Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe
-
Size
453KB
-
MD5
56645632e67dd45d19bf781e03d02b68
-
SHA1
717b373ce0a11375938c6bf259c215367c1545b6
-
SHA256
ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9
-
SHA512
50278056e362a69b60d6751db26452bc9facaf5900a229ab3977ade41a3c62f9c7562870b22b1e43bf23461a99b4ab01d2859dd9e97509a9cd8dae540f69c013
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1M:q7Tc2NYHUrAwfMp3CD1M
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2400-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-58-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1980-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-75-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/572-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-113-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1300-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-169-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-330-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1048-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-510-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 djjvj.exe 2816 3lrfxlf.exe 2400 djppj.exe 2600 bbbtnn.exe 2844 jjvpd.exe 2604 9fxxllf.exe 3004 7pjpv.exe 1980 rxxlrfx.exe 572 jjdvj.exe 2872 9nnthn.exe 856 9jdvv.exe 1920 xxrflrl.exe 1632 vjddj.exe 1300 hhbnbh.exe 620 llfrflr.exe 712 tnthnn.exe 2408 ppppd.exe 2128 llrxflx.exe 2176 hbtbnb.exe 2940 rflrfrf.exe 2012 ttntbb.exe 1812 rlxflxr.exe 1356 3tnttn.exe 700 xllxrxr.exe 1416 hhbthn.exe 2308 jjddp.exe 2968 rlrrxxf.exe 880 djjvv.exe 2364 xxfxrfx.exe 2248 nttnnn.exe 3060 vvpvj.exe 2236 ppjvd.exe 1572 rxrlxlf.exe 2732 thhnth.exe 2840 1ddjp.exe 2772 lfllxfx.exe 2504 3xxfxlx.exe 1048 ttttnb.exe 2592 dvvjv.exe 2616 9rlfrxf.exe 3020 hbbbnn.exe 1728 1dvjv.exe 1980 dpjdd.exe 884 lxrrrlx.exe 2676 bhbhbn.exe 2908 vjpvj.exe 2368 3fxlrfl.exe 1400 5xfrxfl.exe 1364 tnhtbh.exe 1632 jjdvj.exe 308 rxlxfrr.exe 2324 tthbnn.exe 784 vvpdd.exe 2556 1dvdp.exe 2116 9xrxrxf.exe 2392 7thbbb.exe 2128 jpddp.exe 2552 ddvvd.exe 444 frlrxxl.exe 2228 3rrlxff.exe 2208 btnbhn.exe 1776 jdddp.exe 1708 rrfllxf.exe 2672 xrlrflx.exe -
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-58-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1980-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-707-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2536-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-867-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2684 2112 ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe 30 PID 2112 wrote to memory of 2684 2112 ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe 30 PID 2112 wrote to memory of 2684 2112 ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe 30 PID 2112 wrote to memory of 2684 2112 ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe 30 PID 2684 wrote to memory of 2816 2684 djjvj.exe 31 PID 2684 wrote to memory of 2816 2684 djjvj.exe 31 PID 2684 wrote to memory of 2816 2684 djjvj.exe 31 PID 2684 wrote to memory of 2816 2684 djjvj.exe 31 PID 2816 wrote to memory of 2400 2816 3lrfxlf.exe 32 PID 2816 wrote to memory of 2400 2816 3lrfxlf.exe 32 PID 2816 wrote to memory of 2400 2816 3lrfxlf.exe 32 PID 2816 wrote to memory of 2400 2816 3lrfxlf.exe 32 PID 2400 wrote to memory of 2600 2400 djppj.exe 33 PID 2400 wrote to memory of 2600 2400 djppj.exe 33 PID 2400 wrote to memory of 2600 2400 djppj.exe 33 PID 2400 wrote to memory of 2600 2400 djppj.exe 33 PID 2600 wrote to memory of 2844 2600 bbbtnn.exe 34 PID 2600 wrote to memory of 2844 2600 bbbtnn.exe 34 PID 2600 wrote to memory of 2844 2600 bbbtnn.exe 34 PID 2600 wrote to memory of 2844 2600 bbbtnn.exe 34 PID 2844 wrote to memory of 2604 2844 jjvpd.exe 35 PID 2844 wrote to memory of 2604 2844 jjvpd.exe 35 PID 2844 wrote to memory of 2604 2844 jjvpd.exe 35 PID 2844 wrote to memory of 2604 2844 jjvpd.exe 35 PID 2604 wrote to memory of 3004 2604 9fxxllf.exe 36 PID 2604 wrote to memory of 3004 2604 9fxxllf.exe 36 PID 2604 wrote to memory of 3004 2604 9fxxllf.exe 36 PID 2604 wrote to memory of 3004 2604 9fxxllf.exe 36 PID 3004 wrote to memory of 1980 3004 7pjpv.exe 37 PID 3004 wrote to memory of 1980 3004 7pjpv.exe 37 PID 3004 wrote to memory of 1980 3004 7pjpv.exe 37 PID 3004 wrote to memory of 1980 3004 7pjpv.exe 37 PID 1980 wrote to memory of 572 1980 rxxlrfx.exe 38 PID 1980 wrote to memory of 572 1980 rxxlrfx.exe 38 PID 1980 wrote to memory of 572 1980 rxxlrfx.exe 38 PID 1980 wrote to memory of 572 1980 rxxlrfx.exe 38 PID 572 wrote to memory of 2872 572 jjdvj.exe 39 PID 572 wrote to memory of 2872 572 jjdvj.exe 39 PID 572 wrote to memory of 2872 572 jjdvj.exe 39 PID 572 wrote to memory of 2872 572 jjdvj.exe 39 PID 2872 wrote to memory of 856 2872 9nnthn.exe 40 PID 2872 wrote to memory of 856 2872 9nnthn.exe 40 PID 2872 wrote to memory of 856 2872 9nnthn.exe 40 PID 2872 wrote to memory of 856 2872 9nnthn.exe 40 PID 856 wrote to memory of 1920 856 9jdvv.exe 41 PID 856 wrote to memory of 1920 856 9jdvv.exe 41 PID 856 wrote to memory of 1920 856 9jdvv.exe 41 PID 856 wrote to memory of 1920 856 9jdvv.exe 41 PID 1920 wrote to memory of 1632 1920 xxrflrl.exe 42 PID 1920 wrote to memory of 1632 1920 xxrflrl.exe 42 PID 1920 wrote to memory of 1632 1920 xxrflrl.exe 42 PID 1920 wrote to memory of 1632 1920 xxrflrl.exe 42 PID 1632 wrote to memory of 1300 1632 vjddj.exe 43 PID 1632 wrote to memory of 1300 1632 vjddj.exe 43 PID 1632 wrote to memory of 1300 1632 vjddj.exe 43 PID 1632 wrote to memory of 1300 1632 vjddj.exe 43 PID 1300 wrote to memory of 620 1300 hhbnbh.exe 44 PID 1300 wrote to memory of 620 1300 hhbnbh.exe 44 PID 1300 wrote to memory of 620 1300 hhbnbh.exe 44 PID 1300 wrote to memory of 620 1300 hhbnbh.exe 44 PID 620 wrote to memory of 712 620 llfrflr.exe 45 PID 620 wrote to memory of 712 620 llfrflr.exe 45 PID 620 wrote to memory of 712 620 llfrflr.exe 45 PID 620 wrote to memory of 712 620 llfrflr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe"C:\Users\Admin\AppData\Local\Temp\ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\djjvj.exec:\djjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3lrfxlf.exec:\3lrfxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\djppj.exec:\djppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\bbbtnn.exec:\bbbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\jjvpd.exec:\jjvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\9fxxllf.exec:\9fxxllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7pjpv.exec:\7pjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rxxlrfx.exec:\rxxlrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jjdvj.exec:\jjdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\9nnthn.exec:\9nnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9jdvv.exec:\9jdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\xxrflrl.exec:\xxrflrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\vjddj.exec:\vjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\hhbnbh.exec:\hhbnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\llfrflr.exec:\llfrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\tnthnn.exec:\tnthnn.exe17⤵
- Executes dropped EXE
PID:712 -
\??\c:\ppppd.exec:\ppppd.exe18⤵
- Executes dropped EXE
PID:2408 -
\??\c:\llrxflx.exec:\llrxflx.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbtbnb.exec:\hbtbnb.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rflrfrf.exec:\rflrfrf.exe21⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ttntbb.exec:\ttntbb.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rlxflxr.exec:\rlxflxr.exe23⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3tnttn.exec:\3tnttn.exe24⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xllxrxr.exec:\xllxrxr.exe25⤵
- Executes dropped EXE
PID:700 -
\??\c:\hhbthn.exec:\hhbthn.exe26⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jjddp.exec:\jjddp.exe27⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe28⤵
- Executes dropped EXE
PID:2968 -
\??\c:\djjvv.exec:\djjvv.exe29⤵
- Executes dropped EXE
PID:880 -
\??\c:\xxfxrfx.exec:\xxfxrfx.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nttnnn.exec:\nttnnn.exe31⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vvpvj.exec:\vvpvj.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ppjvd.exec:\ppjvd.exe33⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rxrlxlf.exec:\rxrlxlf.exe34⤵
- Executes dropped EXE
PID:1572 -
\??\c:\thhnth.exec:\thhnth.exe35⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1ddjp.exec:\1ddjp.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lfllxfx.exec:\lfllxfx.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3xxfxlx.exec:\3xxfxlx.exe38⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ttttnb.exec:\ttttnb.exe39⤵
- Executes dropped EXE
PID:1048 -
\??\c:\dvvjv.exec:\dvvjv.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9rlfrxf.exec:\9rlfrxf.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbbbnn.exec:\hbbbnn.exe42⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1dvjv.exec:\1dvjv.exe43⤵
- Executes dropped EXE
PID:1728 -
\??\c:\dpjdd.exec:\dpjdd.exe44⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lxrrrlx.exec:\lxrrrlx.exe45⤵
- Executes dropped EXE
PID:884 -
\??\c:\bhbhbn.exec:\bhbhbn.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjpvj.exec:\vjpvj.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3fxlrfl.exec:\3fxlrfl.exe48⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5xfrxfl.exec:\5xfrxfl.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tnhtbh.exec:\tnhtbh.exe50⤵
- Executes dropped EXE
PID:1364 -
\??\c:\jjdvj.exec:\jjdvj.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rxlxfrr.exec:\rxlxfrr.exe52⤵
- Executes dropped EXE
PID:308 -
\??\c:\tthbnn.exec:\tthbnn.exe53⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vvpdd.exec:\vvpdd.exe54⤵
- Executes dropped EXE
PID:784 -
\??\c:\1dvdp.exec:\1dvdp.exe55⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9xrxrxf.exec:\9xrxrxf.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7thbbb.exec:\7thbbb.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jpddp.exec:\jpddp.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ddvvd.exec:\ddvvd.exe59⤵
- Executes dropped EXE
PID:2552 -
\??\c:\frlrxxl.exec:\frlrxxl.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\3rrlxff.exec:\3rrlxff.exe61⤵
- Executes dropped EXE
PID:2228 -
\??\c:\btnbhn.exec:\btnbhn.exe62⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jdddp.exec:\jdddp.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrfllxf.exec:\rrfllxf.exe64⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xrlrflx.exec:\xrlrflx.exe65⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tbtbbh.exec:\tbtbbh.exe66⤵PID:2452
-
\??\c:\pddpp.exec:\pddpp.exe67⤵PID:1248
-
\??\c:\frlrfll.exec:\frlrfll.exe68⤵PID:2656
-
\??\c:\1rxxxfl.exec:\1rxxxfl.exe69⤵PID:1788
-
\??\c:\1htthh.exec:\1htthh.exe70⤵PID:880
-
\??\c:\vdpjp.exec:\vdpjp.exe71⤵PID:1784
-
\??\c:\fflxffr.exec:\fflxffr.exe72⤵PID:1748
-
\??\c:\5hbhnt.exec:\5hbhnt.exe73⤵PID:2348
-
\??\c:\5hbtbb.exec:\5hbtbb.exe74⤵PID:2112
-
\??\c:\jddjp.exec:\jddjp.exe75⤵PID:3060
-
\??\c:\lfflrrf.exec:\lfflrrf.exe76⤵PID:2944
-
\??\c:\nhthth.exec:\nhthth.exe77⤵PID:2800
-
\??\c:\vpjjp.exec:\vpjjp.exe78⤵PID:2732
-
\??\c:\1pjpj.exec:\1pjpj.exe79⤵PID:2816
-
\??\c:\xlrrffr.exec:\xlrrffr.exe80⤵PID:2772
-
\??\c:\bnhnth.exec:\bnhnth.exe81⤵PID:2740
-
\??\c:\bbbnbn.exec:\bbbnbn.exe82⤵PID:2768
-
\??\c:\ddjdp.exec:\ddjdp.exe83⤵PID:2068
-
\??\c:\rllxfll.exec:\rllxfll.exe84⤵PID:3016
-
\??\c:\bhhbhn.exec:\bhhbhn.exe85⤵PID:1428
-
\??\c:\vvppj.exec:\vvppj.exe86⤵PID:2624
-
\??\c:\9dddp.exec:\9dddp.exe87⤵PID:948
-
\??\c:\rllfxfx.exec:\rllfxfx.exe88⤵PID:2752
-
\??\c:\nhhnbh.exec:\nhhnbh.exe89⤵PID:2372
-
\??\c:\ddvjd.exec:\ddvjd.exe90⤵PID:1988
-
\??\c:\xxxlflr.exec:\xxxlflr.exe91⤵PID:2084
-
\??\c:\ttthtn.exec:\ttthtn.exe92⤵PID:1400
-
\??\c:\bbbtnb.exec:\bbbtnb.exe93⤵PID:1364
-
\??\c:\3ppdp.exec:\3ppdp.exe94⤵PID:296
-
\??\c:\fffrflf.exec:\fffrflf.exe95⤵PID:308
-
\??\c:\llrxlrf.exec:\llrxlrf.exe96⤵PID:596
-
\??\c:\bttbnt.exec:\bttbnt.exe97⤵PID:1604
-
\??\c:\5dddj.exec:\5dddj.exe98⤵PID:1928
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe99⤵PID:2824
-
\??\c:\rrrxlxr.exec:\rrrxlxr.exe100⤵PID:2948
-
\??\c:\nnnbnt.exec:\nnnbnt.exe101⤵PID:2300
-
\??\c:\3ddpp.exec:\3ddpp.exe102⤵PID:2916
-
\??\c:\fxflxlf.exec:\fxflxlf.exe103⤵PID:2536
-
\??\c:\rxffxxr.exec:\rxffxxr.exe104⤵PID:1508
-
\??\c:\nnntth.exec:\nnntth.exe105⤵PID:1644
-
\??\c:\ddvpd.exec:\ddvpd.exe106⤵PID:1732
-
\??\c:\pppvj.exec:\pppvj.exe107⤵PID:1520
-
\??\c:\rxxrlrf.exec:\rxxrlrf.exe108⤵PID:1416
-
\??\c:\tbhtht.exec:\tbhtht.exe109⤵PID:2460
-
\??\c:\bhhthb.exec:\bhhthb.exe110⤵PID:2200
-
\??\c:\djppj.exec:\djppj.exe111⤵PID:1796
-
\??\c:\lxfrlff.exec:\lxfrlff.exe112⤵PID:1788
-
\??\c:\tttbnt.exec:\tttbnt.exe113⤵PID:2024
-
\??\c:\nhhbnb.exec:\nhhbnb.exe114⤵PID:1960
-
\??\c:\jpdjp.exec:\jpdjp.exe115⤵PID:2320
-
\??\c:\5xrlflf.exec:\5xrlflf.exe116⤵PID:1576
-
\??\c:\pvvdj.exec:\pvvdj.exe117⤵PID:2720
-
\??\c:\pvjjp.exec:\pvjjp.exe118⤵PID:2240
-
\??\c:\7btbtb.exec:\7btbtb.exe119⤵PID:2580
-
\??\c:\jjdvd.exec:\jjdvd.exe120⤵PID:2400
-
\??\c:\ppppd.exec:\ppppd.exe121⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-