Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe
-
Size
453KB
-
MD5
b6069f55293d90d8180456273010b670
-
SHA1
c6d4b9564ad3268bad75abcd8107e0c26e533cdf
-
SHA256
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357
-
SHA512
7efc6d8cfbd4e49b78e3e74e1188be415a0e2cce1a189b355ea11d06970c6353feb3b5e64632125c8338b418afd0b40a3b0727c1cf0f95e8925eb297305da64e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1600-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-252-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-718-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/676-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-797-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1196-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-807-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 7jdvp.exe 1620 dvjvd.exe 1712 vjddj.exe 2244 3nbbhb.exe 2816 dvjjp.exe 2724 ttnhnn.exe 2936 9ppdd.exe 2708 rrfrlxf.exe 2612 bbntbh.exe 2740 lfrrrrx.exe 3068 lfrxxlr.exe 1792 jjpdj.exe 1260 5vddd.exe 2872 xrflxxf.exe 2928 5nhhhh.exe 1752 9rflrff.exe 1732 hthhtt.exe 2500 nbthnn.exe 2148 jddpd.exe 2176 frflrrr.exe 1508 bntbbn.exe 936 vvdvv.exe 1768 xllfflr.exe 1904 hthhtn.exe 1376 jdpvd.exe 2440 jvjdj.exe 2312 lfxxlfx.exe 888 1bnhnn.exe 2064 3jvdp.exe 2904 lxllrrf.exe 2252 3nnntt.exe 1584 vpdvj.exe 2524 5dppd.exe 2372 fxlfrrx.exe 2520 tnbbnt.exe 2396 vvdpj.exe 576 7vddd.exe 2888 flfxlxr.exe 2820 bnttbb.exe 2980 hbthtt.exe 2188 9pdjp.exe 2756 jvjdj.exe 2608 7xfllff.exe 1172 1bhtbb.exe 1656 nnhnnn.exe 2732 7pppp.exe 2884 jvjjv.exe 2152 rfxfllr.exe 1520 rlxxlfl.exe 900 3nhtbt.exe 2720 tthnnt.exe 300 3jdvj.exe 1044 1lffxrx.exe 2136 xlfffxf.exe 1164 nhhnbt.exe 2496 nbhnnn.exe 2272 5jddd.exe 1964 jjpdv.exe 772 rfrrxxf.exe 1088 fxfflrf.exe 1968 hthbbt.exe 2376 3hbhnn.exe 1780 pjddd.exe 560 xrfxxfl.exe -
resource yara_rule behavioral1/memory/1600-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-991-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2972 1600 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 1600 wrote to memory of 2972 1600 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 1600 wrote to memory of 2972 1600 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 1600 wrote to memory of 2972 1600 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 30 PID 2972 wrote to memory of 1620 2972 7jdvp.exe 31 PID 2972 wrote to memory of 1620 2972 7jdvp.exe 31 PID 2972 wrote to memory of 1620 2972 7jdvp.exe 31 PID 2972 wrote to memory of 1620 2972 7jdvp.exe 31 PID 1620 wrote to memory of 1712 1620 dvjvd.exe 32 PID 1620 wrote to memory of 1712 1620 dvjvd.exe 32 PID 1620 wrote to memory of 1712 1620 dvjvd.exe 32 PID 1620 wrote to memory of 1712 1620 dvjvd.exe 32 PID 1712 wrote to memory of 2244 1712 vjddj.exe 33 PID 1712 wrote to memory of 2244 1712 vjddj.exe 33 PID 1712 wrote to memory of 2244 1712 vjddj.exe 33 PID 1712 wrote to memory of 2244 1712 vjddj.exe 33 PID 2244 wrote to memory of 2816 2244 3nbbhb.exe 34 PID 2244 wrote to memory of 2816 2244 3nbbhb.exe 34 PID 2244 wrote to memory of 2816 2244 3nbbhb.exe 34 PID 2244 wrote to memory of 2816 2244 3nbbhb.exe 34 PID 2816 wrote to memory of 2724 2816 dvjjp.exe 35 PID 2816 wrote to memory of 2724 2816 dvjjp.exe 35 PID 2816 wrote to memory of 2724 2816 dvjjp.exe 35 PID 2816 wrote to memory of 2724 2816 dvjjp.exe 35 PID 2724 wrote to memory of 2936 2724 ttnhnn.exe 36 PID 2724 wrote to memory of 2936 2724 ttnhnn.exe 36 PID 2724 wrote to memory of 2936 2724 ttnhnn.exe 36 PID 2724 wrote to memory of 2936 2724 ttnhnn.exe 36 PID 2936 wrote to memory of 2708 2936 9ppdd.exe 37 PID 2936 wrote to memory of 2708 2936 9ppdd.exe 37 PID 2936 wrote to memory of 2708 2936 9ppdd.exe 37 PID 2936 wrote to memory of 2708 2936 9ppdd.exe 37 PID 2708 wrote to memory of 2612 2708 rrfrlxf.exe 38 PID 2708 wrote to memory of 2612 2708 rrfrlxf.exe 38 PID 2708 wrote to memory of 2612 2708 rrfrlxf.exe 38 PID 2708 wrote to memory of 2612 2708 rrfrlxf.exe 38 PID 2612 wrote to memory of 2740 2612 bbntbh.exe 39 PID 2612 wrote to memory of 2740 2612 bbntbh.exe 39 PID 2612 wrote to memory of 2740 2612 bbntbh.exe 39 PID 2612 wrote to memory of 2740 2612 bbntbh.exe 39 PID 2740 wrote to memory of 3068 2740 lfrrrrx.exe 40 PID 2740 wrote to memory of 3068 2740 lfrrrrx.exe 40 PID 2740 wrote to memory of 3068 2740 lfrrrrx.exe 40 PID 2740 wrote to memory of 3068 2740 lfrrrrx.exe 40 PID 3068 wrote to memory of 1792 3068 lfrxxlr.exe 41 PID 3068 wrote to memory of 1792 3068 lfrxxlr.exe 41 PID 3068 wrote to memory of 1792 3068 lfrxxlr.exe 41 PID 3068 wrote to memory of 1792 3068 lfrxxlr.exe 41 PID 1792 wrote to memory of 1260 1792 jjpdj.exe 121 PID 1792 wrote to memory of 1260 1792 jjpdj.exe 121 PID 1792 wrote to memory of 1260 1792 jjpdj.exe 121 PID 1792 wrote to memory of 1260 1792 jjpdj.exe 121 PID 1260 wrote to memory of 2872 1260 5vddd.exe 43 PID 1260 wrote to memory of 2872 1260 5vddd.exe 43 PID 1260 wrote to memory of 2872 1260 5vddd.exe 43 PID 1260 wrote to memory of 2872 1260 5vddd.exe 43 PID 2872 wrote to memory of 2928 2872 xrflxxf.exe 44 PID 2872 wrote to memory of 2928 2872 xrflxxf.exe 44 PID 2872 wrote to memory of 2928 2872 xrflxxf.exe 44 PID 2872 wrote to memory of 2928 2872 xrflxxf.exe 44 PID 2928 wrote to memory of 1752 2928 5nhhhh.exe 45 PID 2928 wrote to memory of 1752 2928 5nhhhh.exe 45 PID 2928 wrote to memory of 1752 2928 5nhhhh.exe 45 PID 2928 wrote to memory of 1752 2928 5nhhhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe"C:\Users\Admin\AppData\Local\Temp\a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\7jdvp.exec:\7jdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\dvjvd.exec:\dvjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vjddj.exec:\vjddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\3nbbhb.exec:\3nbbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\dvjjp.exec:\dvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ttnhnn.exec:\ttnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9ppdd.exec:\9ppdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\rrfrlxf.exec:\rrfrlxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bbntbh.exec:\bbntbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lfrxxlr.exec:\lfrxxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\jjpdj.exec:\jjpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\5vddd.exec:\5vddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\xrflxxf.exec:\xrflxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\5nhhhh.exec:\5nhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\9rflrff.exec:\9rflrff.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hthhtt.exec:\hthhtt.exe18⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nbthnn.exec:\nbthnn.exe19⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jddpd.exec:\jddpd.exe20⤵
- Executes dropped EXE
PID:2148 -
\??\c:\frflrrr.exec:\frflrrr.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bntbbn.exec:\bntbbn.exe22⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vvdvv.exec:\vvdvv.exe23⤵
- Executes dropped EXE
PID:936 -
\??\c:\xllfflr.exec:\xllfflr.exe24⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hthhtn.exec:\hthhtn.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdpvd.exec:\jdpvd.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jvjdj.exec:\jvjdj.exe27⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lfxxlfx.exec:\lfxxlfx.exe28⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1bnhnn.exec:\1bnhnn.exe29⤵
- Executes dropped EXE
PID:888 -
\??\c:\3jvdp.exec:\3jvdp.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lxllrrf.exec:\lxllrrf.exe31⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3nnntt.exec:\3nnntt.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vpdvj.exec:\vpdvj.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5dppd.exec:\5dppd.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tnbbnt.exec:\tnbbnt.exe36⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vvdpj.exec:\vvdpj.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7vddd.exec:\7vddd.exe38⤵
- Executes dropped EXE
PID:576 -
\??\c:\flfxlxr.exec:\flfxlxr.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bnttbb.exec:\bnttbb.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hbthtt.exec:\hbthtt.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9pdjp.exec:\9pdjp.exe42⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jvjdj.exec:\jvjdj.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7xfllff.exec:\7xfllff.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1bhtbb.exec:\1bhtbb.exe45⤵
- Executes dropped EXE
PID:1172 -
\??\c:\nnhnnn.exec:\nnhnnn.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7pppp.exec:\7pppp.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jvjjv.exec:\jvjjv.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rfxfllr.exec:\rfxfllr.exe49⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rlxxlfl.exec:\rlxxlfl.exe50⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3nhtbt.exec:\3nhtbt.exe51⤵
- Executes dropped EXE
PID:900 -
\??\c:\tthnnt.exec:\tthnnt.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3jdvj.exec:\3jdvj.exe53⤵
- Executes dropped EXE
PID:300 -
\??\c:\1lffxrx.exec:\1lffxrx.exe54⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xlfffxf.exec:\xlfffxf.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nhhnbt.exec:\nhhnbt.exe56⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nbhnnn.exec:\nbhnnn.exe57⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5jddd.exec:\5jddd.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jjpdv.exec:\jjpdv.exe59⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe60⤵
- Executes dropped EXE
PID:772 -
\??\c:\fxfflrf.exec:\fxfflrf.exe61⤵
- Executes dropped EXE
PID:1088 -
\??\c:\hthbbt.exec:\hthbbt.exe62⤵
- Executes dropped EXE
PID:1968 -
\??\c:\3hbhnn.exec:\3hbhnn.exe63⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pjddd.exec:\pjddd.exe64⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xrfxxfl.exec:\xrfxxfl.exe65⤵
- Executes dropped EXE
PID:560 -
\??\c:\lfxxllr.exec:\lfxxllr.exe66⤵PID:1376
-
\??\c:\tnbbhh.exec:\tnbbhh.exe67⤵PID:1196
-
\??\c:\5thntb.exec:\5thntb.exe68⤵PID:2424
-
\??\c:\jdddd.exec:\jdddd.exe69⤵PID:1912
-
\??\c:\3jppv.exec:\3jppv.exe70⤵PID:2392
-
\??\c:\rlrrrll.exec:\rlrrrll.exe71⤵PID:896
-
\??\c:\lfxfffl.exec:\lfxfffl.exe72⤵PID:2256
-
\??\c:\nhbthb.exec:\nhbthb.exe73⤵PID:1580
-
\??\c:\nhbnhn.exec:\nhbnhn.exe74⤵PID:1560
-
\??\c:\3pvpp.exec:\3pvpp.exe75⤵PID:2552
-
\??\c:\jdjpv.exec:\jdjpv.exe76⤵PID:1776
-
\??\c:\frffllr.exec:\frffllr.exe77⤵PID:2808
-
\??\c:\frxxlrx.exec:\frxxlrx.exe78⤵PID:2520
-
\??\c:\5nbthh.exec:\5nbthh.exe79⤵PID:2900
-
\??\c:\jvdjp.exec:\jvdjp.exe80⤵PID:2108
-
\??\c:\ppvvj.exec:\ppvvj.exe81⤵PID:1836
-
\??\c:\ddvvd.exec:\ddvvd.exe82⤵PID:2984
-
\??\c:\9rfllrf.exec:\9rfllrf.exe83⤵PID:2724
-
\??\c:\bbnnnb.exec:\bbnnnb.exe84⤵PID:2836
-
\??\c:\hhtntn.exec:\hhtntn.exe85⤵PID:2896
-
\??\c:\dpvvd.exec:\dpvvd.exe86⤵PID:2792
-
\??\c:\7dvvd.exec:\7dvvd.exe87⤵PID:2624
-
\??\c:\llxllfl.exec:\llxllfl.exe88⤵PID:3064
-
\??\c:\3httbb.exec:\3httbb.exe89⤵PID:2644
-
\??\c:\3thhhb.exec:\3thhhb.exe90⤵PID:2324
-
\??\c:\jvdjv.exec:\jvdjv.exe91⤵PID:872
-
\??\c:\xrllrrl.exec:\xrllrrl.exe92⤵PID:856
-
\??\c:\ffrflll.exec:\ffrflll.exe93⤵PID:1260
-
\??\c:\3bnbth.exec:\3bnbth.exe94⤵PID:848
-
\??\c:\5hbnnt.exec:\5hbnnt.exe95⤵PID:900
-
\??\c:\1flffrx.exec:\1flffrx.exe96⤵PID:768
-
\??\c:\pdddd.exec:\pdddd.exe97⤵PID:2452
-
\??\c:\vjvdj.exec:\vjvdj.exe98⤵PID:2480
-
\??\c:\thnntt.exec:\thnntt.exe99⤵PID:1756
-
\??\c:\jvjvv.exec:\jvjvv.exe100⤵PID:2560
-
\??\c:\bnhbhn.exec:\bnhbhn.exe101⤵PID:2500
-
\??\c:\5dppv.exec:\5dppv.exe102⤵PID:2208
-
\??\c:\rrfrrrr.exec:\rrfrrrr.exe103⤵PID:676
-
\??\c:\thnhhb.exec:\thnhhb.exe104⤵PID:704
-
\??\c:\jjjjv.exec:\jjjjv.exe105⤵PID:1820
-
\??\c:\llxflfl.exec:\llxflfl.exe106⤵PID:1768
-
\??\c:\hbhntt.exec:\hbhntt.exe107⤵PID:1356
-
\??\c:\jdddv.exec:\jdddv.exe108⤵PID:880
-
\??\c:\rxlfllr.exec:\rxlfllr.exe109⤵PID:324
-
\??\c:\9tnnnn.exec:\9tnnnn.exe110⤵PID:2248
-
\??\c:\djdjd.exec:\djdjd.exe111⤵PID:1196
-
\??\c:\xlrllxx.exec:\xlrllxx.exe112⤵PID:888
-
\??\c:\5pjpv.exec:\5pjpv.exe113⤵PID:1596
-
\??\c:\5dpjj.exec:\5dpjj.exe114⤵PID:1536
-
\??\c:\rrxxfff.exec:\rrxxfff.exe115⤵PID:2992
-
\??\c:\5jvjd.exec:\5jvjd.exe116⤵PID:1592
-
\??\c:\rffxllr.exec:\rffxllr.exe117⤵PID:1672
-
\??\c:\ntnbnn.exec:\ntnbnn.exe118⤵PID:1676
-
\??\c:\ppjpv.exec:\ppjpv.exe119⤵PID:1740
-
\??\c:\3rlflfx.exec:\3rlflfx.exe120⤵PID:2860
-
\??\c:\xlfllll.exec:\xlfllll.exe121⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-