Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe
-
Size
454KB
-
MD5
d8265612d4d5a599a41ffc7e9d3d4d90
-
SHA1
a9c9254939f82d0e465c209c76080274662ac839
-
SHA256
4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2c
-
SHA512
72f0d5f292f8d8d115a399b979759663c9b6acc28afb9df9c45ad422cfceddc6febdb65f4b58a74fa111fd62f5232320e0e809f4a554c5353571aafd557ca537
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2268-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-35-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2192-33-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2772-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2036-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-145-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1880-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-166-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2668-185-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-194-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2704-193-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2920-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-235-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2152-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-314-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-448-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2260-458-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/848-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-996-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/980-1016-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1588-1023-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/980-1036-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1332-1064-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-1091-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2816-1119-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-1161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2228 5nhtbn.exe 2092 dpvvv.exe 2192 xxlxxxl.exe 2956 hhtbhh.exe 2964 nhhhnt.exe 2772 tnnnbb.exe 2840 dvjjp.exe 2724 rrffllx.exe 2652 xlfrrrx.exe 2140 dpdpd.exe 1712 frffrxl.exe 1380 lflfllr.exe 2036 ddvdv.exe 992 lfxxxfl.exe 1876 pjvdp.exe 1880 9bhhbh.exe 1868 1jvvv.exe 1248 dvjvd.exe 2668 7bhnbb.exe 2704 1vppv.exe 2124 9nhhnt.exe 2920 5lxfrxl.exe 2792 7hbhtb.exe 1300 9vddj.exe 900 xxrrrrf.exe 2164 7nntbh.exe 316 jjppv.exe 1332 dvdjj.exe 300 flxxfxr.exe 2152 ppjjp.exe 2156 xlxfrxx.exe 1620 rrllrxl.exe 2092 pdjvd.exe 2392 tnbbnn.exe 1540 nnbnbn.exe 2964 1vdvp.exe 2876 fxrrrxf.exe 2952 frlfllx.exe 2616 nhnnnn.exe 2656 vpdjp.exe 2724 vdjdj.exe 2628 7xrrxrx.exe 2500 hhhnbh.exe 668 ppppd.exe 1852 3vjdj.exe 1384 rxffxrx.exe 1704 tbhttn.exe 2096 9dpjv.exe 476 7pjpv.exe 1560 rlxxllr.exe 332 tnbbnh.exe 1644 thbbtn.exe 2044 jjdjv.exe 1668 xxxllrx.exe 1224 lxllffl.exe 2260 7nhbbt.exe 1660 vvppv.exe 2936 7djjv.exe 848 1fxxfxx.exe 2844 bbthnb.exe 904 tbtntt.exe 1780 djvjp.exe 1168 5fflxxl.exe 1640 9llrfff.exe -
resource yara_rule behavioral1/memory/2268-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-108-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2036-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-145-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1880-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-203-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2792-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-458-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/848-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-684-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1868-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2228 2268 4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe 30 PID 2268 wrote to memory of 2228 2268 4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe 30 PID 2268 wrote to memory of 2228 2268 4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe 30 PID 2268 wrote to memory of 2228 2268 4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe 30 PID 2228 wrote to memory of 2092 2228 5nhtbn.exe 31 PID 2228 wrote to memory of 2092 2228 5nhtbn.exe 31 PID 2228 wrote to memory of 2092 2228 5nhtbn.exe 31 PID 2228 wrote to memory of 2092 2228 5nhtbn.exe 31 PID 2092 wrote to memory of 2192 2092 dpvvv.exe 32 PID 2092 wrote to memory of 2192 2092 dpvvv.exe 32 PID 2092 wrote to memory of 2192 2092 dpvvv.exe 32 PID 2092 wrote to memory of 2192 2092 dpvvv.exe 32 PID 2192 wrote to memory of 2956 2192 xxlxxxl.exe 33 PID 2192 wrote to memory of 2956 2192 xxlxxxl.exe 33 PID 2192 wrote to memory of 2956 2192 xxlxxxl.exe 33 PID 2192 wrote to memory of 2956 2192 xxlxxxl.exe 33 PID 2956 wrote to memory of 2964 2956 hhtbhh.exe 34 PID 2956 wrote to memory of 2964 2956 hhtbhh.exe 34 PID 2956 wrote to memory of 2964 2956 hhtbhh.exe 34 PID 2956 wrote to memory of 2964 2956 hhtbhh.exe 34 PID 2964 wrote to memory of 2772 2964 nhhhnt.exe 35 PID 2964 wrote to memory of 2772 2964 nhhhnt.exe 35 PID 2964 wrote to memory of 2772 2964 nhhhnt.exe 35 PID 2964 wrote to memory of 2772 2964 nhhhnt.exe 35 PID 2772 wrote to memory of 2840 2772 tnnnbb.exe 36 PID 2772 wrote to memory of 2840 2772 tnnnbb.exe 36 PID 2772 wrote to memory of 2840 2772 tnnnbb.exe 36 PID 2772 wrote to memory of 2840 2772 tnnnbb.exe 36 PID 2840 wrote to memory of 2724 2840 dvjjp.exe 37 PID 2840 wrote to memory of 2724 2840 dvjjp.exe 37 PID 2840 wrote to memory of 2724 2840 dvjjp.exe 37 PID 2840 wrote to memory of 2724 2840 dvjjp.exe 37 PID 2724 wrote to memory of 2652 2724 rrffllx.exe 38 PID 2724 wrote to memory of 2652 2724 rrffllx.exe 38 PID 2724 wrote to memory of 2652 2724 rrffllx.exe 38 PID 2724 wrote to memory of 2652 2724 rrffllx.exe 38 PID 2652 wrote to memory of 2140 2652 xlfrrrx.exe 39 PID 2652 wrote to memory of 2140 2652 xlfrrrx.exe 39 PID 2652 wrote to memory of 2140 2652 xlfrrrx.exe 39 PID 2652 wrote to memory of 2140 2652 xlfrrrx.exe 39 PID 2140 wrote to memory of 1712 2140 dpdpd.exe 40 PID 2140 wrote to memory of 1712 2140 dpdpd.exe 40 PID 2140 wrote to memory of 1712 2140 dpdpd.exe 40 PID 2140 wrote to memory of 1712 2140 dpdpd.exe 40 PID 1712 wrote to memory of 1380 1712 frffrxl.exe 41 PID 1712 wrote to memory of 1380 1712 frffrxl.exe 41 PID 1712 wrote to memory of 1380 1712 frffrxl.exe 41 PID 1712 wrote to memory of 1380 1712 frffrxl.exe 41 PID 1380 wrote to memory of 2036 1380 lflfllr.exe 42 PID 1380 wrote to memory of 2036 1380 lflfllr.exe 42 PID 1380 wrote to memory of 2036 1380 lflfllr.exe 42 PID 1380 wrote to memory of 2036 1380 lflfllr.exe 42 PID 2036 wrote to memory of 992 2036 ddvdv.exe 43 PID 2036 wrote to memory of 992 2036 ddvdv.exe 43 PID 2036 wrote to memory of 992 2036 ddvdv.exe 43 PID 2036 wrote to memory of 992 2036 ddvdv.exe 43 PID 992 wrote to memory of 1876 992 lfxxxfl.exe 44 PID 992 wrote to memory of 1876 992 lfxxxfl.exe 44 PID 992 wrote to memory of 1876 992 lfxxxfl.exe 44 PID 992 wrote to memory of 1876 992 lfxxxfl.exe 44 PID 1876 wrote to memory of 1880 1876 pjvdp.exe 45 PID 1876 wrote to memory of 1880 1876 pjvdp.exe 45 PID 1876 wrote to memory of 1880 1876 pjvdp.exe 45 PID 1876 wrote to memory of 1880 1876 pjvdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe"C:\Users\Admin\AppData\Local\Temp\4976884618146bed929a8b3de81acdfa7fa308b57defc1d45f4c1b7b4402ff2cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\5nhtbn.exec:\5nhtbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\dpvvv.exec:\dpvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\xxlxxxl.exec:\xxlxxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\hhtbhh.exec:\hhtbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nhhhnt.exec:\nhhhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\tnnnbb.exec:\tnnnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dvjjp.exec:\dvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rrffllx.exec:\rrffllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xlfrrrx.exec:\xlfrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\dpdpd.exec:\dpdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\frffrxl.exec:\frffrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\lflfllr.exec:\lflfllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\ddvdv.exec:\ddvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\lfxxxfl.exec:\lfxxxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\pjvdp.exec:\pjvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\9bhhbh.exec:\9bhhbh.exe17⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1jvvv.exec:\1jvvv.exe18⤵
- Executes dropped EXE
PID:1868 -
\??\c:\dvjvd.exec:\dvjvd.exe19⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7bhnbb.exec:\7bhnbb.exe20⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1vppv.exec:\1vppv.exe21⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9nhhnt.exec:\9nhhnt.exe22⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5lxfrxl.exec:\5lxfrxl.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7hbhtb.exec:\7hbhtb.exe24⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9vddj.exec:\9vddj.exe25⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xxrrrrf.exec:\xxrrrrf.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\7nntbh.exec:\7nntbh.exe27⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jjppv.exec:\jjppv.exe28⤵
- Executes dropped EXE
PID:316 -
\??\c:\dvdjj.exec:\dvdjj.exe29⤵
- Executes dropped EXE
PID:1332 -
\??\c:\flxxfxr.exec:\flxxfxr.exe30⤵
- Executes dropped EXE
PID:300 -
\??\c:\ppjjp.exec:\ppjjp.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xlxfrxx.exec:\xlxfrxx.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rrllrxl.exec:\rrllrxl.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pdjvd.exec:\pdjvd.exe34⤵
- Executes dropped EXE
PID:2092 -
\??\c:\tnbbnn.exec:\tnbbnn.exe35⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nnbnbn.exec:\nnbnbn.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1vdvp.exec:\1vdvp.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fxrrrxf.exec:\fxrrrxf.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\frlfllx.exec:\frlfllx.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952 -
\??\c:\nhnnnn.exec:\nhnnnn.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpdjp.exec:\vpdjp.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vdjdj.exec:\vdjdj.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7xrrxrx.exec:\7xrrxrx.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hhhnbh.exec:\hhhnbh.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ppppd.exec:\ppppd.exe45⤵
- Executes dropped EXE
PID:668 -
\??\c:\3vjdj.exec:\3vjdj.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rxffxrx.exec:\rxffxrx.exe47⤵
- Executes dropped EXE
PID:1384 -
\??\c:\tbhttn.exec:\tbhttn.exe48⤵
- Executes dropped EXE
PID:1704 -
\??\c:\9dpjv.exec:\9dpjv.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7pjpv.exec:\7pjpv.exe50⤵
- Executes dropped EXE
PID:476 -
\??\c:\rlxxllr.exec:\rlxxllr.exe51⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tnbbnh.exec:\tnbbnh.exe52⤵
- Executes dropped EXE
PID:332 -
\??\c:\thbbtn.exec:\thbbtn.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jjdjv.exec:\jjdjv.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xxxllrx.exec:\xxxllrx.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lxllffl.exec:\lxllffl.exe56⤵
- Executes dropped EXE
PID:1224 -
\??\c:\7nhbbt.exec:\7nhbbt.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vvppv.exec:\vvppv.exe58⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7djjv.exec:\7djjv.exe59⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1fxxfxx.exec:\1fxxfxx.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\bbthnb.exec:\bbthnb.exe61⤵
- Executes dropped EXE
PID:2844 -
\??\c:\tbtntt.exec:\tbtntt.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\djvjp.exec:\djvjp.exe63⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5fflxxl.exec:\5fflxxl.exe64⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9llrfff.exec:\9llrfff.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nbnnhb.exec:\nbnnhb.exe66⤵PID:1864
-
\??\c:\7jddd.exec:\7jddd.exe67⤵PID:2212
-
\??\c:\dddjp.exec:\dddjp.exe68⤵PID:1460
-
\??\c:\7fxflxl.exec:\7fxflxl.exe69⤵PID:2364
-
\??\c:\thnntt.exec:\thnntt.exe70⤵PID:1412
-
\??\c:\9tnttt.exec:\9tnttt.exe71⤵PID:2692
-
\??\c:\3dpvd.exec:\3dpvd.exe72⤵PID:2376
-
\??\c:\rfllllf.exec:\rfllllf.exe73⤵PID:2268
-
\??\c:\btntbh.exec:\btntbh.exe74⤵PID:2100
-
\??\c:\5nhntt.exec:\5nhntt.exe75⤵PID:2188
-
\??\c:\5jvdj.exec:\5jvdj.exe76⤵PID:2092
-
\??\c:\xrlrllx.exec:\xrlrllx.exe77⤵PID:2800
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe78⤵PID:2756
-
\??\c:\nhthhh.exec:\nhthhh.exe79⤵PID:2964
-
\??\c:\ppdjj.exec:\ppdjj.exe80⤵PID:2632
-
\??\c:\pjvjp.exec:\pjvjp.exe81⤵PID:2852
-
\??\c:\rlffrrf.exec:\rlffrrf.exe82⤵PID:2840
-
\??\c:\bntttt.exec:\bntttt.exe83⤵PID:2796
-
\??\c:\ththnh.exec:\ththnh.exe84⤵PID:2604
-
\??\c:\1ddjv.exec:\1ddjv.exe85⤵PID:3024
-
\??\c:\xrfrfxf.exec:\xrfrfxf.exe86⤵PID:1996
-
\??\c:\tbnbnn.exec:\tbnbnn.exe87⤵PID:1104
-
\??\c:\nbnntt.exec:\nbnntt.exe88⤵PID:1712
-
\??\c:\pjvdp.exec:\pjvdp.exe89⤵PID:1584
-
\??\c:\ffrrffl.exec:\ffrrffl.exe90⤵PID:2360
-
\??\c:\xrffrrx.exec:\xrffrrx.exe91⤵PID:1892
-
\??\c:\nhbbhh.exec:\nhbbhh.exe92⤵PID:1956
-
\??\c:\vvvvj.exec:\vvvvj.exe93⤵PID:1732
-
\??\c:\3vvvp.exec:\3vvvp.exe94⤵PID:2688
-
\??\c:\lrlrrxl.exec:\lrlrrxl.exe95⤵PID:1736
-
\??\c:\7nbbhh.exec:\7nbbhh.exe96⤵PID:1868
-
\??\c:\7dddj.exec:\7dddj.exe97⤵PID:1552
-
\??\c:\pvpdp.exec:\pvpdp.exe98⤵PID:2916
-
\??\c:\rlfllxx.exec:\rlfllxx.exe99⤵PID:492
-
\??\c:\nbhhhh.exec:\nbhhhh.exe100⤵PID:2452
-
\??\c:\tbtbtb.exec:\tbtbtb.exe101⤵PID:2592
-
\??\c:\1jdjp.exec:\1jdjp.exe102⤵PID:1084
-
\??\c:\3lfxfll.exec:\3lfxfll.exe103⤵PID:2040
-
\??\c:\llxllll.exec:\llxllll.exe104⤵PID:1300
-
\??\c:\3bnhtn.exec:\3bnhtn.exe105⤵PID:1548
-
\??\c:\ppvdp.exec:\ppvdp.exe106⤵PID:1272
-
\??\c:\5ffxlll.exec:\5ffxlll.exe107⤵
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\lrlrxrf.exec:\lrlrxrf.exe108⤵PID:2164
-
\??\c:\9bhthn.exec:\9bhthn.exe109⤵PID:3060
-
\??\c:\bthnth.exec:\bthnth.exe110⤵PID:316
-
\??\c:\5pdjp.exec:\5pdjp.exe111⤵PID:1332
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe112⤵PID:2424
-
\??\c:\9llflfl.exec:\9llflfl.exe113⤵PID:2136
-
\??\c:\thbtbb.exec:\thbtbb.exe114⤵PID:2416
-
\??\c:\vvppj.exec:\vvppj.exe115⤵PID:2376
-
\??\c:\vvpvd.exec:\vvpvd.exe116⤵PID:1840
-
\??\c:\fxxlrrf.exec:\fxxlrrf.exe117⤵PID:1724
-
\??\c:\9nhntb.exec:\9nhntb.exe118⤵PID:2480
-
\??\c:\hbntbh.exec:\hbntbh.exe119⤵PID:2828
-
\??\c:\vpvdj.exec:\vpvdj.exe120⤵PID:2848
-
\??\c:\rrffffl.exec:\rrffffl.exe121⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-