Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe
-
Size
456KB
-
MD5
8fb5f6692d9909919dd6780b65403a80
-
SHA1
092d88cb7ee8861a46cace994165119633414b9d
-
SHA256
9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059
-
SHA512
4b3ea023b38f100010404b77c2518ba7a21d4f881b505fa08daf2b965adcbcfef7927b82fc641715eeefbc5f18e570ccff85711995125c630835351fd6aa5a1e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRe:q7Tc2NYHUrAwfMp3CDRe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1600-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-27-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-151-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1032-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-451-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2912-470-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2356-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-604-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2728-611-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2524-618-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2152-661-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-729-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2628 9nnbbb.exe 2896 pdvpd.exe 2712 1hbbhn.exe 2848 rrffrrf.exe 2568 nnbbhh.exe 2552 3jvvv.exe 2980 3bbhtt.exe 2336 ddvdj.exe 2240 3lfxxxf.exe 2164 7tnthn.exe 2820 ffxfllx.exe 2332 nthhhn.exe 636 3rlrxfr.exe 2592 btnnnn.exe 2952 pjdpv.exe 492 xrflrrx.exe 1032 dvjjv.exe 2396 5ffxlrx.exe 2180 bttthn.exe 2288 5vjdj.exe 2608 5rlxflf.exe 2172 1tttbh.exe 1736 rlllrxl.exe 1524 lfxfllx.exe 1616 dvppv.exe 1716 rlrfrxl.exe 1656 3vjvd.exe 2364 lllrfxl.exe 2448 1thnnt.exe 1852 dvppv.exe 896 5nhbnt.exe 1600 1vjdj.exe 1596 fxlllrl.exe 2784 tnhhnt.exe 2192 dvvvj.exe 2684 jdvdp.exe 3044 lffrrrx.exe 2848 bbtbhh.exe 2600 pjjdj.exe 2976 rfxfrxl.exe 2052 bbtbnn.exe 2968 jvjdj.exe 2336 9rllrxf.exe 2200 9fxxlrf.exe 2136 nhbnhh.exe 596 5dvdj.exe 2844 lrrfxlx.exe 1676 5frrflx.exe 2832 htnbhh.exe 1104 dvvpd.exe 2940 xfffxfx.exe 2952 1xrlllr.exe 320 hbtbnn.exe 1052 vpdpp.exe 2892 llfrflx.exe 2108 bnbbhn.exe 2912 dvjpv.exe 408 llfflrx.exe 2356 7rfflrf.exe 2340 hbhtbt.exe 1404 pjjjp.exe 316 3xrxffr.exe 872 thhbht.exe 1744 pjvjd.exe -
resource yara_rule behavioral1/memory/2628-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-27-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-348-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2968-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-470-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2356-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-604-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1672-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-777-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2628 1600 9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe 30 PID 1600 wrote to memory of 2628 1600 9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe 30 PID 1600 wrote to memory of 2628 1600 9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe 30 PID 1600 wrote to memory of 2628 1600 9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe 30 PID 2628 wrote to memory of 2896 2628 9nnbbb.exe 31 PID 2628 wrote to memory of 2896 2628 9nnbbb.exe 31 PID 2628 wrote to memory of 2896 2628 9nnbbb.exe 31 PID 2628 wrote to memory of 2896 2628 9nnbbb.exe 31 PID 2896 wrote to memory of 2712 2896 pdvpd.exe 32 PID 2896 wrote to memory of 2712 2896 pdvpd.exe 32 PID 2896 wrote to memory of 2712 2896 pdvpd.exe 32 PID 2896 wrote to memory of 2712 2896 pdvpd.exe 32 PID 2712 wrote to memory of 2848 2712 1hbbhn.exe 33 PID 2712 wrote to memory of 2848 2712 1hbbhn.exe 33 PID 2712 wrote to memory of 2848 2712 1hbbhn.exe 33 PID 2712 wrote to memory of 2848 2712 1hbbhn.exe 33 PID 2848 wrote to memory of 2568 2848 rrffrrf.exe 34 PID 2848 wrote to memory of 2568 2848 rrffrrf.exe 34 PID 2848 wrote to memory of 2568 2848 rrffrrf.exe 34 PID 2848 wrote to memory of 2568 2848 rrffrrf.exe 34 PID 2568 wrote to memory of 2552 2568 nnbbhh.exe 35 PID 2568 wrote to memory of 2552 2568 nnbbhh.exe 35 PID 2568 wrote to memory of 2552 2568 nnbbhh.exe 35 PID 2568 wrote to memory of 2552 2568 nnbbhh.exe 35 PID 2552 wrote to memory of 2980 2552 3jvvv.exe 36 PID 2552 wrote to memory of 2980 2552 3jvvv.exe 36 PID 2552 wrote to memory of 2980 2552 3jvvv.exe 36 PID 2552 wrote to memory of 2980 2552 3jvvv.exe 36 PID 2980 wrote to memory of 2336 2980 3bbhtt.exe 37 PID 2980 wrote to memory of 2336 2980 3bbhtt.exe 37 PID 2980 wrote to memory of 2336 2980 3bbhtt.exe 37 PID 2980 wrote to memory of 2336 2980 3bbhtt.exe 37 PID 2336 wrote to memory of 2240 2336 ddvdj.exe 38 PID 2336 wrote to memory of 2240 2336 ddvdj.exe 38 PID 2336 wrote to memory of 2240 2336 ddvdj.exe 38 PID 2336 wrote to memory of 2240 2336 ddvdj.exe 38 PID 2240 wrote to memory of 2164 2240 3lfxxxf.exe 39 PID 2240 wrote to memory of 2164 2240 3lfxxxf.exe 39 PID 2240 wrote to memory of 2164 2240 3lfxxxf.exe 39 PID 2240 wrote to memory of 2164 2240 3lfxxxf.exe 39 PID 2164 wrote to memory of 2820 2164 7tnthn.exe 40 PID 2164 wrote to memory of 2820 2164 7tnthn.exe 40 PID 2164 wrote to memory of 2820 2164 7tnthn.exe 40 PID 2164 wrote to memory of 2820 2164 7tnthn.exe 40 PID 2820 wrote to memory of 2332 2820 ffxfllx.exe 41 PID 2820 wrote to memory of 2332 2820 ffxfllx.exe 41 PID 2820 wrote to memory of 2332 2820 ffxfllx.exe 41 PID 2820 wrote to memory of 2332 2820 ffxfllx.exe 41 PID 2332 wrote to memory of 636 2332 nthhhn.exe 42 PID 2332 wrote to memory of 636 2332 nthhhn.exe 42 PID 2332 wrote to memory of 636 2332 nthhhn.exe 42 PID 2332 wrote to memory of 636 2332 nthhhn.exe 42 PID 636 wrote to memory of 2592 636 3rlrxfr.exe 43 PID 636 wrote to memory of 2592 636 3rlrxfr.exe 43 PID 636 wrote to memory of 2592 636 3rlrxfr.exe 43 PID 636 wrote to memory of 2592 636 3rlrxfr.exe 43 PID 2592 wrote to memory of 2952 2592 btnnnn.exe 44 PID 2592 wrote to memory of 2952 2592 btnnnn.exe 44 PID 2592 wrote to memory of 2952 2592 btnnnn.exe 44 PID 2592 wrote to memory of 2952 2592 btnnnn.exe 44 PID 2952 wrote to memory of 492 2952 pjdpv.exe 45 PID 2952 wrote to memory of 492 2952 pjdpv.exe 45 PID 2952 wrote to memory of 492 2952 pjdpv.exe 45 PID 2952 wrote to memory of 492 2952 pjdpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe"C:\Users\Admin\AppData\Local\Temp\9219a3239c6e5b34498a33c730b0dd03e441996b5ea6a1644a786b9ddedff059N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\9nnbbb.exec:\9nnbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\pdvpd.exec:\pdvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\1hbbhn.exec:\1hbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rrffrrf.exec:\rrffrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nnbbhh.exec:\nnbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\3jvvv.exec:\3jvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3bbhtt.exec:\3bbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\ddvdj.exec:\ddvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\3lfxxxf.exec:\3lfxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\7tnthn.exec:\7tnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\ffxfllx.exec:\ffxfllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nthhhn.exec:\nthhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\3rlrxfr.exec:\3rlrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\btnnnn.exec:\btnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\pjdpv.exec:\pjdpv.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xrflrrx.exec:\xrflrrx.exe17⤵
- Executes dropped EXE
PID:492 -
\??\c:\dvjjv.exec:\dvjjv.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5ffxlrx.exec:\5ffxlrx.exe19⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bttthn.exec:\bttthn.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5vjdj.exec:\5vjdj.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5rlxflf.exec:\5rlxflf.exe22⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1tttbh.exec:\1tttbh.exe23⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rlllrxl.exec:\rlllrxl.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lfxfllx.exec:\lfxfllx.exe25⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dvppv.exec:\dvppv.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3vjvd.exec:\3vjvd.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lllrfxl.exec:\lllrfxl.exe29⤵
- Executes dropped EXE
PID:2364 -
\??\c:\1thnnt.exec:\1thnnt.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dvppv.exec:\dvppv.exe31⤵
- Executes dropped EXE
PID:1852 -
\??\c:\5nhbnt.exec:\5nhbnt.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\1vjdj.exec:\1vjdj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1600 -
\??\c:\fxlllrl.exec:\fxlllrl.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tnhhnt.exec:\tnhhnt.exe35⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dvvvj.exec:\dvvvj.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdvdp.exec:\jdvdp.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lffrrrx.exec:\lffrrrx.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bbtbhh.exec:\bbtbhh.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjjdj.exec:\pjjdj.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rfxfrxl.exec:\rfxfrxl.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bbtbnn.exec:\bbtbnn.exe42⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jvjdj.exec:\jvjdj.exe43⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9rllrxf.exec:\9rllrxf.exe44⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9fxxlrf.exec:\9fxxlrf.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhbnhh.exec:\nhbnhh.exe46⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5dvdj.exec:\5dvdj.exe47⤵
- Executes dropped EXE
PID:596 -
\??\c:\lrrfxlx.exec:\lrrfxlx.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5frrflx.exec:\5frrflx.exe49⤵
- Executes dropped EXE
PID:1676 -
\??\c:\htnbhh.exec:\htnbhh.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvvpd.exec:\dvvpd.exe51⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xfffxfx.exec:\xfffxfx.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1xrlllr.exec:\1xrlllr.exe53⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbtbnn.exec:\hbtbnn.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\vpdpp.exec:\vpdpp.exe55⤵
- Executes dropped EXE
PID:1052 -
\??\c:\llfrflx.exec:\llfrflx.exe56⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bnbbhn.exec:\bnbbhn.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvjpv.exec:\dvjpv.exe58⤵
- Executes dropped EXE
PID:2912 -
\??\c:\llfflrx.exec:\llfflrx.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\7rfflrf.exec:\7rfflrf.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hbhtbt.exec:\hbhtbt.exe61⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pjjjp.exec:\pjjjp.exe62⤵
- Executes dropped EXE
PID:1404 -
\??\c:\3xrxffr.exec:\3xrxffr.exe63⤵
- Executes dropped EXE
PID:316 -
\??\c:\thhbht.exec:\thhbht.exe64⤵
- Executes dropped EXE
PID:872 -
\??\c:\pjvjd.exec:\pjvjd.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vjvpp.exec:\vjvpp.exe66⤵PID:2464
-
\??\c:\rxxxrrf.exec:\rxxxrrf.exe67⤵PID:2360
-
\??\c:\bnnnhb.exec:\bnnnhb.exe68⤵PID:2112
-
\??\c:\dvddd.exec:\dvddd.exe69⤵PID:1880
-
\??\c:\frfrrrx.exec:\frfrrrx.exe70⤵PID:1700
-
\??\c:\nbnnnb.exec:\nbnnnb.exe71⤵PID:1692
-
\??\c:\hbbtbt.exec:\hbbtbt.exe72⤵PID:1852
-
\??\c:\pppjj.exec:\pppjj.exe73⤵PID:1444
-
\??\c:\xlfllfx.exec:\xlfllfx.exe74⤵PID:2668
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe75⤵PID:2752
-
\??\c:\3hbbhh.exec:\3hbbhh.exe76⤵PID:2728
-
\??\c:\7dpjj.exec:\7dpjj.exe77⤵PID:2896
-
\??\c:\lxlffxr.exec:\lxlffxr.exe78⤵PID:2712
-
\??\c:\bhnbbt.exec:\bhnbbt.exe79⤵PID:2780
-
\??\c:\hbnttt.exec:\hbnttt.exe80⤵PID:2524
-
\??\c:\1pjpj.exec:\1pjpj.exe81⤵PID:2536
-
\??\c:\flrxlrx.exec:\flrxlrx.exe82⤵PID:1756
-
\??\c:\nbnhhb.exec:\nbnhhb.exe83⤵PID:860
-
\??\c:\jjdjd.exec:\jjdjd.exe84⤵PID:1044
-
\??\c:\ppvpp.exec:\ppvpp.exe85⤵PID:2380
-
\??\c:\3xfxrlr.exec:\3xfxrlr.exe86⤵PID:2488
-
\??\c:\nbttnh.exec:\nbttnh.exe87⤵PID:2152
-
\??\c:\bnbtth.exec:\bnbtth.exe88⤵PID:1672
-
\??\c:\vjjpv.exec:\vjjpv.exe89⤵PID:2820
-
\??\c:\rffrlfx.exec:\rffrlfx.exe90⤵PID:2844
-
\??\c:\xflflxr.exec:\xflflxr.exe91⤵PID:2756
-
\??\c:\nhtnnn.exec:\nhtnnn.exe92⤵PID:2592
-
\??\c:\nthhth.exec:\nthhth.exe93⤵PID:1636
-
\??\c:\vpjpp.exec:\vpjpp.exe94⤵PID:1308
-
\??\c:\rfrxffl.exec:\rfrxffl.exe95⤵PID:2664
-
\??\c:\bbthnh.exec:\bbthnh.exe96⤵PID:2368
-
\??\c:\thbnnn.exec:\thbnnn.exe97⤵PID:1256
-
\??\c:\vjvvd.exec:\vjvvd.exe98⤵PID:2232
-
\??\c:\rffxrll.exec:\rffxrll.exe99⤵PID:2476
-
\??\c:\hhnbnn.exec:\hhnbnn.exe100⤵PID:1860
-
\??\c:\bnbttt.exec:\bnbttt.exe101⤵PID:2236
-
\??\c:\vdvdp.exec:\vdvdp.exe102⤵PID:1004
-
\??\c:\fflrfxx.exec:\fflrfxx.exe103⤵PID:2172
-
\??\c:\lflfrlx.exec:\lflfrlx.exe104⤵PID:108
-
\??\c:\7bnnbt.exec:\7bnnbt.exe105⤵PID:3028
-
\??\c:\pvjvp.exec:\pvjvp.exe106⤵PID:776
-
\??\c:\lxlffxx.exec:\lxlffxx.exe107⤵PID:2464
-
\??\c:\rflffxf.exec:\rflffxf.exe108⤵PID:1492
-
\??\c:\3hnntb.exec:\3hnntb.exe109⤵PID:2496
-
\??\c:\9ddvv.exec:\9ddvv.exe110⤵PID:1880
-
\??\c:\9vdpp.exec:\9vdpp.exe111⤵PID:1960
-
\??\c:\rlrxrll.exec:\rlrxrll.exe112⤵PID:276
-
\??\c:\5hhbtt.exec:\5hhbtt.exe113⤵PID:896
-
\??\c:\hbtbbt.exec:\hbtbbt.exe114⤵PID:2716
-
\??\c:\vdpdd.exec:\vdpdd.exe115⤵PID:1640
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe116⤵PID:2752
-
\??\c:\rfrllfr.exec:\rfrllfr.exe117⤵PID:2652
-
\??\c:\ttbbnn.exec:\ttbbnn.exe118⤵PID:2548
-
\??\c:\3htntn.exec:\3htntn.exe119⤵PID:2688
-
\??\c:\7jdjv.exec:\7jdjv.exe120⤵PID:2576
-
\??\c:\xrflrxf.exec:\xrflrxf.exe121⤵PID:2696
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe122⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-