vvjvj.exe119⤵PID:1796
-
\??\c:\3frllff.exec:\3frllff.exe120⤵PID:2172
-
\??\c:\xxfrffl.exec:\xxfrffl.exe121⤵PID:1548
-
\??\c:\thnhhh.exec:\thnhhh.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-