Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe
-
Size
454KB
-
MD5
c08cae73261da112c1fa0bfd4111bd7d
-
SHA1
83f5e53605b13ad93454984445ebc1ed2dfed100
-
SHA256
3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574
-
SHA512
19aea5ec0c69166999297c4a30d62a30cd755d1ba40898c47c59206bb400e569d2cd51509bcb72516bfd455d043f8409403c5f5cab2480b0a9abac101ab6be32
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-123-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/896-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1980-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1864-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-251-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1776-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-288-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1872-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-320-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-326-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-337-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2348-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-422-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-430-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2352-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1236-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-448-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2352-453-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1468-514-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/596-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-551-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2288-566-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3060-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-664-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1272-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-755-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1400-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-850-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-967-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1836 pjvdp.exe 2252 hhtbtt.exe 2260 nntnnn.exe 3064 fxxxllx.exe 2616 hhtttt.exe 2740 dpvvp.exe 2880 xlxflfl.exe 2832 hnttbn.exe 2676 7llxlxf.exe 2576 fxrrxrf.exe 2556 1bbtnn.exe 1260 9djdd.exe 896 llxfxfr.exe 300 nhtnhb.exe 1980 vpjvj.exe 1236 fxllrxl.exe 2300 bththn.exe 1864 3tbbbb.exe 1032 jdddv.exe 2852 ffllrrx.exe 2968 1xlfffl.exe 792 jdvdv.exe 2208 xrrlffl.exe 2176 bthnnh.exe 836 rlffrlx.exe 1776 rfllxrr.exe 1584 pdvvj.exe 396 5lflxfr.exe 1604 vvpvd.exe 2144 fxlrflr.exe 1520 bthtbt.exe 1872 nbtbhh.exe 2272 rlfflfl.exe 2252 7rrrxxl.exe 2436 9ntbhn.exe 344 7jvdj.exe 2124 5llffll.exe 2736 bthbhh.exe 2372 hbhhhb.exe 2808 djppd.exe 2748 3xxxfll.exe 2624 lfrxllr.exe 2980 hbnntt.exe 768 vpdjv.exe 2556 vpddv.exe 3020 fxlfffx.exe 2348 nhthtb.exe 1928 1nbhnt.exe 2248 pdvdd.exe 2352 1xrllll.exe 1972 bbntnn.exe 1236 bhnhhb.exe 1724 5vdvd.exe 2036 xxrxlll.exe 1196 9nhntt.exe 1452 btnbnt.exe 2704 3jvvp.exe 2952 xlxfrrr.exe 1432 rfrrfxl.exe 1400 bhnhhb.exe 1300 jvjdd.exe 2284 3vdjd.exe 1468 3flfllr.exe 596 nbnntn.exe -
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-402-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2348-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-514-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/596-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-566-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/3060-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-980-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-1029-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1836 2328 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 2328 wrote to memory of 1836 2328 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 2328 wrote to memory of 1836 2328 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 2328 wrote to memory of 1836 2328 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 1836 wrote to memory of 2252 1836 pjvdp.exe 31 PID 1836 wrote to memory of 2252 1836 pjvdp.exe 31 PID 1836 wrote to memory of 2252 1836 pjvdp.exe 31 PID 1836 wrote to memory of 2252 1836 pjvdp.exe 31 PID 2252 wrote to memory of 2260 2252 hhtbtt.exe 32 PID 2252 wrote to memory of 2260 2252 hhtbtt.exe 32 PID 2252 wrote to memory of 2260 2252 hhtbtt.exe 32 PID 2252 wrote to memory of 2260 2252 hhtbtt.exe 32 PID 2260 wrote to memory of 3064 2260 nntnnn.exe 33 PID 2260 wrote to memory of 3064 2260 nntnnn.exe 33 PID 2260 wrote to memory of 3064 2260 nntnnn.exe 33 PID 2260 wrote to memory of 3064 2260 nntnnn.exe 33 PID 3064 wrote to memory of 2616 3064 fxxxllx.exe 34 PID 3064 wrote to memory of 2616 3064 fxxxllx.exe 34 PID 3064 wrote to memory of 2616 3064 fxxxllx.exe 34 PID 3064 wrote to memory of 2616 3064 fxxxllx.exe 34 PID 2616 wrote to memory of 2740 2616 hhtttt.exe 35 PID 2616 wrote to memory of 2740 2616 hhtttt.exe 35 PID 2616 wrote to memory of 2740 2616 hhtttt.exe 35 PID 2616 wrote to memory of 2740 2616 hhtttt.exe 35 PID 2740 wrote to memory of 2880 2740 dpvvp.exe 36 PID 2740 wrote to memory of 2880 2740 dpvvp.exe 36 PID 2740 wrote to memory of 2880 2740 dpvvp.exe 36 PID 2740 wrote to memory of 2880 2740 dpvvp.exe 36 PID 2880 wrote to memory of 2832 2880 xlxflfl.exe 37 PID 2880 wrote to memory of 2832 2880 xlxflfl.exe 37 PID 2880 wrote to memory of 2832 2880 xlxflfl.exe 37 PID 2880 wrote to memory of 2832 2880 xlxflfl.exe 37 PID 2832 wrote to memory of 2676 2832 hnttbn.exe 38 PID 2832 wrote to memory of 2676 2832 hnttbn.exe 38 PID 2832 wrote to memory of 2676 2832 hnttbn.exe 38 PID 2832 wrote to memory of 2676 2832 hnttbn.exe 38 PID 2676 wrote to memory of 2576 2676 7llxlxf.exe 39 PID 2676 wrote to memory of 2576 2676 7llxlxf.exe 39 PID 2676 wrote to memory of 2576 2676 7llxlxf.exe 39 PID 2676 wrote to memory of 2576 2676 7llxlxf.exe 39 PID 2576 wrote to memory of 2556 2576 fxrrxrf.exe 40 PID 2576 wrote to memory of 2556 2576 fxrrxrf.exe 40 PID 2576 wrote to memory of 2556 2576 fxrrxrf.exe 40 PID 2576 wrote to memory of 2556 2576 fxrrxrf.exe 40 PID 2556 wrote to memory of 1260 2556 1bbtnn.exe 41 PID 2556 wrote to memory of 1260 2556 1bbtnn.exe 41 PID 2556 wrote to memory of 1260 2556 1bbtnn.exe 41 PID 2556 wrote to memory of 1260 2556 1bbtnn.exe 41 PID 1260 wrote to memory of 896 1260 9djdd.exe 42 PID 1260 wrote to memory of 896 1260 9djdd.exe 42 PID 1260 wrote to memory of 896 1260 9djdd.exe 42 PID 1260 wrote to memory of 896 1260 9djdd.exe 42 PID 896 wrote to memory of 300 896 llxfxfr.exe 43 PID 896 wrote to memory of 300 896 llxfxfr.exe 43 PID 896 wrote to memory of 300 896 llxfxfr.exe 43 PID 896 wrote to memory of 300 896 llxfxfr.exe 43 PID 300 wrote to memory of 1980 300 nhtnhb.exe 44 PID 300 wrote to memory of 1980 300 nhtnhb.exe 44 PID 300 wrote to memory of 1980 300 nhtnhb.exe 44 PID 300 wrote to memory of 1980 300 nhtnhb.exe 44 PID 1980 wrote to memory of 1236 1980 vpjvj.exe 45 PID 1980 wrote to memory of 1236 1980 vpjvj.exe 45 PID 1980 wrote to memory of 1236 1980 vpjvj.exe 45 PID 1980 wrote to memory of 1236 1980 vpjvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe"C:\Users\Admin\AppData\Local\Temp\3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pjvdp.exec:\pjvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\hhtbtt.exec:\hhtbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\nntnnn.exec:\nntnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\fxxxllx.exec:\fxxxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hhtttt.exec:\hhtttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dpvvp.exec:\dpvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xlxflfl.exec:\xlxflfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hnttbn.exec:\hnttbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7llxlxf.exec:\7llxlxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\fxrrxrf.exec:\fxrrxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1bbtnn.exec:\1bbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9djdd.exec:\9djdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\llxfxfr.exec:\llxfxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\nhtnhb.exec:\nhtnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\vpjvj.exec:\vpjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\fxllrxl.exec:\fxllrxl.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bththn.exec:\bththn.exe18⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3tbbbb.exec:\3tbbbb.exe19⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jdddv.exec:\jdddv.exe20⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ffllrrx.exec:\ffllrrx.exe21⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1xlfffl.exec:\1xlfffl.exe22⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jdvdv.exec:\jdvdv.exe23⤵
- Executes dropped EXE
PID:792 -
\??\c:\xrrlffl.exec:\xrrlffl.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bthnnh.exec:\bthnnh.exe25⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlffrlx.exec:\rlffrlx.exe26⤵
- Executes dropped EXE
PID:836 -
\??\c:\rfllxrr.exec:\rfllxrr.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pdvvj.exec:\pdvvj.exe28⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5lflxfr.exec:\5lflxfr.exe29⤵
- Executes dropped EXE
PID:396 -
\??\c:\vvpvd.exec:\vvpvd.exe30⤵
- Executes dropped EXE
PID:1604 -
\??\c:\fxlrflr.exec:\fxlrflr.exe31⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bthtbt.exec:\bthtbt.exe32⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nbtbhh.exec:\nbtbhh.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rlfflfl.exec:\rlfflfl.exe34⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7rrrxxl.exec:\7rrrxxl.exe35⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9ntbhn.exec:\9ntbhn.exe36⤵
- Executes dropped EXE
PID:2436 -
\??\c:\7jvdj.exec:\7jvdj.exe37⤵
- Executes dropped EXE
PID:344 -
\??\c:\5llffll.exec:\5llffll.exe38⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bthbhh.exec:\bthbhh.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hbhhhb.exec:\hbhhhb.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\djppd.exec:\djppd.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3xxxfll.exec:\3xxxfll.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfrxllr.exec:\lfrxllr.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hbnntt.exec:\hbnntt.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vpdjv.exec:\vpdjv.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:768 -
\??\c:\vpddv.exec:\vpddv.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxlfffx.exec:\fxlfffx.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhthtb.exec:\nhthtb.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1nbhnt.exec:\1nbhnt.exe49⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pdvdd.exec:\pdvdd.exe50⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1xrllll.exec:\1xrllll.exe51⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bbntnn.exec:\bbntnn.exe52⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bhnhhb.exec:\bhnhhb.exe53⤵
- Executes dropped EXE
PID:1236 -
\??\c:\5vdvd.exec:\5vdvd.exe54⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xxrxlll.exec:\xxrxlll.exe55⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9nhntt.exec:\9nhntt.exe56⤵
- Executes dropped EXE
PID:1196 -
\??\c:\btnbnt.exec:\btnbnt.exe57⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3jvvp.exec:\3jvvp.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xlxfrrr.exec:\xlxfrrr.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rfrrfxl.exec:\rfrrfxl.exe60⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bhnhhb.exec:\bhnhhb.exe61⤵
- Executes dropped EXE
PID:1400 -
\??\c:\jvjdd.exec:\jvjdd.exe62⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3vdjd.exec:\3vdjd.exe63⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3flfllr.exec:\3flfllr.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nbnntn.exec:\nbnntn.exe65⤵
- Executes dropped EXE
PID:596 -
\??\c:\jjdjv.exec:\jjdjv.exe66⤵PID:1704
-
\??\c:\pdpvp.exec:\pdpvp.exe67⤵PID:2408
-
\??\c:\rllfrrr.exec:\rllfrrr.exe68⤵PID:2932
-
\??\c:\nbhhhh.exec:\nbhhhh.exe69⤵PID:3052
-
\??\c:\tnthnn.exec:\tnthnn.exe70⤵PID:1604
-
\??\c:\dpvvd.exec:\dpvvd.exe71⤵PID:2052
-
\??\c:\lfffxxx.exec:\lfffxxx.exe72⤵PID:2288
-
\??\c:\9rxrrrx.exec:\9rxrrrx.exe73⤵PID:2120
-
\??\c:\3tbhnn.exec:\3tbhnn.exe74⤵PID:2800
-
\??\c:\jvjpp.exec:\jvjpp.exe75⤵PID:2116
-
\??\c:\ffxlrfr.exec:\ffxlrfr.exe76⤵PID:3060
-
\??\c:\7lxxfff.exec:\7lxxfff.exe77⤵PID:2336
-
\??\c:\bnbbhh.exec:\bnbbhh.exe78⤵PID:2708
-
\??\c:\pdpjj.exec:\pdpjj.exe79⤵PID:344
-
\??\c:\jvjdv.exec:\jvjdv.exe80⤵PID:2768
-
\??\c:\9rxxlxf.exec:\9rxxlxf.exe81⤵PID:2720
-
\??\c:\tnbbhh.exec:\tnbbhh.exe82⤵PID:2848
-
\??\c:\9hbhhh.exec:\9hbhhh.exe83⤵PID:2184
-
\??\c:\pjddd.exec:\pjddd.exe84⤵PID:284
-
\??\c:\jdppv.exec:\jdppv.exe85⤵PID:2464
-
\??\c:\7frllll.exec:\7frllll.exe86⤵
- System Location Discovery: System Language Discovery
PID:828 -
\??\c:\tthnhb.exec:\tthnhb.exe87⤵PID:1968
-
\??\c:\vdpvv.exec:\vdpvv.exe88⤵PID:1356
-
\??\c:\dpdvd.exec:\dpdvd.exe89⤵PID:1960
-
\??\c:\xrlflxf.exec:\xrlflxf.exe90⤵PID:1272
-
\??\c:\frffrrr.exec:\frffrrr.exe91⤵PID:2324
-
\??\c:\hhtbtt.exec:\hhtbtt.exe92⤵PID:664
-
\??\c:\vpddv.exec:\vpddv.exe93⤵PID:1948
-
\??\c:\jjvvj.exec:\jjvvj.exe94⤵PID:1352
-
\??\c:\rfrrllr.exec:\rfrrllr.exe95⤵PID:2312
-
\??\c:\7tthbb.exec:\7tthbb.exe96⤵PID:1680
-
\??\c:\nhhbbb.exec:\nhhbbb.exe97⤵PID:1708
-
\??\c:\1vjjd.exec:\1vjjd.exe98⤵PID:2844
-
\??\c:\xrfxfxr.exec:\xrfxfxr.exe99⤵PID:2824
-
\??\c:\3xrlxxx.exec:\3xrlxxx.exe100⤵PID:2756
-
\??\c:\nhtnnn.exec:\nhtnnn.exe101⤵PID:688
-
\??\c:\vvvvp.exec:\vvvvp.exe102⤵PID:2952
-
\??\c:\djpjp.exec:\djpjp.exe103⤵PID:2608
-
\??\c:\7lxxxxf.exec:\7lxxxxf.exe104⤵PID:1400
-
\??\c:\7thnnt.exec:\7thnnt.exe105⤵PID:1536
-
\??\c:\tthhth.exec:\tthhth.exe106⤵PID:1784
-
\??\c:\vjvpv.exec:\vjvpv.exe107⤵PID:1468
-
\??\c:\fxlllfr.exec:\fxlllfr.exe108⤵PID:2080
-
\??\c:\xrxlllr.exec:\xrxlllr.exe109⤵PID:1844
-
\??\c:\nhbbnn.exec:\nhbbnn.exe110⤵PID:1584
-
\??\c:\vpdjd.exec:\vpdjd.exe111⤵PID:2932
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe112⤵PID:2948
-
\??\c:\3lrrxxx.exec:\3lrrxxx.exe113⤵PID:3048
-
\??\c:\nhbbtn.exec:\nhbbtn.exe114⤵PID:1788
-
\??\c:\tnbhtt.exec:\tnbhtt.exe115⤵PID:2452
-
\??\c:\pdvvd.exec:\pdvvd.exe116⤵PID:2136
-
\??\c:\fxrfffr.exec:\fxrfffr.exe117⤵PID:2388
-
\??\c:\5thhnt.exec:\5thhnt.exe118⤵PID:1628
-
\??\c:\btnttb.exec:\btnttb.exe119⤵PID:2460
-
\??\c:\1vjjp.exec:\1vjjp.exe120⤵PID:2068
-
\??\c:\dpvvd.exec:\dpvvd.exe121⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-