Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe
-
Size
454KB
-
MD5
b87dad030672fcd5eebcad63afbe8d1f
-
SHA1
ea69440da0f63a5b324b9dd0e32d8469cbe07dc6
-
SHA256
4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca
-
SHA512
f8dc446b70d9fc5022fd38fdbd7ceeb1ba3225826ebfb7312f4c912827e8bb35fe1f7d4b3174f595c17a68b5c02867a9cd8ae45d81b9d980bad4cb7df6d10f94
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1332-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-130-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1808-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-150-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2176-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-291-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon behavioral1/memory/1560-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-494-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1760-551-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1760-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-567-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-723-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/768-722-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2188-864-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-912-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-1007-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-1037-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/976-1087-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-1191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2112-1192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1332 bbtbhn.exe 1908 ttbbnn.exe 2476 dvdpd.exe 2740 xxxxlxr.exe 2840 pjjpj.exe 2620 ddjvj.exe 2960 hhbbnn.exe 2784 jddpd.exe 2632 ffxrfrf.exe 2136 5bbhhh.exe 980 1frlrll.exe 1544 1djdp.exe 2876 xxxlxfx.exe 1808 xxxrlrf.exe 2368 3pjpv.exe 2932 xxrfxxl.exe 2176 9pjjp.exe 1564 dvjvj.exe 1232 ffxrflf.exe 680 3jvvd.exe 2584 xrxrxrl.exe 1916 hhtntn.exe 872 rxrxlff.exe 1680 hbbnbh.exe 2248 jpjjp.exe 924 tbttht.exe 2120 3dppj.exe 1424 5fffflx.exe 1764 nnhnht.exe 1616 lfrflrl.exe 876 flfrllx.exe 3032 5vjjp.exe 1560 1vjpd.exe 1332 1xlxfrf.exe 1908 1httbb.exe 1804 pjvvv.exe 2852 3rrfflx.exe 2816 nhtbnt.exe 2744 nbhbbb.exe 2772 jjvdd.exe 2964 lfxxffl.exe 2960 nhtbht.exe 2684 bbtthh.exe 2616 9dvdp.exe 2484 llflxxl.exe 2144 1frrlrx.exe 1132 nhbhnt.exe 1392 dvvdv.exe 1244 xxrfrxx.exe 1388 tthntb.exe 2916 ttnbnt.exe 1912 ddvvj.exe 1988 rlxxxfl.exe 352 1rrxffr.exe 768 tbthbh.exe 2132 hbhnbh.exe 1404 jpvdp.exe 348 9llxflx.exe 2568 tnnbnb.exe 2492 ttnnbt.exe 1460 ppjpd.exe 1532 9rllrrf.exe 1468 xrrxlff.exe 872 7bbhtb.exe -
resource yara_rule behavioral1/memory/1332-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-130-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1808-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-421-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2492-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-494-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1760-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-1253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-1272-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1332 1964 4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe 30 PID 1964 wrote to memory of 1332 1964 4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe 30 PID 1964 wrote to memory of 1332 1964 4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe 30 PID 1964 wrote to memory of 1332 1964 4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe 30 PID 1332 wrote to memory of 1908 1332 bbtbhn.exe 31 PID 1332 wrote to memory of 1908 1332 bbtbhn.exe 31 PID 1332 wrote to memory of 1908 1332 bbtbhn.exe 31 PID 1332 wrote to memory of 1908 1332 bbtbhn.exe 31 PID 1908 wrote to memory of 2476 1908 ttbbnn.exe 32 PID 1908 wrote to memory of 2476 1908 ttbbnn.exe 32 PID 1908 wrote to memory of 2476 1908 ttbbnn.exe 32 PID 1908 wrote to memory of 2476 1908 ttbbnn.exe 32 PID 2476 wrote to memory of 2740 2476 dvdpd.exe 33 PID 2476 wrote to memory of 2740 2476 dvdpd.exe 33 PID 2476 wrote to memory of 2740 2476 dvdpd.exe 33 PID 2476 wrote to memory of 2740 2476 dvdpd.exe 33 PID 2740 wrote to memory of 2840 2740 xxxxlxr.exe 34 PID 2740 wrote to memory of 2840 2740 xxxxlxr.exe 34 PID 2740 wrote to memory of 2840 2740 xxxxlxr.exe 34 PID 2740 wrote to memory of 2840 2740 xxxxlxr.exe 34 PID 2840 wrote to memory of 2620 2840 pjjpj.exe 35 PID 2840 wrote to memory of 2620 2840 pjjpj.exe 35 PID 2840 wrote to memory of 2620 2840 pjjpj.exe 35 PID 2840 wrote to memory of 2620 2840 pjjpj.exe 35 PID 2620 wrote to memory of 2960 2620 ddjvj.exe 36 PID 2620 wrote to memory of 2960 2620 ddjvj.exe 36 PID 2620 wrote to memory of 2960 2620 ddjvj.exe 36 PID 2620 wrote to memory of 2960 2620 ddjvj.exe 36 PID 2960 wrote to memory of 2784 2960 hhbbnn.exe 37 PID 2960 wrote to memory of 2784 2960 hhbbnn.exe 37 PID 2960 wrote to memory of 2784 2960 hhbbnn.exe 37 PID 2960 wrote to memory of 2784 2960 hhbbnn.exe 37 PID 2784 wrote to memory of 2632 2784 jddpd.exe 38 PID 2784 wrote to memory of 2632 2784 jddpd.exe 38 PID 2784 wrote to memory of 2632 2784 jddpd.exe 38 PID 2784 wrote to memory of 2632 2784 jddpd.exe 38 PID 2632 wrote to memory of 2136 2632 ffxrfrf.exe 39 PID 2632 wrote to memory of 2136 2632 ffxrfrf.exe 39 PID 2632 wrote to memory of 2136 2632 ffxrfrf.exe 39 PID 2632 wrote to memory of 2136 2632 ffxrfrf.exe 39 PID 2136 wrote to memory of 980 2136 5bbhhh.exe 40 PID 2136 wrote to memory of 980 2136 5bbhhh.exe 40 PID 2136 wrote to memory of 980 2136 5bbhhh.exe 40 PID 2136 wrote to memory of 980 2136 5bbhhh.exe 40 PID 980 wrote to memory of 1544 980 1frlrll.exe 41 PID 980 wrote to memory of 1544 980 1frlrll.exe 41 PID 980 wrote to memory of 1544 980 1frlrll.exe 41 PID 980 wrote to memory of 1544 980 1frlrll.exe 41 PID 1544 wrote to memory of 2876 1544 1djdp.exe 42 PID 1544 wrote to memory of 2876 1544 1djdp.exe 42 PID 1544 wrote to memory of 2876 1544 1djdp.exe 42 PID 1544 wrote to memory of 2876 1544 1djdp.exe 42 PID 2876 wrote to memory of 1808 2876 xxxlxfx.exe 43 PID 2876 wrote to memory of 1808 2876 xxxlxfx.exe 43 PID 2876 wrote to memory of 1808 2876 xxxlxfx.exe 43 PID 2876 wrote to memory of 1808 2876 xxxlxfx.exe 43 PID 1808 wrote to memory of 2368 1808 xxxrlrf.exe 44 PID 1808 wrote to memory of 2368 1808 xxxrlrf.exe 44 PID 1808 wrote to memory of 2368 1808 xxxrlrf.exe 44 PID 1808 wrote to memory of 2368 1808 xxxrlrf.exe 44 PID 2368 wrote to memory of 2932 2368 3pjpv.exe 45 PID 2368 wrote to memory of 2932 2368 3pjpv.exe 45 PID 2368 wrote to memory of 2932 2368 3pjpv.exe 45 PID 2368 wrote to memory of 2932 2368 3pjpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe"C:\Users\Admin\AppData\Local\Temp\4dbc496ebd9a199b80f2c8db8a76836e2ac2e2655e7bb4c4f6ea253a43225eca.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\bbtbhn.exec:\bbtbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\ttbbnn.exec:\ttbbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\dvdpd.exec:\dvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xxxxlxr.exec:\xxxxlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjjpj.exec:\pjjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\ddjvj.exec:\ddjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hhbbnn.exec:\hhbbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\jddpd.exec:\jddpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\ffxrfrf.exec:\ffxrfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5bbhhh.exec:\5bbhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\1frlrll.exec:\1frlrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\1djdp.exec:\1djdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\xxxlxfx.exec:\xxxlxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xxxrlrf.exec:\xxxrlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\3pjpv.exec:\3pjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\xxrfxxl.exec:\xxrfxxl.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9pjjp.exec:\9pjjp.exe18⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjvj.exec:\dvjvj.exe19⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ffxrflf.exec:\ffxrflf.exe20⤵
- Executes dropped EXE
PID:1232 -
\??\c:\3jvvd.exec:\3jvvd.exe21⤵
- Executes dropped EXE
PID:680 -
\??\c:\xrxrxrl.exec:\xrxrxrl.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hhtntn.exec:\hhtntn.exe23⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rxrxlff.exec:\rxrxlff.exe24⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbbnbh.exec:\hbbnbh.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jpjjp.exec:\jpjjp.exe26⤵
- Executes dropped EXE
PID:2248 -
\??\c:\tbttht.exec:\tbttht.exe27⤵
- Executes dropped EXE
PID:924 -
\??\c:\3dppj.exec:\3dppj.exe28⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5fffflx.exec:\5fffflx.exe29⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nnhnht.exec:\nnhnht.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lfrflrl.exec:\lfrflrl.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\flfrllx.exec:\flfrllx.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\5vjjp.exec:\5vjjp.exe33⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7xlllrx.exec:\7xlllrx.exe34⤵PID:1524
-
\??\c:\1vjpd.exec:\1vjpd.exe35⤵
- Executes dropped EXE
PID:1560 -
\??\c:\1xlxfrf.exec:\1xlxfrf.exe36⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1httbb.exec:\1httbb.exe37⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pjvvv.exec:\pjvvv.exe38⤵
- Executes dropped EXE
PID:1804 -
\??\c:\3rrfflx.exec:\3rrfflx.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nhtbnt.exec:\nhtbnt.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nbhbbb.exec:\nbhbbb.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjvdd.exec:\jjvdd.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfxxffl.exec:\lfxxffl.exe43⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhtbht.exec:\nhtbht.exe44⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bbtthh.exec:\bbtthh.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9dvdp.exec:\9dvdp.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\llflxxl.exec:\llflxxl.exe47⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1frrlrx.exec:\1frrlrx.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nhbhnt.exec:\nhbhnt.exe49⤵
- Executes dropped EXE
PID:1132 -
\??\c:\dvvdv.exec:\dvvdv.exe50⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xxrfrxx.exec:\xxrfrxx.exe51⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tthntb.exec:\tthntb.exe52⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ttnbnt.exec:\ttnbnt.exe53⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ddvvj.exec:\ddvvj.exe54⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1rrxffr.exec:\1rrxffr.exe56⤵
- Executes dropped EXE
PID:352 -
\??\c:\tbthbh.exec:\tbthbh.exe57⤵
- Executes dropped EXE
PID:768 -
\??\c:\hbhnbh.exec:\hbhnbh.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jpvdp.exec:\jpvdp.exe59⤵
- Executes dropped EXE
PID:1404 -
\??\c:\9llxflx.exec:\9llxflx.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\tnnbnb.exec:\tnnbnb.exe61⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ttnnbt.exec:\ttnnbt.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ppjpd.exec:\ppjpd.exe63⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9rllrrf.exec:\9rllrrf.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xrrxlff.exec:\xrrxlff.exe65⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7bbhtb.exec:\7bbhtb.exe66⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvvvj.exec:\dvvvj.exe67⤵PID:1612
-
\??\c:\xrrxlxf.exec:\xrrxlxf.exe68⤵PID:324
-
\??\c:\tthtnn.exec:\tthtnn.exe69⤵
- System Location Discovery: System Language Discovery
PID:2256 -
\??\c:\nnbnbh.exec:\nnbnbh.exe70⤵PID:2432
-
\??\c:\pjvdj.exec:\pjvdj.exe71⤵PID:2120
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe72⤵PID:1256
-
\??\c:\xrllrrf.exec:\xrllrrf.exe73⤵PID:1936
-
\??\c:\hhbhnt.exec:\hhbhnt.exe74⤵PID:1760
-
\??\c:\ppjdd.exec:\ppjdd.exe75⤵PID:2172
-
\??\c:\pvpdv.exec:\pvpdv.exe76⤵PID:1640
-
\??\c:\flxrflx.exec:\flxrflx.exe77⤵PID:1516
-
\??\c:\1bnthn.exec:\1bnthn.exe78⤵PID:2904
-
\??\c:\vvjjv.exec:\vvjjv.exe79⤵PID:900
-
\??\c:\fxrrlll.exec:\fxrrlll.exe80⤵PID:2540
-
\??\c:\bthtbb.exec:\bthtbb.exe81⤵PID:2908
-
\??\c:\9hbbbb.exec:\9hbbbb.exe82⤵PID:1804
-
\??\c:\jpdpv.exec:\jpdpv.exe83⤵PID:3008
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe84⤵PID:2816
-
\??\c:\xrxfffl.exec:\xrxfffl.exe85⤵PID:2744
-
\??\c:\bttthh.exec:\bttthh.exe86⤵PID:2772
-
\??\c:\dvjvv.exec:\dvjvv.exe87⤵PID:2660
-
\??\c:\pppvp.exec:\pppvp.exe88⤵PID:2628
-
\??\c:\lfxfxxx.exec:\lfxfxxx.exe89⤵PID:2684
-
\??\c:\thnbnh.exec:\thnbnh.exe90⤵PID:2616
-
\??\c:\jdppv.exec:\jdppv.exe91⤵PID:1712
-
\??\c:\jddjp.exec:\jddjp.exe92⤵PID:1128
-
\??\c:\lfrxffr.exec:\lfrxffr.exe93⤵PID:2928
-
\??\c:\9nbhnt.exec:\9nbhnt.exe94⤵PID:1392
-
\??\c:\hnhhtb.exec:\hnhhtb.exe95⤵PID:620
-
\??\c:\pvvvv.exec:\pvvvv.exe96⤵PID:1388
-
\??\c:\frxxfll.exec:\frxxfll.exe97⤵PID:2916
-
\??\c:\9lrxfll.exec:\9lrxfll.exe98⤵PID:2936
-
\??\c:\7bhhnn.exec:\7bhhnn.exe99⤵PID:1988
-
\??\c:\5dvjj.exec:\5dvjj.exe100⤵PID:352
-
\??\c:\vddjv.exec:\vddjv.exe101⤵PID:768
-
\??\c:\lfrrflr.exec:\lfrrflr.exe102⤵PID:2176
-
\??\c:\1htbnn.exec:\1htbnn.exe103⤵PID:2020
-
\??\c:\dvppv.exec:\dvppv.exe104⤵PID:348
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe105⤵PID:824
-
\??\c:\fflfrrx.exec:\fflfrrx.exe106⤵
- System Location Discovery: System Language Discovery
PID:3004 -
\??\c:\3nbntt.exec:\3nbntt.exe107⤵PID:1460
-
\??\c:\jjvvp.exec:\jjvvp.exe108⤵PID:2592
-
\??\c:\1jjpv.exec:\1jjpv.exe109⤵PID:1588
-
\??\c:\lrlrflx.exec:\lrlrflx.exe110⤵PID:1008
-
\??\c:\bbttht.exec:\bbttht.exe111⤵PID:656
-
\??\c:\htnnhh.exec:\htnnhh.exe112⤵PID:2212
-
\??\c:\ppjjp.exec:\ppjjp.exe113⤵PID:2348
-
\??\c:\5ffxffr.exec:\5ffxffr.exe114⤵PID:2080
-
\??\c:\7xxrfff.exec:\7xxrfff.exe115⤵PID:2120
-
\??\c:\bnhhnn.exec:\bnhhnn.exe116⤵PID:1256
-
\??\c:\dvpvv.exec:\dvpvv.exe117⤵PID:1552
-
\??\c:\5lxxllx.exec:\5lxxllx.exe118⤵PID:3040
-
\??\c:\lfflrxl.exec:\lfflrxl.exe119⤵PID:2384
-
\??\c:\9hbbnt.exec:\9hbbnt.exe120⤵PID:2400
-
\??\c:\pjddv.exec:\pjddv.exe121⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-