Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe
-
Size
454KB
-
MD5
f6d5bdad0f49c775d89c6b7b650e62d0
-
SHA1
14de41804df99b9068a1ec7d60a672fbf79d7761
-
SHA256
595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20
-
SHA512
d32f08bd6d451a72d554196997b35c92e86b3eb83eabc17eb781571acc5bb99f3f4bcbc5bdea3a37af0f6f08f73847eb2f426f355a049bad556d860533b891b9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1072-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-75-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2536-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-95-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2092-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-536-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/564-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-601-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2580-604-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2716-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-654-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2700 3thhnn.exe 2704 9nhbhh.exe 2972 jddvp.exe 2844 nntbbb.exe 2664 nhhbhn.exe 2596 fxflflr.exe 3068 ntthbt.exe 1592 rrfxxrx.exe 2536 tnttbb.exe 2092 vpvdd.exe 2252 1rfxfxf.exe 572 jdvvv.exe 2820 lrxxxrl.exe 1664 ddjjj.exe 1172 rxfxfff.exe 1680 vvvpp.exe 264 xxffxff.exe 2016 9fxrxxf.exe 2336 xxfrxlx.exe 1208 xxrxlxf.exe 3028 3htttt.exe 860 ddppj.exe 616 llfrfrx.exe 1668 9rfxxxx.exe 1436 tnnhhb.exe 2460 pvddj.exe 2268 tbhbnt.exe 988 rlrlxfr.exe 1088 1xllrrx.exe 1516 frfxxxf.exe 2324 rrffrxl.exe 1532 ppvdd.exe 2696 7frrxxf.exe 2668 hntnnh.exe 2768 pdppv.exe 2064 xlxrllr.exe 2552 7lfflff.exe 2624 5bhhhh.exe 2616 9vdvd.exe 1420 xflffxf.exe 1204 fxfxfff.exe 1592 btnhnh.exe 2344 dddjj.exe 1752 5fxrrrr.exe 1696 tnnhnn.exe 2148 thhnbh.exe 1152 dddjp.exe 1488 flrlrrl.exe 832 flrrrrr.exe 1220 bbhnnn.exe 444 jjpjp.exe 588 3xlrxxx.exe 2024 nttttb.exe 1776 bbnnhh.exe 636 5pddj.exe 2260 rrxxfxx.exe 2196 7nhbhh.exe 2232 ddjdv.exe 952 llrrfff.exe 3028 llxrrrr.exe 524 tnbttb.exe 348 vdppp.exe 1656 lfllxrr.exe 1668 3fxxffr.exe -
resource yara_rule behavioral1/memory/1072-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-113-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/572-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-262-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2268-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-654-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2264-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-738-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2700 1072 595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe 30 PID 1072 wrote to memory of 2700 1072 595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe 30 PID 1072 wrote to memory of 2700 1072 595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe 30 PID 1072 wrote to memory of 2700 1072 595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe 30 PID 2700 wrote to memory of 2704 2700 3thhnn.exe 31 PID 2700 wrote to memory of 2704 2700 3thhnn.exe 31 PID 2700 wrote to memory of 2704 2700 3thhnn.exe 31 PID 2700 wrote to memory of 2704 2700 3thhnn.exe 31 PID 2704 wrote to memory of 2972 2704 9nhbhh.exe 32 PID 2704 wrote to memory of 2972 2704 9nhbhh.exe 32 PID 2704 wrote to memory of 2972 2704 9nhbhh.exe 32 PID 2704 wrote to memory of 2972 2704 9nhbhh.exe 32 PID 2972 wrote to memory of 2844 2972 jddvp.exe 33 PID 2972 wrote to memory of 2844 2972 jddvp.exe 33 PID 2972 wrote to memory of 2844 2972 jddvp.exe 33 PID 2972 wrote to memory of 2844 2972 jddvp.exe 33 PID 2844 wrote to memory of 2664 2844 nntbbb.exe 34 PID 2844 wrote to memory of 2664 2844 nntbbb.exe 34 PID 2844 wrote to memory of 2664 2844 nntbbb.exe 34 PID 2844 wrote to memory of 2664 2844 nntbbb.exe 34 PID 2664 wrote to memory of 2596 2664 nhhbhn.exe 35 PID 2664 wrote to memory of 2596 2664 nhhbhn.exe 35 PID 2664 wrote to memory of 2596 2664 nhhbhn.exe 35 PID 2664 wrote to memory of 2596 2664 nhhbhn.exe 35 PID 2596 wrote to memory of 3068 2596 fxflflr.exe 36 PID 2596 wrote to memory of 3068 2596 fxflflr.exe 36 PID 2596 wrote to memory of 3068 2596 fxflflr.exe 36 PID 2596 wrote to memory of 3068 2596 fxflflr.exe 36 PID 3068 wrote to memory of 1592 3068 ntthbt.exe 37 PID 3068 wrote to memory of 1592 3068 ntthbt.exe 37 PID 3068 wrote to memory of 1592 3068 ntthbt.exe 37 PID 3068 wrote to memory of 1592 3068 ntthbt.exe 37 PID 1592 wrote to memory of 2536 1592 rrfxxrx.exe 38 PID 1592 wrote to memory of 2536 1592 rrfxxrx.exe 38 PID 1592 wrote to memory of 2536 1592 rrfxxrx.exe 38 PID 1592 wrote to memory of 2536 1592 rrfxxrx.exe 38 PID 2536 wrote to memory of 2092 2536 tnttbb.exe 39 PID 2536 wrote to memory of 2092 2536 tnttbb.exe 39 PID 2536 wrote to memory of 2092 2536 tnttbb.exe 39 PID 2536 wrote to memory of 2092 2536 tnttbb.exe 39 PID 2092 wrote to memory of 2252 2092 vpvdd.exe 40 PID 2092 wrote to memory of 2252 2092 vpvdd.exe 40 PID 2092 wrote to memory of 2252 2092 vpvdd.exe 40 PID 2092 wrote to memory of 2252 2092 vpvdd.exe 40 PID 2252 wrote to memory of 572 2252 1rfxfxf.exe 41 PID 2252 wrote to memory of 572 2252 1rfxfxf.exe 41 PID 2252 wrote to memory of 572 2252 1rfxfxf.exe 41 PID 2252 wrote to memory of 572 2252 1rfxfxf.exe 41 PID 572 wrote to memory of 2820 572 jdvvv.exe 42 PID 572 wrote to memory of 2820 572 jdvvv.exe 42 PID 572 wrote to memory of 2820 572 jdvvv.exe 42 PID 572 wrote to memory of 2820 572 jdvvv.exe 42 PID 2820 wrote to memory of 1664 2820 lrxxxrl.exe 43 PID 2820 wrote to memory of 1664 2820 lrxxxrl.exe 43 PID 2820 wrote to memory of 1664 2820 lrxxxrl.exe 43 PID 2820 wrote to memory of 1664 2820 lrxxxrl.exe 43 PID 1664 wrote to memory of 1172 1664 ddjjj.exe 44 PID 1664 wrote to memory of 1172 1664 ddjjj.exe 44 PID 1664 wrote to memory of 1172 1664 ddjjj.exe 44 PID 1664 wrote to memory of 1172 1664 ddjjj.exe 44 PID 1172 wrote to memory of 1680 1172 rxfxfff.exe 45 PID 1172 wrote to memory of 1680 1172 rxfxfff.exe 45 PID 1172 wrote to memory of 1680 1172 rxfxfff.exe 45 PID 1172 wrote to memory of 1680 1172 rxfxfff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe"C:\Users\Admin\AppData\Local\Temp\595af82e0d222a19b91997d7b1fdad875ee6ae7d8efd28b52c70a06fa3b75f20N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\3thhnn.exec:\3thhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\9nhbhh.exec:\9nhbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jddvp.exec:\jddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nntbbb.exec:\nntbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nhhbhn.exec:\nhhbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fxflflr.exec:\fxflflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ntthbt.exec:\ntthbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rrfxxrx.exec:\rrfxxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\tnttbb.exec:\tnttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vpvdd.exec:\vpvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\1rfxfxf.exec:\1rfxfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\jdvvv.exec:\jdvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\lrxxxrl.exec:\lrxxxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ddjjj.exec:\ddjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\rxfxfff.exec:\rxfxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\vvvpp.exec:\vvvpp.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xxffxff.exec:\xxffxff.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\9fxrxxf.exec:\9fxrxxf.exe19⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xxfrxlx.exec:\xxfrxlx.exe20⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xxrxlxf.exec:\xxrxlxf.exe21⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3htttt.exec:\3htttt.exe22⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ddppj.exec:\ddppj.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\llfrfrx.exec:\llfrfrx.exe24⤵
- Executes dropped EXE
PID:616 -
\??\c:\9rfxxxx.exec:\9rfxxxx.exe25⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tnnhhb.exec:\tnnhhb.exe26⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pvddj.exec:\pvddj.exe27⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tbhbnt.exec:\tbhbnt.exe28⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlrlxfr.exec:\rlrlxfr.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\1xllrrx.exec:\1xllrrx.exe30⤵
- Executes dropped EXE
PID:1088 -
\??\c:\frfxxxf.exec:\frfxxxf.exe31⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rrffrxl.exec:\rrffrxl.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ppvdd.exec:\ppvdd.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\7frrxxf.exec:\7frrxxf.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hntnnh.exec:\hntnnh.exe35⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pdppv.exec:\pdppv.exe36⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xlxrllr.exec:\xlxrllr.exe37⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7lfflff.exec:\7lfflff.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5bhhhh.exec:\5bhhhh.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9vdvd.exec:\9vdvd.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xflffxf.exec:\xflffxf.exe41⤵
- Executes dropped EXE
PID:1420 -
\??\c:\fxfxfff.exec:\fxfxfff.exe42⤵
- Executes dropped EXE
PID:1204 -
\??\c:\btnhnh.exec:\btnhnh.exe43⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dddjj.exec:\dddjj.exe44⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5fxrrrr.exec:\5fxrrrr.exe45⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tnnhnn.exec:\tnnhnn.exe46⤵
- Executes dropped EXE
PID:1696 -
\??\c:\thhnbh.exec:\thhnbh.exe47⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dddjp.exec:\dddjp.exe48⤵
- Executes dropped EXE
PID:1152 -
\??\c:\flrlrrl.exec:\flrlrrl.exe49⤵
- Executes dropped EXE
PID:1488 -
\??\c:\flrrrrr.exec:\flrrrrr.exe50⤵
- Executes dropped EXE
PID:832 -
\??\c:\bbhnnn.exec:\bbhnnn.exe51⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jjpjp.exec:\jjpjp.exe52⤵
- Executes dropped EXE
PID:444 -
\??\c:\3xlrxxx.exec:\3xlrxxx.exe53⤵
- Executes dropped EXE
PID:588 -
\??\c:\nttttb.exec:\nttttb.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bbnnhh.exec:\bbnnhh.exe55⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5pddj.exec:\5pddj.exe56⤵
- Executes dropped EXE
PID:636 -
\??\c:\rrxxfxx.exec:\rrxxfxx.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7nhbhh.exec:\7nhbhh.exe58⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ddjdv.exec:\ddjdv.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\llrrfff.exec:\llrrfff.exe60⤵
- Executes dropped EXE
PID:952 -
\??\c:\llxrrrr.exec:\llxrrrr.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tnbttb.exec:\tnbttb.exe62⤵
- Executes dropped EXE
PID:524 -
\??\c:\vdppp.exec:\vdppp.exe63⤵
- Executes dropped EXE
PID:348 -
\??\c:\lfllxrr.exec:\lfllxrr.exe64⤵
- Executes dropped EXE
PID:1656 -
\??\c:\3fxxffr.exec:\3fxxffr.exe65⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnttnt.exec:\bnttnt.exe66⤵PID:1564
-
\??\c:\pjvvd.exec:\pjvvd.exe67⤵PID:564
-
\??\c:\rrllrrr.exec:\rrllrrr.exe68⤵PID:2456
-
\??\c:\nhnhhh.exec:\nhnhhh.exe69⤵PID:2268
-
\??\c:\nnnntb.exec:\nnnntb.exe70⤵PID:1076
-
\??\c:\jjpjj.exec:\jjpjj.exe71⤵PID:892
-
\??\c:\lllllll.exec:\lllllll.exe72⤵PID:1524
-
\??\c:\bhnnnn.exec:\bhnnnn.exe73⤵PID:2748
-
\??\c:\3jvvj.exec:\3jvvj.exe74⤵PID:1616
-
\??\c:\djpjj.exec:\djpjj.exe75⤵PID:2804
-
\??\c:\rrllfxx.exec:\rrllfxx.exe76⤵PID:2704
-
\??\c:\bthhhh.exec:\bthhhh.exe77⤵PID:1720
-
\??\c:\nntbnt.exec:\nntbnt.exe78⤵PID:2580
-
\??\c:\vvvpj.exec:\vvvpj.exe79⤵PID:2716
-
\??\c:\fxfrrrr.exec:\fxfrrrr.exe80⤵PID:2568
-
\??\c:\nbtbhh.exec:\nbtbhh.exe81⤵PID:2628
-
\??\c:\pppvd.exec:\pppvd.exe82⤵PID:2184
-
\??\c:\rlrfrrr.exec:\rlrfrrr.exe83⤵PID:2176
-
\??\c:\lrrxflr.exec:\lrrxflr.exe84⤵PID:2056
-
\??\c:\bnhhnt.exec:\bnhhnt.exe85⤵PID:3004
-
\??\c:\vvpdp.exec:\vvpdp.exe86⤵PID:1520
-
\??\c:\xxxrxxx.exec:\xxxrxxx.exe87⤵PID:2188
-
\??\c:\rrlfrxx.exec:\rrlfrxx.exe88⤵PID:2444
-
\??\c:\5ttntt.exec:\5ttntt.exe89⤵PID:2264
-
\??\c:\1vjpp.exec:\1vjpp.exe90⤵PID:2824
-
\??\c:\rrrxrlr.exec:\rrrxrlr.exe91⤵PID:2612
-
\??\c:\9xrrlrx.exec:\9xrrlrx.exe92⤵PID:2376
-
\??\c:\5tbbbt.exec:\5tbbbt.exe93⤵PID:1952
-
\??\c:\vvddj.exec:\vvddj.exe94⤵PID:1324
-
\??\c:\xxllxrr.exec:\xxllxrr.exe95⤵PID:480
-
\??\c:\9llxlxl.exec:\9llxlxl.exe96⤵PID:2072
-
\??\c:\bthntt.exec:\bthntt.exe97⤵PID:2080
-
\??\c:\vvjpd.exec:\vvjpd.exe98⤵PID:2192
-
\??\c:\rrfxffl.exec:\rrfxffl.exe99⤵PID:2260
-
\??\c:\nnhnhn.exec:\nnhnhn.exe100⤵PID:2004
-
\??\c:\5hhhht.exec:\5hhhht.exe101⤵PID:1948
-
\??\c:\vvjjp.exec:\vvjjp.exe102⤵PID:1700
-
\??\c:\xrfffxx.exec:\xrfffxx.exe103⤵PID:2448
-
\??\c:\1nbhnn.exec:\1nbhnn.exe104⤵PID:780
-
\??\c:\nnnnhn.exec:\nnnnhn.exe105⤵PID:2868
-
\??\c:\1jdvd.exec:\1jdvd.exe106⤵PID:616
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe107⤵PID:376
-
\??\c:\ffflflr.exec:\ffflflr.exe108⤵PID:3016
-
\??\c:\7ntbhh.exec:\7ntbhh.exe109⤵PID:564
-
\??\c:\ddjpp.exec:\ddjpp.exe110⤵PID:1392
-
\??\c:\5pdjj.exec:\5pdjj.exe111⤵PID:1676
-
\??\c:\xffllrx.exec:\xffllrx.exe112⤵PID:1156
-
\??\c:\nnbbbh.exec:\nnbbbh.exe113⤵PID:1088
-
\??\c:\ddvjv.exec:\ddvjv.exe114⤵PID:2472
-
\??\c:\jdjvv.exec:\jdjvv.exe115⤵PID:1612
-
\??\c:\bbnnhn.exec:\bbnnhn.exe116⤵PID:1708
-
\??\c:\3nnntb.exec:\3nnntb.exe117⤵PID:2828
-
\??\c:\9pjdd.exec:\9pjdd.exe118⤵PID:2696
-
\??\c:\lrfxfff.exec:\lrfxfff.exe119⤵PID:3044
-
\??\c:\xrfxfxl.exec:\xrfxfxl.exe120⤵PID:2768
-
\??\c:\7hntbb.exec:\7hntbb.exe121⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-