Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 05:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
- Target 9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe
- Size 453KB
- Sample250108-fyj3aaxreq
- SHA256 9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0
- MD5 6a82d750da6b17396f7e43e42dd7fb14
- SHA1 e1d9e79458bbcfb459a95515d47d983c1a026c81
- SHA512 bfae91b14383641fdd91e2f0515354bab33e341684d52ce2f12d94553e70a04e708189a516eee2073a0e87bccf60ff34564342aed34b5ce5f759cdf5c8d19f11
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2568-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-63-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2852-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-83-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2732-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-98-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/484-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-212-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1144-221-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2272-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-275-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1200-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-363-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2856-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-391-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1164-442-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2308-464-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/772-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-885-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-899-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-1054-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-1076-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2196-1135-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2756-1218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-1282-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 344 826244.exe 2316 jdjvp.exe 2352 004284.exe 2060 26068.exe 2724 42068.exe 2764 86880.exe 2852 420604.exe 2900 htttbt.exe 2732 2464264.exe 2860 rfflrrl.exe 2660 5rfxxrx.exe 2216 1jdjp.exe 568 i266840.exe 2076 1jpdv.exe 1904 hhhhhh.exe 2020 rlflxrx.exe 2924 2084668.exe 2080 2084484.exe 1276 c026606.exe 320 pvddd.exe 484 tntttt.exe 1080 k24624.exe 1144 hthntt.exe 2272 4862880.exe 1748 rxlrrrr.exe 1364 8640062.exe 2492 7pdjv.exe 548 k46248.exe 1032 686248.exe 2148 9dpjp.exe 2524 9xlxffl.exe 2456 080448.exe 2372 nbhnnn.exe 1200 480622.exe 2988 080664.exe 2344 7thbnh.exe 2544 9xlllfl.exe 2368 s2444.exe 2472 o648444.exe 2128 4248822.exe 2776 646226.exe 2636 9jvpp.exe 2856 lrfxxxl.exe 2748 i688480.exe 1236 m0604.exe 2732 3thtnh.exe 2644 4862884.exe 2704 048026.exe 1944 080066.exe 2688 bnbttn.exe 888 llffxrf.exe 2108 q20644.exe 2076 0400662.exe 1164 xlffrrx.exe 2720 1djjj.exe 2932 86402.exe 2308 7rllllx.exe 2056 hbntbh.exe 1960 2028484.exe 772 0288824.exe 1468 80884.exe 680 864444.exe 272 860004.exe 580 k82288.exe -
resource yara_rule behavioral1/memory/2568-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-116-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/568-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-190-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/320-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-210-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2272-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-226-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1364-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-1142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-1156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-1273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-1282-0x0000000000220000-0x000000000024A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u628484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6882200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8688444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 344 2568 9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe 30 PID 2568 wrote to memory of 344 2568 9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe 30 PID 2568 wrote to memory of 344 2568 9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe 30 PID 2568 wrote to memory of 344 2568 9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe 30 PID 344 wrote to memory of 2316 344 826244.exe 31 PID 344 wrote to memory of 2316 344 826244.exe 31 PID 344 wrote to memory of 2316 344 826244.exe 31 PID 344 wrote to memory of 2316 344 826244.exe 31 PID 2316 wrote to memory of 2352 2316 jdjvp.exe 32 PID 2316 wrote to memory of 2352 2316 jdjvp.exe 32 PID 2316 wrote to memory of 2352 2316 jdjvp.exe 32 PID 2316 wrote to memory of 2352 2316 jdjvp.exe 32 PID 2352 wrote to memory of 2060 2352 004284.exe 33 PID 2352 wrote to memory of 2060 2352 004284.exe 33 PID 2352 wrote to memory of 2060 2352 004284.exe 33 PID 2352 wrote to memory of 2060 2352 004284.exe 33 PID 2060 wrote to memory of 2724 2060 26068.exe 34 PID 2060 wrote to memory of 2724 2060 26068.exe 34 PID 2060 wrote to memory of 2724 2060 26068.exe 34 PID 2060 wrote to memory of 2724 2060 26068.exe 34 PID 2724 wrote to memory of 2764 2724 42068.exe 35 PID 2724 wrote to memory of 2764 2724 42068.exe 35 PID 2724 wrote to memory of 2764 2724 42068.exe 35 PID 2724 wrote to memory of 2764 2724 42068.exe 35 PID 2764 wrote to memory of 2852 2764 86880.exe 36 PID 2764 wrote to memory of 2852 2764 86880.exe 36 PID 2764 wrote to memory of 2852 2764 86880.exe 36 PID 2764 wrote to memory of 2852 2764 86880.exe 36 PID 2852 wrote to memory of 2900 2852 420604.exe 37 PID 2852 wrote to memory of 2900 2852 420604.exe 37 PID 2852 wrote to memory of 2900 2852 420604.exe 37 PID 2852 wrote to memory of 2900 2852 420604.exe 37 PID 2900 wrote to memory of 2732 2900 htttbt.exe 38 PID 2900 wrote to memory of 2732 2900 htttbt.exe 38 PID 2900 wrote to memory of 2732 2900 htttbt.exe 38 PID 2900 wrote to memory of 2732 2900 htttbt.exe 38 PID 2732 wrote to memory of 2860 2732 2464264.exe 39 PID 2732 wrote to memory of 2860 2732 2464264.exe 39 PID 2732 wrote to memory of 2860 2732 2464264.exe 39 PID 2732 wrote to memory of 2860 2732 2464264.exe 39 PID 2860 wrote to memory of 2660 2860 rfflrrl.exe 40 PID 2860 wrote to memory of 2660 2860 rfflrrl.exe 40 PID 2860 wrote to memory of 2660 2860 rfflrrl.exe 40 PID 2860 wrote to memory of 2660 2860 rfflrrl.exe 40 PID 2660 wrote to memory of 2216 2660 5rfxxrx.exe 41 PID 2660 wrote to memory of 2216 2660 5rfxxrx.exe 41 PID 2660 wrote to memory of 2216 2660 5rfxxrx.exe 41 PID 2660 wrote to memory of 2216 2660 5rfxxrx.exe 41 PID 2216 wrote to memory of 568 2216 1jdjp.exe 42 PID 2216 wrote to memory of 568 2216 1jdjp.exe 42 PID 2216 wrote to memory of 568 2216 1jdjp.exe 42 PID 2216 wrote to memory of 568 2216 1jdjp.exe 42 PID 568 wrote to memory of 2076 568 i266840.exe 43 PID 568 wrote to memory of 2076 568 i266840.exe 43 PID 568 wrote to memory of 2076 568 i266840.exe 43 PID 568 wrote to memory of 2076 568 i266840.exe 43 PID 2076 wrote to memory of 1904 2076 1jpdv.exe 44 PID 2076 wrote to memory of 1904 2076 1jpdv.exe 44 PID 2076 wrote to memory of 1904 2076 1jpdv.exe 44 PID 2076 wrote to memory of 1904 2076 1jpdv.exe 44 PID 1904 wrote to memory of 2020 1904 hhhhhh.exe 45 PID 1904 wrote to memory of 2020 1904 hhhhhh.exe 45 PID 1904 wrote to memory of 2020 1904 hhhhhh.exe 45 PID 1904 wrote to memory of 2020 1904 hhhhhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe"C:\Users\Admin\AppData\Local\Temp\9cb8014e7d3465b50940eea3242c2c6c0ed740f95dab239cefa2749b3dd7f9e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\826244.exec:\826244.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\jdjvp.exec:\jdjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\004284.exec:\004284.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\26068.exec:\26068.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\42068.exec:\42068.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\86880.exec:\86880.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\420604.exec:\420604.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\htttbt.exec:\htttbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\2464264.exec:\2464264.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rfflrrl.exec:\rfflrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5rfxxrx.exec:\5rfxxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1jdjp.exec:\1jdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\i266840.exec:\i266840.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\1jpdv.exec:\1jpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\hhhhhh.exec:\hhhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\rlflxrx.exec:\rlflxrx.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\2084668.exec:\2084668.exe18⤵
- Executes dropped EXE
PID:2924 -
\??\c:\2084484.exec:\2084484.exe19⤵
- Executes dropped EXE
PID:2080 -
\??\c:\c026606.exec:\c026606.exe20⤵
- Executes dropped EXE
PID:1276 -
\??\c:\pvddd.exec:\pvddd.exe21⤵
- Executes dropped EXE
PID:320 -
\??\c:\tntttt.exec:\tntttt.exe22⤵
- Executes dropped EXE
PID:484 -
\??\c:\k24624.exec:\k24624.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hthntt.exec:\hthntt.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\4862880.exec:\4862880.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rxlrrrr.exec:\rxlrrrr.exe26⤵
- Executes dropped EXE
PID:1748 -
\??\c:\8640062.exec:\8640062.exe27⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7pdjv.exec:\7pdjv.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\k46248.exec:\k46248.exe29⤵
- Executes dropped EXE
PID:548 -
\??\c:\686248.exec:\686248.exe30⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9dpjp.exec:\9dpjp.exe31⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9xlxffl.exec:\9xlxffl.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\080448.exec:\080448.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nbhnnn.exec:\nbhnnn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\480622.exec:\480622.exe35⤵
- Executes dropped EXE
PID:1200 -
\??\c:\080664.exec:\080664.exe36⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7thbnh.exec:\7thbnh.exe37⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9xlllfl.exec:\9xlllfl.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\s2444.exec:\s2444.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\o648444.exec:\o648444.exe40⤵
- Executes dropped EXE
PID:2472 -
\??\c:\4248822.exec:\4248822.exe41⤵
- Executes dropped EXE
PID:2128 -
\??\c:\646226.exec:\646226.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9jvpp.exec:\9jvpp.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lrfxxxl.exec:\lrfxxxl.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\i688480.exec:\i688480.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\m0604.exec:\m0604.exe46⤵
- Executes dropped EXE
PID:1236 -
\??\c:\3thtnh.exec:\3thtnh.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\4862884.exec:\4862884.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\048026.exec:\048026.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\080066.exec:\080066.exe50⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bnbttn.exec:\bnbttn.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llffxrf.exec:\llffxrf.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\q20644.exec:\q20644.exe53⤵
- Executes dropped EXE
PID:2108 -
\??\c:\0400662.exec:\0400662.exe54⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xlffrrx.exec:\xlffrrx.exe55⤵
- Executes dropped EXE
PID:1164 -
\??\c:\1djjj.exec:\1djjj.exe56⤵
- Executes dropped EXE
PID:2720 -
\??\c:\86402.exec:\86402.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7rllllx.exec:\7rllllx.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\hbntbh.exec:\hbntbh.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\2028484.exec:\2028484.exe60⤵
- Executes dropped EXE
PID:1960 -
\??\c:\0288824.exec:\0288824.exe61⤵
- Executes dropped EXE
PID:772 -
\??\c:\80884.exec:\80884.exe62⤵
- Executes dropped EXE
PID:1468 -
\??\c:\864444.exec:\864444.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:680 -
\??\c:\860004.exec:\860004.exe64⤵
- Executes dropped EXE
PID:272 -
\??\c:\k82288.exec:\k82288.exe65⤵
- Executes dropped EXE
PID:580 -
\??\c:\llfrxlr.exec:\llfrxlr.exe66⤵PID:1328
-
\??\c:\4882884.exec:\4882884.exe67⤵PID:1860
-
\??\c:\82446.exec:\82446.exe68⤵PID:1516
-
\??\c:\djpvp.exec:\djpvp.exe69⤵PID:808
-
\??\c:\hhtbbb.exec:\hhtbbb.exe70⤵PID:2260
-
\??\c:\pjdjd.exec:\pjdjd.exe71⤵PID:584
-
\??\c:\460022.exec:\460022.exe72⤵PID:2512
-
\??\c:\c462284.exec:\c462284.exe73⤵PID:688
-
\??\c:\8688444.exec:\8688444.exe74⤵
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\1dpjj.exec:\1dpjj.exe75⤵PID:328
-
\??\c:\hbhhhn.exec:\hbhhhn.exe76⤵PID:2404
-
\??\c:\s0228.exec:\s0228.exe77⤵PID:652
-
\??\c:\fxlflxf.exec:\fxlflxf.exe78⤵PID:2712
-
\??\c:\bbnntt.exec:\bbnntt.exe79⤵PID:948
-
\??\c:\686288.exec:\686288.exe80⤵PID:2996
-
\??\c:\4262440.exec:\4262440.exe81⤵PID:1824
-
\??\c:\62646.exec:\62646.exe82⤵PID:2096
-
\??\c:\1bthhh.exec:\1bthhh.exe83⤵PID:300
-
\??\c:\u428440.exec:\u428440.exe84⤵PID:1336
-
\??\c:\824406.exec:\824406.exe85⤵PID:2820
-
\??\c:\4404884.exec:\4404884.exe86⤵PID:3008
-
\??\c:\vpdvv.exec:\vpdvv.exe87⤵PID:2824
-
\??\c:\868004.exec:\868004.exe88⤵PID:2756
-
\??\c:\8244640.exec:\8244640.exe89⤵PID:2652
-
\??\c:\xrfffxf.exec:\xrfffxf.exe90⤵PID:2748
-
\??\c:\20622.exec:\20622.exe91⤵PID:2684
-
\??\c:\bnbhtb.exec:\bnbhtb.exe92⤵PID:2860
-
\??\c:\tnbbhh.exec:\tnbbhh.exe93⤵PID:1948
-
\??\c:\886240.exec:\886240.exe94⤵PID:2672
-
\??\c:\tntttn.exec:\tntttn.exe95⤵PID:1808
-
\??\c:\9pddd.exec:\9pddd.exe96⤵PID:2376
-
\??\c:\4200624.exec:\4200624.exe97⤵PID:2528
-
\??\c:\hbntbh.exec:\hbntbh.exe98⤵PID:2928
-
\??\c:\642806.exec:\642806.exe99⤵PID:2320
-
\??\c:\rlflffr.exec:\rlflffr.exe100⤵PID:1272
-
\??\c:\c044642.exec:\c044642.exe101⤵PID:1244
-
\??\c:\hbtbhh.exec:\hbtbhh.exe102⤵PID:2932
-
\??\c:\a2822.exec:\a2822.exe103⤵PID:1268
-
\??\c:\08006.exec:\08006.exe104⤵PID:1276
-
\??\c:\dpddv.exec:\dpddv.exe105⤵PID:2596
-
\??\c:\dvpvj.exec:\dvpvj.exe106⤵PID:944
-
\??\c:\1jvvv.exec:\1jvvv.exe107⤵PID:2728
-
\??\c:\rrlrflf.exec:\rrlrflf.exe108⤵PID:1308
-
\??\c:\3lfrxxx.exec:\3lfrxxx.exe109⤵PID:272
-
\??\c:\q20284.exec:\q20284.exe110⤵PID:1144
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe111⤵PID:928
-
\??\c:\bbntbh.exec:\bbntbh.exe112⤵PID:1700
-
\??\c:\jdvjv.exec:\jdvjv.exe113⤵PID:1712
-
\??\c:\ntnthh.exec:\ntnthh.exe114⤵PID:1708
-
\??\c:\i060606.exec:\i060606.exe115⤵PID:876
-
\??\c:\820684.exec:\820684.exe116⤵PID:1612
-
\??\c:\7bhhhb.exec:\7bhhhb.exe117⤵PID:1940
-
\??\c:\9tnnhh.exec:\9tnnhh.exe118⤵PID:3016
-
\??\c:\dvjpp.exec:\dvjpp.exe119⤵PID:2148
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe120⤵PID:872
-
\??\c:\u668440.exec:\u668440.exe121⤵PID:2360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-