Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe
-
Size
453KB
-
MD5
f4aa05e3d665e90e07ccb953d0548ab2
-
SHA1
95a037523541999335985290daf1cdfc10a00777
-
SHA256
ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc
-
SHA512
76fff6aa6d8c542a3464f1b53e9ac7d19eae0de39aefdb4389fe960344c4214185939074015b1a4427e9ba8a553de5465a5ec396c233cd7537a591514c4de029
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2472-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-333-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1748-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-393-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1392-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-523-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1364-525-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1364-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-546-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3000-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-657-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1056-723-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1740-730-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 lxfllxf.exe 1808 jdppv.exe 2072 9lffrxx.exe 2104 1nhhnh.exe 2956 rxxfrxl.exe 1244 rflrxff.exe 2792 dppvp.exe 2856 jjdpd.exe 2596 5thtbh.exe 2724 7pvpv.exe 2592 rlrlxrr.exe 2800 htbbbt.exe 1324 jvdjj.exe 1048 fxrflrf.exe 1256 9pjjp.exe 1968 rfllllr.exe 1680 nbntbh.exe 1404 xlxxxrr.exe 2840 tnnntb.exe 1936 dvddp.exe 2908 hhnnnt.exe 2900 5dpvd.exe 1640 ffxlxxf.exe 1700 nntbnn.exe 1748 vjddj.exe 1552 rrlrflx.exe 2528 bhnbnb.exe 600 bhnntt.exe 2284 rlflxfr.exe 3000 hhbnbh.exe 2972 9ddvj.exe 1616 vpjpd.exe 2052 7ntntb.exe 1912 pjvjj.exe 2372 ppvdd.exe 2132 xrlrxfr.exe 2120 hnnbnb.exe 2880 3nbbnt.exe 2708 pjppd.exe 1244 1rflflf.exe 2860 frrrxfl.exe 2948 hnhhnt.exe 2692 jdvvd.exe 2684 dvpjp.exe 2636 jjjdv.exe 2624 djddp.exe 684 lrllxxl.exe 1392 3bhntb.exe 1812 fllxrxr.exe 760 nhhbhn.exe 1256 ddpjv.exe 1596 xxxlrxf.exe 1620 bhhtnt.exe 1460 lfxfrxl.exe 1664 fxrxlrf.exe 1072 ttnbbn.exe 2924 vpjjj.exe 2228 vjvpv.exe 2428 rflxlfl.exe 2168 nnttbb.exe 448 pdpjp.exe 1564 7pjjd.exe 872 lfxxffr.exe 1364 rlflllr.exe -
resource yara_rule behavioral1/memory/2472-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-622-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2464-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-657-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3068-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-788-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2064 2472 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 30 PID 2472 wrote to memory of 2064 2472 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 30 PID 2472 wrote to memory of 2064 2472 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 30 PID 2472 wrote to memory of 2064 2472 ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe 30 PID 2064 wrote to memory of 1808 2064 lxfllxf.exe 31 PID 2064 wrote to memory of 1808 2064 lxfllxf.exe 31 PID 2064 wrote to memory of 1808 2064 lxfllxf.exe 31 PID 2064 wrote to memory of 1808 2064 lxfllxf.exe 31 PID 1808 wrote to memory of 2072 1808 jdppv.exe 32 PID 1808 wrote to memory of 2072 1808 jdppv.exe 32 PID 1808 wrote to memory of 2072 1808 jdppv.exe 32 PID 1808 wrote to memory of 2072 1808 jdppv.exe 32 PID 2072 wrote to memory of 2104 2072 9lffrxx.exe 33 PID 2072 wrote to memory of 2104 2072 9lffrxx.exe 33 PID 2072 wrote to memory of 2104 2072 9lffrxx.exe 33 PID 2072 wrote to memory of 2104 2072 9lffrxx.exe 33 PID 2104 wrote to memory of 2956 2104 1nhhnh.exe 34 PID 2104 wrote to memory of 2956 2104 1nhhnh.exe 34 PID 2104 wrote to memory of 2956 2104 1nhhnh.exe 34 PID 2104 wrote to memory of 2956 2104 1nhhnh.exe 34 PID 2956 wrote to memory of 1244 2956 rxxfrxl.exe 69 PID 2956 wrote to memory of 1244 2956 rxxfrxl.exe 69 PID 2956 wrote to memory of 1244 2956 rxxfrxl.exe 69 PID 2956 wrote to memory of 1244 2956 rxxfrxl.exe 69 PID 1244 wrote to memory of 2792 1244 rflrxff.exe 36 PID 1244 wrote to memory of 2792 1244 rflrxff.exe 36 PID 1244 wrote to memory of 2792 1244 rflrxff.exe 36 PID 1244 wrote to memory of 2792 1244 rflrxff.exe 36 PID 2792 wrote to memory of 2856 2792 dppvp.exe 37 PID 2792 wrote to memory of 2856 2792 dppvp.exe 37 PID 2792 wrote to memory of 2856 2792 dppvp.exe 37 PID 2792 wrote to memory of 2856 2792 dppvp.exe 37 PID 2856 wrote to memory of 2596 2856 jjdpd.exe 38 PID 2856 wrote to memory of 2596 2856 jjdpd.exe 38 PID 2856 wrote to memory of 2596 2856 jjdpd.exe 38 PID 2856 wrote to memory of 2596 2856 jjdpd.exe 38 PID 2596 wrote to memory of 2724 2596 5thtbh.exe 39 PID 2596 wrote to memory of 2724 2596 5thtbh.exe 39 PID 2596 wrote to memory of 2724 2596 5thtbh.exe 39 PID 2596 wrote to memory of 2724 2596 5thtbh.exe 39 PID 2724 wrote to memory of 2592 2724 7pvpv.exe 40 PID 2724 wrote to memory of 2592 2724 7pvpv.exe 40 PID 2724 wrote to memory of 2592 2724 7pvpv.exe 40 PID 2724 wrote to memory of 2592 2724 7pvpv.exe 40 PID 2592 wrote to memory of 2800 2592 rlrlxrr.exe 41 PID 2592 wrote to memory of 2800 2592 rlrlxrr.exe 41 PID 2592 wrote to memory of 2800 2592 rlrlxrr.exe 41 PID 2592 wrote to memory of 2800 2592 rlrlxrr.exe 41 PID 2800 wrote to memory of 1324 2800 htbbbt.exe 42 PID 2800 wrote to memory of 1324 2800 htbbbt.exe 42 PID 2800 wrote to memory of 1324 2800 htbbbt.exe 42 PID 2800 wrote to memory of 1324 2800 htbbbt.exe 42 PID 1324 wrote to memory of 1048 1324 jvdjj.exe 43 PID 1324 wrote to memory of 1048 1324 jvdjj.exe 43 PID 1324 wrote to memory of 1048 1324 jvdjj.exe 43 PID 1324 wrote to memory of 1048 1324 jvdjj.exe 43 PID 1048 wrote to memory of 1256 1048 fxrflrf.exe 44 PID 1048 wrote to memory of 1256 1048 fxrflrf.exe 44 PID 1048 wrote to memory of 1256 1048 fxrflrf.exe 44 PID 1048 wrote to memory of 1256 1048 fxrflrf.exe 44 PID 1256 wrote to memory of 1968 1256 9pjjp.exe 45 PID 1256 wrote to memory of 1968 1256 9pjjp.exe 45 PID 1256 wrote to memory of 1968 1256 9pjjp.exe 45 PID 1256 wrote to memory of 1968 1256 9pjjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe"C:\Users\Admin\AppData\Local\Temp\ea4f5635b2196ace8fc1f7dec8223c717591eb0854e98cd4c1b5149c6ea92cbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\lxfllxf.exec:\lxfllxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jdppv.exec:\jdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\9lffrxx.exec:\9lffrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\1nhhnh.exec:\1nhhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\rxxfrxl.exec:\rxxfrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rflrxff.exec:\rflrxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\dppvp.exec:\dppvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjdpd.exec:\jjdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5thtbh.exec:\5thtbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\7pvpv.exec:\7pvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlrlxrr.exec:\rlrlxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\htbbbt.exec:\htbbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jvdjj.exec:\jvdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\fxrflrf.exec:\fxrflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\9pjjp.exec:\9pjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\rfllllr.exec:\rfllllr.exe17⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbntbh.exec:\nbntbh.exe18⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xlxxxrr.exec:\xlxxxrr.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1404 -
\??\c:\tnnntb.exec:\tnnntb.exe20⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dvddp.exec:\dvddp.exe21⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hhnnnt.exec:\hhnnnt.exe22⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5dpvd.exec:\5dpvd.exe23⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ffxlxxf.exec:\ffxlxxf.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nntbnn.exec:\nntbnn.exe25⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vjddj.exec:\vjddj.exe26⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rrlrflx.exec:\rrlrflx.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bhnbnb.exec:\bhnbnb.exe28⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bhnntt.exec:\bhnntt.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\rlflxfr.exec:\rlflxfr.exe30⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hhbnbh.exec:\hhbnbh.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9ddvj.exec:\9ddvj.exe32⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vpjpd.exec:\vpjpd.exe33⤵
- Executes dropped EXE
PID:1616 -
\??\c:\7ntntb.exec:\7ntntb.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pjvjj.exec:\pjvjj.exe35⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ppvdd.exec:\ppvdd.exe36⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe37⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hnnbnb.exec:\hnnbnb.exe38⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3nbbnt.exec:\3nbbnt.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pjppd.exec:\pjppd.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1rflflf.exec:\1rflflf.exe41⤵
- Executes dropped EXE
PID:1244 -
\??\c:\frrrxfl.exec:\frrrxfl.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hnhhnt.exec:\hnhhnt.exe43⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jdvvd.exec:\jdvvd.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dvpjp.exec:\dvpjp.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjjdv.exec:\jjjdv.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\djddp.exec:\djddp.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lrllxxl.exec:\lrllxxl.exe48⤵
- Executes dropped EXE
PID:684 -
\??\c:\3bhntb.exec:\3bhntb.exe49⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fllxrxr.exec:\fllxrxr.exe50⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhhbhn.exec:\nhhbhn.exe51⤵
- Executes dropped EXE
PID:760 -
\??\c:\ddpjv.exec:\ddpjv.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xxxlrxf.exec:\xxxlrxf.exe53⤵
- Executes dropped EXE
PID:1596 -
\??\c:\bhhtnt.exec:\bhhtnt.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe55⤵
- Executes dropped EXE
PID:1460 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ttnbbn.exec:\ttnbbn.exe57⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vpjjj.exec:\vpjjj.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vjvpv.exec:\vjvpv.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rflxlfl.exec:\rflxlfl.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nnttbb.exec:\nnttbb.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pdpjp.exec:\pdpjp.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\7pjjd.exec:\7pjjd.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lfxxffr.exec:\lfxxffr.exe64⤵
- Executes dropped EXE
PID:872 -
\??\c:\rlflllr.exec:\rlflllr.exe65⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hthhhb.exec:\hthhhb.exe66⤵
- System Location Discovery: System Language Discovery
PID:932 -
\??\c:\dvjpv.exec:\dvjpv.exe67⤵PID:2220
-
\??\c:\pdjvv.exec:\pdjvv.exe68⤵PID:268
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe69⤵PID:2224
-
\??\c:\7nbtnh.exec:\7nbtnh.exe70⤵PID:2360
-
\??\c:\btnhnt.exec:\btnhnt.exe71⤵PID:2420
-
\??\c:\pjpvd.exec:\pjpvd.exe72⤵PID:3000
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe73⤵PID:2972
-
\??\c:\lfllrlr.exec:\lfllrlr.exe74⤵PID:2064
-
\??\c:\5hnnnn.exec:\5hnnnn.exe75⤵PID:2468
-
\??\c:\jdjdv.exec:\jdjdv.exe76⤵PID:2180
-
\??\c:\5pjdp.exec:\5pjdp.exe77⤵PID:1912
-
\??\c:\xxlllfl.exec:\xxlllfl.exe78⤵PID:2344
-
\??\c:\nbtttt.exec:\nbtttt.exe79⤵PID:2108
-
\??\c:\1jvvp.exec:\1jvvp.exe80⤵PID:3020
-
\??\c:\1djvv.exec:\1djvv.exe81⤵PID:2464
-
\??\c:\rfllllx.exec:\rfllllx.exe82⤵PID:3016
-
\??\c:\3bhhtt.exec:\3bhhtt.exe83⤵PID:2876
-
\??\c:\hnhbhb.exec:\hnhbhb.exe84⤵PID:3028
-
\??\c:\7vpjv.exec:\7vpjv.exe85⤵PID:2664
-
\??\c:\lrllxlf.exec:\lrllxlf.exe86⤵PID:2764
-
\??\c:\3rrlllr.exec:\3rrlllr.exe87⤵PID:2580
-
\??\c:\hhbthh.exec:\hhbthh.exe88⤵PID:2684
-
\??\c:\3pjjp.exec:\3pjjp.exe89⤵PID:1488
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe90⤵PID:2592
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe91⤵PID:1688
-
\??\c:\bbhthn.exec:\bbhthn.exe92⤵PID:956
-
\??\c:\htbbbh.exec:\htbbbh.exe93⤵PID:3068
-
\??\c:\7jppp.exec:\7jppp.exe94⤵PID:2096
-
\??\c:\xfxxlrf.exec:\xfxxlrf.exe95⤵PID:1056
-
\??\c:\btnhnn.exec:\btnhnn.exe96⤵PID:1740
-
\??\c:\hbbnbb.exec:\hbbnbb.exe97⤵PID:1840
-
\??\c:\ppddp.exec:\ppddp.exe98⤵PID:1148
-
\??\c:\djdjv.exec:\djdjv.exe99⤵PID:1792
-
\??\c:\1lfxxrr.exec:\1lfxxrr.exe100⤵PID:1940
-
\??\c:\5bnnhh.exec:\5bnnhh.exe101⤵PID:2408
-
\??\c:\9dvjp.exec:\9dvjp.exe102⤵PID:2620
-
\??\c:\ddvdj.exec:\ddvdj.exe103⤵PID:2904
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe104⤵PID:2168
-
\??\c:\5btnnt.exec:\5btnnt.exe105⤵PID:448
-
\??\c:\jddpv.exec:\jddpv.exe106⤵PID:2912
-
\??\c:\jdddp.exec:\jdddp.exe107⤵PID:872
-
\??\c:\5frlxrf.exec:\5frlxrf.exe108⤵PID:848
-
\??\c:\1xrfxff.exec:\1xrfxff.exe109⤵PID:2156
-
\??\c:\hhthbt.exec:\hhthbt.exe110⤵PID:1592
-
\??\c:\dddjp.exec:\dddjp.exe111⤵PID:2496
-
\??\c:\1xrxffr.exec:\1xrxffr.exe112⤵PID:980
-
\??\c:\rfrfflx.exec:\rfrfflx.exe113⤵PID:376
-
\??\c:\bhbhtt.exec:\bhbhtt.exe114⤵PID:2100
-
\??\c:\1ppdv.exec:\1ppdv.exe115⤵PID:532
-
\??\c:\dvdjv.exec:\dvdjv.exe116⤵PID:2080
-
\??\c:\frrffxx.exec:\frrffxx.exe117⤵PID:2988
-
\??\c:\frlxfll.exec:\frlxfll.exe118⤵PID:1992
-
\??\c:\hbnhhh.exec:\hbnhhh.exe119⤵PID:2068
-
\??\c:\jjddj.exec:\jjddj.exe120⤵PID:2440
-
\??\c:\pvjpv.exec:\pvjpv.exe121⤵PID:1660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-