Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe
-
Size
454KB
-
MD5
a21c7201e63648a542e5110edd865490
-
SHA1
dc859810c352237af5497761e93697a3b8045850
-
SHA256
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2
-
SHA512
966d33234346a04d2169cff3db3bd47c9d16ee8040a1de1ff825da1111fed707a84a45201a59dda4050925164d4a23b4b0a20d77dec06b32321fb12427aebb4c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2192-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-867-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-820-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-495-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1848-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-253-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1496-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-181-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/1688-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-46-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2848-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-27-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/872-937-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-1046-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/616-1147-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1544-1145-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2080 vdvdp.exe 2756 lrflffr.exe 2848 thntbh.exe 2772 jdjpv.exe 2948 1fllrrx.exe 2460 1xllrrf.exe 2580 7vjpv.exe 2096 xlrxfff.exe 332 hhtntt.exe 376 jdppp.exe 1412 flxxxrx.exe 2812 5ttnnt.exe 2932 3pjpj.exe 1644 rflrxff.exe 2364 ttnntn.exe 1688 dvjvd.exe 1996 lfrrxfr.exe 1632 xfffffl.exe 1868 hhbnnh.exe 1860 pdjpj.exe 1288 7rxxxxl.exe 2860 hhttnt.exe 2424 vpjjj.exe 1572 5nbtbt.exe 1496 pjppd.exe 1852 xrlxlrr.exe 924 fxlrllx.exe 1200 bnttbh.exe 2176 1djpv.exe 2788 rlxfffl.exe 572 hhtbnt.exe 1444 jddjj.exe 2988 llrrllx.exe 2768 xrllrxr.exe 1652 htnhhh.exe 2592 pjvvj.exe 2604 rlxxxxx.exe 2784 bnnntt.exe 2624 9dvvd.exe 2948 rrlrfxx.exe 2928 lxlrxxf.exe 2940 btbbbb.exe 1676 jdpvd.exe 2096 rlxxlll.exe 1428 1xlrfff.exe 2700 3nbhhh.exe 1416 jdvjp.exe 756 rfrrxxf.exe 2212 frlflrx.exe 1020 tnbhtb.exe 2936 3pjjp.exe 1628 5vpvp.exe 2640 frflxrl.exe 2684 bnhhhh.exe 1996 9hhhbn.exe 748 vpdjd.exe 2308 lflrrrr.exe 1664 xrllrrf.exe 348 5tbbbt.exe 2868 nbnttn.exe 1848 3vjpv.exe 2068 5pvvj.exe 2424 9rxrxxf.exe 1892 3htnbb.exe -
resource yara_rule behavioral1/memory/2080-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-1095-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1544-1145-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1192-1199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-1226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-1252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-1265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-1278-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2080 2192 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 28 PID 2192 wrote to memory of 2080 2192 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 28 PID 2192 wrote to memory of 2080 2192 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 28 PID 2192 wrote to memory of 2080 2192 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 28 PID 2080 wrote to memory of 2756 2080 vdvdp.exe 29 PID 2080 wrote to memory of 2756 2080 vdvdp.exe 29 PID 2080 wrote to memory of 2756 2080 vdvdp.exe 29 PID 2080 wrote to memory of 2756 2080 vdvdp.exe 29 PID 2756 wrote to memory of 2848 2756 lrflffr.exe 30 PID 2756 wrote to memory of 2848 2756 lrflffr.exe 30 PID 2756 wrote to memory of 2848 2756 lrflffr.exe 30 PID 2756 wrote to memory of 2848 2756 lrflffr.exe 30 PID 2848 wrote to memory of 2772 2848 thntbh.exe 31 PID 2848 wrote to memory of 2772 2848 thntbh.exe 31 PID 2848 wrote to memory of 2772 2848 thntbh.exe 31 PID 2848 wrote to memory of 2772 2848 thntbh.exe 31 PID 2772 wrote to memory of 2948 2772 jdjpv.exe 32 PID 2772 wrote to memory of 2948 2772 jdjpv.exe 32 PID 2772 wrote to memory of 2948 2772 jdjpv.exe 32 PID 2772 wrote to memory of 2948 2772 jdjpv.exe 32 PID 2948 wrote to memory of 2460 2948 1fllrrx.exe 33 PID 2948 wrote to memory of 2460 2948 1fllrrx.exe 33 PID 2948 wrote to memory of 2460 2948 1fllrrx.exe 33 PID 2948 wrote to memory of 2460 2948 1fllrrx.exe 33 PID 2460 wrote to memory of 2580 2460 1xllrrf.exe 34 PID 2460 wrote to memory of 2580 2460 1xllrrf.exe 34 PID 2460 wrote to memory of 2580 2460 1xllrrf.exe 34 PID 2460 wrote to memory of 2580 2460 1xllrrf.exe 34 PID 2580 wrote to memory of 2096 2580 7vjpv.exe 35 PID 2580 wrote to memory of 2096 2580 7vjpv.exe 35 PID 2580 wrote to memory of 2096 2580 7vjpv.exe 35 PID 2580 wrote to memory of 2096 2580 7vjpv.exe 35 PID 2096 wrote to memory of 332 2096 xlrxfff.exe 36 PID 2096 wrote to memory of 332 2096 xlrxfff.exe 36 PID 2096 wrote to memory of 332 2096 xlrxfff.exe 36 PID 2096 wrote to memory of 332 2096 xlrxfff.exe 36 PID 332 wrote to memory of 376 332 hhtntt.exe 37 PID 332 wrote to memory of 376 332 hhtntt.exe 37 PID 332 wrote to memory of 376 332 hhtntt.exe 37 PID 332 wrote to memory of 376 332 hhtntt.exe 37 PID 376 wrote to memory of 1412 376 jdppp.exe 38 PID 376 wrote to memory of 1412 376 jdppp.exe 38 PID 376 wrote to memory of 1412 376 jdppp.exe 38 PID 376 wrote to memory of 1412 376 jdppp.exe 38 PID 1412 wrote to memory of 2812 1412 flxxxrx.exe 39 PID 1412 wrote to memory of 2812 1412 flxxxrx.exe 39 PID 1412 wrote to memory of 2812 1412 flxxxrx.exe 39 PID 1412 wrote to memory of 2812 1412 flxxxrx.exe 39 PID 2812 wrote to memory of 2932 2812 5ttnnt.exe 40 PID 2812 wrote to memory of 2932 2812 5ttnnt.exe 40 PID 2812 wrote to memory of 2932 2812 5ttnnt.exe 40 PID 2812 wrote to memory of 2932 2812 5ttnnt.exe 40 PID 2932 wrote to memory of 1644 2932 3pjpj.exe 41 PID 2932 wrote to memory of 1644 2932 3pjpj.exe 41 PID 2932 wrote to memory of 1644 2932 3pjpj.exe 41 PID 2932 wrote to memory of 1644 2932 3pjpj.exe 41 PID 1644 wrote to memory of 2364 1644 rflrxff.exe 42 PID 1644 wrote to memory of 2364 1644 rflrxff.exe 42 PID 1644 wrote to memory of 2364 1644 rflrxff.exe 42 PID 1644 wrote to memory of 2364 1644 rflrxff.exe 42 PID 2364 wrote to memory of 1688 2364 ttnntn.exe 43 PID 2364 wrote to memory of 1688 2364 ttnntn.exe 43 PID 2364 wrote to memory of 1688 2364 ttnntn.exe 43 PID 2364 wrote to memory of 1688 2364 ttnntn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe"C:\Users\Admin\AppData\Local\Temp\900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vdvdp.exec:\vdvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\lrflffr.exec:\lrflffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\thntbh.exec:\thntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jdjpv.exec:\jdjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1fllrrx.exec:\1fllrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\1xllrrf.exec:\1xllrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\7vjpv.exec:\7vjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\xlrxfff.exec:\xlrxfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\hhtntt.exec:\hhtntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\jdppp.exec:\jdppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\flxxxrx.exec:\flxxxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\5ttnnt.exec:\5ttnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\3pjpj.exec:\3pjpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rflrxff.exec:\rflrxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\ttnntn.exec:\ttnntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\dvjvd.exec:\dvjvd.exe17⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xfffffl.exec:\xfffffl.exe19⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hhbnnh.exec:\hhbnnh.exe20⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pdjpj.exec:\pdjpj.exe21⤵
- Executes dropped EXE
PID:1860 -
\??\c:\7rxxxxl.exec:\7rxxxxl.exe22⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hhttnt.exec:\hhttnt.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vpjjj.exec:\vpjjj.exe24⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5nbtbt.exec:\5nbtbt.exe25⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pjppd.exec:\pjppd.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xrlxlrr.exec:\xrlxlrr.exe27⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fxlrllx.exec:\fxlrllx.exe28⤵
- Executes dropped EXE
PID:924 -
\??\c:\bnttbh.exec:\bnttbh.exe29⤵
- Executes dropped EXE
PID:1200 -
\??\c:\1djpv.exec:\1djpv.exe30⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlxfffl.exec:\rlxfffl.exe31⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hhtbnt.exec:\hhtbnt.exe32⤵
- Executes dropped EXE
PID:572 -
\??\c:\jddjj.exec:\jddjj.exe33⤵
- Executes dropped EXE
PID:1444 -
\??\c:\llrrllx.exec:\llrrllx.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrllrxr.exec:\xrllrxr.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\htnhhh.exec:\htnhhh.exe36⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjvvj.exec:\pjvvj.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bnnntt.exec:\bnnntt.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9dvvd.exec:\9dvvd.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrlrfxx.exec:\rrlrfxx.exe41⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\btbbbb.exec:\btbbbb.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jdpvd.exec:\jdpvd.exe44⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rlxxlll.exec:\rlxxlll.exe45⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1xlrfff.exec:\1xlrfff.exe46⤵
- Executes dropped EXE
PID:1428 -
\??\c:\3nbhhh.exec:\3nbhhh.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jdvjp.exec:\jdvjp.exe48⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe49⤵
- Executes dropped EXE
PID:756 -
\??\c:\frlflrx.exec:\frlflrx.exe50⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tnbhtb.exec:\tnbhtb.exe51⤵
- Executes dropped EXE
PID:1020 -
\??\c:\3pjjp.exec:\3pjjp.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5vpvp.exec:\5vpvp.exe53⤵
- Executes dropped EXE
PID:1628 -
\??\c:\frflxrl.exec:\frflxrl.exe54⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bnhhhh.exec:\bnhhhh.exe55⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9hhhbn.exec:\9hhhbn.exe56⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vpdjd.exec:\vpdjd.exe57⤵
- Executes dropped EXE
PID:748 -
\??\c:\lflrrrr.exec:\lflrrrr.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xrllrrf.exec:\xrllrrf.exe59⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5tbbbt.exec:\5tbbbt.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\nbnttn.exec:\nbnttn.exe61⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3vjpv.exec:\3vjpv.exe62⤵
- Executes dropped EXE
PID:1848 -
\??\c:\5pvvj.exec:\5pvvj.exe63⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9rxrxxf.exec:\9rxrxxf.exe64⤵
- Executes dropped EXE
PID:2424 -
\??\c:\3htnbb.exec:\3htnbb.exe65⤵
- Executes dropped EXE
PID:1892 -
\??\c:\thttbh.exec:\thttbh.exe66⤵PID:2888
-
\??\c:\7jjjp.exec:\7jjjp.exe67⤵PID:1740
-
\??\c:\xrlrxrr.exec:\xrlrxrr.exe68⤵PID:1272
-
\??\c:\lflflrx.exec:\lflflrx.exe69⤵PID:1608
-
\??\c:\7tbbtn.exec:\7tbbtn.exe70⤵PID:1908
-
\??\c:\jdppd.exec:\jdppd.exe71⤵PID:1260
-
\??\c:\jdpjp.exec:\jdpjp.exe72⤵PID:2992
-
\??\c:\xlffrrx.exec:\xlffrrx.exe73⤵PID:908
-
\??\c:\httnhh.exec:\httnhh.exe74⤵PID:2388
-
\??\c:\7ttnhh.exec:\7ttnhh.exe75⤵PID:2600
-
\??\c:\dvddd.exec:\dvddd.exe76⤵PID:1548
-
\??\c:\5xrfxxx.exec:\5xrfxxx.exe77⤵PID:2768
-
\??\c:\3xlrfxl.exec:\3xlrfxl.exe78⤵PID:1652
-
\??\c:\tnbntt.exec:\tnbntt.exe79⤵PID:2132
-
\??\c:\3bnhhb.exec:\3bnhhb.exe80⤵PID:2612
-
\??\c:\jdjjj.exec:\jdjjj.exe81⤵PID:2800
-
\??\c:\jvdjp.exec:\jvdjp.exe82⤵PID:1132
-
\??\c:\lxlfllr.exec:\lxlfllr.exe83⤵PID:2632
-
\??\c:\fxllffl.exec:\fxllffl.exe84⤵PID:2624
-
\??\c:\nnhnnn.exec:\nnhnnn.exe85⤵PID:2948
-
\??\c:\jdjjj.exec:\jdjjj.exe86⤵PID:2944
-
\??\c:\djpdj.exec:\djpdj.exe87⤵PID:1640
-
\??\c:\xxffxrx.exec:\xxffxrx.exe88⤵PID:2508
-
\??\c:\ffrxffl.exec:\ffrxffl.exe89⤵PID:2504
-
\??\c:\bntnbb.exec:\bntnbb.exe90⤵PID:540
-
\??\c:\ntnbnn.exec:\ntnbnn.exe91⤵PID:1420
-
\??\c:\jvvpj.exec:\jvvpj.exe92⤵
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\5ppdv.exec:\5ppdv.exe93⤵PID:2208
-
\??\c:\xrxrxfr.exec:\xrxrxfr.exe94⤵PID:2348
-
\??\c:\flrrrfl.exec:\flrrrfl.exe95⤵PID:1216
-
\??\c:\bthhhb.exec:\bthhhb.exe96⤵PID:1332
-
\??\c:\dvjjv.exec:\dvjjv.exe97⤵PID:816
-
\??\c:\jvvpp.exec:\jvvpp.exe98⤵PID:2936
-
\??\c:\3jvvd.exec:\3jvvd.exe99⤵PID:1616
-
\??\c:\xrfflfr.exec:\xrfflfr.exe100⤵PID:988
-
\??\c:\bnbttn.exec:\bnbttn.exe101⤵PID:2704
-
\??\c:\5nnnhb.exec:\5nnnhb.exe102⤵PID:1872
-
\??\c:\1jdvv.exec:\1jdvv.exe103⤵PID:1696
-
\??\c:\vpppj.exec:\vpppj.exe104⤵PID:2312
-
\??\c:\1xlrxrr.exec:\1xlrxrr.exe105⤵PID:2036
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe106⤵PID:2340
-
\??\c:\nhtbhb.exec:\nhtbhb.exe107⤵PID:2860
-
\??\c:\tnbbbt.exec:\tnbbbt.exe108⤵PID:2148
-
\??\c:\3djpv.exec:\3djpv.exe109⤵PID:2108
-
\??\c:\jvvpj.exec:\jvvpj.exe110⤵PID:2336
-
\??\c:\fxlrflx.exec:\fxlrflx.exe111⤵PID:1236
-
\??\c:\xfllrrx.exec:\xfllrrx.exe112⤵PID:2440
-
\??\c:\nthbbb.exec:\nthbbb.exe113⤵PID:2156
-
\??\c:\pdjpv.exec:\pdjpv.exe114⤵PID:600
-
\??\c:\vjvdp.exec:\vjvdp.exe115⤵PID:1272
-
\??\c:\fxlxllr.exec:\fxlxllr.exe116⤵PID:2268
-
\??\c:\7xfflll.exec:\7xfflll.exe117⤵PID:2908
-
\??\c:\bnttbh.exec:\bnttbh.exe118⤵PID:1328
-
\??\c:\nbntbn.exec:\nbntbn.exe119⤵PID:2396
-
\??\c:\3jvvd.exec:\3jvvd.exe120⤵PID:2192
-
\??\c:\dpddj.exec:\dpddj.exe121⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-