Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe
-
Size
456KB
-
MD5
26d5d0ea547b437de81ba971119e7730
-
SHA1
62839337d6cf894670b9d943469fb7f1cd9f82e0
-
SHA256
6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895
-
SHA512
dd38ecd7690be37e2bbda483f11e0dad051027af57fc6c25433e5794801ae4efbce64aef3bf24ed6314130c06cdcf348b9d4e868121cb807418dbf050aaef772
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRR:q7Tc2NYHUrAwfMp3CDRR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2252-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-54-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2884-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-149-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1204-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-304-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-346-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1476-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-632-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2636-646-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/352-785-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-881-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-906-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-920-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2028-941-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2676-723-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2596-710-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-685-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2932-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-637-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-271-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1052-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-196-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1360-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-177-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2044-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-1004-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1256-1035-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2852-1138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-1158-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2944-1190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1048-1206-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2252 lffflll.exe 2572 7vjjj.exe 2192 9lfffll.exe 604 9thhhh.exe 2168 dpdpd.exe 2736 nnttnn.exe 2828 ttnntn.exe 2884 jdpvv.exe 2880 xxrxrrf.exe 2744 btttnh.exe 2604 tnbbnn.exe 3004 jdjjv.exe 2028 bbbnnn.exe 1184 1pdvj.exe 108 jjvdp.exe 2044 rrffllx.exe 1204 btthbn.exe 568 vvddd.exe 1360 fxllrxl.exe 1436 tthntt.exe 2320 pjppd.exe 2476 frxrxrx.exe 1656 1pvdd.exe 1176 9frfllr.exe 1256 7xfffff.exe 700 bntttn.exe 1052 jjppd.exe 2328 jvddv.exe 376 fxfxfff.exe 1896 tthhbt.exe 2212 bbhthn.exe 1856 rlxrllx.exe 2068 bnbtbb.exe 2396 vdvdj.exe 2356 xrflxff.exe 2700 hbntbh.exe 2420 nnbnbh.exe 2716 jvvjv.exe 2820 dvjdj.exe 2724 lflffxx.exe 2904 hbttbb.exe 1644 bttnhh.exe 2812 dpjpv.exe 2556 xlxfffr.exe 2876 rflfxrl.exe 3012 btnhtb.exe 560 3ntbbb.exe 2720 dvvvv.exe 1716 ppvpj.exe 284 9rrfffl.exe 1428 btttbb.exe 1840 nbbhnh.exe 1964 ppdpv.exe 1476 pvpdd.exe 2436 9fllrrx.exe 316 1rflxxl.exe 2228 nhhbhh.exe 2320 5hbtbh.exe 1620 jvpvj.exe 1640 1vjjp.exe 1808 lfrlxxf.exe 1672 lflrrrx.exe 648 nntntn.exe 1256 dpddd.exe -
resource yara_rule behavioral1/memory/2532-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-54-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2884-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-678-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2932-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-1138-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2092-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-1207-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2252 2532 6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe 30 PID 2532 wrote to memory of 2252 2532 6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe 30 PID 2532 wrote to memory of 2252 2532 6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe 30 PID 2532 wrote to memory of 2252 2532 6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe 30 PID 2252 wrote to memory of 2572 2252 lffflll.exe 31 PID 2252 wrote to memory of 2572 2252 lffflll.exe 31 PID 2252 wrote to memory of 2572 2252 lffflll.exe 31 PID 2252 wrote to memory of 2572 2252 lffflll.exe 31 PID 2572 wrote to memory of 2192 2572 7vjjj.exe 32 PID 2572 wrote to memory of 2192 2572 7vjjj.exe 32 PID 2572 wrote to memory of 2192 2572 7vjjj.exe 32 PID 2572 wrote to memory of 2192 2572 7vjjj.exe 32 PID 2192 wrote to memory of 604 2192 9lfffll.exe 33 PID 2192 wrote to memory of 604 2192 9lfffll.exe 33 PID 2192 wrote to memory of 604 2192 9lfffll.exe 33 PID 2192 wrote to memory of 604 2192 9lfffll.exe 33 PID 604 wrote to memory of 2168 604 9thhhh.exe 34 PID 604 wrote to memory of 2168 604 9thhhh.exe 34 PID 604 wrote to memory of 2168 604 9thhhh.exe 34 PID 604 wrote to memory of 2168 604 9thhhh.exe 34 PID 2168 wrote to memory of 2736 2168 dpdpd.exe 35 PID 2168 wrote to memory of 2736 2168 dpdpd.exe 35 PID 2168 wrote to memory of 2736 2168 dpdpd.exe 35 PID 2168 wrote to memory of 2736 2168 dpdpd.exe 35 PID 2736 wrote to memory of 2828 2736 nnttnn.exe 36 PID 2736 wrote to memory of 2828 2736 nnttnn.exe 36 PID 2736 wrote to memory of 2828 2736 nnttnn.exe 36 PID 2736 wrote to memory of 2828 2736 nnttnn.exe 36 PID 2828 wrote to memory of 2884 2828 ttnntn.exe 37 PID 2828 wrote to memory of 2884 2828 ttnntn.exe 37 PID 2828 wrote to memory of 2884 2828 ttnntn.exe 37 PID 2828 wrote to memory of 2884 2828 ttnntn.exe 37 PID 2884 wrote to memory of 2880 2884 jdpvv.exe 38 PID 2884 wrote to memory of 2880 2884 jdpvv.exe 38 PID 2884 wrote to memory of 2880 2884 jdpvv.exe 38 PID 2884 wrote to memory of 2880 2884 jdpvv.exe 38 PID 2880 wrote to memory of 2744 2880 xxrxrrf.exe 39 PID 2880 wrote to memory of 2744 2880 xxrxrrf.exe 39 PID 2880 wrote to memory of 2744 2880 xxrxrrf.exe 39 PID 2880 wrote to memory of 2744 2880 xxrxrrf.exe 39 PID 2744 wrote to memory of 2604 2744 btttnh.exe 40 PID 2744 wrote to memory of 2604 2744 btttnh.exe 40 PID 2744 wrote to memory of 2604 2744 btttnh.exe 40 PID 2744 wrote to memory of 2604 2744 btttnh.exe 40 PID 2604 wrote to memory of 3004 2604 tnbbnn.exe 41 PID 2604 wrote to memory of 3004 2604 tnbbnn.exe 41 PID 2604 wrote to memory of 3004 2604 tnbbnn.exe 41 PID 2604 wrote to memory of 3004 2604 tnbbnn.exe 41 PID 3004 wrote to memory of 2028 3004 jdjjv.exe 159 PID 3004 wrote to memory of 2028 3004 jdjjv.exe 159 PID 3004 wrote to memory of 2028 3004 jdjjv.exe 159 PID 3004 wrote to memory of 2028 3004 jdjjv.exe 159 PID 2028 wrote to memory of 1184 2028 bbbnnn.exe 43 PID 2028 wrote to memory of 1184 2028 bbbnnn.exe 43 PID 2028 wrote to memory of 1184 2028 bbbnnn.exe 43 PID 2028 wrote to memory of 1184 2028 bbbnnn.exe 43 PID 1184 wrote to memory of 108 1184 1pdvj.exe 44 PID 1184 wrote to memory of 108 1184 1pdvj.exe 44 PID 1184 wrote to memory of 108 1184 1pdvj.exe 44 PID 1184 wrote to memory of 108 1184 1pdvj.exe 44 PID 108 wrote to memory of 2044 108 jjvdp.exe 45 PID 108 wrote to memory of 2044 108 jjvdp.exe 45 PID 108 wrote to memory of 2044 108 jjvdp.exe 45 PID 108 wrote to memory of 2044 108 jjvdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe"C:\Users\Admin\AppData\Local\Temp\6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lffflll.exec:\lffflll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\7vjjj.exec:\7vjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\9lfffll.exec:\9lfffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\9thhhh.exec:\9thhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\dpdpd.exec:\dpdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nnttnn.exec:\nnttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ttnntn.exec:\ttnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jdpvv.exec:\jdpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xxrxrrf.exec:\xxrxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\btttnh.exec:\btttnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tnbbnn.exec:\tnbbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jdjjv.exec:\jdjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bbbnnn.exec:\bbbnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\1pdvj.exec:\1pdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\jjvdp.exec:\jjvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\rrffllx.exec:\rrffllx.exe17⤵
- Executes dropped EXE
PID:2044 -
\??\c:\btthbn.exec:\btthbn.exe18⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vvddd.exec:\vvddd.exe19⤵
- Executes dropped EXE
PID:568 -
\??\c:\fxllrxl.exec:\fxllrxl.exe20⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tthntt.exec:\tthntt.exe21⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pjppd.exec:\pjppd.exe22⤵
- Executes dropped EXE
PID:2320 -
\??\c:\frxrxrx.exec:\frxrxrx.exe23⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1pvdd.exec:\1pvdd.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9frfllr.exec:\9frfllr.exe25⤵
- Executes dropped EXE
PID:1176 -
\??\c:\7xfffff.exec:\7xfffff.exe26⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bntttn.exec:\bntttn.exe27⤵
- Executes dropped EXE
PID:700 -
\??\c:\jjppd.exec:\jjppd.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jvddv.exec:\jvddv.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fxfxfff.exec:\fxfxfff.exe30⤵
- Executes dropped EXE
PID:376 -
\??\c:\tthhbt.exec:\tthhbt.exe31⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bbhthn.exec:\bbhthn.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlxrllx.exec:\rlxrllx.exe33⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bnbtbb.exec:\bnbtbb.exe34⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vdvdj.exec:\vdvdj.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrflxff.exec:\xrflxff.exe36⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hbntbh.exec:\hbntbh.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nnbnbh.exec:\nnbnbh.exe38⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jvvjv.exec:\jvvjv.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dvjdj.exec:\dvjdj.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lflffxx.exec:\lflffxx.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hbttbb.exec:\hbttbb.exe42⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bttnhh.exec:\bttnhh.exe43⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dpjpv.exec:\dpjpv.exe44⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xlxfffr.exec:\xlxfffr.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rflfxrl.exec:\rflfxrl.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\btnhtb.exec:\btnhtb.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3ntbbb.exec:\3ntbbb.exe48⤵
- Executes dropped EXE
PID:560 -
\??\c:\dvvvv.exec:\dvvvv.exe49⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ppvpj.exec:\ppvpj.exe50⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9rrfffl.exec:\9rrfffl.exe51⤵
- Executes dropped EXE
PID:284 -
\??\c:\btttbb.exec:\btttbb.exe52⤵
- Executes dropped EXE
PID:1428 -
\??\c:\nbbhnh.exec:\nbbhnh.exe53⤵
- Executes dropped EXE
PID:1840 -
\??\c:\ppdpv.exec:\ppdpv.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pvpdd.exec:\pvpdd.exe55⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9fllrrx.exec:\9fllrrx.exe56⤵
- Executes dropped EXE
PID:2436 -
\??\c:\1rflxxl.exec:\1rflxxl.exe57⤵
- Executes dropped EXE
PID:316 -
\??\c:\nhhbhh.exec:\nhhbhh.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5hbtbh.exec:\5hbtbh.exe59⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jvpvj.exec:\jvpvj.exe60⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1vjjp.exec:\1vjjp.exe61⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lfrlxxf.exec:\lfrlxxf.exe62⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lflrrrx.exec:\lflrrrx.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nntntn.exec:\nntntn.exe64⤵
- Executes dropped EXE
PID:648 -
\??\c:\dpddd.exec:\dpddd.exe65⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vpddd.exec:\vpddd.exe66⤵PID:1040
-
\??\c:\7xrrxfl.exec:\7xrrxfl.exe67⤵PID:1848
-
\??\c:\1bntbb.exec:\1bntbb.exe68⤵PID:2020
-
\??\c:\9jdjv.exec:\9jdjv.exe69⤵PID:1264
-
\??\c:\vpddj.exec:\vpddj.exe70⤵PID:588
-
\??\c:\ffrxllr.exec:\ffrxllr.exe71⤵PID:2696
-
\??\c:\7rfrfrf.exec:\7rfrfrf.exe72⤵PID:1628
-
\??\c:\9bhntt.exec:\9bhntt.exe73⤵PID:1348
-
\??\c:\7bnttt.exec:\7bnttt.exe74⤵PID:3000
-
\??\c:\3jddv.exec:\3jddv.exe75⤵PID:2204
-
\??\c:\vdvjv.exec:\vdvjv.exe76⤵PID:448
-
\??\c:\5ffflfl.exec:\5ffflfl.exe77⤵PID:2356
-
\??\c:\tbnhbt.exec:\tbnhbt.exe78⤵PID:1044
-
\??\c:\pjdjv.exec:\pjdjv.exe79⤵PID:2824
-
\??\c:\ddpjp.exec:\ddpjp.exe80⤵PID:2752
-
\??\c:\1rlfflr.exec:\1rlfflr.exe81⤵PID:2152
-
\??\c:\rrlrxxl.exec:\rrlrxxl.exe82⤵PID:2912
-
\??\c:\9hhbhb.exec:\9hhbhb.exe83⤵PID:2296
-
\??\c:\nhhntb.exec:\nhhntb.exe84⤵PID:2772
-
\??\c:\vppvp.exec:\vppvp.exe85⤵PID:2640
-
\??\c:\vvjvp.exec:\vvjvp.exe86⤵PID:2936
-
\??\c:\rfxxfff.exec:\rfxxfff.exe87⤵PID:2636
-
\??\c:\1bhhhn.exec:\1bhhhn.exe88⤵PID:2932
-
\??\c:\htnntn.exec:\htnntn.exe89⤵PID:1116
-
\??\c:\ddvvd.exec:\ddvvd.exe90⤵PID:2792
-
\??\c:\ddjjp.exec:\ddjjp.exe91⤵
- System Location Discovery: System Language Discovery
PID:544 -
\??\c:\frfxffl.exec:\frfxffl.exe92⤵PID:2720
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe93⤵PID:1816
-
\??\c:\hbthnn.exec:\hbthnn.exe94⤵PID:848
-
\??\c:\djvdp.exec:\djvdp.exe95⤵PID:1204
-
\??\c:\dpdpv.exec:\dpdpv.exe96⤵PID:1548
-
\??\c:\xrlrlrl.exec:\xrlrlrl.exe97⤵PID:2596
-
\??\c:\9lflxxl.exec:\9lflxxl.exe98⤵PID:344
-
\??\c:\hbbbnn.exec:\hbbbnn.exe99⤵PID:2676
-
\??\c:\hhbbtb.exec:\hhbbtb.exe100⤵PID:332
-
\??\c:\pjdjj.exec:\pjdjj.exe101⤵PID:2440
-
\??\c:\pvvvv.exec:\pvvvv.exe102⤵PID:2172
-
\??\c:\rlfxlrx.exec:\rlfxlrx.exe103⤵PID:2460
-
\??\c:\5xlrxxl.exec:\5xlrxxl.exe104⤵PID:1700
-
\??\c:\ttthtn.exec:\ttthtn.exe105⤵PID:2208
-
\??\c:\1vvdj.exec:\1vvdj.exe106⤵PID:1292
-
\??\c:\dvvvd.exec:\dvvvd.exe107⤵PID:1576
-
\??\c:\flflffx.exec:\flflffx.exe108⤵PID:536
-
\??\c:\3lxfrff.exec:\3lxfrff.exe109⤵PID:352
-
\??\c:\nhhnbb.exec:\nhhnbb.exe110⤵PID:1848
-
\??\c:\bttnbh.exec:\bttnbh.exe111⤵PID:1800
-
\??\c:\jddvj.exec:\jddvj.exe112⤵PID:2896
-
\??\c:\9dvvd.exec:\9dvvd.exe113⤵PID:1488
-
\??\c:\3lffflx.exec:\3lffflx.exe114⤵PID:2340
-
\??\c:\nthtth.exec:\nthtth.exe115⤵PID:1704
-
\??\c:\1nhntt.exec:\1nhntt.exe116⤵PID:2432
-
\??\c:\tnbhnn.exec:\tnbhnn.exe117⤵PID:320
-
\??\c:\jvjjp.exec:\jvjjp.exe118⤵PID:1420
-
\??\c:\lxffllr.exec:\lxffllr.exe119⤵PID:2700
-
\??\c:\llxxflx.exec:\llxxflx.exe120⤵PID:2748
-
\??\c:\9rfrxxx.exec:\9rfrxxx.exe121⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-