Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe
-
Size
453KB
-
MD5
6201e64431d58cd17ab33cffb5a31803
-
SHA1
4a3f8c85ac5a6cea0216124da2e4845ea0a22c2b
-
SHA256
00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e
-
SHA512
9c05d507f2ef835c5c2c8c3fa6b25c53783ae8d84cde366bcac5d3a6b1d6a9d2330d072d4b221c62be9aa24ecd95f091998088eabb374fe755c7462461657661
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG4:q7Tc2NYHUrAwfMp3CDG4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-132-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2332-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-165-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2956-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-314-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2088-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-565-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2592-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-653-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2580-922-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1804 htbhhh.exe 3040 jjjjv.exe 2552 bthnbn.exe 2176 fxlxllx.exe 2736 bnhntb.exe 2828 jddpv.exe 2696 fxlxflr.exe 2600 pdddj.exe 2836 flxxlrx.exe 2652 1xxlxxl.exe 2200 ttnbnb.exe 1664 3fxfxxf.exe 2332 1hhhhh.exe 2076 pjvvd.exe 1020 rrxxxff.exe 2768 ppdjv.exe 1440 hthntt.exe 2956 1pdvv.exe 2908 jvjjj.exe 2444 3tbtnn.exe 2196 9dvdj.exe 916 btbbbt.exe 3008 pdjvp.exe 796 fxfrxfx.exe 1372 1tnnnn.exe 560 xxrxlrf.exe 2072 nbhhhh.exe 1548 rrflllx.exe 2036 btttbt.exe 1884 jdvpp.exe 2296 xrxfxxf.exe 1556 vjpvv.exe 3060 xlrxxfr.exe 2088 3lflfff.exe 2348 tnhnbb.exe 2688 ppddp.exe 2824 rrfrffr.exe 3000 hthhhh.exe 2856 hnttnb.exe 860 vjdpd.exe 2968 1xllfxf.exe 2572 7thbhh.exe 2752 1djjd.exe 2252 dvvdv.exe 1872 xrffrlr.exe 1924 bbtntb.exe 1932 jjvjv.exe 2112 vpjjp.exe 1868 xfrrllr.exe 828 nhbbhh.exe 1508 htbbbb.exe 2680 jjddj.exe 2900 frfffff.exe 1420 rrrrfrf.exe 2224 nbhhhn.exe 1032 dvppd.exe 672 3rfffff.exe 316 flflflf.exe 2196 btbhnh.exe 3020 jdjdv.exe 1128 jvppv.exe 1300 rflfxrx.exe 1572 ttthbt.exe 2344 vjvpp.exe -
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-935-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1804 2388 00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe 30 PID 2388 wrote to memory of 1804 2388 00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe 30 PID 2388 wrote to memory of 1804 2388 00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe 30 PID 2388 wrote to memory of 1804 2388 00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe 30 PID 1804 wrote to memory of 3040 1804 htbhhh.exe 31 PID 1804 wrote to memory of 3040 1804 htbhhh.exe 31 PID 1804 wrote to memory of 3040 1804 htbhhh.exe 31 PID 1804 wrote to memory of 3040 1804 htbhhh.exe 31 PID 3040 wrote to memory of 2552 3040 jjjjv.exe 32 PID 3040 wrote to memory of 2552 3040 jjjjv.exe 32 PID 3040 wrote to memory of 2552 3040 jjjjv.exe 32 PID 3040 wrote to memory of 2552 3040 jjjjv.exe 32 PID 2552 wrote to memory of 2176 2552 bthnbn.exe 33 PID 2552 wrote to memory of 2176 2552 bthnbn.exe 33 PID 2552 wrote to memory of 2176 2552 bthnbn.exe 33 PID 2552 wrote to memory of 2176 2552 bthnbn.exe 33 PID 2176 wrote to memory of 2736 2176 fxlxllx.exe 34 PID 2176 wrote to memory of 2736 2176 fxlxllx.exe 34 PID 2176 wrote to memory of 2736 2176 fxlxllx.exe 34 PID 2176 wrote to memory of 2736 2176 fxlxllx.exe 34 PID 2736 wrote to memory of 2828 2736 bnhntb.exe 35 PID 2736 wrote to memory of 2828 2736 bnhntb.exe 35 PID 2736 wrote to memory of 2828 2736 bnhntb.exe 35 PID 2736 wrote to memory of 2828 2736 bnhntb.exe 35 PID 2828 wrote to memory of 2696 2828 jddpv.exe 36 PID 2828 wrote to memory of 2696 2828 jddpv.exe 36 PID 2828 wrote to memory of 2696 2828 jddpv.exe 36 PID 2828 wrote to memory of 2696 2828 jddpv.exe 36 PID 2696 wrote to memory of 2600 2696 fxlxflr.exe 37 PID 2696 wrote to memory of 2600 2696 fxlxflr.exe 37 PID 2696 wrote to memory of 2600 2696 fxlxflr.exe 37 PID 2696 wrote to memory of 2600 2696 fxlxflr.exe 37 PID 2600 wrote to memory of 2836 2600 pdddj.exe 38 PID 2600 wrote to memory of 2836 2600 pdddj.exe 38 PID 2600 wrote to memory of 2836 2600 pdddj.exe 38 PID 2600 wrote to memory of 2836 2600 pdddj.exe 38 PID 2836 wrote to memory of 2652 2836 flxxlrx.exe 39 PID 2836 wrote to memory of 2652 2836 flxxlrx.exe 39 PID 2836 wrote to memory of 2652 2836 flxxlrx.exe 39 PID 2836 wrote to memory of 2652 2836 flxxlrx.exe 39 PID 2652 wrote to memory of 2200 2652 1xxlxxl.exe 40 PID 2652 wrote to memory of 2200 2652 1xxlxxl.exe 40 PID 2652 wrote to memory of 2200 2652 1xxlxxl.exe 40 PID 2652 wrote to memory of 2200 2652 1xxlxxl.exe 40 PID 2200 wrote to memory of 1664 2200 ttnbnb.exe 41 PID 2200 wrote to memory of 1664 2200 ttnbnb.exe 41 PID 2200 wrote to memory of 1664 2200 ttnbnb.exe 41 PID 2200 wrote to memory of 1664 2200 ttnbnb.exe 41 PID 1664 wrote to memory of 2332 1664 3fxfxxf.exe 42 PID 1664 wrote to memory of 2332 1664 3fxfxxf.exe 42 PID 1664 wrote to memory of 2332 1664 3fxfxxf.exe 42 PID 1664 wrote to memory of 2332 1664 3fxfxxf.exe 42 PID 2332 wrote to memory of 2076 2332 1hhhhh.exe 43 PID 2332 wrote to memory of 2076 2332 1hhhhh.exe 43 PID 2332 wrote to memory of 2076 2332 1hhhhh.exe 43 PID 2332 wrote to memory of 2076 2332 1hhhhh.exe 43 PID 2076 wrote to memory of 1020 2076 pjvvd.exe 44 PID 2076 wrote to memory of 1020 2076 pjvvd.exe 44 PID 2076 wrote to memory of 1020 2076 pjvvd.exe 44 PID 2076 wrote to memory of 1020 2076 pjvvd.exe 44 PID 1020 wrote to memory of 2768 1020 rrxxxff.exe 45 PID 1020 wrote to memory of 2768 1020 rrxxxff.exe 45 PID 1020 wrote to memory of 2768 1020 rrxxxff.exe 45 PID 1020 wrote to memory of 2768 1020 rrxxxff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe"C:\Users\Admin\AppData\Local\Temp\00a9234320895355e6180f9f32f823e55f20f1e7a82cdccb2e78bfcb4171984e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\htbhhh.exec:\htbhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\jjjjv.exec:\jjjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bthnbn.exec:\bthnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\fxlxllx.exec:\fxlxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\bnhntb.exec:\bnhntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jddpv.exec:\jddpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fxlxflr.exec:\fxlxflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pdddj.exec:\pdddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\flxxlrx.exec:\flxxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\1xxlxxl.exec:\1xxlxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ttnbnb.exec:\ttnbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\3fxfxxf.exec:\3fxfxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\1hhhhh.exec:\1hhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pjvvd.exec:\pjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\rrxxxff.exec:\rrxxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\ppdjv.exec:\ppdjv.exe17⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hthntt.exec:\hthntt.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1pdvv.exec:\1pdvv.exe19⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jvjjj.exec:\jvjjj.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3tbtnn.exec:\3tbtnn.exe21⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9dvdj.exec:\9dvdj.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\btbbbt.exec:\btbbbt.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\pdjvp.exec:\pdjvp.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fxfrxfx.exec:\fxfrxfx.exe25⤵
- Executes dropped EXE
PID:796 -
\??\c:\1tnnnn.exec:\1tnnnn.exe26⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe27⤵
- Executes dropped EXE
PID:560 -
\??\c:\nbhhhh.exec:\nbhhhh.exe28⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rrflllx.exec:\rrflllx.exe29⤵
- Executes dropped EXE
PID:1548 -
\??\c:\btttbt.exec:\btttbt.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdvpp.exec:\jdvpp.exe31⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xrxfxxf.exec:\xrxfxxf.exe32⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vjpvv.exec:\vjpvv.exe33⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xlrxxfr.exec:\xlrxxfr.exe34⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3lflfff.exec:\3lflfff.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnhnbb.exec:\tnhnbb.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ppddp.exec:\ppddp.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rrfrffr.exec:\rrfrffr.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hthhhh.exec:\hthhhh.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hnttnb.exec:\hnttnb.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vjdpd.exec:\vjdpd.exe41⤵
- Executes dropped EXE
PID:860 -
\??\c:\1xllfxf.exec:\1xllfxf.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7thbhh.exec:\7thbhh.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1djjd.exec:\1djjd.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dvvdv.exec:\dvvdv.exe45⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xrffrlr.exec:\xrffrlr.exe46⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bbtntb.exec:\bbtntb.exe47⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jjvjv.exec:\jjvjv.exe48⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpjjp.exec:\vpjjp.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\xfrrllr.exec:\xfrrllr.exe50⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nhbbhh.exec:\nhbbhh.exe51⤵
- Executes dropped EXE
PID:828 -
\??\c:\htbbbb.exec:\htbbbb.exe52⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jjddj.exec:\jjddj.exe53⤵
- Executes dropped EXE
PID:2680 -
\??\c:\frfffff.exec:\frfffff.exe54⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rrrrfrf.exec:\rrrrfrf.exe55⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nbhhhn.exec:\nbhhhn.exe56⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dvppd.exec:\dvppd.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3rfffff.exec:\3rfffff.exe58⤵
- Executes dropped EXE
PID:672 -
\??\c:\flflflf.exec:\flflflf.exe59⤵
- Executes dropped EXE
PID:316 -
\??\c:\btbhnh.exec:\btbhnh.exe60⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jdjdv.exec:\jdjdv.exe61⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jvppv.exec:\jvppv.exe62⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rflfxrx.exec:\rflfxrx.exe63⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ttthbt.exec:\ttthbt.exe64⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vjvpp.exec:\vjvpp.exe65⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jvdvp.exec:\jvdvp.exe66⤵PID:264
-
\??\c:\1flrxxl.exec:\1flrxxl.exe67⤵PID:2172
-
\??\c:\tthnbt.exec:\tthnbt.exe68⤵PID:2972
-
\??\c:\1djvd.exec:\1djvd.exe69⤵PID:1900
-
\??\c:\jjvvd.exec:\jjvvd.exe70⤵PID:988
-
\??\c:\lrxrlfl.exec:\lrxrlfl.exe71⤵PID:1484
-
\??\c:\bnttbb.exec:\bnttbb.exe72⤵PID:320
-
\??\c:\1tbtnh.exec:\1tbtnh.exe73⤵PID:2524
-
\??\c:\pdjdj.exec:\pdjdj.exe74⤵PID:1556
-
\??\c:\rlrlfxl.exec:\rlrlfxl.exe75⤵PID:2116
-
\??\c:\7rfxffx.exec:\7rfxffx.exe76⤵
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\9ttnhb.exec:\9ttnhb.exe77⤵PID:2096
-
\??\c:\pvjdd.exec:\pvjdd.exe78⤵PID:2468
-
\??\c:\pdvpv.exec:\pdvpv.exe79⤵PID:2708
-
\??\c:\rffxflr.exec:\rffxflr.exe80⤵PID:2584
-
\??\c:\hthhnn.exec:\hthhnn.exe81⤵PID:2840
-
\??\c:\pjjpd.exec:\pjjpd.exe82⤵PID:2888
-
\??\c:\vvvdj.exec:\vvvdj.exe83⤵PID:2316
-
\??\c:\rlxfffl.exec:\rlxfffl.exe84⤵PID:2592
-
\??\c:\tnbttt.exec:\tnbttt.exe85⤵PID:2588
-
\??\c:\9jvvv.exec:\9jvvv.exe86⤵PID:2216
-
\??\c:\pvpdp.exec:\pvpdp.exe87⤵PID:908
-
\??\c:\7fllllf.exec:\7fllllf.exe88⤵PID:1560
-
\??\c:\nhbbnt.exec:\nhbbnt.exe89⤵PID:1924
-
\??\c:\1hhbbb.exec:\1hhbbb.exe90⤵PID:2808
-
\??\c:\7djvv.exec:\7djvv.exe91⤵PID:1712
-
\??\c:\3lxrrfl.exec:\3lxrrfl.exe92⤵PID:1356
-
\??\c:\rlxxlfr.exec:\rlxxlfr.exe93⤵PID:1632
-
\??\c:\nbnttb.exec:\nbnttb.exe94⤵PID:2636
-
\??\c:\vdppp.exec:\vdppp.exe95⤵PID:2416
-
\??\c:\5vjdd.exec:\5vjdd.exe96⤵PID:2952
-
\??\c:\fxrxffr.exec:\fxrxffr.exe97⤵PID:1740
-
\??\c:\htbbbb.exec:\htbbbb.exe98⤵PID:2208
-
\??\c:\dvjjj.exec:\dvjjj.exe99⤵PID:2908
-
\??\c:\5dpdd.exec:\5dpdd.exe100⤵PID:3064
-
\??\c:\lxfflfr.exec:\lxfflfr.exe101⤵PID:1292
-
\??\c:\5ntbtt.exec:\5ntbtt.exe102⤵PID:2260
-
\??\c:\1httbb.exec:\1httbb.exe103⤵PID:3016
-
\??\c:\vpdjd.exec:\vpdjd.exe104⤵PID:276
-
\??\c:\5lxlrll.exec:\5lxlrll.exe105⤵PID:896
-
\??\c:\3xffrll.exec:\3xffrll.exe106⤵PID:796
-
\??\c:\hbtbhh.exec:\hbtbhh.exe107⤵PID:1656
-
\??\c:\5vdjj.exec:\5vdjj.exe108⤵PID:1760
-
\??\c:\rffrrff.exec:\rffrrff.exe109⤵PID:1348
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe110⤵PID:2204
-
\??\c:\nntnnn.exec:\nntnnn.exe111⤵PID:1544
-
\??\c:\3vddd.exec:\3vddd.exe112⤵PID:2972
-
\??\c:\1vjvd.exec:\1vjvd.exe113⤵PID:1900
-
\??\c:\xxlflff.exec:\xxlflff.exe114⤵PID:2036
-
\??\c:\9hbttt.exec:\9hbttt.exe115⤵PID:1884
-
\??\c:\3hhtnh.exec:\3hhtnh.exe116⤵PID:320
-
\??\c:\pvppd.exec:\pvppd.exe117⤵PID:2524
-
\??\c:\xrfflrf.exec:\xrfflrf.exe118⤵PID:3056
-
\??\c:\rlrxfll.exec:\rlrxfll.exe119⤵PID:2924
-
\??\c:\bntthb.exec:\bntthb.exe120⤵PID:1892
-
\??\c:\djpjd.exec:\djpjd.exe121⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-