Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe
-
Size
453KB
-
MD5
b6069f55293d90d8180456273010b670
-
SHA1
c6d4b9564ad3268bad75abcd8107e0c26e533cdf
-
SHA256
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357
-
SHA512
7efc6d8cfbd4e49b78e3e74e1188be415a0e2cce1a189b355ea11d06970c6353feb3b5e64632125c8338b418afd0b40a3b0727c1cf0f95e8925eb297305da64e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2080-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-109-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2676-107-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2800-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/292-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/736-266-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-289-0x0000000077530000-0x000000007764F000-memory.dmp family_blackmoon behavioral1/memory/2140-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-380-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1984-385-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/484-406-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1376-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-433-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-495-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1792-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-577-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-586-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2172-619-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-664-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2204-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-698-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/860-713-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-863-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1920-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-893-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 9pddp.exe 1916 lxlrxrr.exe 2256 9bntbb.exe 2796 5dvvd.exe 2864 3dvdp.exe 2184 lllrxfl.exe 2732 jjjjv.exe 2892 9ffrlrx.exe 2624 ddvdj.exe 2876 nnbhtt.exe 2676 5nhnbn.exe 2228 vvjjp.exe 2800 tbhnbh.exe 588 nhbbhh.exe 2828 7rlxxfl.exe 1112 nhnntt.exe 1448 tbnntt.exe 692 vvddp.exe 1484 rfrxllr.exe 2932 xfflrxx.exe 580 dpddj.exe 2144 5fxrxlr.exe 292 bthntb.exe 1244 5ddjj.exe 308 tbnbnb.exe 1532 rrrrxrx.exe 2088 hnhtbt.exe 1716 jpdvd.exe 736 ffrrlll.exe 3064 djpjj.exe 1764 vpvvv.exe 1136 llllrrr.exe 2324 5pdjj.exe 1920 1pddd.exe 2172 rrxxlrr.exe 2000 tnnnhh.exe 2140 dddjv.exe 2880 ddjjp.exe 2852 xrxffll.exe 2708 9lxxffl.exe 3020 bbhhnn.exe 2760 vvvvp.exe 2628 9djjd.exe 2844 xflffxf.exe 2604 7hthnh.exe 1984 ttbnnh.exe 2676 vpvdp.exe 1072 5frllrx.exe 484 lfrrxff.exe 1132 ttbttn.exe 1284 pdddp.exe 1376 xllrxxf.exe 1356 lxlrflr.exe 576 nntnbt.exe 1576 9jvdd.exe 1528 dddpp.exe 2952 xllrxxf.exe 2696 9bnhnb.exe 2116 vvdjp.exe 2640 pjppp.exe 1420 ffllrrf.exe 560 1hbhth.exe 1792 jvjvd.exe 3056 7ddvd.exe -
resource yara_rule behavioral1/memory/2080-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-54-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/736-268-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1764-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-289-0x0000000077530000-0x000000007764F000-memory.dmp upx behavioral1/memory/1592-296-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2140-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-380-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/484-406-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1376-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-480-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1420-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-713-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2936-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-854-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-871-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2564 2080 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 2080 wrote to memory of 2564 2080 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 2080 wrote to memory of 2564 2080 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 2080 wrote to memory of 2564 2080 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 2564 wrote to memory of 1916 2564 9pddp.exe 31 PID 2564 wrote to memory of 1916 2564 9pddp.exe 31 PID 2564 wrote to memory of 1916 2564 9pddp.exe 31 PID 2564 wrote to memory of 1916 2564 9pddp.exe 31 PID 1916 wrote to memory of 2256 1916 lxlrxrr.exe 32 PID 1916 wrote to memory of 2256 1916 lxlrxrr.exe 32 PID 1916 wrote to memory of 2256 1916 lxlrxrr.exe 32 PID 1916 wrote to memory of 2256 1916 lxlrxrr.exe 32 PID 2256 wrote to memory of 2796 2256 9bntbb.exe 33 PID 2256 wrote to memory of 2796 2256 9bntbb.exe 33 PID 2256 wrote to memory of 2796 2256 9bntbb.exe 33 PID 2256 wrote to memory of 2796 2256 9bntbb.exe 33 PID 2796 wrote to memory of 2864 2796 5dvvd.exe 34 PID 2796 wrote to memory of 2864 2796 5dvvd.exe 34 PID 2796 wrote to memory of 2864 2796 5dvvd.exe 34 PID 2796 wrote to memory of 2864 2796 5dvvd.exe 34 PID 2864 wrote to memory of 2184 2864 3dvdp.exe 35 PID 2864 wrote to memory of 2184 2864 3dvdp.exe 35 PID 2864 wrote to memory of 2184 2864 3dvdp.exe 35 PID 2864 wrote to memory of 2184 2864 3dvdp.exe 35 PID 2184 wrote to memory of 2732 2184 lllrxfl.exe 36 PID 2184 wrote to memory of 2732 2184 lllrxfl.exe 36 PID 2184 wrote to memory of 2732 2184 lllrxfl.exe 36 PID 2184 wrote to memory of 2732 2184 lllrxfl.exe 36 PID 2732 wrote to memory of 2892 2732 jjjjv.exe 37 PID 2732 wrote to memory of 2892 2732 jjjjv.exe 37 PID 2732 wrote to memory of 2892 2732 jjjjv.exe 37 PID 2732 wrote to memory of 2892 2732 jjjjv.exe 37 PID 2892 wrote to memory of 2624 2892 9ffrlrx.exe 38 PID 2892 wrote to memory of 2624 2892 9ffrlrx.exe 38 PID 2892 wrote to memory of 2624 2892 9ffrlrx.exe 38 PID 2892 wrote to memory of 2624 2892 9ffrlrx.exe 38 PID 2624 wrote to memory of 2876 2624 ddvdj.exe 39 PID 2624 wrote to memory of 2876 2624 ddvdj.exe 39 PID 2624 wrote to memory of 2876 2624 ddvdj.exe 39 PID 2624 wrote to memory of 2876 2624 ddvdj.exe 39 PID 2876 wrote to memory of 2676 2876 nnbhtt.exe 40 PID 2876 wrote to memory of 2676 2876 nnbhtt.exe 40 PID 2876 wrote to memory of 2676 2876 nnbhtt.exe 40 PID 2876 wrote to memory of 2676 2876 nnbhtt.exe 40 PID 2676 wrote to memory of 2228 2676 5nhnbn.exe 41 PID 2676 wrote to memory of 2228 2676 5nhnbn.exe 41 PID 2676 wrote to memory of 2228 2676 5nhnbn.exe 41 PID 2676 wrote to memory of 2228 2676 5nhnbn.exe 41 PID 2228 wrote to memory of 2800 2228 vvjjp.exe 42 PID 2228 wrote to memory of 2800 2228 vvjjp.exe 42 PID 2228 wrote to memory of 2800 2228 vvjjp.exe 42 PID 2228 wrote to memory of 2800 2228 vvjjp.exe 42 PID 2800 wrote to memory of 588 2800 tbhnbh.exe 43 PID 2800 wrote to memory of 588 2800 tbhnbh.exe 43 PID 2800 wrote to memory of 588 2800 tbhnbh.exe 43 PID 2800 wrote to memory of 588 2800 tbhnbh.exe 43 PID 588 wrote to memory of 2828 588 nhbbhh.exe 44 PID 588 wrote to memory of 2828 588 nhbbhh.exe 44 PID 588 wrote to memory of 2828 588 nhbbhh.exe 44 PID 588 wrote to memory of 2828 588 nhbbhh.exe 44 PID 2828 wrote to memory of 1112 2828 7rlxxfl.exe 45 PID 2828 wrote to memory of 1112 2828 7rlxxfl.exe 45 PID 2828 wrote to memory of 1112 2828 7rlxxfl.exe 45 PID 2828 wrote to memory of 1112 2828 7rlxxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe"C:\Users\Admin\AppData\Local\Temp\a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\9pddp.exec:\9pddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\lxlrxrr.exec:\lxlrxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\9bntbb.exec:\9bntbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\5dvvd.exec:\5dvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3dvdp.exec:\3dvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lllrxfl.exec:\lllrxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jjjjv.exec:\jjjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\9ffrlrx.exec:\9ffrlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ddvdj.exec:\ddvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nnbhtt.exec:\nnbhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\5nhnbn.exec:\5nhnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vvjjp.exec:\vvjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\tbhnbh.exec:\tbhnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nhbbhh.exec:\nhbbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\7rlxxfl.exec:\7rlxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nhnntt.exec:\nhnntt.exe17⤵
- Executes dropped EXE
PID:1112 -
\??\c:\tbnntt.exec:\tbnntt.exe18⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vvddp.exec:\vvddp.exe19⤵
- Executes dropped EXE
PID:692 -
\??\c:\rfrxllr.exec:\rfrxllr.exe20⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xfflrxx.exec:\xfflrxx.exe21⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dpddj.exec:\dpddj.exe22⤵
- Executes dropped EXE
PID:580 -
\??\c:\5fxrxlr.exec:\5fxrxlr.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bthntb.exec:\bthntb.exe24⤵
- Executes dropped EXE
PID:292 -
\??\c:\5ddjj.exec:\5ddjj.exe25⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tbnbnb.exec:\tbnbnb.exe26⤵
- Executes dropped EXE
PID:308 -
\??\c:\rrrrxrx.exec:\rrrrxrx.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hnhtbt.exec:\hnhtbt.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jpdvd.exec:\jpdvd.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ffrrlll.exec:\ffrrlll.exe30⤵
- Executes dropped EXE
PID:736 -
\??\c:\djpjj.exec:\djpjj.exe31⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vpvvv.exec:\vpvvv.exe32⤵
- Executes dropped EXE
PID:1764 -
\??\c:\llllrrr.exec:\llllrrr.exe33⤵
- Executes dropped EXE
PID:1136 -
\??\c:\ppppj.exec:\ppppj.exe34⤵PID:1592
-
\??\c:\5pdjj.exec:\5pdjj.exe35⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1pddd.exec:\1pddd.exe36⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rrxxlrr.exec:\rrxxlrr.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnnnhh.exec:\tnnnhh.exe38⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dddjv.exec:\dddjv.exe39⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ddjjp.exec:\ddjjp.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrxffll.exec:\xrxffll.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9lxxffl.exec:\9lxxffl.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bbhhnn.exec:\bbhhnn.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvvvp.exec:\vvvvp.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9djjd.exec:\9djjd.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xflffxf.exec:\xflffxf.exe46⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7hthnh.exec:\7hthnh.exe47⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ttbnnh.exec:\ttbnnh.exe48⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vpvdp.exec:\vpvdp.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5frllrx.exec:\5frllrx.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\lfrrxff.exec:\lfrrxff.exe51⤵
- Executes dropped EXE
PID:484 -
\??\c:\ttbttn.exec:\ttbttn.exe52⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pdddp.exec:\pdddp.exe53⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xllrxxf.exec:\xllrxxf.exe54⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lxlrflr.exec:\lxlrflr.exe55⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nntnbt.exec:\nntnbt.exe56⤵
- Executes dropped EXE
PID:576 -
\??\c:\9jvdd.exec:\9jvdd.exe57⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dddpp.exec:\dddpp.exe58⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xllrxxf.exec:\xllrxxf.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9bnhnb.exec:\9bnhnb.exe60⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vvdjp.exec:\vvdjp.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pjppp.exec:\pjppp.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\ffllrrf.exec:\ffllrrf.exe63⤵
- Executes dropped EXE
PID:1420 -
\??\c:\1hbhth.exec:\1hbhth.exe64⤵
- Executes dropped EXE
PID:560 -
\??\c:\jvjvd.exec:\jvjvd.exe65⤵
- Executes dropped EXE
PID:1792 -
\??\c:\7ddvd.exec:\7ddvd.exe66⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rxllrxf.exec:\rxllrxf.exe67⤵PID:2460
-
\??\c:\ntntbt.exec:\ntntbt.exe68⤵PID:2276
-
\??\c:\pjjdd.exec:\pjjdd.exe69⤵PID:1912
-
\??\c:\9lxflff.exec:\9lxflff.exe70⤵PID:2196
-
\??\c:\lrxlxff.exec:\lrxlxff.exe71⤵PID:2340
-
\??\c:\5ntthn.exec:\5ntthn.exe72⤵PID:2792
-
\??\c:\jdjvd.exec:\jdjvd.exe73⤵PID:2404
-
\??\c:\9pjjd.exec:\9pjjd.exe74⤵PID:1764
-
\??\c:\rxllxrx.exec:\rxllxrx.exe75⤵PID:1600
-
\??\c:\ntttbt.exec:\ntttbt.exe76⤵PID:1592
-
\??\c:\vpdvj.exec:\vpdvj.exe77⤵PID:2392
-
\??\c:\ppjpp.exec:\ppjpp.exe78⤵PID:1828
-
\??\c:\ffrxllr.exec:\ffrxllr.exe79⤵PID:2172
-
\??\c:\hbbbtt.exec:\hbbbtt.exe80⤵PID:2868
-
\??\c:\5pjjp.exec:\5pjjp.exe81⤵PID:3028
-
\??\c:\jddvv.exec:\jddvv.exe82⤵PID:2864
-
\??\c:\llxxxfl.exec:\llxxxfl.exe83⤵PID:2716
-
\??\c:\5bhhht.exec:\5bhhht.exe84⤵PID:2928
-
\??\c:\nnnttt.exec:\nnnttt.exe85⤵PID:2788
-
\??\c:\9vpjj.exec:\9vpjj.exe86⤵PID:2736
-
\??\c:\xxlrrfr.exec:\xxlrrfr.exe87⤵PID:2624
-
\??\c:\lfxxflr.exec:\lfxxflr.exe88⤵PID:2876
-
\??\c:\nttbbn.exec:\nttbbn.exe89⤵PID:2024
-
\??\c:\7dppv.exec:\7dppv.exe90⤵PID:2204
-
\??\c:\5xlllrr.exec:\5xlllrr.exe91⤵PID:2816
-
\??\c:\xrxrfff.exec:\xrxrfff.exe92⤵PID:588
-
\??\c:\3bnthn.exec:\3bnthn.exe93⤵PID:2420
-
\??\c:\7vvvd.exec:\7vvvd.exe94⤵PID:1516
-
\??\c:\jvjpv.exec:\jvjpv.exe95⤵PID:836
-
\??\c:\lllrxxr.exec:\lllrxxr.exe96⤵PID:860
-
\??\c:\bbnhnn.exec:\bbnhnn.exe97⤵PID:1868
-
\??\c:\dvjjd.exec:\dvjjd.exe98⤵PID:1480
-
\??\c:\jjppv.exec:\jjppv.exe99⤵PID:2940
-
\??\c:\xfrflxx.exec:\xfrflxx.exe100⤵PID:2936
-
\??\c:\tttthn.exec:\tttthn.exe101⤵PID:2216
-
\??\c:\hbbhnt.exec:\hbbhnt.exe102⤵PID:2092
-
\??\c:\jpvdd.exec:\jpvdd.exe103⤵PID:2144
-
\??\c:\3rxlxrx.exec:\3rxlxrx.exe104⤵PID:1420
-
\??\c:\nntttb.exec:\nntttb.exe105⤵PID:608
-
\??\c:\5nnnhh.exec:\5nnnhh.exe106⤵PID:1676
-
\??\c:\jjjdd.exec:\jjjdd.exe107⤵PID:904
-
\??\c:\ffxrrfl.exec:\ffxrrfl.exe108⤵PID:2456
-
\??\c:\1htttt.exec:\1htttt.exe109⤵PID:2088
-
\??\c:\nnnhbt.exec:\nnnhbt.exe110⤵PID:2532
-
\??\c:\ddpvd.exec:\ddpvd.exe111⤵PID:2476
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe112⤵PID:736
-
\??\c:\xflllrx.exec:\xflllrx.exe113⤵PID:1084
-
\??\c:\1hnnnb.exec:\1hnnnb.exe114⤵PID:2032
-
\??\c:\vvjjp.exec:\vvjjp.exe115⤵PID:2112
-
\??\c:\7vjdv.exec:\7vjdv.exe116⤵PID:1892
-
\??\c:\xfxxxfr.exec:\xfxxxfr.exe117⤵PID:2680
-
\??\c:\nnbbhn.exec:\nnbbhn.exe118⤵PID:2372
-
\??\c:\bhnttb.exec:\bhnttb.exe119⤵PID:1920
-
\??\c:\9jddp.exec:\9jddp.exe120⤵PID:1828
-
\??\c:\rxlllll.exec:\rxlllll.exe121⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-