Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 04:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe
Resource
win7-20241023-en
7 signatures
150 seconds
General
-
Target
9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe
-
Size
455KB
-
MD5
d2661e33f97a97b2d62d6108d3e509d3
-
SHA1
fc4d331435f88889b3c4b3dde63b7640ab4f50dd
-
SHA256
9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991
-
SHA512
99cff4f03b19fc68ee1fca1082d3ae86b5c2ff71c54404aaf2365318ea64e1e0d750c6f8788e2e2c6c754ca8242d93f2283b9251a3928a539530e64c22be1f4c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/1800-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2116-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-78-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-138-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2676-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-171-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2224-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1268-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/548-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-285-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1116-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2400-316-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1488-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-394-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-526-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-580-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-607-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-615-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2596-635-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2732-698-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2288-751-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2468-832-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/892-858-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2548-910-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-1089-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1800 82620.exe 2116 2608068.exe 2600 64222.exe 2968 xrlxflr.exe 2832 20844.exe 2932 60808.exe 3040 pddpd.exe 2804 hhhntt.exe 2928 e86662.exe 2688 c422880.exe 2808 8262228.exe 2196 604028.exe 2944 k26868.exe 1644 84886.exe 2676 m6068.exe 2004 fxrflxl.exe 2980 86402.exe 2872 4868486.exe 2224 2088068.exe 2244 u620228.exe 1268 u200202.exe 1280 nthbhh.exe 2208 820684.exe 1620 vpjvp.exe 800 8268084.exe 548 fxfxlff.exe 924 268028.exe 1544 bhbtnb.exe 2608 826644.exe 2660 rfxfxfx.exe 892 0402402.exe 1116 8628880.exe 2160 4402842.exe 2400 pjvjv.exe 2500 thbnnh.exe 2596 dpjpv.exe 2768 tnhhnt.exe 1748 7rrfrfl.exe 1488 882084.exe 2836 9rrlxlf.exe 1912 lxrxlrl.exe 2948 nnbbth.exe 2696 848664.exe 2712 1pvjd.exe 1920 8202064.exe 2704 vjjvp.exe 2692 26064.exe 2336 u206806.exe 2740 2646284.exe 2436 608244.exe 2352 84260.exe 1644 664684.exe 2676 fflrxlf.exe 1368 60220.exe 820 2606882.exe 3016 26840.exe 2276 9pdjp.exe 2260 1rlxlrx.exe 2636 s8864.exe 2292 vvpvj.exe 496 220868.exe 1268 pjvdj.exe 912 9hbtnt.exe 2308 68802.exe -
resource yara_rule behavioral1/memory/1800-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-63-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2804-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-102-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2196-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-302-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1488-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-615-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/3020-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-698-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/556-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-910-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1752-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-966-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1560-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-1020-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6606068.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1800 2064 9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe 30 PID 2064 wrote to memory of 1800 2064 9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe 30 PID 2064 wrote to memory of 1800 2064 9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe 30 PID 2064 wrote to memory of 1800 2064 9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe 30 PID 1800 wrote to memory of 2116 1800 82620.exe 31 PID 1800 wrote to memory of 2116 1800 82620.exe 31 PID 1800 wrote to memory of 2116 1800 82620.exe 31 PID 1800 wrote to memory of 2116 1800 82620.exe 31 PID 2116 wrote to memory of 2600 2116 2608068.exe 32 PID 2116 wrote to memory of 2600 2116 2608068.exe 32 PID 2116 wrote to memory of 2600 2116 2608068.exe 32 PID 2116 wrote to memory of 2600 2116 2608068.exe 32 PID 2600 wrote to memory of 2968 2600 64222.exe 33 PID 2600 wrote to memory of 2968 2600 64222.exe 33 PID 2600 wrote to memory of 2968 2600 64222.exe 33 PID 2600 wrote to memory of 2968 2600 64222.exe 33 PID 2968 wrote to memory of 2832 2968 xrlxflr.exe 34 PID 2968 wrote to memory of 2832 2968 xrlxflr.exe 34 PID 2968 wrote to memory of 2832 2968 xrlxflr.exe 34 PID 2968 wrote to memory of 2832 2968 xrlxflr.exe 34 PID 2832 wrote to memory of 2932 2832 20844.exe 35 PID 2832 wrote to memory of 2932 2832 20844.exe 35 PID 2832 wrote to memory of 2932 2832 20844.exe 35 PID 2832 wrote to memory of 2932 2832 20844.exe 35 PID 2932 wrote to memory of 3040 2932 60808.exe 36 PID 2932 wrote to memory of 3040 2932 60808.exe 36 PID 2932 wrote to memory of 3040 2932 60808.exe 36 PID 2932 wrote to memory of 3040 2932 60808.exe 36 PID 3040 wrote to memory of 2804 3040 pddpd.exe 37 PID 3040 wrote to memory of 2804 3040 pddpd.exe 37 PID 3040 wrote to memory of 2804 3040 pddpd.exe 37 PID 3040 wrote to memory of 2804 3040 pddpd.exe 37 PID 2804 wrote to memory of 2928 2804 hhhntt.exe 38 PID 2804 wrote to memory of 2928 2804 hhhntt.exe 38 PID 2804 wrote to memory of 2928 2804 hhhntt.exe 38 PID 2804 wrote to memory of 2928 2804 hhhntt.exe 38 PID 2928 wrote to memory of 2688 2928 e86662.exe 39 PID 2928 wrote to memory of 2688 2928 e86662.exe 39 PID 2928 wrote to memory of 2688 2928 e86662.exe 39 PID 2928 wrote to memory of 2688 2928 e86662.exe 39 PID 2688 wrote to memory of 2808 2688 c422880.exe 40 PID 2688 wrote to memory of 2808 2688 c422880.exe 40 PID 2688 wrote to memory of 2808 2688 c422880.exe 40 PID 2688 wrote to memory of 2808 2688 c422880.exe 40 PID 2808 wrote to memory of 2196 2808 8262228.exe 41 PID 2808 wrote to memory of 2196 2808 8262228.exe 41 PID 2808 wrote to memory of 2196 2808 8262228.exe 41 PID 2808 wrote to memory of 2196 2808 8262228.exe 41 PID 2196 wrote to memory of 2944 2196 604028.exe 42 PID 2196 wrote to memory of 2944 2196 604028.exe 42 PID 2196 wrote to memory of 2944 2196 604028.exe 42 PID 2196 wrote to memory of 2944 2196 604028.exe 42 PID 2944 wrote to memory of 1644 2944 k26868.exe 43 PID 2944 wrote to memory of 1644 2944 k26868.exe 43 PID 2944 wrote to memory of 1644 2944 k26868.exe 43 PID 2944 wrote to memory of 1644 2944 k26868.exe 43 PID 1644 wrote to memory of 2676 1644 84886.exe 44 PID 1644 wrote to memory of 2676 1644 84886.exe 44 PID 1644 wrote to memory of 2676 1644 84886.exe 44 PID 1644 wrote to memory of 2676 1644 84886.exe 44 PID 2676 wrote to memory of 2004 2676 m6068.exe 45 PID 2676 wrote to memory of 2004 2676 m6068.exe 45 PID 2676 wrote to memory of 2004 2676 m6068.exe 45 PID 2676 wrote to memory of 2004 2676 m6068.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe"C:\Users\Admin\AppData\Local\Temp\9739c3ffbd58fb5068bd639fcd6c53f6bfc89730cd559c9d304a5faabf7ee991.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\82620.exec:\82620.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\2608068.exec:\2608068.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\64222.exec:\64222.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\xrlxflr.exec:\xrlxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\20844.exec:\20844.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\60808.exec:\60808.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pddpd.exec:\pddpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\hhhntt.exec:\hhhntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\e86662.exec:\e86662.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\c422880.exec:\c422880.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\8262228.exec:\8262228.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\604028.exec:\604028.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\k26868.exec:\k26868.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\84886.exec:\84886.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\m6068.exec:\m6068.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\fxrflxl.exec:\fxrflxl.exe17⤵
- Executes dropped EXE
PID:2004 -
\??\c:\86402.exec:\86402.exe18⤵
- Executes dropped EXE
PID:2980 -
\??\c:\4868486.exec:\4868486.exe19⤵
- Executes dropped EXE
PID:2872 -
\??\c:\2088068.exec:\2088068.exe20⤵
- Executes dropped EXE
PID:2224 -
\??\c:\u620228.exec:\u620228.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\u200202.exec:\u200202.exe22⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nthbhh.exec:\nthbhh.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
\??\c:\820684.exec:\820684.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vpjvp.exec:\vpjvp.exe25⤵
- Executes dropped EXE
PID:1620 -
\??\c:\8268084.exec:\8268084.exe26⤵
- Executes dropped EXE
PID:800 -
\??\c:\fxfxlff.exec:\fxfxlff.exe27⤵
- Executes dropped EXE
PID:548 -
\??\c:\268028.exec:\268028.exe28⤵
- Executes dropped EXE
PID:924 -
\??\c:\bhbtnb.exec:\bhbtnb.exe29⤵
- Executes dropped EXE
PID:1544 -
\??\c:\826644.exec:\826644.exe30⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rfxfxfx.exec:\rfxfxfx.exe31⤵
- Executes dropped EXE
PID:2660 -
\??\c:\0402402.exec:\0402402.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\8628880.exec:\8628880.exe33⤵
- Executes dropped EXE
PID:1116 -
\??\c:\4402842.exec:\4402842.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pjvjv.exec:\pjvjv.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\thbnnh.exec:\thbnnh.exe36⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dpjpv.exec:\dpjpv.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tnhhnt.exec:\tnhhnt.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\7rrfrfl.exec:\7rrfrfl.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\882084.exec:\882084.exe40⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9rrlxlf.exec:\9rrlxlf.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lxrxlrl.exec:\lxrxlrl.exe42⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nnbbth.exec:\nnbbth.exe43⤵
- Executes dropped EXE
PID:2948 -
\??\c:\848664.exec:\848664.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1pvjd.exec:\1pvjd.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\8202064.exec:\8202064.exe46⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vjjvp.exec:\vjjvp.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\26064.exec:\26064.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\u206806.exec:\u206806.exe49⤵
- Executes dropped EXE
PID:2336 -
\??\c:\2646284.exec:\2646284.exe50⤵
- Executes dropped EXE
PID:2740 -
\??\c:\608244.exec:\608244.exe51⤵
- Executes dropped EXE
PID:2436 -
\??\c:\84260.exec:\84260.exe52⤵
- Executes dropped EXE
PID:2352 -
\??\c:\664684.exec:\664684.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\fflrxlf.exec:\fflrxlf.exe54⤵
- Executes dropped EXE
PID:2676 -
\??\c:\60220.exec:\60220.exe55⤵
- Executes dropped EXE
PID:1368 -
\??\c:\2606882.exec:\2606882.exe56⤵
- Executes dropped EXE
PID:820 -
\??\c:\26840.exec:\26840.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9pdjp.exec:\9pdjp.exe58⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1rlxlrx.exec:\1rlxlrx.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\s8864.exec:\s8864.exe60⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vvpvj.exec:\vvpvj.exe61⤵
- Executes dropped EXE
PID:2292 -
\??\c:\220868.exec:\220868.exe62⤵
- Executes dropped EXE
PID:496 -
\??\c:\pjvdj.exec:\pjvdj.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9hbtnt.exec:\9hbtnt.exe64⤵
- Executes dropped EXE
PID:912 -
\??\c:\68802.exec:\68802.exe65⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1jvdj.exec:\1jvdj.exe66⤵PID:1864
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe67⤵PID:1240
-
\??\c:\rrlrflx.exec:\rrlrflx.exe68⤵PID:1396
-
\??\c:\vdjjv.exec:\vdjjv.exe69⤵PID:2464
-
\??\c:\7rrxflr.exec:\7rrxflr.exe70⤵PID:964
-
\??\c:\0888002.exec:\0888002.exe71⤵PID:992
-
\??\c:\w86884.exec:\w86884.exe72⤵PID:1612
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe73⤵PID:2556
-
\??\c:\4828668.exec:\4828668.exe74⤵PID:2912
-
\??\c:\a8224.exec:\a8224.exe75⤵PID:892
-
\??\c:\lrrlxfr.exec:\lrrlxfr.exe76⤵PID:2364
-
\??\c:\vvjvd.exec:\vvjvd.exe77⤵PID:1532
-
\??\c:\048422.exec:\048422.exe78⤵PID:2160
-
\??\c:\nbtbnn.exec:\nbtbnn.exe79⤵PID:1660
-
\??\c:\5bbnht.exec:\5bbnht.exe80⤵PID:2592
-
\??\c:\vpppv.exec:\vpppv.exe81⤵PID:2596
-
\??\c:\48680.exec:\48680.exe82⤵PID:2768
-
\??\c:\260622.exec:\260622.exe83⤵PID:2968
-
\??\c:\hbtbth.exec:\hbtbth.exe84⤵PID:2840
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe85⤵PID:2796
-
\??\c:\pdvvv.exec:\pdvvv.exe86⤵PID:2976
-
\??\c:\frxxrrf.exec:\frxxrrf.exe87⤵PID:3020
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe88⤵PID:2956
-
\??\c:\jdjpv.exec:\jdjpv.exe89⤵PID:2952
-
\??\c:\424060.exec:\424060.exe90⤵PID:1920
-
\??\c:\u468464.exec:\u468464.exe91⤵PID:2732
-
\??\c:\i428068.exec:\i428068.exe92⤵PID:1992
-
\??\c:\k80022.exec:\k80022.exe93⤵PID:2320
-
\??\c:\jppdp.exec:\jppdp.exe94⤵PID:1356
-
\??\c:\5htntt.exec:\5htntt.exe95⤵PID:1528
-
\??\c:\pvjjp.exec:\pvjjp.exe96⤵PID:1292
-
\??\c:\06604.exec:\06604.exe97⤵PID:556
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe98⤵PID:2676
-
\??\c:\86842.exec:\86842.exe99⤵PID:2184
-
\??\c:\jvpjp.exec:\jvpjp.exe100⤵PID:2728
-
\??\c:\fxrxllx.exec:\fxrxllx.exe101⤵PID:2272
-
\??\c:\442800.exec:\442800.exe102⤵PID:2288
-
\??\c:\nhhntb.exec:\nhhntb.exe103⤵PID:2248
-
\??\c:\q06848.exec:\q06848.exe104⤵PID:2244
-
\??\c:\lxrrflx.exec:\lxrrflx.exe105⤵PID:1624
-
\??\c:\u868846.exec:\u868846.exe106⤵PID:496
-
\??\c:\80888.exec:\80888.exe107⤵PID:2784
-
\??\c:\5xlllrf.exec:\5xlllrf.exe108⤵
- System Location Discovery: System Language Discovery
PID:3004 -
\??\c:\4224286.exec:\4224286.exe109⤵PID:1556
-
\??\c:\fxllrrf.exec:\fxllrrf.exe110⤵PID:1864
-
\??\c:\q24028.exec:\q24028.exe111⤵PID:1768
-
\??\c:\ttbbnt.exec:\ttbbnt.exe112⤵PID:1068
-
\??\c:\ddvdv.exec:\ddvdv.exe113⤵PID:1984
-
\??\c:\nhtthn.exec:\nhtthn.exe114⤵PID:608
-
\??\c:\04062.exec:\04062.exe115⤵PID:2468
-
\??\c:\nhntbb.exec:\nhntbb.exe116⤵PID:1908
-
\??\c:\nhhntb.exec:\nhhntb.exe117⤵PID:1508
-
\??\c:\60406.exec:\60406.exe118⤵PID:2912
-
\??\c:\vvjpd.exec:\vvjpd.exe119⤵PID:892
-
\??\c:\640666.exec:\640666.exe120⤵PID:2364
-
\??\c:\vpdpd.exec:\vpdpd.exe121⤵PID:1760
-
\??\c:\fxlrffr.exec:\fxlrffr.exe122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-