Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:32
Behavioral task
behavioral1
Sample
ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe
-
Size
335KB
-
MD5
e4a18e98a4250eb70843b8abe25ca690
-
SHA1
92bd89ea7f7d47c4e4643ed9662ee6fb3301a7f1
-
SHA256
ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656
-
SHA512
4bb6b174f1838ff69bd6549691d33a3bb6319ff52f9e1de0be37de8d90cfdcd9c307f877af88cf633d94ab52d20dc66f8fdb69b54b176c5d14228701ae87d063
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR/:R4wFHoSHYHUrAwfMp3CDR/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2908-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/788-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-341-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2736-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-559-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2992-592-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-823-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-956-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2516-986-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1012-998-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-1004-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1496-1056-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2688-1144-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-15214-0x00000000778E0000-0x00000000779FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2908 dvjjv.exe 2320 djjjv.exe 2108 xrflrxx.exe 2088 tthbhh.exe 2480 htbbnn.exe 2828 5jpvd.exe 2768 1lrrxfx.exe 2776 7flflff.exe 1056 9tbnbb.exe 2892 tntbhh.exe 2644 jvdjv.exe 2224 9lrrxxx.exe 1292 7thnnn.exe 576 pdjjp.exe 1824 fxrfffl.exe 1732 bnbtnn.exe 1804 jvjpv.exe 1884 5xfffff.exe 1896 rfxllrr.exe 1780 3frxffl.exe 2308 bthhnn.exe 2944 tnbhtt.exe 2212 rxffxff.exe 2140 btbhhn.exe 788 jdvdj.exe 2116 9xfrflr.exe 1696 bhbbhn.exe 1552 rxlrxxf.exe 2016 xrlrxlx.exe 2208 nttnnh.exe 1340 vjvvd.exe 896 9tnttt.exe 1312 bnhnnt.exe 1512 9xxfllr.exe 800 5frxrfl.exe 3020 hbthhn.exe 2220 bthntt.exe 2108 vjppp.exe 2552 5lfflrx.exe 2088 xrxxllr.exe 2836 bthnbt.exe 2864 3pdvd.exe 2768 3vjdd.exe 2648 3lfxxff.exe 2732 tnhtht.exe 2848 1bnhnh.exe 1612 pdjjj.exe 2968 lxrrxxf.exe 2636 lfllrlr.exe 2736 btbbhb.exe 3060 bnbbhh.exe 2632 jdppv.exe 1536 dvpvj.exe 1872 lxlllfl.exe 2192 llffrxl.exe 1800 bthntt.exe 2144 thnhnh.exe 2524 1jjpv.exe 820 7frrxfl.exe 1432 3rrxlfr.exe 1976 hhbhnt.exe 1972 3tbttn.exe 1016 vpvjj.exe 1768 5lfrrxf.exe -
resource yara_rule behavioral1/memory/2404-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-5.dat upx behavioral1/memory/2320-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cc9-18.dat upx behavioral1/memory/2908-17-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2908-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cd1-26.dat upx behavioral1/memory/2088-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ce5-36.dat upx behavioral1/memory/2828-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d2a-67.dat upx behavioral1/memory/2776-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000167dc-75.dat upx behavioral1/files/0x0006000000016a47-84.dat upx behavioral1/memory/2892-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c3d-91.dat upx behavioral1/files/0x0006000000016c4e-98.dat upx behavioral1/memory/2224-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1292-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c58-107.dat upx behavioral1/files/0x0006000000016ca2-115.dat upx behavioral1/files/0x0006000000016cd3-121.dat upx behavioral1/memory/1056-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d0e-59.dat upx behavioral1/memory/2768-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d04-51.dat upx behavioral1/files/0x0007000000015cf2-44.dat upx behavioral1/memory/2108-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2320-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2404-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cfe-129.dat upx behavioral1/memory/1804-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d0b-137.dat upx behavioral1/files/0x0006000000016d1b-152.dat upx behavioral1/memory/1884-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d13-145.dat upx behavioral1/memory/1780-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d24-162.dat upx behavioral1/memory/1896-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d2e-170.dat upx behavioral1/files/0x0006000000016d36-178.dat upx behavioral1/files/0x0006000000016d3f-184.dat upx behavioral1/memory/2140-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015b6e-193.dat upx behavioral1/memory/788-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d47-200.dat upx behavioral1/memory/788-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d50-210.dat upx behavioral1/files/0x0006000000016d9f-216.dat upx behavioral1/files/0x0006000000016dad-224.dat upx behavioral1/files/0x0006000000016dc8-230.dat upx behavioral1/files/0x0006000000016e74-239.dat upx behavioral1/files/0x0006000000016f9c-245.dat upx behavioral1/memory/896-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001739a-255.dat upx behavioral1/memory/1312-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/800-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-358-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hththt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2908 2404 ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe 30 PID 2404 wrote to memory of 2908 2404 ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe 30 PID 2404 wrote to memory of 2908 2404 ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe 30 PID 2404 wrote to memory of 2908 2404 ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe 30 PID 2908 wrote to memory of 2320 2908 dvjjv.exe 31 PID 2908 wrote to memory of 2320 2908 dvjjv.exe 31 PID 2908 wrote to memory of 2320 2908 dvjjv.exe 31 PID 2908 wrote to memory of 2320 2908 dvjjv.exe 31 PID 2320 wrote to memory of 2108 2320 djjjv.exe 32 PID 2320 wrote to memory of 2108 2320 djjjv.exe 32 PID 2320 wrote to memory of 2108 2320 djjjv.exe 32 PID 2320 wrote to memory of 2108 2320 djjjv.exe 32 PID 2108 wrote to memory of 2088 2108 xrflrxx.exe 33 PID 2108 wrote to memory of 2088 2108 xrflrxx.exe 33 PID 2108 wrote to memory of 2088 2108 xrflrxx.exe 33 PID 2108 wrote to memory of 2088 2108 xrflrxx.exe 33 PID 2088 wrote to memory of 2480 2088 tthbhh.exe 34 PID 2088 wrote to memory of 2480 2088 tthbhh.exe 34 PID 2088 wrote to memory of 2480 2088 tthbhh.exe 34 PID 2088 wrote to memory of 2480 2088 tthbhh.exe 34 PID 2480 wrote to memory of 2828 2480 htbbnn.exe 35 PID 2480 wrote to memory of 2828 2480 htbbnn.exe 35 PID 2480 wrote to memory of 2828 2480 htbbnn.exe 35 PID 2480 wrote to memory of 2828 2480 htbbnn.exe 35 PID 2828 wrote to memory of 2768 2828 5jpvd.exe 36 PID 2828 wrote to memory of 2768 2828 5jpvd.exe 36 PID 2828 wrote to memory of 2768 2828 5jpvd.exe 36 PID 2828 wrote to memory of 2768 2828 5jpvd.exe 36 PID 2768 wrote to memory of 2776 2768 1lrrxfx.exe 37 PID 2768 wrote to memory of 2776 2768 1lrrxfx.exe 37 PID 2768 wrote to memory of 2776 2768 1lrrxfx.exe 37 PID 2768 wrote to memory of 2776 2768 1lrrxfx.exe 37 PID 2776 wrote to memory of 1056 2776 7flflff.exe 38 PID 2776 wrote to memory of 1056 2776 7flflff.exe 38 PID 2776 wrote to memory of 1056 2776 7flflff.exe 38 PID 2776 wrote to memory of 1056 2776 7flflff.exe 38 PID 1056 wrote to memory of 2892 1056 9tbnbb.exe 39 PID 1056 wrote to memory of 2892 1056 9tbnbb.exe 39 PID 1056 wrote to memory of 2892 1056 9tbnbb.exe 39 PID 1056 wrote to memory of 2892 1056 9tbnbb.exe 39 PID 2892 wrote to memory of 2644 2892 tntbhh.exe 40 PID 2892 wrote to memory of 2644 2892 tntbhh.exe 40 PID 2892 wrote to memory of 2644 2892 tntbhh.exe 40 PID 2892 wrote to memory of 2644 2892 tntbhh.exe 40 PID 2644 wrote to memory of 2224 2644 jvdjv.exe 41 PID 2644 wrote to memory of 2224 2644 jvdjv.exe 41 PID 2644 wrote to memory of 2224 2644 jvdjv.exe 41 PID 2644 wrote to memory of 2224 2644 jvdjv.exe 41 PID 2224 wrote to memory of 1292 2224 9lrrxxx.exe 42 PID 2224 wrote to memory of 1292 2224 9lrrxxx.exe 42 PID 2224 wrote to memory of 1292 2224 9lrrxxx.exe 42 PID 2224 wrote to memory of 1292 2224 9lrrxxx.exe 42 PID 1292 wrote to memory of 576 1292 7thnnn.exe 43 PID 1292 wrote to memory of 576 1292 7thnnn.exe 43 PID 1292 wrote to memory of 576 1292 7thnnn.exe 43 PID 1292 wrote to memory of 576 1292 7thnnn.exe 43 PID 576 wrote to memory of 1824 576 pdjjp.exe 44 PID 576 wrote to memory of 1824 576 pdjjp.exe 44 PID 576 wrote to memory of 1824 576 pdjjp.exe 44 PID 576 wrote to memory of 1824 576 pdjjp.exe 44 PID 1824 wrote to memory of 1732 1824 fxrfffl.exe 45 PID 1824 wrote to memory of 1732 1824 fxrfffl.exe 45 PID 1824 wrote to memory of 1732 1824 fxrfffl.exe 45 PID 1824 wrote to memory of 1732 1824 fxrfffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe"C:\Users\Admin\AppData\Local\Temp\ee0866533d2cb617b6b053cdb25128640ee3c0cf5950522ca3389790773e2656N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\dvjjv.exec:\dvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\djjjv.exec:\djjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xrflrxx.exec:\xrflrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\tthbhh.exec:\tthbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\htbbnn.exec:\htbbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\5jpvd.exec:\5jpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1lrrxfx.exec:\1lrrxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7flflff.exec:\7flflff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\9tbnbb.exec:\9tbnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\tntbhh.exec:\tntbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\jvdjv.exec:\jvdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9lrrxxx.exec:\9lrrxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\7thnnn.exec:\7thnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\pdjjp.exec:\pdjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\fxrfffl.exec:\fxrfffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\bnbtnn.exec:\bnbtnn.exe17⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jvjpv.exec:\jvjpv.exe18⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5xfffff.exec:\5xfffff.exe19⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rfxllrr.exec:\rfxllrr.exe20⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3frxffl.exec:\3frxffl.exe21⤵
- Executes dropped EXE
PID:1780 -
\??\c:\bthhnn.exec:\bthhnn.exe22⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tnbhtt.exec:\tnbhtt.exe23⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rxffxff.exec:\rxffxff.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\btbhhn.exec:\btbhhn.exe25⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jdvdj.exec:\jdvdj.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\9xfrflr.exec:\9xfrflr.exe27⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bhbbhn.exec:\bhbbhn.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rxlrxxf.exec:\rxlrxxf.exe29⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nttnnh.exec:\nttnnh.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vjvvd.exec:\vjvvd.exe32⤵
- Executes dropped EXE
PID:1340 -
\??\c:\9tnttt.exec:\9tnttt.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\bnhnnt.exec:\bnhnnt.exe34⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9xxfllr.exec:\9xxfllr.exe35⤵
- Executes dropped EXE
PID:1512 -
\??\c:\5frxrfl.exec:\5frxrfl.exe36⤵
- Executes dropped EXE
PID:800 -
\??\c:\hbthhn.exec:\hbthhn.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bthntt.exec:\bthntt.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\vjppp.exec:\vjppp.exe39⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5lfflrx.exec:\5lfflrx.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xrxxllr.exec:\xrxxllr.exe41⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bthnbt.exec:\bthnbt.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3pdvd.exec:\3pdvd.exe43⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3vjdd.exec:\3vjdd.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3lfxxff.exec:\3lfxxff.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnhtht.exec:\tnhtht.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1bnhnh.exec:\1bnhnh.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pdjjj.exec:\pdjjj.exe48⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lfllrlr.exec:\lfllrlr.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btbbhb.exec:\btbbhb.exe51⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bnbbhh.exec:\bnbbhh.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jdppv.exec:\jdppv.exe53⤵
- Executes dropped EXE
PID:2632 -
\??\c:\dvpvj.exec:\dvpvj.exe54⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lxlllfl.exec:\lxlllfl.exe55⤵
- Executes dropped EXE
PID:1872 -
\??\c:\llffrxl.exec:\llffrxl.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bthntt.exec:\bthntt.exe57⤵
- Executes dropped EXE
PID:1800 -
\??\c:\thnhnh.exec:\thnhnh.exe58⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1jjpv.exec:\1jjpv.exe59⤵
- Executes dropped EXE
PID:2524 -
\??\c:\7frrxfl.exec:\7frrxfl.exe60⤵
- Executes dropped EXE
PID:820 -
\??\c:\3rrxlfr.exec:\3rrxlfr.exe61⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hhbhnt.exec:\hhbhnt.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3tbttn.exec:\3tbttn.exe63⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vpvjj.exec:\vpvjj.exe64⤵
- Executes dropped EXE
PID:1016 -
\??\c:\5lfrrxf.exec:\5lfrrxf.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\9xfxxlr.exec:\9xfxxlr.exe66⤵PID:3032
-
\??\c:\nnhhnn.exec:\nnhhnn.exe67⤵PID:2944
-
\??\c:\7thbbb.exec:\7thbbb.exe68⤵PID:2912
-
\??\c:\jvjvd.exec:\jvjvd.exe69⤵PID:2304
-
\??\c:\ffxrfxl.exec:\ffxrfxl.exe70⤵PID:2516
-
\??\c:\xlrlrlx.exec:\xlrlrlx.exe71⤵PID:1540
-
\??\c:\tnbbnn.exec:\tnbbnn.exe72⤵PID:788
-
\??\c:\hbthhh.exec:\hbthhh.exe73⤵PID:1668
-
\??\c:\vjpjp.exec:\vjpjp.exe74⤵PID:1560
-
\??\c:\pdjdj.exec:\pdjdj.exe75⤵PID:1656
-
\??\c:\xxlllfl.exec:\xxlllfl.exe76⤵PID:1036
-
\??\c:\nhhnnt.exec:\nhhnnt.exe77⤵PID:2272
-
\??\c:\thtnnh.exec:\thtnnh.exe78⤵PID:2984
-
\??\c:\jdppp.exec:\jdppp.exe79⤵PID:2564
-
\??\c:\lxfflfr.exec:\lxfflfr.exe80⤵PID:2264
-
\??\c:\7rfxxfl.exec:\7rfxxfl.exe81⤵PID:108
-
\??\c:\5bnttt.exec:\5bnttt.exe82⤵PID:1496
-
\??\c:\5tbtbb.exec:\5tbtbb.exe83⤵PID:2580
-
\??\c:\dvddd.exec:\dvddd.exe84⤵PID:800
-
\??\c:\lrxlllr.exec:\lrxlllr.exe85⤵
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\xrffllr.exec:\xrffllr.exe86⤵PID:1728
-
\??\c:\hhthtb.exec:\hhthtb.exe87⤵PID:2536
-
\??\c:\1ntbbb.exec:\1ntbbb.exe88⤵PID:1164
-
\??\c:\jvjdd.exec:\jvjdd.exe89⤵PID:2088
-
\??\c:\dvdpd.exec:\dvdpd.exe90⤵PID:2836
-
\??\c:\fflfxll.exec:\fflfxll.exe91⤵PID:2820
-
\??\c:\bthtbt.exec:\bthtbt.exe92⤵PID:2760
-
\??\c:\hbhbtn.exec:\hbhbtn.exe93⤵PID:1792
-
\??\c:\7dpdj.exec:\7dpdj.exe94⤵PID:2992
-
\??\c:\7nbhnn.exec:\7nbhnn.exe95⤵PID:2092
-
\??\c:\nhnbhh.exec:\nhnbhh.exe96⤵PID:2668
-
\??\c:\ddppp.exec:\ddppp.exe97⤵PID:2640
-
\??\c:\xlrlllr.exec:\xlrlllr.exe98⤵PID:2968
-
\??\c:\9fxxffr.exec:\9fxxffr.exe99⤵PID:2628
-
\??\c:\nbntbt.exec:\nbntbt.exe100⤵PID:2660
-
\??\c:\nhbbnn.exec:\nhbbnn.exe101⤵PID:2224
-
\??\c:\jvjjd.exec:\jvjjd.exe102⤵PID:2028
-
\??\c:\dpvvd.exec:\dpvvd.exe103⤵PID:1124
-
\??\c:\xrxffff.exec:\xrxffff.exe104⤵PID:1480
-
\??\c:\5hbbhh.exec:\5hbbhh.exe105⤵PID:1388
-
\??\c:\1btbhn.exec:\1btbhn.exe106⤵PID:1296
-
\??\c:\9dppj.exec:\9dppj.exe107⤵PID:1844
-
\??\c:\9pppj.exec:\9pppj.exe108⤵PID:1284
-
\??\c:\rrrflxr.exec:\rrrflxr.exe109⤵PID:2444
-
\??\c:\bnbbhh.exec:\bnbbhh.exe110⤵PID:820
-
\??\c:\hbttnt.exec:\hbttnt.exe111⤵PID:1272
-
\??\c:\7vjdj.exec:\7vjdj.exe112⤵PID:1628
-
\??\c:\jvvvv.exec:\jvvvv.exe113⤵PID:2956
-
\??\c:\flffxxf.exec:\flffxxf.exe114⤵PID:740
-
\??\c:\3rfxffl.exec:\3rfxffl.exe115⤵PID:2512
-
\??\c:\hbhhhb.exec:\hbhhhb.exe116⤵PID:2308
-
\??\c:\jjdvp.exec:\jjdvp.exe117⤵PID:2944
-
\??\c:\jjjjd.exec:\jjjjd.exe118⤵PID:2232
-
\??\c:\xrfxflr.exec:\xrfxflr.exe119⤵PID:1256
-
\??\c:\rlllllx.exec:\rlllllx.exe120⤵PID:1624
-
\??\c:\9hhbbb.exec:\9hhbbb.exe121⤵PID:2008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-