Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe
-
Size
453KB
-
MD5
1bf92ff7b02652b69c83bd1aa97d6702
-
SHA1
43eea7f9d7bd8428fc70ede188a67c00b9a72a50
-
SHA256
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a
-
SHA512
c8d04dde236e814ac501058f6331a4f875204368e7833a706e8b04d1d2a9eb4ec32a3485e6dbed5dbe537f7e729fdc500f893210d1448884dbcf63248f588b81
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-75-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-110-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1244-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-185-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/548-203-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1636-220-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-257-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2492-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-489-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2040-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-577-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-580-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2792-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-789-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2480-802-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-821-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-859-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-902-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2888-917-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/448-977-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-1008-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-1134-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1708-1164-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2256-1325-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 ddvdp.exe 864 bthntt.exe 2096 vpvvd.exe 1820 rlxfllx.exe 2832 vpjjv.exe 2700 lxxflrf.exe 2008 5djjp.exe 2872 dpjjj.exe 2604 xrllllx.exe 2600 jddvd.exe 2220 llfrxxx.exe 1244 hhnntn.exe 2732 jvdjv.exe 1252 bnbbbb.exe 1632 pjppp.exe 2804 xffrrfx.exe 1448 thtnnn.exe 1932 xxlrxxl.exe 2940 nnhhbn.exe 1160 pdppd.exe 2268 5pppd.exe 548 9tnhhn.exe 1900 7jjjj.exe 1636 3xrxxxl.exe 1028 xxrxlrf.exe 2380 xfrfxlf.exe 1992 jdpjp.exe 2164 rrlrllx.exe 2148 hbnthn.exe 2160 xxrrxfl.exe 2492 ttnnbb.exe 1524 xrllrxl.exe 2336 5fxxxxf.exe 2092 1xrxxfr.exe 572 hbhnbh.exe 1792 ddjjj.exe 2840 vpddd.exe 2708 xrlxflr.exe 2372 5thhhh.exe 2008 thnthh.exe 2584 jdjpd.exe 1660 rrxxxxf.exe 2592 hhbhnn.exe 652 bthhhb.exe 3068 ppjpd.exe 2792 7xllrxx.exe 1244 xfrxllr.exe 2732 btnthh.exe 2796 bthbhh.exe 2368 1jppv.exe 1816 xrflrlx.exe 2348 hthhhh.exe 1980 btnntt.exe 3040 ppddv.exe 1932 jdvdj.exe 1648 xffrllr.exe 1444 nnbhnt.exe 2120 bthnnt.exe 1936 3vjdp.exe 548 9lxxrrr.exe 1968 1xfxfxr.exe 2412 1htttb.exe 1680 jjppd.exe 1164 pjdjv.exe -
resource yara_rule behavioral1/memory/2524-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-202-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1636-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-258-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2148-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-917-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2880-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-1008-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-1060-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-1325-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2448-1358-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xflrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2524 2480 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 31 PID 2480 wrote to memory of 2524 2480 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 31 PID 2480 wrote to memory of 2524 2480 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 31 PID 2480 wrote to memory of 2524 2480 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 31 PID 2524 wrote to memory of 864 2524 ddvdp.exe 32 PID 2524 wrote to memory of 864 2524 ddvdp.exe 32 PID 2524 wrote to memory of 864 2524 ddvdp.exe 32 PID 2524 wrote to memory of 864 2524 ddvdp.exe 32 PID 864 wrote to memory of 2096 864 bthntt.exe 33 PID 864 wrote to memory of 2096 864 bthntt.exe 33 PID 864 wrote to memory of 2096 864 bthntt.exe 33 PID 864 wrote to memory of 2096 864 bthntt.exe 33 PID 2096 wrote to memory of 1820 2096 vpvvd.exe 34 PID 2096 wrote to memory of 1820 2096 vpvvd.exe 34 PID 2096 wrote to memory of 1820 2096 vpvvd.exe 34 PID 2096 wrote to memory of 1820 2096 vpvvd.exe 34 PID 1820 wrote to memory of 2832 1820 rlxfllx.exe 35 PID 1820 wrote to memory of 2832 1820 rlxfllx.exe 35 PID 1820 wrote to memory of 2832 1820 rlxfllx.exe 35 PID 1820 wrote to memory of 2832 1820 rlxfllx.exe 35 PID 2832 wrote to memory of 2700 2832 vpjjv.exe 36 PID 2832 wrote to memory of 2700 2832 vpjjv.exe 36 PID 2832 wrote to memory of 2700 2832 vpjjv.exe 36 PID 2832 wrote to memory of 2700 2832 vpjjv.exe 36 PID 2700 wrote to memory of 2008 2700 lxxflrf.exe 37 PID 2700 wrote to memory of 2008 2700 lxxflrf.exe 37 PID 2700 wrote to memory of 2008 2700 lxxflrf.exe 37 PID 2700 wrote to memory of 2008 2700 lxxflrf.exe 37 PID 2008 wrote to memory of 2872 2008 5djjp.exe 38 PID 2008 wrote to memory of 2872 2008 5djjp.exe 38 PID 2008 wrote to memory of 2872 2008 5djjp.exe 38 PID 2008 wrote to memory of 2872 2008 5djjp.exe 38 PID 2872 wrote to memory of 2604 2872 dpjjj.exe 39 PID 2872 wrote to memory of 2604 2872 dpjjj.exe 39 PID 2872 wrote to memory of 2604 2872 dpjjj.exe 39 PID 2872 wrote to memory of 2604 2872 dpjjj.exe 39 PID 2604 wrote to memory of 2600 2604 xrllllx.exe 40 PID 2604 wrote to memory of 2600 2604 xrllllx.exe 40 PID 2604 wrote to memory of 2600 2604 xrllllx.exe 40 PID 2604 wrote to memory of 2600 2604 xrllllx.exe 40 PID 2600 wrote to memory of 2220 2600 jddvd.exe 41 PID 2600 wrote to memory of 2220 2600 jddvd.exe 41 PID 2600 wrote to memory of 2220 2600 jddvd.exe 41 PID 2600 wrote to memory of 2220 2600 jddvd.exe 41 PID 2220 wrote to memory of 1244 2220 llfrxxx.exe 42 PID 2220 wrote to memory of 1244 2220 llfrxxx.exe 42 PID 2220 wrote to memory of 1244 2220 llfrxxx.exe 42 PID 2220 wrote to memory of 1244 2220 llfrxxx.exe 42 PID 1244 wrote to memory of 2732 1244 hhnntn.exe 43 PID 1244 wrote to memory of 2732 1244 hhnntn.exe 43 PID 1244 wrote to memory of 2732 1244 hhnntn.exe 43 PID 1244 wrote to memory of 2732 1244 hhnntn.exe 43 PID 2732 wrote to memory of 1252 2732 jvdjv.exe 44 PID 2732 wrote to memory of 1252 2732 jvdjv.exe 44 PID 2732 wrote to memory of 1252 2732 jvdjv.exe 44 PID 2732 wrote to memory of 1252 2732 jvdjv.exe 44 PID 1252 wrote to memory of 1632 1252 bnbbbb.exe 45 PID 1252 wrote to memory of 1632 1252 bnbbbb.exe 45 PID 1252 wrote to memory of 1632 1252 bnbbbb.exe 45 PID 1252 wrote to memory of 1632 1252 bnbbbb.exe 45 PID 1632 wrote to memory of 2804 1632 pjppp.exe 46 PID 1632 wrote to memory of 2804 1632 pjppp.exe 46 PID 1632 wrote to memory of 2804 1632 pjppp.exe 46 PID 1632 wrote to memory of 2804 1632 pjppp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe"C:\Users\Admin\AppData\Local\Temp\37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ddvdp.exec:\ddvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bthntt.exec:\bthntt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\vpvvd.exec:\vpvvd.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\rlxfllx.exec:\rlxfllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\vpjjv.exec:\vpjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lxxflrf.exec:\lxxflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\5djjp.exec:\5djjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\dpjjj.exec:\dpjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xrllllx.exec:\xrllllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jddvd.exec:\jddvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\llfrxxx.exec:\llfrxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\hhnntn.exec:\hhnntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\jvdjv.exec:\jvdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bnbbbb.exec:\bnbbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\pjppp.exec:\pjppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\xffrrfx.exec:\xffrrfx.exe17⤵
- Executes dropped EXE
PID:2804 -
\??\c:\thtnnn.exec:\thtnnn.exe18⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe19⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nnhhbn.exec:\nnhhbn.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pdppd.exec:\pdppd.exe21⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5pppd.exec:\5pppd.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9tnhhn.exec:\9tnhhn.exe23⤵
- Executes dropped EXE
PID:548 -
\??\c:\7jjjj.exec:\7jjjj.exe24⤵
- Executes dropped EXE
PID:1900 -
\??\c:\3xrxxxl.exec:\3xrxxxl.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe26⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xfrfxlf.exec:\xfrfxlf.exe27⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jdpjp.exec:\jdpjp.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rrlrllx.exec:\rrlrllx.exe29⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbnthn.exec:\hbnthn.exe30⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xxrrxfl.exec:\xxrrxfl.exe31⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ttnnbb.exec:\ttnnbb.exe32⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xrllrxl.exec:\xrllrxl.exe33⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5fxxxxf.exec:\5fxxxxf.exe34⤵
- Executes dropped EXE
PID:2336 -
\??\c:\1xrxxfr.exec:\1xrxxfr.exe35⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hbhnbh.exec:\hbhnbh.exe36⤵
- Executes dropped EXE
PID:572 -
\??\c:\ddjjj.exec:\ddjjj.exe37⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vpddd.exec:\vpddd.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xrlxflr.exec:\xrlxflr.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5thhhh.exec:\5thhhh.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\thnthh.exec:\thnthh.exe41⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jdjpd.exec:\jdjpd.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe43⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hhbhnn.exec:\hhbhnn.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bthhhb.exec:\bthhhb.exe45⤵
- Executes dropped EXE
PID:652 -
\??\c:\ppjpd.exec:\ppjpd.exe46⤵
- Executes dropped EXE
PID:3068 -
\??\c:\7xllrxx.exec:\7xllrxx.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xfrxllr.exec:\xfrxllr.exe48⤵
- Executes dropped EXE
PID:1244 -
\??\c:\btnthh.exec:\btnthh.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bthbhh.exec:\bthbhh.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1jppv.exec:\1jppv.exe51⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xrflrlx.exec:\xrflrlx.exe52⤵
- Executes dropped EXE
PID:1816 -
\??\c:\hthhhh.exec:\hthhhh.exe53⤵
- Executes dropped EXE
PID:2348 -
\??\c:\btnntt.exec:\btnntt.exe54⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ppddv.exec:\ppddv.exe55⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdvdj.exec:\jdvdj.exe56⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xffrllr.exec:\xffrllr.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nnbhnt.exec:\nnbhnt.exe58⤵
- Executes dropped EXE
PID:1444 -
\??\c:\bthnnt.exec:\bthnnt.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3vjdp.exec:\3vjdp.exe60⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9lxxrrr.exec:\9lxxrrr.exe61⤵
- Executes dropped EXE
PID:548 -
\??\c:\1xfxfxr.exec:\1xfxfxr.exe62⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1htttb.exec:\1htttb.exe63⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjppd.exec:\jjppd.exe64⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pjdjv.exec:\pjdjv.exe65⤵
- Executes dropped EXE
PID:1164 -
\??\c:\frxxffl.exec:\frxxffl.exe66⤵PID:1256
-
\??\c:\nhntbh.exec:\nhntbh.exe67⤵PID:2068
-
\??\c:\bnttbt.exec:\bnttbt.exe68⤵PID:2180
-
\??\c:\pdpjp.exec:\pdpjp.exe69⤵PID:2476
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe70⤵PID:884
-
\??\c:\1lxrffr.exec:\1lxrffr.exe71⤵PID:872
-
\??\c:\hthntb.exec:\hthntb.exe72⤵PID:2492
-
\??\c:\pjpvd.exec:\pjpvd.exe73⤵PID:484
-
\??\c:\pjppp.exec:\pjppp.exe74⤵PID:1368
-
\??\c:\frlfllr.exec:\frlfllr.exe75⤵PID:2040
-
\??\c:\hbnnbb.exec:\hbnnbb.exe76⤵PID:2320
-
\??\c:\thtttb.exec:\thtttb.exe77⤵PID:2696
-
\??\c:\5pjpp.exec:\5pjpp.exe78⤵PID:2816
-
\??\c:\rlxrrrf.exec:\rlxrrrf.exe79⤵PID:2704
-
\??\c:\xrfrxxx.exec:\xrfrxxx.exe80⤵PID:2764
-
\??\c:\htnthh.exec:\htnthh.exe81⤵PID:2668
-
\??\c:\dvjjp.exec:\dvjjp.exe82⤵PID:2716
-
\??\c:\dddvj.exec:\dddvj.exe83⤵PID:1304
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe84⤵PID:2544
-
\??\c:\bnbhnn.exec:\bnbhnn.exe85⤵PID:1660
-
\??\c:\hbttbb.exec:\hbttbb.exe86⤵PID:2592
-
\??\c:\vpjdj.exec:\vpjdj.exe87⤵PID:1676
-
\??\c:\1dvpp.exec:\1dvpp.exe88⤵PID:2876
-
\??\c:\5rrrxrx.exec:\5rrrxrx.exe89⤵PID:2792
-
\??\c:\3hnntb.exec:\3hnntb.exe90⤵PID:1244
-
\??\c:\hthntt.exec:\hthntt.exe91⤵PID:1852
-
\??\c:\jjvvd.exec:\jjvvd.exe92⤵PID:1632
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe93⤵PID:2640
-
\??\c:\btttbb.exec:\btttbb.exe94⤵PID:1816
-
\??\c:\hbnbnt.exec:\hbnbnt.exe95⤵PID:2348
-
\??\c:\dpdvd.exec:\dpdvd.exe96⤵PID:1776
-
\??\c:\3lxrllx.exec:\3lxrllx.exe97⤵PID:2952
-
\??\c:\9rrxflx.exec:\9rrxflx.exe98⤵PID:1312
-
\??\c:\thtthh.exec:\thtthh.exe99⤵PID:2104
-
\??\c:\ttntbb.exec:\ttntbb.exe100⤵PID:1444
-
\??\c:\vjpjv.exec:\vjpjv.exe101⤵PID:2120
-
\??\c:\xlfflfl.exec:\xlfflfl.exe102⤵PID:3024
-
\??\c:\nhtthh.exec:\nhtthh.exe103⤵PID:1344
-
\??\c:\tnntbb.exec:\tnntbb.exe104⤵PID:1968
-
\??\c:\1djdv.exec:\1djdv.exe105⤵PID:2412
-
\??\c:\xfllffl.exec:\xfllffl.exe106⤵PID:2740
-
\??\c:\3xfflxf.exec:\3xfflxf.exe107⤵PID:2420
-
\??\c:\btnttt.exec:\btnttt.exe108⤵PID:1948
-
\??\c:\vppdd.exec:\vppdd.exe109⤵PID:324
-
\??\c:\jdvvv.exec:\jdvvv.exe110⤵PID:2868
-
\??\c:\xllfllr.exec:\xllfllr.exe111⤵PID:2148
-
\??\c:\7hnhnh.exec:\7hnhnh.exe112⤵PID:1396
-
\??\c:\hbthnt.exec:\hbthnt.exe113⤵PID:2480
-
\??\c:\pjpjp.exec:\pjpjp.exe114⤵PID:2256
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe115⤵PID:1568
-
\??\c:\rrlrrfl.exec:\rrlrrfl.exe116⤵PID:2324
-
\??\c:\nhnttt.exec:\nhnttt.exe117⤵PID:2736
-
\??\c:\3jvdj.exec:\3jvdj.exe118⤵PID:924
-
\??\c:\lfrxxrx.exec:\lfrxxrx.exe119⤵PID:1820
-
\??\c:\lfxfffl.exec:\lfxfffl.exe120⤵PID:2836
-
\??\c:\nbnnnh.exec:\nbnnnh.exe121⤵PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-