Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe
-
Size
453KB
-
MD5
b3209a2956e4bd51fe08791046723bd0
-
SHA1
aa10546ca93c7b83d32d7c250a15482a9bbbad03
-
SHA256
3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207f
-
SHA512
119a5a51bcb031fd77f0bf0bc4b1f3733443a974fd56dbb706659d92bc53f79670b6e966a9d6902c7d06cb3fe9400234053502c12190b674d7c817e92fe8d5c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2096-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-375-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2680-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-487-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1680-509-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1188-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-578-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-643-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-692-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-844-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-957-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-1208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 pjvvj.exe 2228 1fxfrrf.exe 1980 vpjpj.exe 2976 hnbnth.exe 2328 hntnnb.exe 2940 vvvdj.exe 2740 3nbhnb.exe 2160 pjjpd.exe 2752 5frxxfr.exe 2628 7pjvv.exe 3060 tbnbbb.exe 1752 tnnthn.exe 1704 llxxrxl.exe 1808 xlrlrrx.exe 1816 vjjjp.exe 1996 7xxrrrf.exe 1436 1vvjd.exe 1424 7frfrrf.exe 2856 bbntbt.exe 2868 dpjpv.exe 2872 nhthbn.exe 1132 bhttbh.exe 2492 xrxxxxl.exe 944 bnhhnb.exe 1580 3vvvv.exe 2576 xrffflx.exe 2144 fffllrf.exe 2996 hbttth.exe 1664 rlffrrf.exe 884 btnthh.exe 1728 rfxxlrl.exe 1696 hbthtb.exe 552 jdvdj.exe 2248 rlflrrx.exe 996 xxlllrr.exe 2296 nnhntt.exe 2980 ppjdv.exe 564 rlxfrlr.exe 2888 rrffrxx.exe 2904 nhnbbn.exe 2732 pdvvj.exe 2784 1vpvp.exe 2672 rlfrxfr.exe 2680 btnntt.exe 2404 jdvdd.exe 1028 3vjpp.exe 1736 rxrxlrf.exe 1744 htnbbh.exe 336 tntnnt.exe 2032 jvppv.exe 1816 rlffllr.exe 1236 9ttthh.exe 1996 bbntth.exe 1436 3vpjp.exe 1712 fxrxrfl.exe 772 rrxxflx.exe 2460 tttntb.exe 2820 vvdpp.exe 2464 jdvvd.exe 2052 llffxfr.exe 1796 tnhntb.exe 1304 ttnbnt.exe 1828 vpjjp.exe 1680 7lxxlrf.exe -
resource yara_rule behavioral1/memory/2096-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-46-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2976-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-549-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2296-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-970-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-1128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-1195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-1208-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2956 2096 3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe 31 PID 2096 wrote to memory of 2956 2096 3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe 31 PID 2096 wrote to memory of 2956 2096 3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe 31 PID 2096 wrote to memory of 2956 2096 3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe 31 PID 2956 wrote to memory of 2228 2956 pjvvj.exe 32 PID 2956 wrote to memory of 2228 2956 pjvvj.exe 32 PID 2956 wrote to memory of 2228 2956 pjvvj.exe 32 PID 2956 wrote to memory of 2228 2956 pjvvj.exe 32 PID 2228 wrote to memory of 1980 2228 1fxfrrf.exe 33 PID 2228 wrote to memory of 1980 2228 1fxfrrf.exe 33 PID 2228 wrote to memory of 1980 2228 1fxfrrf.exe 33 PID 2228 wrote to memory of 1980 2228 1fxfrrf.exe 33 PID 1980 wrote to memory of 2976 1980 vpjpj.exe 34 PID 1980 wrote to memory of 2976 1980 vpjpj.exe 34 PID 1980 wrote to memory of 2976 1980 vpjpj.exe 34 PID 1980 wrote to memory of 2976 1980 vpjpj.exe 34 PID 2976 wrote to memory of 2328 2976 hnbnth.exe 35 PID 2976 wrote to memory of 2328 2976 hnbnth.exe 35 PID 2976 wrote to memory of 2328 2976 hnbnth.exe 35 PID 2976 wrote to memory of 2328 2976 hnbnth.exe 35 PID 2328 wrote to memory of 2940 2328 hntnnb.exe 36 PID 2328 wrote to memory of 2940 2328 hntnnb.exe 36 PID 2328 wrote to memory of 2940 2328 hntnnb.exe 36 PID 2328 wrote to memory of 2940 2328 hntnnb.exe 36 PID 2940 wrote to memory of 2740 2940 vvvdj.exe 37 PID 2940 wrote to memory of 2740 2940 vvvdj.exe 37 PID 2940 wrote to memory of 2740 2940 vvvdj.exe 37 PID 2940 wrote to memory of 2740 2940 vvvdj.exe 37 PID 2740 wrote to memory of 2160 2740 3nbhnb.exe 38 PID 2740 wrote to memory of 2160 2740 3nbhnb.exe 38 PID 2740 wrote to memory of 2160 2740 3nbhnb.exe 38 PID 2740 wrote to memory of 2160 2740 3nbhnb.exe 38 PID 2160 wrote to memory of 2752 2160 pjjpd.exe 39 PID 2160 wrote to memory of 2752 2160 pjjpd.exe 39 PID 2160 wrote to memory of 2752 2160 pjjpd.exe 39 PID 2160 wrote to memory of 2752 2160 pjjpd.exe 39 PID 2752 wrote to memory of 2628 2752 5frxxfr.exe 40 PID 2752 wrote to memory of 2628 2752 5frxxfr.exe 40 PID 2752 wrote to memory of 2628 2752 5frxxfr.exe 40 PID 2752 wrote to memory of 2628 2752 5frxxfr.exe 40 PID 2628 wrote to memory of 3060 2628 7pjvv.exe 41 PID 2628 wrote to memory of 3060 2628 7pjvv.exe 41 PID 2628 wrote to memory of 3060 2628 7pjvv.exe 41 PID 2628 wrote to memory of 3060 2628 7pjvv.exe 41 PID 3060 wrote to memory of 1752 3060 tbnbbb.exe 42 PID 3060 wrote to memory of 1752 3060 tbnbbb.exe 42 PID 3060 wrote to memory of 1752 3060 tbnbbb.exe 42 PID 3060 wrote to memory of 1752 3060 tbnbbb.exe 42 PID 1752 wrote to memory of 1704 1752 tnnthn.exe 43 PID 1752 wrote to memory of 1704 1752 tnnthn.exe 43 PID 1752 wrote to memory of 1704 1752 tnnthn.exe 43 PID 1752 wrote to memory of 1704 1752 tnnthn.exe 43 PID 1704 wrote to memory of 1808 1704 llxxrxl.exe 44 PID 1704 wrote to memory of 1808 1704 llxxrxl.exe 44 PID 1704 wrote to memory of 1808 1704 llxxrxl.exe 44 PID 1704 wrote to memory of 1808 1704 llxxrxl.exe 44 PID 1808 wrote to memory of 1816 1808 xlrlrrx.exe 45 PID 1808 wrote to memory of 1816 1808 xlrlrrx.exe 45 PID 1808 wrote to memory of 1816 1808 xlrlrrx.exe 45 PID 1808 wrote to memory of 1816 1808 xlrlrrx.exe 45 PID 1816 wrote to memory of 1996 1816 vjjjp.exe 46 PID 1816 wrote to memory of 1996 1816 vjjjp.exe 46 PID 1816 wrote to memory of 1996 1816 vjjjp.exe 46 PID 1816 wrote to memory of 1996 1816 vjjjp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe"C:\Users\Admin\AppData\Local\Temp\3663da7e504bac28777148f4860398b60f9e611de3b9ac3cf2d439965b93207fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\pjvvj.exec:\pjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1fxfrrf.exec:\1fxfrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\vpjpj.exec:\vpjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\hnbnth.exec:\hnbnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hntnnb.exec:\hntnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\vvvdj.exec:\vvvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\3nbhnb.exec:\3nbhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjjpd.exec:\pjjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\5frxxfr.exec:\5frxxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\7pjvv.exec:\7pjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\tbnbbb.exec:\tbnbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\tnnthn.exec:\tnnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\llxxrxl.exec:\llxxrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\xlrlrrx.exec:\xlrlrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\vjjjp.exec:\vjjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\7xxrrrf.exec:\7xxrrrf.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1vvjd.exec:\1vvjd.exe18⤵
- Executes dropped EXE
PID:1436 -
\??\c:\7frfrrf.exec:\7frfrrf.exe19⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bbntbt.exec:\bbntbt.exe20⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dpjpv.exec:\dpjpv.exe21⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhthbn.exec:\nhthbn.exe22⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bhttbh.exec:\bhttbh.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xrxxxxl.exec:\xrxxxxl.exe24⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bnhhnb.exec:\bnhhnb.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\3vvvv.exec:\3vvvv.exe26⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xrffflx.exec:\xrffflx.exe27⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fffllrf.exec:\fffllrf.exe28⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbttth.exec:\hbttth.exe29⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rlffrrf.exec:\rlffrrf.exe30⤵
- Executes dropped EXE
PID:1664 -
\??\c:\btnthh.exec:\btnthh.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\rfxxlrl.exec:\rfxxlrl.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbthtb.exec:\hbthtb.exe33⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jdvdj.exec:\jdvdj.exe34⤵
- Executes dropped EXE
PID:552 -
\??\c:\rlflrrx.exec:\rlflrrx.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xxlllrr.exec:\xxlllrr.exe36⤵
- Executes dropped EXE
PID:996 -
\??\c:\nnhntt.exec:\nnhntt.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ppjdv.exec:\ppjdv.exe38⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rlxfrlr.exec:\rlxfrlr.exe39⤵
- Executes dropped EXE
PID:564 -
\??\c:\rrffrxx.exec:\rrffrxx.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nhnbbn.exec:\nhnbbn.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pdvvj.exec:\pdvvj.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1vpvp.exec:\1vpvp.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btnntt.exec:\btnntt.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jdvdd.exec:\jdvdd.exe46⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3vjpp.exec:\3vjpp.exe47⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe48⤵
- Executes dropped EXE
PID:1736 -
\??\c:\htnbbh.exec:\htnbbh.exe49⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tntnnt.exec:\tntnnt.exe50⤵
- Executes dropped EXE
PID:336 -
\??\c:\jvppv.exec:\jvppv.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlffllr.exec:\rlffllr.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816 -
\??\c:\9ttthh.exec:\9ttthh.exe53⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bbntth.exec:\bbntth.exe54⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3vpjp.exec:\3vpjp.exe55⤵
- Executes dropped EXE
PID:1436 -
\??\c:\fxrxrfl.exec:\fxrxrfl.exe56⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rrxxflx.exec:\rrxxflx.exe57⤵
- Executes dropped EXE
PID:772 -
\??\c:\tttntb.exec:\tttntb.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vvdpp.exec:\vvdpp.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jdvvd.exec:\jdvvd.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\llffxfr.exec:\llffxfr.exe61⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tnhntb.exec:\tnhntb.exe62⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ttnbnt.exec:\ttnbnt.exe63⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vpjjp.exec:\vpjjp.exe64⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7lxxlrf.exec:\7lxxlrf.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\fxrxffr.exec:\fxrxffr.exe66⤵PID:1036
-
\??\c:\bbtbtt.exec:\bbtbtt.exe67⤵PID:1188
-
\??\c:\1vpvv.exec:\1vpvv.exe68⤵PID:2080
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe69⤵PID:3008
-
\??\c:\lrfrffx.exec:\lrfrffx.exe70⤵PID:2996
-
\??\c:\bbbhht.exec:\bbbhht.exe71⤵PID:1876
-
\??\c:\jdjdp.exec:\jdjdp.exe72⤵PID:988
-
\??\c:\rllrrfl.exec:\rllrrfl.exe73⤵PID:2088
-
\??\c:\rllrxxf.exec:\rllrxxf.exe74⤵PID:2380
-
\??\c:\httbhn.exec:\httbhn.exe75⤵PID:1968
-
\??\c:\pjjpv.exec:\pjjpv.exe76⤵PID:2108
-
\??\c:\3vpvd.exec:\3vpvd.exe77⤵PID:1980
-
\??\c:\llflllr.exec:\llflllr.exe78⤵PID:768
-
\??\c:\thbhth.exec:\thbhth.exe79⤵PID:2296
-
\??\c:\nhtnhh.exec:\nhtnhh.exe80⤵PID:2760
-
\??\c:\dvjjv.exec:\dvjjv.exe81⤵PID:2920
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe82⤵PID:2776
-
\??\c:\5xllxxf.exec:\5xllxxf.exe83⤵PID:2644
-
\??\c:\nnhthn.exec:\nnhthn.exe84⤵PID:2660
-
\??\c:\3jjjd.exec:\3jjjd.exe85⤵PID:2936
-
\??\c:\jdpvp.exec:\jdpvp.exe86⤵PID:2964
-
\??\c:\rrffllr.exec:\rrffllr.exe87⤵PID:2680
-
\??\c:\htbnnh.exec:\htbnnh.exe88⤵PID:2236
-
\??\c:\1btnhh.exec:\1btnhh.exe89⤵PID:320
-
\??\c:\pdpvv.exec:\pdpvv.exe90⤵PID:2184
-
\??\c:\3pvdj.exec:\3pvdj.exe91⤵PID:1920
-
\??\c:\xfffflx.exec:\xfffflx.exe92⤵PID:2044
-
\??\c:\hhbttb.exec:\hhbttb.exe93⤵PID:1628
-
\??\c:\pjdpv.exec:\pjdpv.exe94⤵PID:2136
-
\??\c:\3dpdp.exec:\3dpdp.exe95⤵PID:1648
-
\??\c:\1xfllll.exec:\1xfllll.exe96⤵PID:1692
-
\??\c:\7lflrrx.exec:\7lflrrx.exe97⤵PID:1932
-
\??\c:\bhhhbb.exec:\bhhhbb.exe98⤵PID:1344
-
\??\c:\dpdvj.exec:\dpdvj.exe99⤵PID:2472
-
\??\c:\vpdvv.exec:\vpdvv.exe100⤵PID:2828
-
\??\c:\lfflrrf.exec:\lfflrrf.exe101⤵PID:2488
-
\??\c:\bntbhh.exec:\bntbhh.exe102⤵PID:904
-
\??\c:\1pdvv.exec:\1pdvv.exe103⤵PID:2824
-
\??\c:\pdjvd.exec:\pdjvd.exe104⤵PID:1636
-
\??\c:\rllrxlr.exec:\rllrxlr.exe105⤵PID:2440
-
\??\c:\bhnbbt.exec:\bhnbbt.exe106⤵PID:944
-
\??\c:\bnbthh.exec:\bnbthh.exe107⤵PID:832
-
\??\c:\jvddd.exec:\jvddd.exe108⤵PID:532
-
\??\c:\3rllxfr.exec:\3rllxfr.exe109⤵PID:3016
-
\??\c:\5nbbbb.exec:\5nbbbb.exe110⤵PID:1056
-
\??\c:\9nthtt.exec:\9nthtt.exe111⤵PID:1916
-
\??\c:\jpvpv.exec:\jpvpv.exe112⤵PID:1672
-
\??\c:\3llrrxr.exec:\3llrrxr.exe113⤵PID:1684
-
\??\c:\bnnttt.exec:\bnnttt.exe114⤵PID:976
-
\??\c:\thnbbb.exec:\thnbbb.exe115⤵PID:3032
-
\??\c:\vpvdj.exec:\vpvdj.exe116⤵PID:1604
-
\??\c:\7dvdd.exec:\7dvdd.exe117⤵PID:2072
-
\??\c:\rlxxfxx.exec:\rlxxfxx.exe118⤵PID:1656
-
\??\c:\nnthhh.exec:\nnthhh.exe119⤵PID:1972
-
\??\c:\7pvdv.exec:\7pvdv.exe120⤵PID:2708
-
\??\c:\jdvvj.exec:\jdvvj.exe121⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-