Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe
-
Size
454KB
-
MD5
2933fd6e894772345f95ff5d709dcc60
-
SHA1
80813f0c723c38d6775207c64a9f7080ceea8c07
-
SHA256
3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134
-
SHA512
14f12bb6b7ae7c72e0c2f8d8fd6799e37c711ed71fe55f3dd3e4d9eef5a1b3f7c672a9c1ce8d770bc44999982adfc881be3e9adf1255300450b777ced6c72180
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe4:q7Tc2NYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2896-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-52-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-129-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2760-143-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2960-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-275-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1564-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-322-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-451-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1744-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-533-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2872-546-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-641-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2612-663-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2700-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-716-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1916-748-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/392-777-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/776-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-797-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/776-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-812-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-851-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1504-852-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1520-992-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 pjddj.exe 2260 1dvdv.exe 1300 xrlxffx.exe 2312 lrrffrf.exe 2408 3frrffx.exe 1936 9ththt.exe 2768 pjdjp.exe 752 fxffrrf.exe 2684 dpvdj.exe 2852 7djvp.exe 2760 7bnttt.exe 3016 fxrxlxl.exe 2380 nhtbhn.exe 2600 vpjjp.exe 2960 thtttn.exe 1512 3rrrrxf.exe 280 hhtbnh.exe 1920 llfrllx.exe 1616 7lxxffr.exe 1788 nhtbhb.exe 868 lxllllx.exe 924 vvjjv.exe 2696 xlrlrrr.exe 2936 btbbbt.exe 2568 9pvpp.exe 300 5lxlxxr.exe 780 5ntttb.exe 2576 5bhnnt.exe 2308 9jvvv.exe 572 9nbttt.exe 872 nhbtbb.exe 3048 9dvdp.exe 1564 9btbtt.exe 2564 jdpjv.exe 2164 frfffxx.exe 2280 hnbnhn.exe 1932 jpdpv.exe 1984 ffxfrxl.exe 2004 rrrrxxl.exe 2288 hbttnt.exe 2160 pjvdj.exe 2220 vjjjp.exe 1804 rllrxfl.exe 2632 ntnbnb.exe 2684 dddvp.exe 2848 jjdjp.exe 2824 lfllrxl.exe 2616 hhnnnn.exe 2472 1tbtnn.exe 2952 ppdvd.exe 2424 3fffxxl.exe 1304 rfrlllr.exe 1800 nhnnbt.exe 1664 jvpvp.exe 1744 pdjdd.exe 1704 rlrlllr.exe 1920 nntntn.exe 392 5tnbbb.exe 480 pdddp.exe 1356 rxfflrx.exe 1748 3rfflrf.exe 784 hhbbtt.exe 2792 7djdd.exe 2796 3lxfrfx.exe -
resource yara_rule behavioral1/memory/2896-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-451-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1744-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-533-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2660-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-851-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2216-859-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 3008 2896 3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe 28 PID 2896 wrote to memory of 3008 2896 3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe 28 PID 2896 wrote to memory of 3008 2896 3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe 28 PID 2896 wrote to memory of 3008 2896 3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe 28 PID 3008 wrote to memory of 2260 3008 pjddj.exe 29 PID 3008 wrote to memory of 2260 3008 pjddj.exe 29 PID 3008 wrote to memory of 2260 3008 pjddj.exe 29 PID 3008 wrote to memory of 2260 3008 pjddj.exe 29 PID 2260 wrote to memory of 1300 2260 1dvdv.exe 30 PID 2260 wrote to memory of 1300 2260 1dvdv.exe 30 PID 2260 wrote to memory of 1300 2260 1dvdv.exe 30 PID 2260 wrote to memory of 1300 2260 1dvdv.exe 30 PID 1300 wrote to memory of 2312 1300 xrlxffx.exe 31 PID 1300 wrote to memory of 2312 1300 xrlxffx.exe 31 PID 1300 wrote to memory of 2312 1300 xrlxffx.exe 31 PID 1300 wrote to memory of 2312 1300 xrlxffx.exe 31 PID 2312 wrote to memory of 2408 2312 lrrffrf.exe 32 PID 2312 wrote to memory of 2408 2312 lrrffrf.exe 32 PID 2312 wrote to memory of 2408 2312 lrrffrf.exe 32 PID 2312 wrote to memory of 2408 2312 lrrffrf.exe 32 PID 2408 wrote to memory of 1936 2408 3frrffx.exe 33 PID 2408 wrote to memory of 1936 2408 3frrffx.exe 33 PID 2408 wrote to memory of 1936 2408 3frrffx.exe 33 PID 2408 wrote to memory of 1936 2408 3frrffx.exe 33 PID 1936 wrote to memory of 2768 1936 9ththt.exe 34 PID 1936 wrote to memory of 2768 1936 9ththt.exe 34 PID 1936 wrote to memory of 2768 1936 9ththt.exe 34 PID 1936 wrote to memory of 2768 1936 9ththt.exe 34 PID 2768 wrote to memory of 752 2768 pjdjp.exe 35 PID 2768 wrote to memory of 752 2768 pjdjp.exe 35 PID 2768 wrote to memory of 752 2768 pjdjp.exe 35 PID 2768 wrote to memory of 752 2768 pjdjp.exe 35 PID 752 wrote to memory of 2684 752 fxffrrf.exe 36 PID 752 wrote to memory of 2684 752 fxffrrf.exe 36 PID 752 wrote to memory of 2684 752 fxffrrf.exe 36 PID 752 wrote to memory of 2684 752 fxffrrf.exe 36 PID 2684 wrote to memory of 2852 2684 dpvdj.exe 37 PID 2684 wrote to memory of 2852 2684 dpvdj.exe 37 PID 2684 wrote to memory of 2852 2684 dpvdj.exe 37 PID 2684 wrote to memory of 2852 2684 dpvdj.exe 37 PID 2852 wrote to memory of 2760 2852 7djvp.exe 38 PID 2852 wrote to memory of 2760 2852 7djvp.exe 38 PID 2852 wrote to memory of 2760 2852 7djvp.exe 38 PID 2852 wrote to memory of 2760 2852 7djvp.exe 38 PID 2760 wrote to memory of 3016 2760 7bnttt.exe 39 PID 2760 wrote to memory of 3016 2760 7bnttt.exe 39 PID 2760 wrote to memory of 3016 2760 7bnttt.exe 39 PID 2760 wrote to memory of 3016 2760 7bnttt.exe 39 PID 3016 wrote to memory of 2380 3016 fxrxlxl.exe 40 PID 3016 wrote to memory of 2380 3016 fxrxlxl.exe 40 PID 3016 wrote to memory of 2380 3016 fxrxlxl.exe 40 PID 3016 wrote to memory of 2380 3016 fxrxlxl.exe 40 PID 2380 wrote to memory of 2600 2380 nhtbhn.exe 41 PID 2380 wrote to memory of 2600 2380 nhtbhn.exe 41 PID 2380 wrote to memory of 2600 2380 nhtbhn.exe 41 PID 2380 wrote to memory of 2600 2380 nhtbhn.exe 41 PID 2600 wrote to memory of 2960 2600 vpjjp.exe 42 PID 2600 wrote to memory of 2960 2600 vpjjp.exe 42 PID 2600 wrote to memory of 2960 2600 vpjjp.exe 42 PID 2600 wrote to memory of 2960 2600 vpjjp.exe 42 PID 2960 wrote to memory of 1512 2960 thtttn.exe 43 PID 2960 wrote to memory of 1512 2960 thtttn.exe 43 PID 2960 wrote to memory of 1512 2960 thtttn.exe 43 PID 2960 wrote to memory of 1512 2960 thtttn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe"C:\Users\Admin\AppData\Local\Temp\3ad7075ae238f05ac3e8aae48d61560e6238521964f2811842760afef8b49134.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pjddj.exec:\pjddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\1dvdv.exec:\1dvdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\xrlxffx.exec:\xrlxffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\lrrffrf.exec:\lrrffrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3frrffx.exec:\3frrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\9ththt.exec:\9ththt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\pjdjp.exec:\pjdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\fxffrrf.exec:\fxffrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\dpvdj.exec:\dpvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7djvp.exec:\7djvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7bnttt.exec:\7bnttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fxrxlxl.exec:\fxrxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\nhtbhn.exec:\nhtbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vpjjp.exec:\vpjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\thtttn.exec:\thtttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\3rrrrxf.exec:\3rrrrxf.exe17⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hhtbnh.exec:\hhtbnh.exe18⤵
- Executes dropped EXE
PID:280 -
\??\c:\llfrllx.exec:\llfrllx.exe19⤵
- Executes dropped EXE
PID:1920 -
\??\c:\7lxxffr.exec:\7lxxffr.exe20⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nhtbhb.exec:\nhtbhb.exe21⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxllllx.exec:\lxllllx.exe22⤵
- Executes dropped EXE
PID:868 -
\??\c:\vvjjv.exec:\vvjjv.exe23⤵
- Executes dropped EXE
PID:924 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe24⤵
- Executes dropped EXE
PID:2696 -
\??\c:\btbbbt.exec:\btbbbt.exe25⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9pvpp.exec:\9pvpp.exe26⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5lxlxxr.exec:\5lxlxxr.exe27⤵
- Executes dropped EXE
PID:300 -
\??\c:\5ntttb.exec:\5ntttb.exe28⤵
- Executes dropped EXE
PID:780 -
\??\c:\5bhnnt.exec:\5bhnnt.exe29⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9jvvv.exec:\9jvvv.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9nbttt.exec:\9nbttt.exe31⤵
- Executes dropped EXE
PID:572 -
\??\c:\nhbtbb.exec:\nhbtbb.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\9dvdp.exec:\9dvdp.exe33⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9btbtt.exec:\9btbtt.exe34⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jdpjv.exec:\jdpjv.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\frfffxx.exec:\frfffxx.exe36⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hnbnhn.exec:\hnbnhn.exe37⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jpdpv.exec:\jpdpv.exe38⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe39⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rrrrxxl.exec:\rrrrxxl.exe40⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbttnt.exec:\hbttnt.exe41⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjvdj.exec:\pjvdj.exe42⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vjjjp.exec:\vjjjp.exe43⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rllrxfl.exec:\rllrxfl.exe44⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ntnbnb.exec:\ntnbnb.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\dddvp.exec:\dddvp.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjdjp.exec:\jjdjp.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lfllrxl.exec:\lfllrxl.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hhnnnn.exec:\hhnnnn.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1tbtnn.exec:\1tbtnn.exe50⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ppdvd.exec:\ppdvd.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3fffxxl.exec:\3fffxxl.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rfrlllr.exec:\rfrlllr.exe53⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nhnnbt.exec:\nhnnbt.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jvpvp.exec:\jvpvp.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pdjdd.exec:\pdjdd.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rlrlllr.exec:\rlrlllr.exe57⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nntntn.exec:\nntntn.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5tnbbb.exec:\5tnbbb.exe59⤵
- Executes dropped EXE
PID:392 -
\??\c:\pdddp.exec:\pdddp.exe60⤵
- Executes dropped EXE
PID:480 -
\??\c:\rxfflrx.exec:\rxfflrx.exe61⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3rfflrf.exec:\3rfflrf.exe62⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hhbbtt.exec:\hhbbtt.exe63⤵
- Executes dropped EXE
PID:784 -
\??\c:\7djdd.exec:\7djdd.exe64⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3lxfrfx.exec:\3lxfrfx.exe65⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7rfxfff.exec:\7rfxfff.exe66⤵PID:2924
-
\??\c:\9bhnnt.exec:\9bhnnt.exe67⤵PID:2784
-
\??\c:\dvvvp.exec:\dvvvp.exe68⤵PID:2988
-
\??\c:\pjvdd.exec:\pjvdd.exe69⤵PID:1476
-
\??\c:\9flflfl.exec:\9flflfl.exe70⤵PID:2880
-
\??\c:\hhttbb.exec:\hhttbb.exe71⤵PID:2872
-
\??\c:\jpddd.exec:\jpddd.exe72⤵PID:1732
-
\??\c:\pjvvv.exec:\pjvvv.exe73⤵PID:2184
-
\??\c:\7flxllr.exec:\7flxllr.exe74⤵PID:572
-
\??\c:\hhtthb.exec:\hhtthb.exe75⤵PID:1956
-
\??\c:\7thhnt.exec:\7thhnt.exe76⤵PID:2216
-
\??\c:\3dvdd.exec:\3dvdd.exe77⤵PID:1692
-
\??\c:\3rxrrrr.exec:\3rxrrrr.exe78⤵PID:316
-
\??\c:\nbhhnt.exec:\nbhhnt.exe79⤵PID:2412
-
\??\c:\nnhttt.exec:\nnhttt.exe80⤵PID:2196
-
\??\c:\7jvdv.exec:\7jvdv.exe81⤵PID:2388
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe82⤵PID:1912
-
\??\c:\lrlrffl.exec:\lrlrffl.exe83⤵PID:1932
-
\??\c:\nbhhnh.exec:\nbhhnh.exe84⤵PID:1064
-
\??\c:\1jdpp.exec:\1jdpp.exe85⤵PID:1292
-
\??\c:\lflrrrr.exec:\lflrrrr.exe86⤵PID:2572
-
\??\c:\thbbhh.exec:\thbbhh.exe87⤵PID:3056
-
\??\c:\jpdpp.exec:\jpdpp.exe88⤵PID:2756
-
\??\c:\xrrfllr.exec:\xrrfllr.exe89⤵PID:2612
-
\??\c:\fxrxllx.exec:\fxrxllx.exe90⤵PID:2660
-
\??\c:\htnbnt.exec:\htnbnt.exe91⤵PID:2800
-
\??\c:\vvppv.exec:\vvppv.exe92⤵PID:2652
-
\??\c:\1ffrffr.exec:\1ffrffr.exe93⤵PID:2700
-
\??\c:\7lrrrrf.exec:\7lrrrrf.exe94⤵PID:2488
-
\??\c:\1nbbbh.exec:\1nbbbh.exe95⤵PID:2952
-
\??\c:\3dpjj.exec:\3dpjj.exe96⤵PID:2424
-
\??\c:\dvjjd.exec:\dvjjd.exe97⤵PID:2336
-
\??\c:\9xlllfl.exec:\9xlllfl.exe98⤵PID:1568
-
\??\c:\tnhnhh.exec:\tnhnhh.exe99⤵PID:1916
-
\??\c:\pddpv.exec:\pddpv.exe100⤵PID:1744
-
\??\c:\9pppp.exec:\9pppp.exe101⤵PID:308
-
\??\c:\rlrxlff.exec:\rlrxlff.exe102⤵PID:1680
-
\??\c:\3bbhnn.exec:\3bbhnn.exe103⤵PID:392
-
\??\c:\5djjv.exec:\5djjv.exe104⤵PID:836
-
\??\c:\xrrxllr.exec:\xrrxllr.exe105⤵PID:980
-
\??\c:\7frfffr.exec:\7frfffr.exe106⤵PID:2804
-
\??\c:\hnnbnn.exec:\hnnbnn.exe107⤵PID:776
-
\??\c:\3pvvj.exec:\3pvvj.exe108⤵PID:2904
-
\??\c:\7xrrrxx.exec:\7xrrrxx.exe109⤵PID:2984
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe110⤵PID:1716
-
\??\c:\3nhhtt.exec:\3nhhtt.exe111⤵PID:840
-
\??\c:\jjvvj.exec:\jjvvj.exe112⤵PID:584
-
\??\c:\3rxxxrx.exec:\3rxxxrx.exe113⤵PID:2172
-
\??\c:\1hnhhh.exec:\1hnhhh.exe114⤵PID:2872
-
\??\c:\hbtnnn.exec:\hbtnnn.exe115⤵PID:1768
-
\??\c:\3pvvv.exec:\3pvvv.exe116⤵PID:2308
-
\??\c:\vvpvp.exec:\vvpvp.exe117⤵PID:1504
-
\??\c:\5xlfxxx.exec:\5xlfxxx.exe118⤵PID:2364
-
\??\c:\bbnthn.exec:\bbnthn.exe119⤵PID:2216
-
\??\c:\ppvjv.exec:\ppvjv.exe120⤵PID:1692
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe121⤵PID:316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-