Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe
-
Size
454KB
-
MD5
5f1c686ecbf639a559a52de5a75e8db4
-
SHA1
3f0d45b8ec59bccf352fda218d128593e09da8f8
-
SHA256
6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031
-
SHA512
eb9395e76ac1cb0c6359eb84fb518b6c397904a14a7bdc03d5ec16b4049190e474eecb2c0737febc39c5e945720b0a01da84bb35e86644c9b42f995d3c3ce012
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet+:q7Tc2NYHUrAwfMp3CDt+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1724-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-108-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2936-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2328-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-138-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3008-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1328-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-216-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2144-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-559-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2672-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-762-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1764-794-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1292 rffrfxf.exe 2568 btbtth.exe 2488 1lfflfr.exe 2804 rffxfxf.exe 2440 jpddj.exe 2876 5frrrfl.exe 2624 jdpjj.exe 2192 xxrxrrf.exe 2784 thtnbt.exe 2632 rflfllr.exe 2328 9btnhh.exe 2936 jvpjp.exe 3008 lfxfrrx.exe 2852 9jjdj.exe 1328 rrllxrx.exe 3024 vjjjj.exe 1968 rrrfrxr.exe 1628 pppvp.exe 1272 7xfrxlr.exe 2188 9jpdd.exe 2144 llxllrx.exe 1068 thtnnn.exe 1948 dpvvj.exe 1784 rfrlrrr.exe 1700 vjvvv.exe 2356 xrfxflf.exe 2148 nnhnnn.exe 1480 rlxrrff.exe 1752 9frrxxf.exe 2168 7vdvd.exe 1292 5frxfxf.exe 868 7bhbtb.exe 2568 rfrrllf.exe 2708 hbhbhh.exe 616 tnbhhh.exe 2252 vvjpp.exe 3052 xrllrrf.exe 2884 rrlflxf.exe 2744 tnnhnt.exe 2900 ddvpp.exe 2732 fxfrxff.exe 2648 3rrxflr.exe 2872 ttbbbh.exe 704 9pddj.exe 2344 ffxlflf.exe 2340 xxrlxfr.exe 2844 nthbht.exe 3008 jjjvd.exe 1732 vpjjp.exe 3012 llfrflf.exe 1728 bhhbbt.exe 348 5ddjj.exe 2224 7jppp.exe 1632 3rfxfxl.exe 2320 tnhnht.exe 2060 pjppv.exe 1092 dppjp.exe 1524 xrrlxff.exe 1764 nbnhht.exe 1692 hhttbb.exe 1384 dpjjd.exe 2420 3rxrffr.exe 1100 7llffxf.exe 2584 hthhtb.exe -
resource yara_rule behavioral1/memory/1724-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-227-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1784-244-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1784-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-879-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1292 1724 6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe 30 PID 1724 wrote to memory of 1292 1724 6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe 30 PID 1724 wrote to memory of 1292 1724 6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe 30 PID 1724 wrote to memory of 1292 1724 6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe 30 PID 1292 wrote to memory of 2568 1292 rffrfxf.exe 31 PID 1292 wrote to memory of 2568 1292 rffrfxf.exe 31 PID 1292 wrote to memory of 2568 1292 rffrfxf.exe 31 PID 1292 wrote to memory of 2568 1292 rffrfxf.exe 31 PID 2568 wrote to memory of 2488 2568 btbtth.exe 32 PID 2568 wrote to memory of 2488 2568 btbtth.exe 32 PID 2568 wrote to memory of 2488 2568 btbtth.exe 32 PID 2568 wrote to memory of 2488 2568 btbtth.exe 32 PID 2488 wrote to memory of 2804 2488 1lfflfr.exe 33 PID 2488 wrote to memory of 2804 2488 1lfflfr.exe 33 PID 2488 wrote to memory of 2804 2488 1lfflfr.exe 33 PID 2488 wrote to memory of 2804 2488 1lfflfr.exe 33 PID 2804 wrote to memory of 2440 2804 rffxfxf.exe 34 PID 2804 wrote to memory of 2440 2804 rffxfxf.exe 34 PID 2804 wrote to memory of 2440 2804 rffxfxf.exe 34 PID 2804 wrote to memory of 2440 2804 rffxfxf.exe 34 PID 2440 wrote to memory of 2876 2440 jpddj.exe 35 PID 2440 wrote to memory of 2876 2440 jpddj.exe 35 PID 2440 wrote to memory of 2876 2440 jpddj.exe 35 PID 2440 wrote to memory of 2876 2440 jpddj.exe 35 PID 2876 wrote to memory of 2624 2876 5frrrfl.exe 36 PID 2876 wrote to memory of 2624 2876 5frrrfl.exe 36 PID 2876 wrote to memory of 2624 2876 5frrrfl.exe 36 PID 2876 wrote to memory of 2624 2876 5frrrfl.exe 36 PID 2624 wrote to memory of 2192 2624 jdpjj.exe 37 PID 2624 wrote to memory of 2192 2624 jdpjj.exe 37 PID 2624 wrote to memory of 2192 2624 jdpjj.exe 37 PID 2624 wrote to memory of 2192 2624 jdpjj.exe 37 PID 2192 wrote to memory of 2784 2192 xxrxrrf.exe 38 PID 2192 wrote to memory of 2784 2192 xxrxrrf.exe 38 PID 2192 wrote to memory of 2784 2192 xxrxrrf.exe 38 PID 2192 wrote to memory of 2784 2192 xxrxrrf.exe 38 PID 2784 wrote to memory of 2632 2784 thtnbt.exe 39 PID 2784 wrote to memory of 2632 2784 thtnbt.exe 39 PID 2784 wrote to memory of 2632 2784 thtnbt.exe 39 PID 2784 wrote to memory of 2632 2784 thtnbt.exe 39 PID 2632 wrote to memory of 2328 2632 rflfllr.exe 40 PID 2632 wrote to memory of 2328 2632 rflfllr.exe 40 PID 2632 wrote to memory of 2328 2632 rflfllr.exe 40 PID 2632 wrote to memory of 2328 2632 rflfllr.exe 40 PID 2328 wrote to memory of 2936 2328 9btnhh.exe 41 PID 2328 wrote to memory of 2936 2328 9btnhh.exe 41 PID 2328 wrote to memory of 2936 2328 9btnhh.exe 41 PID 2328 wrote to memory of 2936 2328 9btnhh.exe 41 PID 2936 wrote to memory of 3008 2936 jvpjp.exe 42 PID 2936 wrote to memory of 3008 2936 jvpjp.exe 42 PID 2936 wrote to memory of 3008 2936 jvpjp.exe 42 PID 2936 wrote to memory of 3008 2936 jvpjp.exe 42 PID 3008 wrote to memory of 2852 3008 lfxfrrx.exe 43 PID 3008 wrote to memory of 2852 3008 lfxfrrx.exe 43 PID 3008 wrote to memory of 2852 3008 lfxfrrx.exe 43 PID 3008 wrote to memory of 2852 3008 lfxfrrx.exe 43 PID 2852 wrote to memory of 1328 2852 9jjdj.exe 44 PID 2852 wrote to memory of 1328 2852 9jjdj.exe 44 PID 2852 wrote to memory of 1328 2852 9jjdj.exe 44 PID 2852 wrote to memory of 1328 2852 9jjdj.exe 44 PID 1328 wrote to memory of 3024 1328 rrllxrx.exe 45 PID 1328 wrote to memory of 3024 1328 rrllxrx.exe 45 PID 1328 wrote to memory of 3024 1328 rrllxrx.exe 45 PID 1328 wrote to memory of 3024 1328 rrllxrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe"C:\Users\Admin\AppData\Local\Temp\6449e9989cc3fea5a817abb9813623eff304880dc38a1e554ebac236dc6f6031.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\rffrfxf.exec:\rffrfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\btbtth.exec:\btbtth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\1lfflfr.exec:\1lfflfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rffxfxf.exec:\rffxfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jpddj.exec:\jpddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\5frrrfl.exec:\5frrrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jdpjj.exec:\jdpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xxrxrrf.exec:\xxrxrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\thtnbt.exec:\thtnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rflfllr.exec:\rflfllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9btnhh.exec:\9btnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\jvpjp.exec:\jvpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9jjdj.exec:\9jjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rrllxrx.exec:\rrllxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\vjjjj.exec:\vjjjj.exe17⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rrrfrxr.exec:\rrrfrxr.exe18⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pppvp.exec:\pppvp.exe19⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7xfrxlr.exec:\7xfrxlr.exe20⤵
- Executes dropped EXE
PID:1272 -
\??\c:\9jpdd.exec:\9jpdd.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\llxllrx.exec:\llxllrx.exe22⤵
- Executes dropped EXE
PID:2144 -
\??\c:\thtnnn.exec:\thtnnn.exe23⤵
- Executes dropped EXE
PID:1068 -
\??\c:\dpvvj.exec:\dpvvj.exe24⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vjvvv.exec:\vjvvv.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xrfxflf.exec:\xrfxflf.exe27⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nnhnnn.exec:\nnhnnn.exe28⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rlxrrff.exec:\rlxrrff.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9frrxxf.exec:\9frrxxf.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7vdvd.exec:\7vdvd.exe31⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5frxfxf.exec:\5frxfxf.exe32⤵
- Executes dropped EXE
PID:1292 -
\??\c:\7bhbtb.exec:\7bhbtb.exe33⤵
- Executes dropped EXE
PID:868 -
\??\c:\rfrrllf.exec:\rfrrllf.exe34⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbhbhh.exec:\hbhbhh.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tnbhhh.exec:\tnbhhh.exe36⤵
- Executes dropped EXE
PID:616 -
\??\c:\vvjpp.exec:\vvjpp.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xrllrrf.exec:\xrllrrf.exe38⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rrlflxf.exec:\rrlflxf.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tnnhnt.exec:\tnnhnt.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ddvpp.exec:\ddvpp.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fxfrxff.exec:\fxfrxff.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3rrxflr.exec:\3rrxflr.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ttbbbh.exec:\ttbbbh.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9pddj.exec:\9pddj.exe45⤵
- Executes dropped EXE
PID:704 -
\??\c:\ffxlflf.exec:\ffxlflf.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xxrlxfr.exec:\xxrlxfr.exe47⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nthbht.exec:\nthbht.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jjjvd.exec:\jjjvd.exe49⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vpjjp.exec:\vpjjp.exe50⤵
- Executes dropped EXE
PID:1732 -
\??\c:\llfrflf.exec:\llfrflf.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3012 -
\??\c:\bhhbbt.exec:\bhhbbt.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5ddjj.exec:\5ddjj.exe53⤵
- Executes dropped EXE
PID:348 -
\??\c:\7jppp.exec:\7jppp.exe54⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3rfxfxl.exec:\3rfxfxl.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tnhnht.exec:\tnhnht.exe56⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pjppv.exec:\pjppv.exe57⤵
- Executes dropped EXE
PID:2060 -
\??\c:\dppjp.exec:\dppjp.exe58⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrrlxff.exec:\xrrlxff.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nbnhht.exec:\nbnhht.exe60⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hhttbb.exec:\hhttbb.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dpjjd.exec:\dpjjd.exe62⤵
- Executes dropped EXE
PID:1384 -
\??\c:\3rxrffr.exec:\3rxrffr.exe63⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7llffxf.exec:\7llffxf.exe64⤵
- Executes dropped EXE
PID:1100 -
\??\c:\hthhtb.exec:\hthhtb.exe65⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tbnnnb.exec:\tbnnnb.exe66⤵PID:592
-
\??\c:\ddddj.exec:\ddddj.exe67⤵PID:1940
-
\??\c:\fllxxrl.exec:\fllxxrl.exe68⤵PID:2392
-
\??\c:\1xfxxlr.exec:\1xfxxlr.exe69⤵PID:2556
-
\??\c:\tnbhtt.exec:\tnbhtt.exe70⤵PID:2256
-
\??\c:\nbnntt.exec:\nbnntt.exe71⤵PID:2236
-
\??\c:\3vjdd.exec:\3vjdd.exe72⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\9frllxx.exec:\9frllxx.exe73⤵PID:2428
-
\??\c:\1fllrrr.exec:\1fllrrr.exe74⤵PID:2352
-
\??\c:\nhbhtt.exec:\nhbhtt.exe75⤵PID:1812
-
\??\c:\jdpvv.exec:\jdpvv.exe76⤵PID:2452
-
\??\c:\pvjvp.exec:\pvjvp.exe77⤵PID:2460
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe78⤵PID:2804
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe79⤵PID:2888
-
\??\c:\hthnnn.exec:\hthnnn.exe80⤵PID:2276
-
\??\c:\vpjjd.exec:\vpjjd.exe81⤵PID:2832
-
\??\c:\jvjjp.exec:\jvjjp.exe82⤵PID:2904
-
\??\c:\fxrrflx.exec:\fxrrflx.exe83⤵PID:2672
-
\??\c:\lxxffll.exec:\lxxffll.exe84⤵PID:2192
-
\??\c:\1tnnnb.exec:\1tnnnb.exe85⤵PID:2628
-
\??\c:\pjvdp.exec:\pjvdp.exe86⤵PID:2648
-
\??\c:\dvpvj.exec:\dvpvj.exe87⤵PID:2616
-
\??\c:\1rxxfxx.exec:\1rxxfxx.exe88⤵PID:2324
-
\??\c:\1tnnnt.exec:\1tnnnt.exe89⤵PID:2964
-
\??\c:\tnbtnn.exec:\tnbtnn.exe90⤵PID:2340
-
\??\c:\jvdvd.exec:\jvdvd.exe91⤵PID:2932
-
\??\c:\rlrxxfx.exec:\rlrxxfx.exe92⤵PID:3008
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe93⤵PID:636
-
\??\c:\5thbbt.exec:\5thbbt.exe94⤵PID:880
-
\??\c:\ttntbb.exec:\ttntbb.exe95⤵PID:804
-
\??\c:\1pvvv.exec:\1pvvv.exe96⤵PID:2012
-
\??\c:\lrflfxl.exec:\lrflfxl.exe97⤵PID:2444
-
\??\c:\9lxfxxx.exec:\9lxfxxx.exe98⤵PID:1632
-
\??\c:\bnnthb.exec:\bnnthb.exe99⤵PID:2320
-
\??\c:\ppdjp.exec:\ppdjp.exe100⤵PID:1272
-
\??\c:\5vdvp.exec:\5vdvp.exe101⤵PID:1268
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe102⤵PID:1908
-
\??\c:\nnhhtt.exec:\nnhhtt.exe103⤵PID:1764
-
\??\c:\hbbnnh.exec:\hbbnnh.exe104⤵PID:2520
-
\??\c:\jvjjp.exec:\jvjjp.exe105⤵PID:1716
-
\??\c:\5lrrxrl.exec:\5lrrxrl.exe106⤵PID:1744
-
\??\c:\lllllll.exec:\lllllll.exe107⤵PID:2480
-
\??\c:\3hbbbn.exec:\3hbbbn.exe108⤵PID:2116
-
\??\c:\vpjdj.exec:\vpjdj.exe109⤵PID:1784
-
\??\c:\jdppv.exec:\jdppv.exe110⤵PID:1336
-
\??\c:\3fxxllx.exec:\3fxxllx.exe111⤵PID:1652
-
\??\c:\1frrlll.exec:\1frrlll.exe112⤵PID:488
-
\??\c:\tthhnh.exec:\tthhnh.exe113⤵PID:1480
-
\??\c:\5vddv.exec:\5vddv.exe114⤵PID:2176
-
\??\c:\vvppd.exec:\vvppd.exe115⤵PID:2388
-
\??\c:\9rxxrrr.exec:\9rxxrrr.exe116⤵PID:2428
-
\??\c:\thhbtn.exec:\thhbtn.exe117⤵PID:2532
-
\??\c:\3hhbbn.exec:\3hhbbn.exe118⤵PID:2108
-
\??\c:\pdddv.exec:\pdddv.exe119⤵PID:868
-
\??\c:\dppjj.exec:\dppjj.exe120⤵PID:1836
-
\??\c:\flfxxrr.exec:\flfxxrr.exe121⤵PID:616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-