Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe
-
Size
456KB
-
MD5
3c5c533919eef08d52a482eb76643382
-
SHA1
133a12794d4d06b5fb3dbb55ea9a2d3234b314ac
-
SHA256
2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e
-
SHA512
4ff4cf6a9f5e262d730c8c43e8f50d5d5bf799b8960a3e8b06a447edc282e06e17aabf11c8e73fc4a87099c1b1e18cdfb1dae1a10c4a6f086aca2a0a793d48d3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRg:q7Tc2NYHUrAwfMp3CDRg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1728-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-87-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-522-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-568-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1704-593-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2456-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-698-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2108-697-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1908-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-905-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-984-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2400-998-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-1012-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1344-1063-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/700-1110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-1160-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1528 nhnbhh.exe 2152 tnhhth.exe 1012 088462.exe 2696 44406.exe 2744 bnhhnn.exe 2916 fxlrxrx.exe 2184 vjvvp.exe 2632 u084480.exe 2660 ddddj.exe 2624 264448.exe 2648 426204.exe 2108 pjjpp.exe 2132 dpdjv.exe 2672 2028484.exe 2892 fxfffxf.exe 2968 vddpv.exe 2984 2666226.exe 2348 0822222.exe 2488 9xrflfl.exe 2532 7djjj.exe 2096 lxrrlrr.exe 1648 i646804.exe 2584 426282.exe 1344 486682.exe 2060 e02222.exe 1816 5bhbbt.exe 1780 6460600.exe 2168 86846.exe 3048 rlxxxxf.exe 568 640066.exe 1868 1tnhhb.exe 1792 5hnhhb.exe 2344 02406.exe 2300 s4288.exe 2360 08000.exe 1600 nbnhhb.exe 2364 5vjjp.exe 1012 642466.exe 584 pdvdj.exe 2800 dpddj.exe 2872 8282262.exe 3012 i866888.exe 2864 vdjvd.exe 2732 ddjpp.exe 1808 08484.exe 2068 w68400.exe 2680 680004.exe 2772 9xlflll.exe 2780 868800.exe 2940 tnbbbh.exe 840 646626.exe 1756 6084668.exe 2964 4268440.exe 2892 lxrxxrl.exe 2968 264060.exe 1328 462888.exe 2308 llxllfl.exe 2572 3rrrrrr.exe 2552 ddpvj.exe 920 tbhhhh.exe 2096 604662.exe 316 s0886.exe 2588 088802.exe 3016 i422880.exe -
resource yara_rule behavioral1/memory/1728-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-212-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2060-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-697-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1784-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-712-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2984-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-1097-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-1110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-1160-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c244484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u646880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2622880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 088802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 1528 1728 2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe 30 PID 1728 wrote to memory of 1528 1728 2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe 30 PID 1728 wrote to memory of 1528 1728 2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe 30 PID 1728 wrote to memory of 1528 1728 2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe 30 PID 1528 wrote to memory of 2152 1528 nhnbhh.exe 31 PID 1528 wrote to memory of 2152 1528 nhnbhh.exe 31 PID 1528 wrote to memory of 2152 1528 nhnbhh.exe 31 PID 1528 wrote to memory of 2152 1528 nhnbhh.exe 31 PID 2152 wrote to memory of 1012 2152 tnhhth.exe 32 PID 2152 wrote to memory of 1012 2152 tnhhth.exe 32 PID 2152 wrote to memory of 1012 2152 tnhhth.exe 32 PID 2152 wrote to memory of 1012 2152 tnhhth.exe 32 PID 1012 wrote to memory of 2696 1012 088462.exe 33 PID 1012 wrote to memory of 2696 1012 088462.exe 33 PID 1012 wrote to memory of 2696 1012 088462.exe 33 PID 1012 wrote to memory of 2696 1012 088462.exe 33 PID 2696 wrote to memory of 2744 2696 44406.exe 34 PID 2696 wrote to memory of 2744 2696 44406.exe 34 PID 2696 wrote to memory of 2744 2696 44406.exe 34 PID 2696 wrote to memory of 2744 2696 44406.exe 34 PID 2744 wrote to memory of 2916 2744 bnhhnn.exe 35 PID 2744 wrote to memory of 2916 2744 bnhhnn.exe 35 PID 2744 wrote to memory of 2916 2744 bnhhnn.exe 35 PID 2744 wrote to memory of 2916 2744 bnhhnn.exe 35 PID 2916 wrote to memory of 2184 2916 fxlrxrx.exe 36 PID 2916 wrote to memory of 2184 2916 fxlrxrx.exe 36 PID 2916 wrote to memory of 2184 2916 fxlrxrx.exe 36 PID 2916 wrote to memory of 2184 2916 fxlrxrx.exe 36 PID 2184 wrote to memory of 2632 2184 vjvvp.exe 37 PID 2184 wrote to memory of 2632 2184 vjvvp.exe 37 PID 2184 wrote to memory of 2632 2184 vjvvp.exe 37 PID 2184 wrote to memory of 2632 2184 vjvvp.exe 37 PID 2632 wrote to memory of 2660 2632 u084480.exe 38 PID 2632 wrote to memory of 2660 2632 u084480.exe 38 PID 2632 wrote to memory of 2660 2632 u084480.exe 38 PID 2632 wrote to memory of 2660 2632 u084480.exe 38 PID 2660 wrote to memory of 2624 2660 ddddj.exe 39 PID 2660 wrote to memory of 2624 2660 ddddj.exe 39 PID 2660 wrote to memory of 2624 2660 ddddj.exe 39 PID 2660 wrote to memory of 2624 2660 ddddj.exe 39 PID 2624 wrote to memory of 2648 2624 264448.exe 40 PID 2624 wrote to memory of 2648 2624 264448.exe 40 PID 2624 wrote to memory of 2648 2624 264448.exe 40 PID 2624 wrote to memory of 2648 2624 264448.exe 40 PID 2648 wrote to memory of 2108 2648 426204.exe 41 PID 2648 wrote to memory of 2108 2648 426204.exe 41 PID 2648 wrote to memory of 2108 2648 426204.exe 41 PID 2648 wrote to memory of 2108 2648 426204.exe 41 PID 2108 wrote to memory of 2132 2108 pjjpp.exe 42 PID 2108 wrote to memory of 2132 2108 pjjpp.exe 42 PID 2108 wrote to memory of 2132 2108 pjjpp.exe 42 PID 2108 wrote to memory of 2132 2108 pjjpp.exe 42 PID 2132 wrote to memory of 2672 2132 dpdjv.exe 43 PID 2132 wrote to memory of 2672 2132 dpdjv.exe 43 PID 2132 wrote to memory of 2672 2132 dpdjv.exe 43 PID 2132 wrote to memory of 2672 2132 dpdjv.exe 43 PID 2672 wrote to memory of 2892 2672 2028484.exe 44 PID 2672 wrote to memory of 2892 2672 2028484.exe 44 PID 2672 wrote to memory of 2892 2672 2028484.exe 44 PID 2672 wrote to memory of 2892 2672 2028484.exe 44 PID 2892 wrote to memory of 2968 2892 fxfffxf.exe 45 PID 2892 wrote to memory of 2968 2892 fxfffxf.exe 45 PID 2892 wrote to memory of 2968 2892 fxfffxf.exe 45 PID 2892 wrote to memory of 2968 2892 fxfffxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe"C:\Users\Admin\AppData\Local\Temp\2c44b92c03b518f92f617cfdc8e6e97afc667cf1fb76b9ec5e6d5c43dd491d1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\nhnbhh.exec:\nhnbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\tnhhth.exec:\tnhhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\088462.exec:\088462.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\44406.exec:\44406.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bnhhnn.exec:\bnhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\vjvvp.exec:\vjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\u084480.exec:\u084480.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ddddj.exec:\ddddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\264448.exec:\264448.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\426204.exec:\426204.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pjjpp.exec:\pjjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\dpdjv.exec:\dpdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\2028484.exec:\2028484.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\fxfffxf.exec:\fxfffxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vddpv.exec:\vddpv.exe17⤵
- Executes dropped EXE
PID:2968 -
\??\c:\2666226.exec:\2666226.exe18⤵
- Executes dropped EXE
PID:2984 -
\??\c:\0822222.exec:\0822222.exe19⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9xrflfl.exec:\9xrflfl.exe20⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7djjj.exec:\7djjj.exe21⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\i646804.exec:\i646804.exe23⤵
- Executes dropped EXE
PID:1648 -
\??\c:\426282.exec:\426282.exe24⤵
- Executes dropped EXE
PID:2584 -
\??\c:\486682.exec:\486682.exe25⤵
- Executes dropped EXE
PID:1344 -
\??\c:\e02222.exec:\e02222.exe26⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5bhbbt.exec:\5bhbbt.exe27⤵
- Executes dropped EXE
PID:1816 -
\??\c:\6460600.exec:\6460600.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\86846.exec:\86846.exe29⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\640066.exec:\640066.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\1tnhhb.exec:\1tnhhb.exe32⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5hnhhb.exec:\5hnhhb.exe33⤵
- Executes dropped EXE
PID:1792 -
\??\c:\02406.exec:\02406.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\s4288.exec:\s4288.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\08000.exec:\08000.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nbnhhb.exec:\nbnhhb.exe37⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5vjjp.exec:\5vjjp.exe38⤵
- Executes dropped EXE
PID:2364 -
\??\c:\642466.exec:\642466.exe39⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pdvdj.exec:\pdvdj.exe40⤵
- Executes dropped EXE
PID:584 -
\??\c:\dpddj.exec:\dpddj.exe41⤵
- Executes dropped EXE
PID:2800 -
\??\c:\8282262.exec:\8282262.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\i866888.exec:\i866888.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vdjvd.exec:\vdjvd.exe44⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ddjpp.exec:\ddjpp.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\08484.exec:\08484.exe46⤵
- Executes dropped EXE
PID:1808 -
\??\c:\w68400.exec:\w68400.exe47⤵
- Executes dropped EXE
PID:2068 -
\??\c:\680004.exec:\680004.exe48⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9xlflll.exec:\9xlflll.exe49⤵
- Executes dropped EXE
PID:2772 -
\??\c:\868800.exec:\868800.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnbbbh.exec:\tnbbbh.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\646626.exec:\646626.exe52⤵
- Executes dropped EXE
PID:840 -
\??\c:\6084668.exec:\6084668.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\4268440.exec:\4268440.exe54⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lxrxxrl.exec:\lxrxxrl.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\264060.exec:\264060.exe56⤵
- Executes dropped EXE
PID:2968 -
\??\c:\462888.exec:\462888.exe57⤵
- Executes dropped EXE
PID:1328 -
\??\c:\llxllfl.exec:\llxllfl.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3rrrrrr.exec:\3rrrrrr.exe59⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ddpvj.exec:\ddpvj.exe60⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tbhhhh.exec:\tbhhhh.exe61⤵
- Executes dropped EXE
PID:920 -
\??\c:\604662.exec:\604662.exe62⤵
- Executes dropped EXE
PID:2096 -
\??\c:\s0886.exec:\s0886.exe63⤵
- Executes dropped EXE
PID:316 -
\??\c:\088802.exec:\088802.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\i422880.exec:\i422880.exe65⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhbnnt.exec:\hhbnnt.exe66⤵PID:992
-
\??\c:\7lfffxx.exec:\7lfffxx.exe67⤵PID:1044
-
\??\c:\s6884.exec:\s6884.exe68⤵PID:1828
-
\??\c:\m8002.exec:\m8002.exe69⤵PID:1816
-
\??\c:\pjppv.exec:\pjppv.exe70⤵PID:908
-
\??\c:\682828.exec:\682828.exe71⤵PID:556
-
\??\c:\e40682.exec:\e40682.exe72⤵PID:1744
-
\??\c:\nhttbt.exec:\nhttbt.exe73⤵PID:3048
-
\??\c:\62066.exec:\62066.exe74⤵PID:1540
-
\??\c:\4622228.exec:\4622228.exe75⤵PID:1152
-
\??\c:\42068.exec:\42068.exe76⤵PID:1632
-
\??\c:\20228.exec:\20228.exe77⤵PID:2684
-
\??\c:\0066606.exec:\0066606.exe78⤵PID:2516
-
\??\c:\66408.exec:\66408.exe79⤵PID:1704
-
\??\c:\086226.exec:\086226.exe80⤵PID:2360
-
\??\c:\8864228.exec:\8864228.exe81⤵PID:2524
-
\??\c:\a4840.exec:\a4840.exe82⤵PID:2456
-
\??\c:\s6020.exec:\s6020.exe83⤵PID:2840
-
\??\c:\044400.exec:\044400.exe84⤵PID:2824
-
\??\c:\hhbtbb.exec:\hhbtbb.exe85⤵PID:2748
-
\??\c:\5nbbbb.exec:\5nbbbb.exe86⤵PID:2796
-
\??\c:\k24844.exec:\k24844.exe87⤵PID:3068
-
\??\c:\nhtthh.exec:\nhtthh.exe88⤵PID:2760
-
\??\c:\lfxxlfr.exec:\lfxxlfr.exe89⤵PID:2608
-
\??\c:\xrfxxff.exec:\xrfxxff.exe90⤵PID:1808
-
\??\c:\48628.exec:\48628.exe91⤵PID:2616
-
\??\c:\48286.exec:\48286.exe92⤵PID:2668
-
\??\c:\600202.exec:\600202.exe93⤵PID:2772
-
\??\c:\fxllrxx.exec:\fxllrxx.exe94⤵PID:2688
-
\??\c:\862666.exec:\862666.exe95⤵PID:2108
-
\??\c:\thnnhn.exec:\thnnhn.exe96⤵PID:1092
-
\??\c:\3nbtnh.exec:\3nbtnh.exe97⤵PID:1784
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe98⤵PID:2964
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe99⤵PID:1908
-
\??\c:\bhtnhh.exec:\bhtnhh.exe100⤵PID:2984
-
\??\c:\hhnbhn.exec:\hhnbhn.exe101⤵PID:1988
-
\??\c:\m2006.exec:\m2006.exe102⤵PID:2092
-
\??\c:\vvpdj.exec:\vvpdj.exe103⤵PID:2700
-
\??\c:\64280.exec:\64280.exe104⤵PID:304
-
\??\c:\20824.exec:\20824.exe105⤵PID:2020
-
\??\c:\nhnhhb.exec:\nhnhhb.exe106⤵PID:2484
-
\??\c:\frxxffl.exec:\frxxffl.exe107⤵PID:1032
-
\??\c:\nhbbht.exec:\nhbbht.exe108⤵PID:3020
-
\??\c:\864462.exec:\864462.exe109⤵PID:2900
-
\??\c:\xlffxff.exec:\xlffxff.exe110⤵PID:832
-
\??\c:\lxrlffr.exec:\lxrlffr.exe111⤵PID:1932
-
\??\c:\0248880.exec:\0248880.exe112⤵PID:2100
-
\??\c:\s6266.exec:\s6266.exe113⤵PID:2492
-
\??\c:\q68888.exec:\q68888.exe114⤵PID:1788
-
\??\c:\26446.exec:\26446.exe115⤵
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\4688262.exec:\4688262.exe116⤵PID:1168
-
\??\c:\64040.exec:\64040.exe117⤵PID:700
-
\??\c:\9rfrlll.exec:\9rfrlll.exe118⤵PID:1504
-
\??\c:\86444.exec:\86444.exe119⤵PID:1492
-
\??\c:\vvjvv.exec:\vvjvv.exe120⤵PID:1796
-
\??\c:\pdjdd.exec:\pdjdd.exe121⤵PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-