Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 00:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe
-
Size
455KB
-
MD5
7e7a4198f30e70f2281bfab4009b8086
-
SHA1
c173c51f410caae9d2505fcec23bbdf29b9e2f3e
-
SHA256
71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534
-
SHA512
69bef9bf05b9be9b3d194958fbfccae69a0ce2eca8878f4d6fe17d323306d5660c7e4d17f10f0cab1a7bd36fdb4e09c06d21fea6d53a432915aae20e1f347054
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2828-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-17-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2620-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-319-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-547-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/800-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-1112-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/944-1036-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-849-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-647-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2420-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-532-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2360-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-374-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/696-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1820-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-27-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 9bnttt.exe 3064 xxffrff.exe 3020 flrffrx.exe 2700 5hnnbt.exe 2620 dvdjj.exe 1920 fxlxlrr.exe 320 tthntt.exe 580 pjjjj.exe 2148 xllxxll.exe 2512 tnnbbt.exe 2928 jvddd.exe 2976 9lxxxrx.exe 2992 5hbhtb.exe 2872 ppddj.exe 2300 9frllfl.exe 2940 tbnbhh.exe 552 7pppj.exe 1820 llffflr.exe 1580 9btthb.exe 3060 jdvdv.exe 2356 fxxrflx.exe 2204 tnbbhn.exe 1148 3jpvd.exe 1944 xfxxxxx.exe 1704 nbnhhh.exe 1992 1lrfllx.exe 2656 5bhbhb.exe 2332 5pjjj.exe 996 1lffrrf.exe 1752 7tthtb.exe 1872 pvvpj.exe 2716 lrrlxfr.exe 2740 1nbbhb.exe 3012 pjvdj.exe 2644 9rlxffr.exe 2236 ffxrllr.exe 2624 tntthb.exe 696 pjppd.exe 1048 dvpjp.exe 2924 rlxxllr.exe 2504 tnhntt.exe 2108 btthbh.exe 1228 vppdp.exe 3032 frrxlrf.exe 2952 7hbthn.exe 2976 btnnbb.exe 792 7dppp.exe 2360 9fxfrxl.exe 2768 xlflffr.exe 1612 9thhhn.exe 1288 thttbb.exe 2772 dddjp.exe 2004 rllrlrf.exe 2168 lfxlffr.exe 2008 nnhhnn.exe 1476 vvdvd.exe 1608 5pdjv.exe 1888 frllxfl.exe 2392 5ntthn.exe 2552 nbhhtb.exe 1532 ddddd.exe 944 jjjjp.exe 1292 lrrfxxr.exe 1096 nnhnbn.exe -
resource yara_rule behavioral1/memory/2828-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-1113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-586-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2008-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-28-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2824 2828 71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe 801 PID 2828 wrote to memory of 2824 2828 71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe 801 PID 2828 wrote to memory of 2824 2828 71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe 801 PID 2828 wrote to memory of 2824 2828 71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe 801 PID 2824 wrote to memory of 3064 2824 9bnttt.exe 31 PID 2824 wrote to memory of 3064 2824 9bnttt.exe 31 PID 2824 wrote to memory of 3064 2824 9bnttt.exe 31 PID 2824 wrote to memory of 3064 2824 9bnttt.exe 31 PID 3064 wrote to memory of 3020 3064 xxffrff.exe 32 PID 3064 wrote to memory of 3020 3064 xxffrff.exe 32 PID 3064 wrote to memory of 3020 3064 xxffrff.exe 32 PID 3064 wrote to memory of 3020 3064 xxffrff.exe 32 PID 3020 wrote to memory of 2700 3020 flrffrx.exe 33 PID 3020 wrote to memory of 2700 3020 flrffrx.exe 33 PID 3020 wrote to memory of 2700 3020 flrffrx.exe 33 PID 3020 wrote to memory of 2700 3020 flrffrx.exe 33 PID 2700 wrote to memory of 2620 2700 5hnnbt.exe 34 PID 2700 wrote to memory of 2620 2700 5hnnbt.exe 34 PID 2700 wrote to memory of 2620 2700 5hnnbt.exe 34 PID 2700 wrote to memory of 2620 2700 5hnnbt.exe 34 PID 2620 wrote to memory of 1920 2620 dvdjj.exe 35 PID 2620 wrote to memory of 1920 2620 dvdjj.exe 35 PID 2620 wrote to memory of 1920 2620 dvdjj.exe 35 PID 2620 wrote to memory of 1920 2620 dvdjj.exe 35 PID 1920 wrote to memory of 320 1920 fxlxlrr.exe 1079 PID 1920 wrote to memory of 320 1920 fxlxlrr.exe 1079 PID 1920 wrote to memory of 320 1920 fxlxlrr.exe 1079 PID 1920 wrote to memory of 320 1920 fxlxlrr.exe 1079 PID 320 wrote to memory of 580 320 tthntt.exe 37 PID 320 wrote to memory of 580 320 tthntt.exe 37 PID 320 wrote to memory of 580 320 tthntt.exe 37 PID 320 wrote to memory of 580 320 tthntt.exe 37 PID 580 wrote to memory of 2148 580 pjjjj.exe 272 PID 580 wrote to memory of 2148 580 pjjjj.exe 272 PID 580 wrote to memory of 2148 580 pjjjj.exe 272 PID 580 wrote to memory of 2148 580 pjjjj.exe 272 PID 2148 wrote to memory of 2512 2148 xllxxll.exe 39 PID 2148 wrote to memory of 2512 2148 xllxxll.exe 39 PID 2148 wrote to memory of 2512 2148 xllxxll.exe 39 PID 2148 wrote to memory of 2512 2148 xllxxll.exe 39 PID 2512 wrote to memory of 2928 2512 tnnbbt.exe 40 PID 2512 wrote to memory of 2928 2512 tnnbbt.exe 40 PID 2512 wrote to memory of 2928 2512 tnnbbt.exe 40 PID 2512 wrote to memory of 2928 2512 tnnbbt.exe 40 PID 2928 wrote to memory of 2976 2928 jvddd.exe 41 PID 2928 wrote to memory of 2976 2928 jvddd.exe 41 PID 2928 wrote to memory of 2976 2928 jvddd.exe 41 PID 2928 wrote to memory of 2976 2928 jvddd.exe 41 PID 2976 wrote to memory of 2992 2976 9lxxxrx.exe 42 PID 2976 wrote to memory of 2992 2976 9lxxxrx.exe 42 PID 2976 wrote to memory of 2992 2976 9lxxxrx.exe 42 PID 2976 wrote to memory of 2992 2976 9lxxxrx.exe 42 PID 2992 wrote to memory of 2872 2992 5hbhtb.exe 43 PID 2992 wrote to memory of 2872 2992 5hbhtb.exe 43 PID 2992 wrote to memory of 2872 2992 5hbhtb.exe 43 PID 2992 wrote to memory of 2872 2992 5hbhtb.exe 43 PID 2872 wrote to memory of 2300 2872 ppddj.exe 44 PID 2872 wrote to memory of 2300 2872 ppddj.exe 44 PID 2872 wrote to memory of 2300 2872 ppddj.exe 44 PID 2872 wrote to memory of 2300 2872 ppddj.exe 44 PID 2300 wrote to memory of 2940 2300 9frllfl.exe 45 PID 2300 wrote to memory of 2940 2300 9frllfl.exe 45 PID 2300 wrote to memory of 2940 2300 9frllfl.exe 45 PID 2300 wrote to memory of 2940 2300 9frllfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe"C:\Users\Admin\AppData\Local\Temp\71a52b0b2d9a74f6275447bcbb904120a74c1287a759040af67dcaf2ebd0f534.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\9bnttt.exec:\9bnttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xxffrff.exec:\xxffrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\flrffrx.exec:\flrffrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\5hnnbt.exec:\5hnnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dvdjj.exec:\dvdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fxlxlrr.exec:\fxlxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\tthntt.exec:\tthntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\pjjjj.exec:\pjjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\xllxxll.exec:\xllxxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tnnbbt.exec:\tnnbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\jvddd.exec:\jvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\9lxxxrx.exec:\9lxxxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\5hbhtb.exec:\5hbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ppddj.exec:\ppddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9frllfl.exec:\9frllfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\tbnbhh.exec:\tbnbhh.exe17⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7pppj.exec:\7pppj.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552 -
\??\c:\llffflr.exec:\llffflr.exe19⤵
- Executes dropped EXE
PID:1820 -
\??\c:\9btthb.exec:\9btthb.exe20⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jdvdv.exec:\jdvdv.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fxxrflx.exec:\fxxrflx.exe22⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tnbbhn.exec:\tnbbhn.exe23⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3jpvd.exec:\3jpvd.exe24⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nbnhhh.exec:\nbnhhh.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1lrfllx.exec:\1lrfllx.exe27⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5bhbhb.exec:\5bhbhb.exe28⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5pjjj.exec:\5pjjj.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1lffrrf.exec:\1lffrrf.exe30⤵
- Executes dropped EXE
PID:996 -
\??\c:\7tthtb.exec:\7tthtb.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pvvpj.exec:\pvvpj.exe32⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lrrlxfr.exec:\lrrlxfr.exe33⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1nbbhb.exec:\1nbbhb.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pjvdj.exec:\pjvdj.exe35⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9rlxffr.exec:\9rlxffr.exe36⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ffxrllr.exec:\ffxrllr.exe37⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tntthb.exec:\tntthb.exe38⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjppd.exec:\pjppd.exe39⤵
- Executes dropped EXE
PID:696 -
\??\c:\dvpjp.exec:\dvpjp.exe40⤵
- Executes dropped EXE
PID:1048 -
\??\c:\rlxxllr.exec:\rlxxllr.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tnhntt.exec:\tnhntt.exe42⤵
- Executes dropped EXE
PID:2504 -
\??\c:\btthbh.exec:\btthbh.exe43⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vppdp.exec:\vppdp.exe44⤵
- Executes dropped EXE
PID:1228 -
\??\c:\frrxlrf.exec:\frrxlrf.exe45⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7hbthn.exec:\7hbthn.exe46⤵
- Executes dropped EXE
PID:2952 -
\??\c:\btnnbb.exec:\btnnbb.exe47⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7dppp.exec:\7dppp.exe48⤵
- Executes dropped EXE
PID:792 -
\??\c:\9fxfrxl.exec:\9fxfrxl.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xlflffr.exec:\xlflffr.exe50⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9thhhn.exec:\9thhhn.exe51⤵
- Executes dropped EXE
PID:1612 -
\??\c:\thttbb.exec:\thttbb.exe52⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dddjp.exec:\dddjp.exe53⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rllrlrf.exec:\rllrlrf.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lfxlffr.exec:\lfxlffr.exe55⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nnhhnn.exec:\nnhhnn.exe56⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vvdvd.exec:\vvdvd.exe57⤵
- Executes dropped EXE
PID:1476 -
\??\c:\5pdjv.exec:\5pdjv.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\frllxfl.exec:\frllxfl.exe59⤵
- Executes dropped EXE
PID:1888 -
\??\c:\5ntthn.exec:\5ntthn.exe60⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nbhhtb.exec:\nbhhtb.exe61⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ddddd.exec:\ddddd.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jjjjp.exec:\jjjjp.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\lrrfxxr.exec:\lrrfxxr.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1292 -
\??\c:\nnhnbn.exec:\nnhnbn.exe65⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5nhhtt.exec:\5nhhtt.exe66⤵PID:1616
-
\??\c:\jpdpd.exec:\jpdpd.exe67⤵PID:1600
-
\??\c:\5lffxfl.exec:\5lffxfl.exe68⤵
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\5lfxfll.exec:\5lfxfll.exe69⤵PID:1776
-
\??\c:\5bntbb.exec:\5bntbb.exe70⤵PID:1596
-
\??\c:\dvjjp.exec:\dvjjp.exe71⤵PID:2804
-
\??\c:\jddvj.exec:\jddvj.exe72⤵PID:3064
-
\??\c:\rfrrrlr.exec:\rfrrrlr.exe73⤵PID:2632
-
\??\c:\frxxllr.exec:\frxxllr.exe74⤵PID:1244
-
\??\c:\tntnnb.exec:\tntnnb.exe75⤵PID:2420
-
\??\c:\5tnntt.exec:\5tnntt.exe76⤵
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\3jpdd.exec:\3jpdd.exe77⤵PID:2600
-
\??\c:\lllrllr.exec:\lllrllr.exe78⤵PID:560
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe79⤵PID:800
-
\??\c:\hthbhh.exec:\hthbhh.exe80⤵PID:2988
-
\??\c:\vpdjv.exec:\vpdjv.exe81⤵PID:1736
-
\??\c:\vjpjp.exec:\vjpjp.exe82⤵PID:2140
-
\??\c:\ffrfllx.exec:\ffrfllx.exe83⤵PID:2536
-
\??\c:\nnhhtn.exec:\nnhhtn.exe84⤵PID:1228
-
\??\c:\bbnbht.exec:\bbnbht.exe85⤵PID:3032
-
\??\c:\9jjpd.exec:\9jjpd.exe86⤵PID:2952
-
\??\c:\ppjjp.exec:\ppjjp.exe87⤵PID:2860
-
\??\c:\lrlxxxx.exec:\lrlxxxx.exe88⤵PID:2960
-
\??\c:\rfrflll.exec:\rfrflll.exe89⤵PID:2056
-
\??\c:\hbttth.exec:\hbttth.exe90⤵PID:2780
-
\??\c:\vpjpv.exec:\vpjpv.exe91⤵PID:1756
-
\??\c:\7vvvj.exec:\7vvvj.exe92⤵PID:2052
-
\??\c:\7frxfff.exec:\7frxfff.exe93⤵PID:2556
-
\??\c:\7rfxrrr.exec:\7rfxrrr.exe94⤵PID:2772
-
\??\c:\bntnbn.exec:\bntnbn.exe95⤵PID:2004
-
\??\c:\vvpdv.exec:\vvpdv.exe96⤵PID:1500
-
\??\c:\pjvpp.exec:\pjvpp.exe97⤵PID:2036
-
\??\c:\rxlrrxf.exec:\rxlrrxf.exe98⤵PID:2120
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe99⤵PID:2424
-
\??\c:\hhbhtt.exec:\hhbhtt.exe100⤵PID:2072
-
\??\c:\nbhbbt.exec:\nbhbbt.exe101⤵PID:1888
-
\??\c:\1pjpv.exec:\1pjpv.exe102⤵PID:1536
-
\??\c:\rrllxlx.exec:\rrllxlx.exe103⤵PID:924
-
\??\c:\xxxxffl.exec:\xxxxffl.exe104⤵PID:2428
-
\??\c:\bhhnnb.exec:\bhhnnb.exe105⤵PID:2124
-
\??\c:\btntbh.exec:\btntbh.exe106⤵PID:1080
-
\??\c:\vpjdj.exec:\vpjdj.exe107⤵PID:1124
-
\??\c:\rxlxrfl.exec:\rxlxrfl.exe108⤵PID:2000
-
\??\c:\rfxxffl.exec:\rfxxffl.exe109⤵PID:2800
-
\??\c:\nhbnbb.exec:\nhbnbb.exe110⤵PID:1752
-
\??\c:\tnhhnn.exec:\tnhhnn.exe111⤵PID:2476
-
\??\c:\1jdjd.exec:\1jdjd.exe112⤵PID:2748
-
\??\c:\lfflrrx.exec:\lfflrrx.exe113⤵PID:2648
-
\??\c:\ffrxflr.exec:\ffrxflr.exe114⤵PID:1272
-
\??\c:\bhnhnh.exec:\bhnhnh.exe115⤵PID:2896
-
\??\c:\1dvvd.exec:\1dvvd.exe116⤵PID:2640
-
\??\c:\dvvvd.exec:\dvvvd.exe117⤵PID:1584
-
\??\c:\9xllrrf.exec:\9xllrrf.exe118⤵PID:804
-
\??\c:\5llrrlr.exec:\5llrrlr.exe119⤵PID:1860
-
\??\c:\tnbbnt.exec:\tnbbnt.exe120⤵PID:2652
-
\??\c:\pjdjj.exec:\pjdjj.exe121⤵PID:1728
-
\??\c:\jdppj.exec:\jdppj.exe122⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-