Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe
-
Size
454KB
-
MD5
8e0c464984a43ff694affdee178e6330
-
SHA1
cd8b00ceafc63c4fbd3ad8c1158837f3f9762c7f
-
SHA256
f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163
-
SHA512
be7b8f028279f6189e31cb6116358900246df7d3626e0cc3f543a30e4d6bd1fd0c842dff2b93069b72ddb7105edcddb7645b5a5a7d7a8a1271d6e4f9e1f03531
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-366-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/852-420-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2252-484-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1980-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-698-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2204-725-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1520-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-874-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/588-1077-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 vvppd.exe 3024 tnhhtb.exe 3032 jdddj.exe 2816 5xxrxfl.exe 600 hbnttt.exe 2988 vjvdj.exe 2500 7lffllr.exe 2924 jjvjp.exe 2748 jpvvv.exe 2656 7nbhnb.exe 2244 5vjdd.exe 1748 hhtttt.exe 852 5djjd.exe 1740 xlxrrll.exe 2452 pdpjj.exe 1972 3fxfrrx.exe 836 9tbntb.exe 2812 3xrlrxx.exe 2928 frflflx.exe 2268 dvjpp.exe 2312 pjddj.exe 1964 bthnnn.exe 1136 9pddp.exe 1904 frffllr.exe 912 nhnbbb.exe 1720 3rxfxxx.exe 876 hbbbbt.exe 2052 9vjjv.exe 544 5vvpp.exe 988 hhthbh.exe 888 btnttt.exe 1708 dvppv.exe 2028 ffrxxfr.exe 2556 nhtnbt.exe 2536 bthhnn.exe 3028 jvvdj.exe 2844 5fxfxrf.exe 2584 nbnntt.exe 2336 pdppp.exe 2752 djpvd.exe 2500 xrlrffx.exe 2876 ntbtbt.exe 2868 vpjjp.exe 2668 7jjpv.exe 2648 frxrlxf.exe 2756 rxfxxrl.exe 3064 hbnhnh.exe 1948 pdpvd.exe 1732 jvddd.exe 852 fxfrxrf.exe 1936 hnhnnn.exe 2160 bthnbb.exe 2916 dvpjp.exe 2936 7lrrxxr.exe 1356 tthhbn.exe 2492 htbtbt.exe 2444 9djdd.exe 2516 3djjp.exe 2252 fxxffff.exe 972 bnttbt.exe 940 vjvvd.exe 1980 jpvpp.exe 1464 3frlffl.exe 2288 5rflrll.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-940-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-977-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2144-1009-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2540 2100 f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe 30 PID 2100 wrote to memory of 2540 2100 f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe 30 PID 2100 wrote to memory of 2540 2100 f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe 30 PID 2100 wrote to memory of 2540 2100 f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe 30 PID 2540 wrote to memory of 3024 2540 vvppd.exe 31 PID 2540 wrote to memory of 3024 2540 vvppd.exe 31 PID 2540 wrote to memory of 3024 2540 vvppd.exe 31 PID 2540 wrote to memory of 3024 2540 vvppd.exe 31 PID 3024 wrote to memory of 3032 3024 tnhhtb.exe 32 PID 3024 wrote to memory of 3032 3024 tnhhtb.exe 32 PID 3024 wrote to memory of 3032 3024 tnhhtb.exe 32 PID 3024 wrote to memory of 3032 3024 tnhhtb.exe 32 PID 3032 wrote to memory of 2816 3032 jdddj.exe 33 PID 3032 wrote to memory of 2816 3032 jdddj.exe 33 PID 3032 wrote to memory of 2816 3032 jdddj.exe 33 PID 3032 wrote to memory of 2816 3032 jdddj.exe 33 PID 2816 wrote to memory of 600 2816 5xxrxfl.exe 34 PID 2816 wrote to memory of 600 2816 5xxrxfl.exe 34 PID 2816 wrote to memory of 600 2816 5xxrxfl.exe 34 PID 2816 wrote to memory of 600 2816 5xxrxfl.exe 34 PID 600 wrote to memory of 2988 600 hbnttt.exe 35 PID 600 wrote to memory of 2988 600 hbnttt.exe 35 PID 600 wrote to memory of 2988 600 hbnttt.exe 35 PID 600 wrote to memory of 2988 600 hbnttt.exe 35 PID 2988 wrote to memory of 2500 2988 vjvdj.exe 36 PID 2988 wrote to memory of 2500 2988 vjvdj.exe 36 PID 2988 wrote to memory of 2500 2988 vjvdj.exe 36 PID 2988 wrote to memory of 2500 2988 vjvdj.exe 36 PID 2500 wrote to memory of 2924 2500 7lffllr.exe 37 PID 2500 wrote to memory of 2924 2500 7lffllr.exe 37 PID 2500 wrote to memory of 2924 2500 7lffllr.exe 37 PID 2500 wrote to memory of 2924 2500 7lffllr.exe 37 PID 2924 wrote to memory of 2748 2924 jjvjp.exe 38 PID 2924 wrote to memory of 2748 2924 jjvjp.exe 38 PID 2924 wrote to memory of 2748 2924 jjvjp.exe 38 PID 2924 wrote to memory of 2748 2924 jjvjp.exe 38 PID 2748 wrote to memory of 2656 2748 jpvvv.exe 39 PID 2748 wrote to memory of 2656 2748 jpvvv.exe 39 PID 2748 wrote to memory of 2656 2748 jpvvv.exe 39 PID 2748 wrote to memory of 2656 2748 jpvvv.exe 39 PID 2656 wrote to memory of 2244 2656 7nbhnb.exe 40 PID 2656 wrote to memory of 2244 2656 7nbhnb.exe 40 PID 2656 wrote to memory of 2244 2656 7nbhnb.exe 40 PID 2656 wrote to memory of 2244 2656 7nbhnb.exe 40 PID 2244 wrote to memory of 1748 2244 5vjdd.exe 41 PID 2244 wrote to memory of 1748 2244 5vjdd.exe 41 PID 2244 wrote to memory of 1748 2244 5vjdd.exe 41 PID 2244 wrote to memory of 1748 2244 5vjdd.exe 41 PID 1748 wrote to memory of 852 1748 hhtttt.exe 42 PID 1748 wrote to memory of 852 1748 hhtttt.exe 42 PID 1748 wrote to memory of 852 1748 hhtttt.exe 42 PID 1748 wrote to memory of 852 1748 hhtttt.exe 42 PID 852 wrote to memory of 1740 852 5djjd.exe 43 PID 852 wrote to memory of 1740 852 5djjd.exe 43 PID 852 wrote to memory of 1740 852 5djjd.exe 43 PID 852 wrote to memory of 1740 852 5djjd.exe 43 PID 1740 wrote to memory of 2452 1740 xlxrrll.exe 44 PID 1740 wrote to memory of 2452 1740 xlxrrll.exe 44 PID 1740 wrote to memory of 2452 1740 xlxrrll.exe 44 PID 1740 wrote to memory of 2452 1740 xlxrrll.exe 44 PID 2452 wrote to memory of 1972 2452 pdpjj.exe 45 PID 2452 wrote to memory of 1972 2452 pdpjj.exe 45 PID 2452 wrote to memory of 1972 2452 pdpjj.exe 45 PID 2452 wrote to memory of 1972 2452 pdpjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe"C:\Users\Admin\AppData\Local\Temp\f4e00fdcf414bb3c2c09617102a4f08232c80eb9c439d1f1cc301007a9945163N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vvppd.exec:\vvppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\tnhhtb.exec:\tnhhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jdddj.exec:\jdddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\5xxrxfl.exec:\5xxrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hbnttt.exec:\hbnttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\vjvdj.exec:\vjvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7lffllr.exec:\7lffllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jjvjp.exec:\jjvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\jpvvv.exec:\jpvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\7nbhnb.exec:\7nbhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5vjdd.exec:\5vjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\hhtttt.exec:\hhtttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\5djjd.exec:\5djjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\xlxrrll.exec:\xlxrrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pdpjj.exec:\pdpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\3fxfrrx.exec:\3fxfrrx.exe17⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9tbntb.exec:\9tbntb.exe18⤵
- Executes dropped EXE
PID:836 -
\??\c:\3xrlrxx.exec:\3xrlrxx.exe19⤵
- Executes dropped EXE
PID:2812 -
\??\c:\frflflx.exec:\frflflx.exe20⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dvjpp.exec:\dvjpp.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pjddj.exec:\pjddj.exe22⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bthnnn.exec:\bthnnn.exe23⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9pddp.exec:\9pddp.exe24⤵
- Executes dropped EXE
PID:1136 -
\??\c:\frffllr.exec:\frffllr.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nhnbbb.exec:\nhnbbb.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\3rxfxxx.exec:\3rxfxxx.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbbbbt.exec:\hbbbbt.exe28⤵
- Executes dropped EXE
PID:876 -
\??\c:\9vjjv.exec:\9vjjv.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5vvpp.exec:\5vvpp.exe30⤵
- Executes dropped EXE
PID:544 -
\??\c:\hhthbh.exec:\hhthbh.exe31⤵
- Executes dropped EXE
PID:988 -
\??\c:\btnttt.exec:\btnttt.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\dvppv.exec:\dvppv.exe33⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ffrxxfr.exec:\ffrxxfr.exe34⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nhtnbt.exec:\nhtnbt.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bthhnn.exec:\bthhnn.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jvvdj.exec:\jvvdj.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5fxfxrf.exec:\5fxfxrf.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nbnntt.exec:\nbnntt.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pdppp.exec:\pdppp.exe40⤵
- Executes dropped EXE
PID:2336 -
\??\c:\djpvd.exec:\djpvd.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrlrffx.exec:\xrlrffx.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ntbtbt.exec:\ntbtbt.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vpjjp.exec:\vpjjp.exe44⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7jjpv.exec:\7jjpv.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\frxrlxf.exec:\frxrlxf.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rxfxxrl.exec:\rxfxxrl.exe47⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hbnhnh.exec:\hbnhnh.exe48⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pdpvd.exec:\pdpvd.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jvddd.exec:\jvddd.exe50⤵
- Executes dropped EXE
PID:1732 -
\??\c:\fxfrxrf.exec:\fxfrxrf.exe51⤵
- Executes dropped EXE
PID:852 -
\??\c:\hnhnnn.exec:\hnhnnn.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bthnbb.exec:\bthnbb.exe53⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dvpjp.exec:\dvpjp.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7lrrxxr.exec:\7lrrxxr.exe55⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tthhbn.exec:\tthhbn.exe56⤵
- Executes dropped EXE
PID:1356 -
\??\c:\htbtbt.exec:\htbtbt.exe57⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9djdd.exec:\9djdd.exe58⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3djjp.exec:\3djjp.exe59⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fxxffff.exec:\fxxffff.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bnttbt.exec:\bnttbt.exe61⤵
- Executes dropped EXE
PID:972 -
\??\c:\vjvvd.exec:\vjvvd.exe62⤵
- Executes dropped EXE
PID:940 -
\??\c:\jpvpp.exec:\jpvpp.exe63⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3frlffl.exec:\3frlffl.exe64⤵
- Executes dropped EXE
PID:1464 -
\??\c:\5rflrll.exec:\5rflrll.exe65⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nhhhtn.exec:\nhhhtn.exe66⤵PID:1572
-
\??\c:\pjvjp.exec:\pjvjp.exe67⤵PID:2352
-
\??\c:\vjdjd.exec:\vjdjd.exe68⤵PID:2992
-
\??\c:\frrrrrx.exec:\frrrrrx.exe69⤵PID:2260
-
\??\c:\9nbhnh.exec:\9nbhnh.exe70⤵PID:544
-
\??\c:\7hthnh.exec:\7hthnh.exe71⤵PID:2200
-
\??\c:\5pjjd.exec:\5pjjd.exe72⤵PID:1016
-
\??\c:\jvjjj.exec:\jvjjj.exe73⤵PID:1528
-
\??\c:\xflffrx.exec:\xflffrx.exe74⤵PID:2368
-
\??\c:\tnhnnh.exec:\tnhnnh.exe75⤵PID:2720
-
\??\c:\9tnntn.exec:\9tnntn.exe76⤵PID:2236
-
\??\c:\jdvvv.exec:\jdvvv.exe77⤵PID:2904
-
\??\c:\5xxxxxf.exec:\5xxxxxf.exe78⤵PID:3028
-
\??\c:\9httnn.exec:\9httnn.exe79⤵PID:2844
-
\??\c:\hnbtht.exec:\hnbtht.exe80⤵PID:2888
-
\??\c:\9pjvv.exec:\9pjvv.exe81⤵PID:2336
-
\??\c:\jjvvv.exec:\jjvvv.exe82⤵PID:2768
-
\??\c:\lxxflfl.exec:\lxxflfl.exe83⤵PID:2672
-
\??\c:\hntbtn.exec:\hntbtn.exe84⤵PID:1124
-
\??\c:\vpddp.exec:\vpddp.exe85⤵PID:2640
-
\??\c:\9pdvv.exec:\9pdvv.exe86⤵PID:2800
-
\??\c:\rffxrrx.exec:\rffxrrx.exe87⤵PID:2240
-
\??\c:\lxrxfff.exec:\lxrxfff.exe88⤵PID:1212
-
\??\c:\tntbnn.exec:\tntbnn.exe89⤵PID:2108
-
\??\c:\nhttnn.exec:\nhttnn.exe90⤵PID:2736
-
\??\c:\vpvpj.exec:\vpvpj.exe91⤵PID:1752
-
\??\c:\xrllfxl.exec:\xrllfxl.exe92⤵PID:1168
-
\??\c:\rflxlll.exec:\rflxlll.exe93⤵PID:2124
-
\??\c:\hbnnbb.exec:\hbnnbb.exe94⤵PID:1908
-
\??\c:\dpddp.exec:\dpddp.exe95⤵PID:1972
-
\??\c:\dvjvd.exec:\dvjvd.exe96⤵PID:1688
-
\??\c:\5flflrx.exec:\5flflrx.exe97⤵PID:2204
-
\??\c:\frlrxrr.exec:\frlrxrr.exe98⤵PID:1356
-
\??\c:\1bnhhh.exec:\1bnhhh.exe99⤵
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\pjpdj.exec:\pjpdj.exe100⤵PID:352
-
\??\c:\jvdvj.exec:\jvdvj.exe101⤵PID:968
-
\??\c:\fxxxxrx.exec:\fxxxxrx.exe102⤵PID:904
-
\??\c:\5nnnnh.exec:\5nnnnh.exe103⤵PID:1288
-
\??\c:\tnbhnh.exec:\tnbhnh.exe104⤵PID:1172
-
\??\c:\djppp.exec:\djppp.exe105⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\rrxrrlr.exec:\rrxrrlr.exe106⤵PID:1976
-
\??\c:\1xflllx.exec:\1xflllx.exe107⤵PID:1724
-
\??\c:\nhnbnh.exec:\nhnbnh.exe108⤵PID:108
-
\??\c:\vpvpd.exec:\vpvpd.exe109⤵PID:1852
-
\??\c:\pdpjj.exec:\pdpjj.exe110⤵PID:648
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe111⤵PID:2332
-
\??\c:\9xllxrf.exec:\9xllxrf.exe112⤵PID:2208
-
\??\c:\httbbt.exec:\httbbt.exe113⤵PID:348
-
\??\c:\5jpvv.exec:\5jpvv.exe114⤵PID:1520
-
\??\c:\pvddj.exec:\pvddj.exe115⤵PID:1708
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe116⤵PID:1644
-
\??\c:\hntttn.exec:\hntttn.exe117⤵PID:2372
-
\??\c:\nhtttt.exec:\nhtttt.exe118⤵PID:2716
-
\??\c:\pdjjp.exec:\pdjjp.exe119⤵PID:2432
-
\??\c:\pdjdd.exec:\pdjdd.exe120⤵PID:3032
-
\??\c:\lxffxrr.exec:\lxffxrr.exe121⤵PID:2852
-
\??\c:\flxxllr.exec:\flxxllr.exe122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-