Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe
-
Size
456KB
-
MD5
7aeb93f5cb8385c002a3bb03081a4680
-
SHA1
a268e9a3e11008bf1c20e19224e9654ad4d15000
-
SHA256
c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2c
-
SHA512
05357d1f34f3717502eac809122dca827ff57f431efbc1e6e0073f7b9571807b62d161efa85be633f728c1c3b5df9181003d5340e027e92b89ab16f7e6797fd0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRg:q7Tc2NYHUrAwfMp3CDRg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2792-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-12-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2200-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-74-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2544-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-123-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2876-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-133-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2380-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1440-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-163-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1980-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-272-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2100-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-300-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2392-304-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2900-322-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-381-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2880-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-436-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1652-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-486-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-677-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-737-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-758-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2280-887-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-987-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2860 frrfxxl.exe 2200 hthnhh.exe 1812 9lrlffr.exe 2888 btbbtt.exe 1660 vjjdd.exe 2616 5rrfxxx.exe 2544 tbnhtt.exe 2800 5pvvv.exe 2144 vjvpj.exe 2652 nnnnhh.exe 2600 htbbbt.exe 2448 7lrlrll.exe 2876 1hbbbt.exe 2380 pjdvd.exe 1200 xflffxx.exe 1440 3bbtnn.exe 1980 rxlfxxl.exe 2216 3rxfflx.exe 2044 tbbttn.exe 1260 3vdpp.exe 2736 lxffxxx.exe 2764 hbhttn.exe 1580 pvdvp.exe 996 xlrrrrr.exe 2476 bnbntn.exe 2056 rflfflr.exe 1140 tthntb.exe 2100 7frxxxf.exe 3048 fxlrxrx.exe 2984 ppddj.exe 1240 5lxxxrx.exe 2392 9jvjp.exe 2848 pdjdd.exe 2900 bbnntt.exe 1912 hbnbnt.exe 2284 pdvdp.exe 2708 rflllll.exe 2888 5rfffxx.exe 1648 bbnntt.exe 1660 dpjpv.exe 2264 jjvvj.exe 2668 lrffrrl.exe 2800 hbhhtt.exe 2640 pjvdd.exe 2524 3vpvv.exe 2680 ffxxxxx.exe 2444 nbtthh.exe 2488 3jvdv.exe 2440 rlxxxxf.exe 2880 rlxrfxl.exe 2876 5tnhhn.exe 344 pjddj.exe 808 5xrxfll.exe 1652 1xllrrx.exe 1440 hthhtb.exe 1456 jddjv.exe 2248 dvjdd.exe 2004 lflxffr.exe 1264 httbbh.exe 2340 hbthnb.exe 2040 jdppp.exe 2760 lxlxxfr.exe 1716 hhtbbb.exe 2036 vpddv.exe -
resource yara_rule behavioral1/memory/2792-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-249-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2476-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-436-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1652-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-677-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2868-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-737-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1472-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-854-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1876-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-935-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2860 2792 c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe 28 PID 2792 wrote to memory of 2860 2792 c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe 28 PID 2792 wrote to memory of 2860 2792 c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe 28 PID 2792 wrote to memory of 2860 2792 c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe 28 PID 2860 wrote to memory of 2200 2860 frrfxxl.exe 29 PID 2860 wrote to memory of 2200 2860 frrfxxl.exe 29 PID 2860 wrote to memory of 2200 2860 frrfxxl.exe 29 PID 2860 wrote to memory of 2200 2860 frrfxxl.exe 29 PID 2200 wrote to memory of 1812 2200 hthnhh.exe 30 PID 2200 wrote to memory of 1812 2200 hthnhh.exe 30 PID 2200 wrote to memory of 1812 2200 hthnhh.exe 30 PID 2200 wrote to memory of 1812 2200 hthnhh.exe 30 PID 1812 wrote to memory of 2888 1812 9lrlffr.exe 31 PID 1812 wrote to memory of 2888 1812 9lrlffr.exe 31 PID 1812 wrote to memory of 2888 1812 9lrlffr.exe 31 PID 1812 wrote to memory of 2888 1812 9lrlffr.exe 31 PID 2888 wrote to memory of 1660 2888 btbbtt.exe 32 PID 2888 wrote to memory of 1660 2888 btbbtt.exe 32 PID 2888 wrote to memory of 1660 2888 btbbtt.exe 32 PID 2888 wrote to memory of 1660 2888 btbbtt.exe 32 PID 1660 wrote to memory of 2616 1660 vjjdd.exe 33 PID 1660 wrote to memory of 2616 1660 vjjdd.exe 33 PID 1660 wrote to memory of 2616 1660 vjjdd.exe 33 PID 1660 wrote to memory of 2616 1660 vjjdd.exe 33 PID 2616 wrote to memory of 2544 2616 5rrfxxx.exe 34 PID 2616 wrote to memory of 2544 2616 5rrfxxx.exe 34 PID 2616 wrote to memory of 2544 2616 5rrfxxx.exe 34 PID 2616 wrote to memory of 2544 2616 5rrfxxx.exe 34 PID 2544 wrote to memory of 2800 2544 tbnhtt.exe 35 PID 2544 wrote to memory of 2800 2544 tbnhtt.exe 35 PID 2544 wrote to memory of 2800 2544 tbnhtt.exe 35 PID 2544 wrote to memory of 2800 2544 tbnhtt.exe 35 PID 2800 wrote to memory of 2144 2800 5pvvv.exe 36 PID 2800 wrote to memory of 2144 2800 5pvvv.exe 36 PID 2800 wrote to memory of 2144 2800 5pvvv.exe 36 PID 2800 wrote to memory of 2144 2800 5pvvv.exe 36 PID 2144 wrote to memory of 2652 2144 vjvpj.exe 37 PID 2144 wrote to memory of 2652 2144 vjvpj.exe 37 PID 2144 wrote to memory of 2652 2144 vjvpj.exe 37 PID 2144 wrote to memory of 2652 2144 vjvpj.exe 37 PID 2652 wrote to memory of 2600 2652 nnnnhh.exe 38 PID 2652 wrote to memory of 2600 2652 nnnnhh.exe 38 PID 2652 wrote to memory of 2600 2652 nnnnhh.exe 38 PID 2652 wrote to memory of 2600 2652 nnnnhh.exe 38 PID 2600 wrote to memory of 2448 2600 htbbbt.exe 39 PID 2600 wrote to memory of 2448 2600 htbbbt.exe 39 PID 2600 wrote to memory of 2448 2600 htbbbt.exe 39 PID 2600 wrote to memory of 2448 2600 htbbbt.exe 39 PID 2448 wrote to memory of 2876 2448 7lrlrll.exe 40 PID 2448 wrote to memory of 2876 2448 7lrlrll.exe 40 PID 2448 wrote to memory of 2876 2448 7lrlrll.exe 40 PID 2448 wrote to memory of 2876 2448 7lrlrll.exe 40 PID 2876 wrote to memory of 2380 2876 1hbbbt.exe 41 PID 2876 wrote to memory of 2380 2876 1hbbbt.exe 41 PID 2876 wrote to memory of 2380 2876 1hbbbt.exe 41 PID 2876 wrote to memory of 2380 2876 1hbbbt.exe 41 PID 2380 wrote to memory of 1200 2380 pjdvd.exe 42 PID 2380 wrote to memory of 1200 2380 pjdvd.exe 42 PID 2380 wrote to memory of 1200 2380 pjdvd.exe 42 PID 2380 wrote to memory of 1200 2380 pjdvd.exe 42 PID 1200 wrote to memory of 1440 1200 xflffxx.exe 43 PID 1200 wrote to memory of 1440 1200 xflffxx.exe 43 PID 1200 wrote to memory of 1440 1200 xflffxx.exe 43 PID 1200 wrote to memory of 1440 1200 xflffxx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe"C:\Users\Admin\AppData\Local\Temp\c1b25b1371913b22cbba844d9ac8cd5d844e98fc4826eadfb9740f708a4a6d2cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\frrfxxl.exec:\frrfxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\hthnhh.exec:\hthnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\9lrlffr.exec:\9lrlffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\btbbtt.exec:\btbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vjjdd.exec:\vjjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\5rrfxxx.exec:\5rrfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tbnhtt.exec:\tbnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\5pvvv.exec:\5pvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\vjvpj.exec:\vjvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nnnnhh.exec:\nnnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\htbbbt.exec:\htbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7lrlrll.exec:\7lrlrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\1hbbbt.exec:\1hbbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pjdvd.exec:\pjdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\xflffxx.exec:\xflffxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\3bbtnn.exec:\3bbtnn.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rxlfxxl.exec:\rxlfxxl.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3rxfflx.exec:\3rxfflx.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tbbttn.exec:\tbbttn.exe20⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3vdpp.exec:\3vdpp.exe21⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lxffxxx.exec:\lxffxxx.exe22⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hbhttn.exec:\hbhttn.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pvdvp.exec:\pvdvp.exe24⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe25⤵
- Executes dropped EXE
PID:996 -
\??\c:\bnbntn.exec:\bnbntn.exe26⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rflfflr.exec:\rflfflr.exe27⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tthntb.exec:\tthntb.exe28⤵
- Executes dropped EXE
PID:1140 -
\??\c:\7frxxxf.exec:\7frxxxf.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ppddj.exec:\ppddj.exe31⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5lxxxrx.exec:\5lxxxrx.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9jvjp.exec:\9jvjp.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pdjdd.exec:\pdjdd.exe34⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbnntt.exec:\bbnntt.exe35⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbnbnt.exec:\hbnbnt.exe36⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pdvdp.exec:\pdvdp.exe37⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rflllll.exec:\rflllll.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5rfffxx.exec:\5rfffxx.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bbnntt.exec:\bbnntt.exe40⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dpjpv.exec:\dpjpv.exe41⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jjvvj.exec:\jjvvj.exe42⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lrffrrl.exec:\lrffrrl.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hbhhtt.exec:\hbhhtt.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjvdd.exec:\pjvdd.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3vpvv.exec:\3vpvv.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nbtthh.exec:\nbtthh.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3jvdv.exec:\3jvdv.exe49⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rlxrfxl.exec:\rlxrfxl.exe51⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5tnhhn.exec:\5tnhhn.exe52⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjddj.exec:\pjddj.exe53⤵
- Executes dropped EXE
PID:344 -
\??\c:\5xrxfll.exec:\5xrxfll.exe54⤵
- Executes dropped EXE
PID:808 -
\??\c:\1xllrrx.exec:\1xllrrx.exe55⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hthhtb.exec:\hthhtb.exe56⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jddjv.exec:\jddjv.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\dvjdd.exec:\dvjdd.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lflxffr.exec:\lflxffr.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\httbbh.exec:\httbbh.exe60⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hbthnb.exec:\hbthnb.exe61⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jdppp.exec:\jdppp.exe62⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lxlxxfr.exec:\lxlxxfr.exe63⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hhtbbb.exec:\hhtbbb.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vpddv.exec:\vpddv.exe65⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pjvpd.exec:\pjvpd.exe66⤵PID:1484
-
\??\c:\7xlxrrl.exec:\7xlxrrl.exe67⤵PID:1700
-
\??\c:\1ntnhh.exec:\1ntnhh.exe68⤵PID:1864
-
\??\c:\jvddd.exec:\jvddd.exe69⤵PID:1452
-
\??\c:\jvppj.exec:\jvppj.exe70⤵PID:824
-
\??\c:\frfrrlf.exec:\frfrrlf.exe71⤵PID:3020
-
\??\c:\bnbhtn.exec:\bnbhtn.exe72⤵PID:2100
-
\??\c:\thbbbt.exec:\thbbbt.exe73⤵PID:1500
-
\??\c:\1vppp.exec:\1vppp.exe74⤵PID:2976
-
\??\c:\lflfffl.exec:\lflfffl.exe75⤵PID:896
-
\??\c:\9bthnn.exec:\9bthnn.exe76⤵PID:1240
-
\??\c:\jdpvv.exec:\jdpvv.exe77⤵PID:1496
-
\??\c:\ddpvd.exec:\ddpvd.exe78⤵PID:2908
-
\??\c:\rlxfxxr.exec:\rlxfxxr.exe79⤵PID:2912
-
\??\c:\nnhthn.exec:\nnhthn.exe80⤵PID:340
-
\??\c:\3nbbbt.exec:\3nbbbt.exe81⤵PID:1812
-
\??\c:\jpvvd.exec:\jpvvd.exe82⤵PID:1916
-
\??\c:\lrffxxf.exec:\lrffxxf.exe83⤵PID:1612
-
\??\c:\xrflrrr.exec:\xrflrrr.exe84⤵PID:1884
-
\??\c:\9nhbbb.exec:\9nhbbb.exe85⤵PID:1676
-
\??\c:\pjppj.exec:\pjppj.exe86⤵PID:2160
-
\??\c:\1lfxffx.exec:\1lfxffx.exe87⤵PID:2672
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe88⤵PID:2684
-
\??\c:\hthbhh.exec:\hthbhh.exe89⤵PID:2624
-
\??\c:\pjdjp.exec:\pjdjp.exe90⤵PID:2144
-
\??\c:\pjvvj.exec:\pjvvj.exe91⤵PID:2608
-
\??\c:\rflrxfl.exec:\rflrxfl.exe92⤵PID:2480
-
\??\c:\3thbbh.exec:\3thbbh.exe93⤵PID:2460
-
\??\c:\nbtbtt.exec:\nbtbtt.exe94⤵PID:2868
-
\??\c:\vpvdj.exec:\vpvdj.exe95⤵PID:2556
-
\??\c:\fxlfffl.exec:\fxlfffl.exe96⤵PID:2880
-
\??\c:\lrllrll.exec:\lrllrll.exe97⤵PID:680
-
\??\c:\btnntn.exec:\btnntn.exe98⤵PID:1244
-
\??\c:\thnnnh.exec:\thnnnh.exe99⤵PID:1044
-
\??\c:\dpdvj.exec:\dpdvj.exe100⤵PID:1040
-
\??\c:\3xrxxxx.exec:\3xrxxxx.exe101⤵PID:2232
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe102⤵PID:1980
-
\??\c:\bbnttt.exec:\bbnttt.exe103⤵PID:2024
-
\??\c:\ppjvd.exec:\ppjvd.exe104⤵PID:2032
-
\??\c:\pjjjp.exec:\pjjjp.exe105⤵PID:1472
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe106⤵PID:2276
-
\??\c:\3hnbtb.exec:\3hnbtb.exe107⤵PID:2612
-
\??\c:\dvvjv.exec:\dvvjv.exe108⤵PID:2852
-
\??\c:\pdddj.exec:\pdddj.exe109⤵PID:2780
-
\??\c:\9fllxxf.exec:\9fllxxf.exe110⤵PID:1360
-
\??\c:\3xfffff.exec:\3xfffff.exe111⤵PID:996
-
\??\c:\bnntnt.exec:\bnntnt.exe112⤵PID:1724
-
\??\c:\ppjjj.exec:\ppjjj.exe113⤵PID:1720
-
\??\c:\pdjjj.exec:\pdjjj.exe114⤵PID:3004
-
\??\c:\7fllllx.exec:\7fllllx.exe115⤵PID:2972
-
\??\c:\bbbbhn.exec:\bbbbhn.exe116⤵PID:2980
-
\??\c:\djdjp.exec:\djdjp.exe117⤵
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\5dvdp.exec:\5dvdp.exe118⤵PID:1596
-
\??\c:\rlxxflx.exec:\rlxxflx.exe119⤵PID:1876
-
\??\c:\ttthbb.exec:\ttthbb.exe120⤵PID:2332
-
\??\c:\nhnhtb.exec:\nhnhtb.exe121⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-