Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe
-
Size
456KB
-
MD5
8f178be0ca9f752e558bd8b9d85b64a0
-
SHA1
47d9337a31b23dae5f5f2ffe9fa700b13a82ab9f
-
SHA256
071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51
-
SHA512
eaab9f75dce5cf924748dd3e5a908272adddd1db731b8ff67e9f227df233dc5feadfb642807ffc7900b23b7b9081d90940419d40c7f359b88046bb2fe31d9a41
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-193-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2292-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-258-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2216-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-414-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2432-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-442-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1296-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-481-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1116-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-514-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1360-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1536-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-756-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2996-881-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-888-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2652-909-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/672-935-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/552-1008-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-1059-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-1120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-1223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-1248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1556 5tbhnt.exe 2692 jjdjv.exe 2064 7rxxxxx.exe 1964 1lrrxrr.exe 2760 3bbhtt.exe 2740 pjdvj.exe 2728 lxlrxfl.exe 2632 vjvjv.exe 2652 1xlfllr.exe 2656 hhtttt.exe 2200 9dpvv.exe 672 flxrrrf.exe 2940 7tnbhb.exe 1080 jvdjd.exe 984 lrxxfxf.exe 2896 5ntbbb.exe 1432 fffflrf.exe 2020 hbbnbn.exe 2648 5lflrrf.exe 2316 5lfxrlr.exe 2292 pdddd.exe 2204 frxfxxf.exe 2124 frxrrll.exe 2236 3nttth.exe 1608 jvddd.exe 664 1lrxxxx.exe 2216 1nbttt.exe 2976 1djdv.exe 3028 xfrllff.exe 2032 jdvvd.exe 2352 frxrrll.exe 1720 nhnntt.exe 2400 1lxxxrx.exe 2264 9frlfff.exe 2884 bhnhht.exe 2752 1nthbn.exe 1964 ppjjp.exe 2356 frxxfxf.exe 2704 xrflllr.exe 2740 tbnbtn.exe 2748 vdvjj.exe 316 pvvpp.exe 2944 rlfrrfl.exe 2640 rflffxf.exe 2784 hbtbbt.exe 1516 pjddd.exe 1716 dvjpp.exe 1340 rlrlrlr.exe 2908 thnnth.exe 2432 thnhnh.exe 1136 vdpdd.exe 2912 dvpjj.exe 1628 1lfflfl.exe 1296 bttthb.exe 1432 nbhbtn.exe 552 pjvdd.exe 2420 7ffxxrx.exe 2100 7rxrlff.exe 2164 hhtbtt.exe 1852 vjvpd.exe 1624 djpjj.exe 1116 fllflxx.exe 2124 ntbbnn.exe 848 thhhbt.exe -
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-888-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2652-909-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2624-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-1008-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-1021-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-1154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-1223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-1309-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1556 2012 071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe 30 PID 2012 wrote to memory of 1556 2012 071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe 30 PID 2012 wrote to memory of 1556 2012 071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe 30 PID 2012 wrote to memory of 1556 2012 071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe 30 PID 1556 wrote to memory of 2692 1556 5tbhnt.exe 31 PID 1556 wrote to memory of 2692 1556 5tbhnt.exe 31 PID 1556 wrote to memory of 2692 1556 5tbhnt.exe 31 PID 1556 wrote to memory of 2692 1556 5tbhnt.exe 31 PID 2692 wrote to memory of 2064 2692 jjdjv.exe 32 PID 2692 wrote to memory of 2064 2692 jjdjv.exe 32 PID 2692 wrote to memory of 2064 2692 jjdjv.exe 32 PID 2692 wrote to memory of 2064 2692 jjdjv.exe 32 PID 2064 wrote to memory of 1964 2064 7rxxxxx.exe 33 PID 2064 wrote to memory of 1964 2064 7rxxxxx.exe 33 PID 2064 wrote to memory of 1964 2064 7rxxxxx.exe 33 PID 2064 wrote to memory of 1964 2064 7rxxxxx.exe 33 PID 1964 wrote to memory of 2760 1964 1lrrxrr.exe 34 PID 1964 wrote to memory of 2760 1964 1lrrxrr.exe 34 PID 1964 wrote to memory of 2760 1964 1lrrxrr.exe 34 PID 1964 wrote to memory of 2760 1964 1lrrxrr.exe 34 PID 2760 wrote to memory of 2740 2760 3bbhtt.exe 35 PID 2760 wrote to memory of 2740 2760 3bbhtt.exe 35 PID 2760 wrote to memory of 2740 2760 3bbhtt.exe 35 PID 2760 wrote to memory of 2740 2760 3bbhtt.exe 35 PID 2740 wrote to memory of 2728 2740 pjdvj.exe 36 PID 2740 wrote to memory of 2728 2740 pjdvj.exe 36 PID 2740 wrote to memory of 2728 2740 pjdvj.exe 36 PID 2740 wrote to memory of 2728 2740 pjdvj.exe 36 PID 2728 wrote to memory of 2632 2728 lxlrxfl.exe 37 PID 2728 wrote to memory of 2632 2728 lxlrxfl.exe 37 PID 2728 wrote to memory of 2632 2728 lxlrxfl.exe 37 PID 2728 wrote to memory of 2632 2728 lxlrxfl.exe 37 PID 2632 wrote to memory of 2652 2632 vjvjv.exe 38 PID 2632 wrote to memory of 2652 2632 vjvjv.exe 38 PID 2632 wrote to memory of 2652 2632 vjvjv.exe 38 PID 2632 wrote to memory of 2652 2632 vjvjv.exe 38 PID 2652 wrote to memory of 2656 2652 1xlfllr.exe 39 PID 2652 wrote to memory of 2656 2652 1xlfllr.exe 39 PID 2652 wrote to memory of 2656 2652 1xlfllr.exe 39 PID 2652 wrote to memory of 2656 2652 1xlfllr.exe 39 PID 2656 wrote to memory of 2200 2656 hhtttt.exe 40 PID 2656 wrote to memory of 2200 2656 hhtttt.exe 40 PID 2656 wrote to memory of 2200 2656 hhtttt.exe 40 PID 2656 wrote to memory of 2200 2656 hhtttt.exe 40 PID 2200 wrote to memory of 672 2200 9dpvv.exe 41 PID 2200 wrote to memory of 672 2200 9dpvv.exe 41 PID 2200 wrote to memory of 672 2200 9dpvv.exe 41 PID 2200 wrote to memory of 672 2200 9dpvv.exe 41 PID 672 wrote to memory of 2940 672 flxrrrf.exe 42 PID 672 wrote to memory of 2940 672 flxrrrf.exe 42 PID 672 wrote to memory of 2940 672 flxrrrf.exe 42 PID 672 wrote to memory of 2940 672 flxrrrf.exe 42 PID 2940 wrote to memory of 1080 2940 7tnbhb.exe 43 PID 2940 wrote to memory of 1080 2940 7tnbhb.exe 43 PID 2940 wrote to memory of 1080 2940 7tnbhb.exe 43 PID 2940 wrote to memory of 1080 2940 7tnbhb.exe 43 PID 1080 wrote to memory of 984 1080 jvdjd.exe 44 PID 1080 wrote to memory of 984 1080 jvdjd.exe 44 PID 1080 wrote to memory of 984 1080 jvdjd.exe 44 PID 1080 wrote to memory of 984 1080 jvdjd.exe 44 PID 984 wrote to memory of 2896 984 lrxxfxf.exe 45 PID 984 wrote to memory of 2896 984 lrxxfxf.exe 45 PID 984 wrote to memory of 2896 984 lrxxfxf.exe 45 PID 984 wrote to memory of 2896 984 lrxxfxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe"C:\Users\Admin\AppData\Local\Temp\071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\5tbhnt.exec:\5tbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\jjdjv.exec:\jjdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7rxxxxx.exec:\7rxxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\1lrrxrr.exec:\1lrrxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\3bbhtt.exec:\3bbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\pjdvj.exec:\pjdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vjvjv.exec:\vjvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\1xlfllr.exec:\1xlfllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hhtttt.exec:\hhtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\9dpvv.exec:\9dpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\flxrrrf.exec:\flxrrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\7tnbhb.exec:\7tnbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jvdjd.exec:\jvdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\lrxxfxf.exec:\lrxxfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\5ntbbb.exec:\5ntbbb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\fffflrf.exec:\fffflrf.exe18⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hbbnbn.exec:\hbbnbn.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5lflrrf.exec:\5lflrrf.exe20⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5lfxrlr.exec:\5lfxrlr.exe21⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pdddd.exec:\pdddd.exe22⤵
- Executes dropped EXE
PID:2292 -
\??\c:\frxfxxf.exec:\frxfxxf.exe23⤵
- Executes dropped EXE
PID:2204 -
\??\c:\frxrrll.exec:\frxrrll.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3nttth.exec:\3nttth.exe25⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jvddd.exec:\jvddd.exe26⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1lrxxxx.exec:\1lrxxxx.exe27⤵
- Executes dropped EXE
PID:664 -
\??\c:\1nbttt.exec:\1nbttt.exe28⤵
- Executes dropped EXE
PID:2216 -
\??\c:\1djdv.exec:\1djdv.exe29⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xfrllff.exec:\xfrllff.exe30⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdvvd.exec:\jdvvd.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\frxrrll.exec:\frxrrll.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhnntt.exec:\nhnntt.exe33⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1lxxxrx.exec:\1lxxxrx.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9frlfff.exec:\9frlfff.exe35⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bhnhht.exec:\bhnhht.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1nthbn.exec:\1nthbn.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ppjjp.exec:\ppjjp.exe38⤵
- Executes dropped EXE
PID:1964 -
\??\c:\frxxfxf.exec:\frxxfxf.exe39⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xrflllr.exec:\xrflllr.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\tbnbtn.exec:\tbnbtn.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vdvjj.exec:\vdvjj.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pvvpp.exec:\pvvpp.exe43⤵
- Executes dropped EXE
PID:316 -
\??\c:\rlfrrfl.exec:\rlfrrfl.exe44⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rflffxf.exec:\rflffxf.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hbtbbt.exec:\hbtbbt.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjddd.exec:\pjddd.exe47⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvjpp.exec:\dvjpp.exe48⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe49⤵
- Executes dropped EXE
PID:1340 -
\??\c:\thnnth.exec:\thnnth.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\thnhnh.exec:\thnhnh.exe51⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vdpdd.exec:\vdpdd.exe52⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dvpjj.exec:\dvpjj.exe53⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1lfflfl.exec:\1lfflfl.exe54⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bttthb.exec:\bttthb.exe55⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nbhbtn.exec:\nbhbtn.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pjvdd.exec:\pjvdd.exe57⤵
- Executes dropped EXE
PID:552 -
\??\c:\7ffxxrx.exec:\7ffxxrx.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7rxrlff.exec:\7rxrlff.exe59⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hhtbtt.exec:\hhtbtt.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vjvpd.exec:\vjvpd.exe61⤵
- Executes dropped EXE
PID:1852 -
\??\c:\djpjj.exec:\djpjj.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fllflxx.exec:\fllflxx.exe63⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ntbbnn.exec:\ntbbnn.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\thhhbt.exec:\thhhbt.exe65⤵
- Executes dropped EXE
PID:848 -
\??\c:\jdppv.exec:\jdppv.exe66⤵PID:692
-
\??\c:\1frlfff.exec:\1frlfff.exe67⤵PID:1360
-
\??\c:\9rrflfl.exec:\9rrflfl.exe68⤵PID:2392
-
\??\c:\bhhbbt.exec:\bhhbbt.exe69⤵PID:1248
-
\??\c:\dvvvv.exec:\dvvvv.exe70⤵PID:1928
-
\??\c:\3vdvp.exec:\3vdvp.exe71⤵PID:1472
-
\??\c:\5fxrfrl.exec:\5fxrfrl.exe72⤵PID:1740
-
\??\c:\rfllrll.exec:\rfllrll.exe73⤵PID:2032
-
\??\c:\htbhnh.exec:\htbhnh.exe74⤵PID:2408
-
\??\c:\5jvvv.exec:\5jvvv.exe75⤵PID:2424
-
\??\c:\jvdvv.exec:\jvdvv.exe76⤵PID:1720
-
\??\c:\3flfrlf.exec:\3flfrlf.exe77⤵PID:1576
-
\??\c:\9hnhbb.exec:\9hnhbb.exe78⤵PID:2692
-
\??\c:\tbhnnh.exec:\tbhnnh.exe79⤵PID:2884
-
\??\c:\pdjjd.exec:\pdjjd.exe80⤵PID:588
-
\??\c:\3vjjj.exec:\3vjjj.exe81⤵PID:2860
-
\??\c:\1xlrrlx.exec:\1xlrrlx.exe82⤵PID:2220
-
\??\c:\ntbbtt.exec:\ntbbtt.exe83⤵PID:2580
-
\??\c:\bthtnb.exec:\bthtnb.exe84⤵PID:2812
-
\??\c:\jpvjj.exec:\jpvjj.exe85⤵PID:2728
-
\??\c:\frfrrlx.exec:\frfrrlx.exe86⤵PID:2960
-
\??\c:\3ffxrrx.exec:\3ffxrrx.exe87⤵PID:2612
-
\??\c:\bhhtnh.exec:\bhhtnh.exe88⤵PID:1276
-
\??\c:\3jjdv.exec:\3jjdv.exe89⤵
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\djpdd.exec:\djpdd.exe90⤵PID:1536
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe91⤵PID:2900
-
\??\c:\5nbbtn.exec:\5nbbtn.exe92⤵PID:2892
-
\??\c:\hbthhh.exec:\hbthhh.exe93⤵PID:2924
-
\??\c:\jpvdd.exec:\jpvdd.exe94⤵PID:1468
-
\??\c:\dpddv.exec:\dpddv.exe95⤵PID:2932
-
\??\c:\3rxrlff.exec:\3rxrlff.exe96⤵PID:1700
-
\??\c:\nhbbnn.exec:\nhbbnn.exe97⤵PID:1952
-
\??\c:\hbhtnt.exec:\hbhtnt.exe98⤵PID:2136
-
\??\c:\jdppv.exec:\jdppv.exe99⤵PID:1420
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe100⤵PID:1284
-
\??\c:\lflllfl.exec:\lflllfl.exe101⤵PID:2180
-
\??\c:\5nhbhb.exec:\5nhbhb.exe102⤵PID:2300
-
\??\c:\hhttbn.exec:\hhttbn.exe103⤵PID:2172
-
\??\c:\vdpdd.exec:\vdpdd.exe104⤵PID:2208
-
\??\c:\1dpjd.exec:\1dpjd.exe105⤵PID:756
-
\??\c:\frrlrff.exec:\frrlrff.exe106⤵PID:2140
-
\??\c:\hbbbhh.exec:\hbbbhh.exe107⤵PID:1636
-
\??\c:\bntnhb.exec:\bntnhb.exe108⤵PID:2236
-
\??\c:\9jjdj.exec:\9jjdj.exe109⤵PID:812
-
\??\c:\5rxfxxx.exec:\5rxfxxx.exe110⤵PID:664
-
\??\c:\xrllrrx.exec:\xrllrrx.exe111⤵PID:1708
-
\??\c:\7btnnh.exec:\7btnnh.exe112⤵PID:1992
-
\??\c:\jvddd.exec:\jvddd.exe113⤵PID:1248
-
\??\c:\5lrffxr.exec:\5lrffxr.exe114⤵PID:1912
-
\??\c:\9flflff.exec:\9flflff.exe115⤵PID:876
-
\??\c:\tnbhhh.exec:\tnbhhh.exe116⤵PID:2560
-
\??\c:\9dppp.exec:\9dppp.exe117⤵PID:2576
-
\??\c:\djpjd.exec:\djpjd.exe118⤵PID:1788
-
\??\c:\flrllfl.exec:\flrllfl.exe119⤵PID:1584
-
\??\c:\1llffxf.exec:\1llffxf.exe120⤵PID:2544
-
\??\c:\bthntt.exec:\bthntt.exe121⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-