Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 17:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe
-
Size
454KB
-
MD5
ec8072b73ddb47055a3c41df0ae0458d
-
SHA1
f88d95bef7d73d65d818f70a9918f6b362e563d7
-
SHA256
9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2
-
SHA512
1da758e2e5ca471c82133563e452e67ece895bc6e8f44f8556eb6a9b067d262b1eef9e09bf6dcdbdf1d2f2bf7de325af39e46bba7a3793e1a5525e607f9d702d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2032-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-126-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/864-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-146-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/864-144-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1872-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-469-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2364-468-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/112-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-689-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-709-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1772-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-838-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1524 jjdjv.exe 2788 htbbhn.exe 2708 jpdpj.exe 2832 rfxxxxl.exe 2712 9pjvv.exe 2572 xrllrxf.exe 3056 hhbhtb.exe 2620 vjvjp.exe 2552 nnbhtt.exe 1276 7rfxxlf.exe 1648 rlxrxrr.exe 2968 thhttb.exe 3012 rrlxlfx.exe 2936 7lflrrx.exe 864 9vvdj.exe 1748 xrffrlx.exe 1872 pjdpv.exe 1272 frllflr.exe 2364 ttntbb.exe 1280 5dvvp.exe 2060 7frflfl.exe 628 nbnbnh.exe 1308 dvppv.exe 2332 fxrlxxx.exe 3008 hbtbnt.exe 2148 bthnhn.exe 1104 nnhntb.exe 652 7pjjd.exe 2460 btnttb.exe 1688 1vjpp.exe 1044 5xllrll.exe 2276 1nbbhb.exe 2684 flfrfrf.exe 1600 pdpvv.exe 2804 llrllfl.exe 2228 3llrxxx.exe 2720 9nntnt.exe 2772 ppjvj.exe 2632 fxxllrf.exe 2712 nhttbb.exe 2572 htbhth.exe 2212 dddpj.exe 3056 9fflxlr.exe 2540 7nhhtb.exe 1112 ntbnbb.exe 2452 9vvpv.exe 1060 3llfxlx.exe 2536 nbhtbh.exe 1132 7nhtbh.exe 2900 vppvv.exe 2220 xxxlxff.exe 568 btnbnt.exe 2188 vvjpj.exe 2160 5jvvj.exe 560 9rffflx.exe 2252 ttnnbn.exe 2420 bbtbnh.exe 2364 7dvdd.exe 2132 rxlxllf.exe 1624 tttbbh.exe 2480 5jvvp.exe 112 1rrlrrr.exe 1732 rrlrlrr.exe 716 1tnntb.exe -
resource yara_rule behavioral1/memory/2032-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-126-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/864-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-901-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1524 2032 9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe 30 PID 2032 wrote to memory of 1524 2032 9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe 30 PID 2032 wrote to memory of 1524 2032 9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe 30 PID 2032 wrote to memory of 1524 2032 9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe 30 PID 1524 wrote to memory of 2788 1524 jjdjv.exe 31 PID 1524 wrote to memory of 2788 1524 jjdjv.exe 31 PID 1524 wrote to memory of 2788 1524 jjdjv.exe 31 PID 1524 wrote to memory of 2788 1524 jjdjv.exe 31 PID 2788 wrote to memory of 2708 2788 htbbhn.exe 32 PID 2788 wrote to memory of 2708 2788 htbbhn.exe 32 PID 2788 wrote to memory of 2708 2788 htbbhn.exe 32 PID 2788 wrote to memory of 2708 2788 htbbhn.exe 32 PID 2708 wrote to memory of 2832 2708 jpdpj.exe 33 PID 2708 wrote to memory of 2832 2708 jpdpj.exe 33 PID 2708 wrote to memory of 2832 2708 jpdpj.exe 33 PID 2708 wrote to memory of 2832 2708 jpdpj.exe 33 PID 2832 wrote to memory of 2712 2832 rfxxxxl.exe 34 PID 2832 wrote to memory of 2712 2832 rfxxxxl.exe 34 PID 2832 wrote to memory of 2712 2832 rfxxxxl.exe 34 PID 2832 wrote to memory of 2712 2832 rfxxxxl.exe 34 PID 2712 wrote to memory of 2572 2712 9pjvv.exe 35 PID 2712 wrote to memory of 2572 2712 9pjvv.exe 35 PID 2712 wrote to memory of 2572 2712 9pjvv.exe 35 PID 2712 wrote to memory of 2572 2712 9pjvv.exe 35 PID 2572 wrote to memory of 3056 2572 xrllrxf.exe 36 PID 2572 wrote to memory of 3056 2572 xrllrxf.exe 36 PID 2572 wrote to memory of 3056 2572 xrllrxf.exe 36 PID 2572 wrote to memory of 3056 2572 xrllrxf.exe 36 PID 3056 wrote to memory of 2620 3056 hhbhtb.exe 37 PID 3056 wrote to memory of 2620 3056 hhbhtb.exe 37 PID 3056 wrote to memory of 2620 3056 hhbhtb.exe 37 PID 3056 wrote to memory of 2620 3056 hhbhtb.exe 37 PID 2620 wrote to memory of 2552 2620 vjvjp.exe 38 PID 2620 wrote to memory of 2552 2620 vjvjp.exe 38 PID 2620 wrote to memory of 2552 2620 vjvjp.exe 38 PID 2620 wrote to memory of 2552 2620 vjvjp.exe 38 PID 2552 wrote to memory of 1276 2552 nnbhtt.exe 39 PID 2552 wrote to memory of 1276 2552 nnbhtt.exe 39 PID 2552 wrote to memory of 1276 2552 nnbhtt.exe 39 PID 2552 wrote to memory of 1276 2552 nnbhtt.exe 39 PID 1276 wrote to memory of 1648 1276 7rfxxlf.exe 40 PID 1276 wrote to memory of 1648 1276 7rfxxlf.exe 40 PID 1276 wrote to memory of 1648 1276 7rfxxlf.exe 40 PID 1276 wrote to memory of 1648 1276 7rfxxlf.exe 40 PID 1648 wrote to memory of 2968 1648 rlxrxrr.exe 41 PID 1648 wrote to memory of 2968 1648 rlxrxrr.exe 41 PID 1648 wrote to memory of 2968 1648 rlxrxrr.exe 41 PID 1648 wrote to memory of 2968 1648 rlxrxrr.exe 41 PID 2968 wrote to memory of 3012 2968 thhttb.exe 42 PID 2968 wrote to memory of 3012 2968 thhttb.exe 42 PID 2968 wrote to memory of 3012 2968 thhttb.exe 42 PID 2968 wrote to memory of 3012 2968 thhttb.exe 42 PID 3012 wrote to memory of 2936 3012 rrlxlfx.exe 43 PID 3012 wrote to memory of 2936 3012 rrlxlfx.exe 43 PID 3012 wrote to memory of 2936 3012 rrlxlfx.exe 43 PID 3012 wrote to memory of 2936 3012 rrlxlfx.exe 43 PID 2936 wrote to memory of 864 2936 7lflrrx.exe 44 PID 2936 wrote to memory of 864 2936 7lflrrx.exe 44 PID 2936 wrote to memory of 864 2936 7lflrrx.exe 44 PID 2936 wrote to memory of 864 2936 7lflrrx.exe 44 PID 864 wrote to memory of 1748 864 9vvdj.exe 45 PID 864 wrote to memory of 1748 864 9vvdj.exe 45 PID 864 wrote to memory of 1748 864 9vvdj.exe 45 PID 864 wrote to memory of 1748 864 9vvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe"C:\Users\Admin\AppData\Local\Temp\9cbf5cc806bbfdd357f3890bb02dae13a09a872bd936a25e05a50643770e9ce2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jjdjv.exec:\jjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\htbbhn.exec:\htbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jpdpj.exec:\jpdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rfxxxxl.exec:\rfxxxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9pjvv.exec:\9pjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xrllrxf.exec:\xrllrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hhbhtb.exec:\hhbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vjvjp.exec:\vjvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nnbhtt.exec:\nnbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7rfxxlf.exec:\7rfxxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\rlxrxrr.exec:\rlxrxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\thhttb.exec:\thhttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rrlxlfx.exec:\rrlxlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\7lflrrx.exec:\7lflrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\9vvdj.exec:\9vvdj.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\xrffrlx.exec:\xrffrlx.exe17⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pjdpv.exec:\pjdpv.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frllflr.exec:\frllflr.exe19⤵
- Executes dropped EXE
PID:1272 -
\??\c:\ttntbb.exec:\ttntbb.exe20⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5dvvp.exec:\5dvvp.exe21⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7frflfl.exec:\7frflfl.exe22⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nbnbnh.exec:\nbnbnh.exe23⤵
- Executes dropped EXE
PID:628 -
\??\c:\dvppv.exec:\dvppv.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe25⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hbtbnt.exec:\hbtbnt.exe26⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bthnhn.exec:\bthnhn.exe27⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nnhntb.exec:\nnhntb.exe28⤵
- Executes dropped EXE
PID:1104 -
\??\c:\7pjjd.exec:\7pjjd.exe29⤵
- Executes dropped EXE
PID:652 -
\??\c:\btnttb.exec:\btnttb.exe30⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1vjpp.exec:\1vjpp.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5xllrll.exec:\5xllrll.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\1nbbhb.exec:\1nbbhb.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\flfrfrf.exec:\flfrfrf.exe34⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdpvv.exec:\pdpvv.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\llrllfl.exec:\llrllfl.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3llrxxx.exec:\3llrxxx.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9nntnt.exec:\9nntnt.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ppjvj.exec:\ppjvj.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fxxllrf.exec:\fxxllrf.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nhttbb.exec:\nhttbb.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\htbhth.exec:\htbhth.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dddpj.exec:\dddpj.exe43⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9fflxlr.exec:\9fflxlr.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7nhhtb.exec:\7nhhtb.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ntbnbb.exec:\ntbnbb.exe46⤵
- Executes dropped EXE
PID:1112 -
\??\c:\9vvpv.exec:\9vvpv.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3llfxlx.exec:\3llfxlx.exe48⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nbhtbh.exec:\nbhtbh.exe49⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7nhtbh.exec:\7nhtbh.exe50⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vppvv.exec:\vppvv.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xxxlxff.exec:\xxxlxff.exe52⤵
- Executes dropped EXE
PID:2220 -
\??\c:\btnbnt.exec:\btnbnt.exe53⤵
- Executes dropped EXE
PID:568 -
\??\c:\vvjpj.exec:\vvjpj.exe54⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5jvvj.exec:\5jvvj.exe55⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9rffflx.exec:\9rffflx.exe56⤵
- Executes dropped EXE
PID:560 -
\??\c:\ttnnbn.exec:\ttnnbn.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bbtbnh.exec:\bbtbnh.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7dvdd.exec:\7dvdd.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rxlxllf.exec:\rxlxllf.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tttbbh.exec:\tttbbh.exe61⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5jvvp.exec:\5jvvp.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1rrlrrr.exec:\1rrlrrr.exe63⤵
- Executes dropped EXE
PID:112 -
\??\c:\rrlrlrr.exec:\rrlrlrr.exe64⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1tnntb.exec:\1tnntb.exe65⤵
- Executes dropped EXE
PID:716 -
\??\c:\7vvjd.exec:\7vvjd.exe66⤵PID:2332
-
\??\c:\rlflrxf.exec:\rlflrxf.exe67⤵PID:1656
-
\??\c:\bthhtt.exec:\bthhtt.exe68⤵PID:2024
-
\??\c:\3bhnnt.exec:\3bhnnt.exe69⤵PID:1564
-
\??\c:\pjvpp.exec:\pjvpp.exe70⤵PID:332
-
\??\c:\fxfllfr.exec:\fxfllfr.exe71⤵PID:820
-
\??\c:\tnbtbb.exec:\tnbtbb.exe72⤵PID:3068
-
\??\c:\1bnnnh.exec:\1bnnnh.exe73⤵PID:2080
-
\??\c:\5jjpd.exec:\5jjpd.exe74⤵PID:1052
-
\??\c:\xrflrrf.exec:\xrflrrf.exe75⤵PID:2288
-
\??\c:\rlflrrx.exec:\rlflrrx.exe76⤵
- System Location Discovery: System Language Discovery
PID:340 -
\??\c:\bbbhbn.exec:\bbbhbn.exe77⤵PID:2380
-
\??\c:\jpdjv.exec:\jpdjv.exe78⤵PID:1824
-
\??\c:\3lrxfxf.exec:\3lrxfxf.exe79⤵
- System Location Discovery: System Language Discovery
PID:1600 -
\??\c:\rlflxlx.exec:\rlflxlx.exe80⤵PID:2820
-
\??\c:\hbbhtt.exec:\hbbhtt.exe81⤵PID:2956
-
\??\c:\5dvvd.exec:\5dvvd.exe82⤵PID:2764
-
\??\c:\dvjjp.exec:\dvjjp.exe83⤵PID:2604
-
\??\c:\rllxllr.exec:\rllxllr.exe84⤵PID:2576
-
\??\c:\tnnbtb.exec:\tnnbtb.exe85⤵PID:2640
-
\??\c:\vpjjp.exec:\vpjjp.exe86⤵PID:1676
-
\??\c:\xxxxlxr.exec:\xxxxlxr.exe87⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\5frrrrf.exec:\5frrrrf.exe88⤵PID:2620
-
\??\c:\nnhbtn.exec:\nnhbtn.exe89⤵PID:1340
-
\??\c:\jppjv.exec:\jppjv.exe90⤵PID:2340
-
\??\c:\frrlfxx.exec:\frrlfxx.exe91⤵PID:2560
-
\??\c:\ffxfffl.exec:\ffxfffl.exe92⤵PID:2976
-
\??\c:\bhhnbh.exec:\bhhnbh.exe93⤵PID:2672
-
\??\c:\ddvvp.exec:\ddvvp.exe94⤵PID:2868
-
\??\c:\pppdp.exec:\pppdp.exe95⤵PID:2904
-
\??\c:\rrffllx.exec:\rrffllx.exe96⤵PID:2564
-
\??\c:\nthhth.exec:\nthhth.exe97⤵PID:2280
-
\??\c:\3jjpp.exec:\3jjpp.exe98⤵PID:2416
-
\??\c:\lffrxlf.exec:\lffrxlf.exe99⤵PID:2068
-
\??\c:\1tthbt.exec:\1tthbt.exe100⤵PID:1872
-
\??\c:\ttthbh.exec:\ttthbh.exe101⤵PID:1272
-
\??\c:\pjvvd.exec:\pjvvd.exe102⤵PID:2152
-
\??\c:\lxrxxfr.exec:\lxrxxfr.exe103⤵PID:588
-
\??\c:\9rfllrf.exec:\9rfllrf.exe104⤵PID:1952
-
\??\c:\1httbn.exec:\1httbn.exe105⤵PID:2996
-
\??\c:\djjjd.exec:\djjjd.exe106⤵PID:2304
-
\??\c:\llxlflf.exec:\llxlflf.exe107⤵
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\thnttb.exec:\thnttb.exe108⤵PID:1664
-
\??\c:\tbhbhb.exec:\tbhbhb.exe109⤵PID:1372
-
\??\c:\5vdpj.exec:\5vdpj.exe110⤵PID:1772
-
\??\c:\rxrrlrx.exec:\rxrrlrx.exe111⤵PID:1544
-
\??\c:\9nnnhn.exec:\9nnnhn.exe112⤵PID:1268
-
\??\c:\nnthth.exec:\nnthth.exe113⤵PID:1244
-
\??\c:\dddpd.exec:\dddpd.exe114⤵PID:2300
-
\??\c:\rxxxxlr.exec:\rxxxxlr.exe115⤵PID:548
-
\??\c:\7bntnn.exec:\7bntnn.exe116⤵PID:2072
-
\??\c:\jpdpj.exec:\jpdpj.exe117⤵PID:576
-
\??\c:\ffflflr.exec:\ffflflr.exe118⤵PID:1044
-
\??\c:\vpjpd.exec:\vpjpd.exe119⤵PID:2716
-
\??\c:\vjpjp.exec:\vjpjp.exe120⤵PID:1596
-
\??\c:\btbbnt.exec:\btbbnt.exe121⤵PID:1524
-
\??\c:\vjvjv.exec:\vjvjv.exe122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-