Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe
-
Size
454KB
-
MD5
fcab61bda86c112b10b376c4db30b8a8
-
SHA1
bd020f6f5377bf3f15fb1a1e449b5bb467429ad6
-
SHA256
b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01
-
SHA512
4114be965c85fc7e0a2070a451a8124076fe8b94bc37ee9aaa77ee024bcc1dc846f20b52cfcf293fee4806b4ae8f633da59e7b32611bfb9639528e1a8a63ffd4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2544-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-76-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-102-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2664-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-126-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1684-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2112-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-280-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-416-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2956-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-443-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-462-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-473-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-483-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-497-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2332-496-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1796-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/912-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-630-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-685-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/476-733-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/3032-770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1852 jpddj.exe 3060 jpjpd.exe 2084 hnhnbh.exe 2336 ffxfxfr.exe 2072 bbtnth.exe 2888 vpdvp.exe 2744 tnhthn.exe 2700 vdjjd.exe 1264 rxfrrll.exe 2664 pjdjv.exe 2440 ddddj.exe 1424 tnbhnt.exe 1016 vpvvd.exe 300 xrffrxf.exe 1684 bbntbb.exe 532 bnhbhh.exe 1608 vpjjp.exe 1248 bnhbtn.exe 2112 ppvvp.exe 2416 xxrfrxx.exe 3024 jdvvv.exe 1920 3jpjj.exe 1856 xlxxxff.exe 1636 nhbhtb.exe 544 pjdjp.exe 840 xxxflrf.exe 2804 9bbntt.exe 2160 nnbbbt.exe 2184 bthhtn.exe 2536 rlllrrx.exe 2264 ntntth.exe 1732 pvpvd.exe 3068 hbtthh.exe 1588 3vjdj.exe 1704 rrlrffr.exe 2912 hbbthb.exe 2484 pdvvd.exe 2740 vppdp.exe 2824 ffrxxxl.exe 3016 nnhnnt.exe 2728 jdvdp.exe 2972 rfrrrrf.exe 2780 3flfxxx.exe 2784 nbhnnn.exe 2624 pjvdv.exe 2676 pvdpj.exe 1096 rfllrlr.exe 2360 nhbbhn.exe 1464 1tnnnt.exe 2956 pdvvv.exe 2916 llrxrrx.exe 2368 5htntt.exe 1644 thttbh.exe 2852 dvppv.exe 1608 fxrrxfl.exe 2220 bbthnb.exe 2988 1nhnbh.exe 344 vjvvd.exe 2996 lfrrflr.exe 2332 nhthtt.exe 1612 hbnntb.exe 2124 dpvvd.exe 1856 xrlrxfl.exe 2376 rlxffxl.exe -
resource yara_rule behavioral1/memory/2544-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-352-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2728-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-473-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/344-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-523-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1796-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-637-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2876-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-685-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/476-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-771-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1852 2544 b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe 30 PID 2544 wrote to memory of 1852 2544 b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe 30 PID 2544 wrote to memory of 1852 2544 b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe 30 PID 2544 wrote to memory of 1852 2544 b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe 30 PID 1852 wrote to memory of 3060 1852 jpddj.exe 31 PID 1852 wrote to memory of 3060 1852 jpddj.exe 31 PID 1852 wrote to memory of 3060 1852 jpddj.exe 31 PID 1852 wrote to memory of 3060 1852 jpddj.exe 31 PID 3060 wrote to memory of 2084 3060 jpjpd.exe 32 PID 3060 wrote to memory of 2084 3060 jpjpd.exe 32 PID 3060 wrote to memory of 2084 3060 jpjpd.exe 32 PID 3060 wrote to memory of 2084 3060 jpjpd.exe 32 PID 2084 wrote to memory of 2336 2084 hnhnbh.exe 33 PID 2084 wrote to memory of 2336 2084 hnhnbh.exe 33 PID 2084 wrote to memory of 2336 2084 hnhnbh.exe 33 PID 2084 wrote to memory of 2336 2084 hnhnbh.exe 33 PID 2336 wrote to memory of 2072 2336 ffxfxfr.exe 34 PID 2336 wrote to memory of 2072 2336 ffxfxfr.exe 34 PID 2336 wrote to memory of 2072 2336 ffxfxfr.exe 34 PID 2336 wrote to memory of 2072 2336 ffxfxfr.exe 34 PID 2072 wrote to memory of 2888 2072 bbtnth.exe 35 PID 2072 wrote to memory of 2888 2072 bbtnth.exe 35 PID 2072 wrote to memory of 2888 2072 bbtnth.exe 35 PID 2072 wrote to memory of 2888 2072 bbtnth.exe 35 PID 2888 wrote to memory of 2744 2888 vpdvp.exe 36 PID 2888 wrote to memory of 2744 2888 vpdvp.exe 36 PID 2888 wrote to memory of 2744 2888 vpdvp.exe 36 PID 2888 wrote to memory of 2744 2888 vpdvp.exe 36 PID 2744 wrote to memory of 2700 2744 tnhthn.exe 37 PID 2744 wrote to memory of 2700 2744 tnhthn.exe 37 PID 2744 wrote to memory of 2700 2744 tnhthn.exe 37 PID 2744 wrote to memory of 2700 2744 tnhthn.exe 37 PID 2700 wrote to memory of 1264 2700 vdjjd.exe 38 PID 2700 wrote to memory of 1264 2700 vdjjd.exe 38 PID 2700 wrote to memory of 1264 2700 vdjjd.exe 38 PID 2700 wrote to memory of 1264 2700 vdjjd.exe 38 PID 1264 wrote to memory of 2664 1264 rxfrrll.exe 39 PID 1264 wrote to memory of 2664 1264 rxfrrll.exe 39 PID 1264 wrote to memory of 2664 1264 rxfrrll.exe 39 PID 1264 wrote to memory of 2664 1264 rxfrrll.exe 39 PID 2664 wrote to memory of 2440 2664 pjdjv.exe 40 PID 2664 wrote to memory of 2440 2664 pjdjv.exe 40 PID 2664 wrote to memory of 2440 2664 pjdjv.exe 40 PID 2664 wrote to memory of 2440 2664 pjdjv.exe 40 PID 2440 wrote to memory of 1424 2440 ddddj.exe 41 PID 2440 wrote to memory of 1424 2440 ddddj.exe 41 PID 2440 wrote to memory of 1424 2440 ddddj.exe 41 PID 2440 wrote to memory of 1424 2440 ddddj.exe 41 PID 1424 wrote to memory of 1016 1424 tnbhnt.exe 42 PID 1424 wrote to memory of 1016 1424 tnbhnt.exe 42 PID 1424 wrote to memory of 1016 1424 tnbhnt.exe 42 PID 1424 wrote to memory of 1016 1424 tnbhnt.exe 42 PID 1016 wrote to memory of 300 1016 vpvvd.exe 43 PID 1016 wrote to memory of 300 1016 vpvvd.exe 43 PID 1016 wrote to memory of 300 1016 vpvvd.exe 43 PID 1016 wrote to memory of 300 1016 vpvvd.exe 43 PID 300 wrote to memory of 1684 300 xrffrxf.exe 44 PID 300 wrote to memory of 1684 300 xrffrxf.exe 44 PID 300 wrote to memory of 1684 300 xrffrxf.exe 44 PID 300 wrote to memory of 1684 300 xrffrxf.exe 44 PID 1684 wrote to memory of 532 1684 bbntbb.exe 45 PID 1684 wrote to memory of 532 1684 bbntbb.exe 45 PID 1684 wrote to memory of 532 1684 bbntbb.exe 45 PID 1684 wrote to memory of 532 1684 bbntbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe"C:\Users\Admin\AppData\Local\Temp\b8b7d89f94a587b116de079d524cadaaad75915991a27ad2237663d5b4ce2f01.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jpddj.exec:\jpddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\jpjpd.exec:\jpjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\hnhnbh.exec:\hnhnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\bbtnth.exec:\bbtnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpdvp.exec:\vpdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tnhthn.exec:\tnhthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vdjjd.exec:\vdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rxfrrll.exec:\rxfrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\pjdjv.exec:\pjdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ddddj.exec:\ddddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\tnbhnt.exec:\tnbhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\vpvvd.exec:\vpvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\xrffrxf.exec:\xrffrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\bbntbb.exec:\bbntbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\bnhbhh.exec:\bnhbhh.exe17⤵
- Executes dropped EXE
PID:532 -
\??\c:\vpjjp.exec:\vpjjp.exe18⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bnhbtn.exec:\bnhbtn.exe19⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ppvvp.exec:\ppvvp.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xxrfrxx.exec:\xxrfrxx.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdvvv.exec:\jdvvv.exe22⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3jpjj.exec:\3jpjj.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xlxxxff.exec:\xlxxxff.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nhbhtb.exec:\nhbhtb.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pjdjp.exec:\pjdjp.exe26⤵
- Executes dropped EXE
PID:544 -
\??\c:\xxxflrf.exec:\xxxflrf.exe27⤵
- Executes dropped EXE
PID:840 -
\??\c:\9bbntt.exec:\9bbntt.exe28⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnbbbt.exec:\nnbbbt.exe29⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bthhtn.exec:\bthhtn.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rlllrrx.exec:\rlllrrx.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ntntth.exec:\ntntth.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pvpvd.exec:\pvpvd.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbtthh.exec:\hbtthh.exe34⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3vjdj.exec:\3vjdj.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rrlrffr.exec:\rrlrffr.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbbthb.exec:\hbbthb.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdvvd.exec:\pdvvd.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vppdp.exec:\vppdp.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ffrxxxl.exec:\ffrxxxl.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nnhnnt.exec:\nnhnnt.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jdvdp.exec:\jdvdp.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe43⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3flfxxx.exec:\3flfxxx.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nbhnnn.exec:\nbhnnn.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjvdv.exec:\pjvdv.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pvdpj.exec:\pvdpj.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rfllrlr.exec:\rfllrlr.exe48⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nhbbhn.exec:\nhbbhn.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1tnnnt.exec:\1tnnnt.exe50⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pdvvv.exec:\pdvvv.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\llrxrrx.exec:\llrxrrx.exe52⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5htntt.exec:\5htntt.exe53⤵
- Executes dropped EXE
PID:2368 -
\??\c:\thttbh.exec:\thttbh.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dvppv.exec:\dvppv.exe55⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe56⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bbthnb.exec:\bbthnb.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1nhnbh.exec:\1nhnbh.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vjvvd.exec:\vjvvd.exe59⤵
- Executes dropped EXE
PID:344 -
\??\c:\lfrrflr.exec:\lfrrflr.exe60⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nhthtt.exec:\nhthtt.exe61⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hbnntb.exec:\hbnntb.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dpvvd.exec:\dpvvd.exe63⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rlxffxl.exec:\rlxffxl.exe65⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hnthbt.exec:\hnthbt.exe66⤵PID:2052
-
\??\c:\jdvdp.exec:\jdvdp.exe67⤵PID:1796
-
\??\c:\flxlfrx.exec:\flxlfrx.exe68⤵PID:1944
-
\??\c:\9thhhb.exec:\9thhhb.exe69⤵PID:2500
-
\??\c:\3nbbtt.exec:\3nbbtt.exe70⤵PID:1620
-
\??\c:\dpdvv.exec:\dpdvv.exe71⤵PID:2524
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe72⤵PID:912
-
\??\c:\9lxxfxf.exec:\9lxxfxf.exe73⤵PID:2284
-
\??\c:\hbnttb.exec:\hbnttb.exe74⤵PID:1056
-
\??\c:\tbhbnh.exec:\tbhbnh.exe75⤵PID:1852
-
\??\c:\pjdjj.exec:\pjdjj.exe76⤵PID:1232
-
\??\c:\rrrxxff.exec:\rrrxxff.exe77⤵PID:1512
-
\??\c:\rxxrxff.exec:\rxxrxff.exe78⤵PID:2116
-
\??\c:\ttnbnh.exec:\ttnbnh.exe79⤵PID:2196
-
\??\c:\pjjjp.exec:\pjjjp.exe80⤵PID:2720
-
\??\c:\frlxxrr.exec:\frlxxrr.exe81⤵PID:2268
-
\??\c:\7flfffx.exec:\7flfffx.exe82⤵PID:2752
-
\??\c:\hhhnnb.exec:\hhhnnb.exe83⤵PID:2876
-
\??\c:\jdjjp.exec:\jdjjp.exe84⤵PID:2908
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe85⤵PID:2964
-
\??\c:\fxllllx.exec:\fxllllx.exe86⤵PID:2832
-
\??\c:\tthtbt.exec:\tthtbt.exe87⤵PID:2780
-
\??\c:\9dvvv.exec:\9dvvv.exe88⤵PID:2732
-
\??\c:\7jpdp.exec:\7jpdp.exe89⤵PID:2688
-
\??\c:\frlrxfl.exec:\frlrxfl.exe90⤵PID:2440
-
\??\c:\bbtbhn.exec:\bbtbhn.exe91⤵PID:2924
-
\??\c:\9jvvd.exec:\9jvvd.exe92⤵PID:2712
-
\??\c:\7fxxflr.exec:\7fxxflr.exe93⤵PID:476
-
\??\c:\fxxxfxl.exec:\fxxxfxl.exe94⤵PID:1712
-
\??\c:\3bbbtt.exec:\3bbbtt.exe95⤵PID:2840
-
\??\c:\pjvvv.exec:\pjvvv.exe96⤵PID:1900
-
\??\c:\9pddv.exec:\9pddv.exe97⤵PID:1480
-
\??\c:\1rxllll.exec:\1rxllll.exe98⤵PID:1148
-
\??\c:\5ntnnn.exec:\5ntnnn.exe99⤵PID:2952
-
\??\c:\nhtbhn.exec:\nhtbhn.exe100⤵PID:1592
-
\??\c:\jdddd.exec:\jdddd.exe101⤵PID:2988
-
\??\c:\xfxlrxx.exec:\xfxlrxx.exe102⤵PID:3032
-
\??\c:\nbnhnn.exec:\nbnhnn.exe103⤵PID:1632
-
\??\c:\9thhhh.exec:\9thhhh.exe104⤵PID:2332
-
\??\c:\7vjdj.exec:\7vjdj.exe105⤵PID:1496
-
\??\c:\xrllllf.exec:\xrllllf.exe106⤵PID:1036
-
\??\c:\3xflxfx.exec:\3xflxfx.exe107⤵PID:1848
-
\??\c:\nbnntt.exec:\nbnntt.exe108⤵PID:2376
-
\??\c:\pjvjp.exec:\pjvjp.exe109⤵PID:764
-
\??\c:\fxrfrrl.exec:\fxrfrrl.exe110⤵PID:2080
-
\??\c:\lxlfllr.exec:\lxlfllr.exe111⤵PID:2532
-
\??\c:\bthhnn.exec:\bthhnn.exe112⤵PID:2600
-
\??\c:\ththhh.exec:\ththhh.exe113⤵PID:2164
-
\??\c:\jjdvd.exec:\jjdvd.exe114⤵PID:2032
-
\??\c:\lflfllr.exec:\lflfllr.exe115⤵PID:2404
-
\??\c:\ffrrxrx.exec:\ffrrxrx.exe116⤵PID:1288
-
\??\c:\7hhbhb.exec:\7hhbhb.exe117⤵PID:892
-
\??\c:\pvjpv.exec:\pvjpv.exe118⤵PID:1580
-
\??\c:\vvjjp.exec:\vvjjp.exe119⤵PID:2696
-
\??\c:\ffrrrlr.exec:\ffrrrlr.exe120⤵PID:1588
-
\??\c:\hbtnbb.exec:\hbtnbb.exe121⤵
- System Location Discovery: System Language Discovery
PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-