Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 07:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe
-
Size
454KB
-
MD5
8a58cba655cf9e0683739ac81b6843e0
-
SHA1
d81c968d94c6393250470cc5bb90655fe1050cee
-
SHA256
2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8
-
SHA512
e2f250c8a88c608244aa7b5bb7249496ab702cd925945a841cce15ad3489acc157ca67c4bdda1a46065b83437c8822064976313f4502232fba410f2be6c92f86
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-134-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2648-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-179-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2140-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-500-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1564-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-691-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/396-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-833-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1524 pdpjj.exe 1996 vpdjv.exe 3068 vjjpv.exe 3008 nhbhnt.exe 2348 vvddj.exe 2868 bbtbnt.exe 2912 3vvdd.exe 2624 rfrllfl.exe 2876 bntttt.exe 2592 lfrrxrf.exe 2144 hbnnth.exe 772 flxflrf.exe 2832 tnbhnn.exe 756 pppdj.exe 2648 9xfrfxf.exe 812 pdjdd.exe 984 5lrlrll.exe 284 7bbntt.exe 2140 jdjjv.exe 2096 5hbhnn.exe 2128 dddpj.exe 1204 3frlrrx.exe 2444 thnnnh.exe 1968 9lxfrfl.exe 1564 htthnn.exe 2488 ddvjj.exe 2268 7frfflr.exe 2256 flrllxl.exe 876 nhbnbh.exe 2916 xrlrfrl.exe 1596 ffrlrfx.exe 1972 3jvjj.exe 2304 1xflrrx.exe 2356 bhbhbn.exe 2776 pjvjp.exe 2424 rrllxfx.exe 2348 5ntnnn.exe 2868 jdvdp.exe 2704 3fxxrfr.exe 2796 thhntb.exe 2752 nththn.exe 2760 3jvjp.exe 2592 7lfrxlr.exe 2708 1htbnb.exe 2324 dvpvj.exe 2840 lllrlrf.exe 664 lfflxrx.exe 576 hthntt.exe 2816 dvppd.exe 2648 fxflrxr.exe 1036 fxxlfrx.exe 464 bbbnhn.exe 1672 vvvvp.exe 2964 lfrffrr.exe 2328 3llrlxl.exe 2132 9hbhtt.exe 1072 jdvdd.exe 2988 ffrflrf.exe 1712 nhtbtt.exe 1924 hbtbht.exe 1780 pjpvd.exe 2676 9llrflx.exe 1564 9lflrrx.exe 1504 tnnthn.exe -
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/464-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-797-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 1524 2672 2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe 30 PID 2672 wrote to memory of 1524 2672 2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe 30 PID 2672 wrote to memory of 1524 2672 2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe 30 PID 2672 wrote to memory of 1524 2672 2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe 30 PID 1524 wrote to memory of 1996 1524 pdpjj.exe 31 PID 1524 wrote to memory of 1996 1524 pdpjj.exe 31 PID 1524 wrote to memory of 1996 1524 pdpjj.exe 31 PID 1524 wrote to memory of 1996 1524 pdpjj.exe 31 PID 1996 wrote to memory of 3068 1996 vpdjv.exe 32 PID 1996 wrote to memory of 3068 1996 vpdjv.exe 32 PID 1996 wrote to memory of 3068 1996 vpdjv.exe 32 PID 1996 wrote to memory of 3068 1996 vpdjv.exe 32 PID 3068 wrote to memory of 3008 3068 vjjpv.exe 33 PID 3068 wrote to memory of 3008 3068 vjjpv.exe 33 PID 3068 wrote to memory of 3008 3068 vjjpv.exe 33 PID 3068 wrote to memory of 3008 3068 vjjpv.exe 33 PID 3008 wrote to memory of 2348 3008 nhbhnt.exe 34 PID 3008 wrote to memory of 2348 3008 nhbhnt.exe 34 PID 3008 wrote to memory of 2348 3008 nhbhnt.exe 34 PID 3008 wrote to memory of 2348 3008 nhbhnt.exe 34 PID 2348 wrote to memory of 2868 2348 vvddj.exe 35 PID 2348 wrote to memory of 2868 2348 vvddj.exe 35 PID 2348 wrote to memory of 2868 2348 vvddj.exe 35 PID 2348 wrote to memory of 2868 2348 vvddj.exe 35 PID 2868 wrote to memory of 2912 2868 bbtbnt.exe 36 PID 2868 wrote to memory of 2912 2868 bbtbnt.exe 36 PID 2868 wrote to memory of 2912 2868 bbtbnt.exe 36 PID 2868 wrote to memory of 2912 2868 bbtbnt.exe 36 PID 2912 wrote to memory of 2624 2912 3vvdd.exe 37 PID 2912 wrote to memory of 2624 2912 3vvdd.exe 37 PID 2912 wrote to memory of 2624 2912 3vvdd.exe 37 PID 2912 wrote to memory of 2624 2912 3vvdd.exe 37 PID 2624 wrote to memory of 2876 2624 rfrllfl.exe 38 PID 2624 wrote to memory of 2876 2624 rfrllfl.exe 38 PID 2624 wrote to memory of 2876 2624 rfrllfl.exe 38 PID 2624 wrote to memory of 2876 2624 rfrllfl.exe 38 PID 2876 wrote to memory of 2592 2876 bntttt.exe 39 PID 2876 wrote to memory of 2592 2876 bntttt.exe 39 PID 2876 wrote to memory of 2592 2876 bntttt.exe 39 PID 2876 wrote to memory of 2592 2876 bntttt.exe 39 PID 2592 wrote to memory of 2144 2592 lfrrxrf.exe 40 PID 2592 wrote to memory of 2144 2592 lfrrxrf.exe 40 PID 2592 wrote to memory of 2144 2592 lfrrxrf.exe 40 PID 2592 wrote to memory of 2144 2592 lfrrxrf.exe 40 PID 2144 wrote to memory of 772 2144 hbnnth.exe 41 PID 2144 wrote to memory of 772 2144 hbnnth.exe 41 PID 2144 wrote to memory of 772 2144 hbnnth.exe 41 PID 2144 wrote to memory of 772 2144 hbnnth.exe 41 PID 772 wrote to memory of 2832 772 flxflrf.exe 42 PID 772 wrote to memory of 2832 772 flxflrf.exe 42 PID 772 wrote to memory of 2832 772 flxflrf.exe 42 PID 772 wrote to memory of 2832 772 flxflrf.exe 42 PID 2832 wrote to memory of 756 2832 tnbhnn.exe 43 PID 2832 wrote to memory of 756 2832 tnbhnn.exe 43 PID 2832 wrote to memory of 756 2832 tnbhnn.exe 43 PID 2832 wrote to memory of 756 2832 tnbhnn.exe 43 PID 756 wrote to memory of 2648 756 pppdj.exe 44 PID 756 wrote to memory of 2648 756 pppdj.exe 44 PID 756 wrote to memory of 2648 756 pppdj.exe 44 PID 756 wrote to memory of 2648 756 pppdj.exe 44 PID 2648 wrote to memory of 812 2648 9xfrfxf.exe 45 PID 2648 wrote to memory of 812 2648 9xfrfxf.exe 45 PID 2648 wrote to memory of 812 2648 9xfrfxf.exe 45 PID 2648 wrote to memory of 812 2648 9xfrfxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe"C:\Users\Admin\AppData\Local\Temp\2c42d75f2ce756bf92c271b142b549345f43bf1ef0db6b9074c757c9af95bde8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pdpjj.exec:\pdpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\vpdjv.exec:\vpdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\vjjpv.exec:\vjjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nhbhnt.exec:\nhbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vvddj.exec:\vvddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\bbtbnt.exec:\bbtbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\3vvdd.exec:\3vvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rfrllfl.exec:\rfrllfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bntttt.exec:\bntttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hbnnth.exec:\hbnnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\flxflrf.exec:\flxflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\tnbhnn.exec:\tnbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\pppdj.exec:\pppdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\9xfrfxf.exec:\9xfrfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pdjdd.exec:\pdjdd.exe17⤵
- Executes dropped EXE
PID:812 -
\??\c:\5lrlrll.exec:\5lrlrll.exe18⤵
- Executes dropped EXE
PID:984 -
\??\c:\7bbntt.exec:\7bbntt.exe19⤵
- Executes dropped EXE
PID:284 -
\??\c:\jdjjv.exec:\jdjjv.exe20⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5hbhnn.exec:\5hbhnn.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dddpj.exec:\dddpj.exe22⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3frlrrx.exec:\3frlrrx.exe23⤵
- Executes dropped EXE
PID:1204 -
\??\c:\thnnnh.exec:\thnnnh.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9lxfrfl.exec:\9lxfrfl.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\htthnn.exec:\htthnn.exe26⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ddvjj.exec:\ddvjj.exe27⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7frfflr.exec:\7frfflr.exe28⤵
- Executes dropped EXE
PID:2268 -
\??\c:\flrllxl.exec:\flrllxl.exe29⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhbnbh.exec:\nhbnbh.exe30⤵
- Executes dropped EXE
PID:876 -
\??\c:\xrlrfrl.exec:\xrlrfrl.exe31⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ffrlrfx.exec:\ffrlrfx.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3jvjj.exec:\3jvjj.exe33⤵
- Executes dropped EXE
PID:1972 -
\??\c:\1xflrrx.exec:\1xflrrx.exe34⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bhbhbn.exec:\bhbhbn.exe35⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pjvjp.exec:\pjvjp.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rrllxfx.exec:\rrllxfx.exe37⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5ntnnn.exec:\5ntnnn.exe38⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jdvdp.exec:\jdvdp.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3fxxrfr.exec:\3fxxrfr.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\thhntb.exec:\thhntb.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nththn.exec:\nththn.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3jvjp.exec:\3jvjp.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7lfrxlr.exec:\7lfrxlr.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1htbnb.exec:\1htbnb.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvpvj.exec:\dvpvj.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lllrlrf.exec:\lllrlrf.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lfflxrx.exec:\lfflxrx.exe48⤵
- Executes dropped EXE
PID:664 -
\??\c:\hthntt.exec:\hthntt.exe49⤵
- Executes dropped EXE
PID:576 -
\??\c:\dvppd.exec:\dvppd.exe50⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxflrxr.exec:\fxflrxr.exe51⤵
- Executes dropped EXE
PID:2648 -
\??\c:\fxxlfrx.exec:\fxxlfrx.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bbbnhn.exec:\bbbnhn.exe53⤵
- Executes dropped EXE
PID:464 -
\??\c:\vvvvp.exec:\vvvvp.exe54⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lfrffrr.exec:\lfrffrr.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3llrlxl.exec:\3llrlxl.exe56⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9hbhtt.exec:\9hbhtt.exe57⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jdvdd.exec:\jdvdd.exe58⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ffrflrf.exec:\ffrflrf.exe59⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nhtbtt.exec:\nhtbtt.exe60⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hbtbht.exec:\hbtbht.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pjpvd.exec:\pjpvd.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\9llrflx.exec:\9llrflx.exe63⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9lflrrx.exec:\9lflrrx.exe64⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tnnthn.exec:\tnnthn.exe65⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ppjvp.exec:\ppjvp.exe66⤵PID:1656
-
\??\c:\1xllrrf.exec:\1xllrrf.exe67⤵PID:2292
-
\??\c:\lfrxllr.exec:\lfrxllr.exe68⤵PID:2028
-
\??\c:\9hbtnn.exec:\9hbtnn.exe69⤵PID:2276
-
\??\c:\jjddp.exec:\jjddp.exe70⤵PID:1560
-
\??\c:\7ppvj.exec:\7ppvj.exe71⤵PID:2564
-
\??\c:\1rrxffr.exec:\1rrxffr.exe72⤵PID:1524
-
\??\c:\nnhnth.exec:\nnhnth.exe73⤵PID:2000
-
\??\c:\tbtnbh.exec:\tbtnbh.exe74⤵PID:2372
-
\??\c:\dddpd.exec:\dddpd.exe75⤵PID:2304
-
\??\c:\3xrrllf.exec:\3xrrllf.exe76⤵PID:2732
-
\??\c:\xrfrlrl.exec:\xrfrlrl.exe77⤵PID:1636
-
\??\c:\nhbntb.exec:\nhbntb.exe78⤵PID:2224
-
\??\c:\djddp.exec:\djddp.exe79⤵PID:2884
-
\??\c:\9jvvd.exec:\9jvvd.exe80⤵PID:2596
-
\??\c:\rfxlxfx.exec:\rfxlxfx.exe81⤵PID:2940
-
\??\c:\3ttnbh.exec:\3ttnbh.exe82⤵PID:2644
-
\??\c:\7vddd.exec:\7vddd.exe83⤵PID:2908
-
\??\c:\jjdjj.exec:\jjdjj.exe84⤵PID:2604
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe85⤵PID:2456
-
\??\c:\bbthnt.exec:\bbthnt.exe86⤵PID:2508
-
\??\c:\5nhtbh.exec:\5nhtbh.exe87⤵PID:1804
-
\??\c:\3vdpj.exec:\3vdpj.exe88⤵PID:1484
-
\??\c:\lfxlflx.exec:\lfxlflx.exe89⤵PID:1488
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe90⤵PID:664
-
\??\c:\thbnbh.exec:\thbnbh.exe91⤵PID:576
-
\??\c:\vpvpv.exec:\vpvpv.exe92⤵PID:348
-
\??\c:\7flxfxl.exec:\7flxfxl.exe93⤵
- System Location Discovery: System Language Discovery
PID:396 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe94⤵PID:2344
-
\??\c:\tthtbh.exec:\tthtbh.exe95⤵PID:2976
-
\??\c:\jjdjp.exec:\jjdjp.exe96⤵PID:1672
-
\??\c:\rfxfxlf.exec:\rfxfxlf.exe97⤵PID:2184
-
\??\c:\rlxfxfr.exec:\rlxfxfr.exe98⤵PID:2992
-
\??\c:\btnbnb.exec:\btnbnb.exe99⤵PID:2472
-
\??\c:\3pjpv.exec:\3pjpv.exe100⤵PID:2300
-
\??\c:\vpdvd.exec:\vpdvd.exe101⤵PID:2364
-
\??\c:\1xrlxfl.exec:\1xrlxfl.exe102⤵PID:2444
-
\??\c:\ttnttb.exec:\ttnttb.exe103⤵PID:1312
-
\??\c:\dpjdp.exec:\dpjdp.exe104⤵PID:1780
-
\??\c:\5pjvj.exec:\5pjvj.exe105⤵PID:2272
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe106⤵PID:1600
-
\??\c:\9nnnhh.exec:\9nnnhh.exe107⤵PID:2056
-
\??\c:\7hbbhb.exec:\7hbbhb.exe108⤵PID:1656
-
\??\c:\dvpvj.exec:\dvpvj.exe109⤵PID:2384
-
\??\c:\ffxfllf.exec:\ffxfllf.exe110⤵PID:876
-
\??\c:\5hhhht.exec:\5hhhht.exe111⤵PID:2200
-
\??\c:\thhtbt.exec:\thhtbt.exe112⤵PID:1560
-
\??\c:\vvpjv.exec:\vvpjv.exe113⤵PID:1444
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe114⤵PID:1524
-
\??\c:\ffflxrf.exec:\ffflxrf.exe115⤵PID:1996
-
\??\c:\nhthnt.exec:\nhthnt.exe116⤵PID:2412
-
\??\c:\3djjp.exec:\3djjp.exe117⤵PID:1248
-
\??\c:\lxlffff.exec:\lxlffff.exe118⤵PID:2864
-
\??\c:\frlxxlx.exec:\frlxxlx.exe119⤵PID:2872
-
\??\c:\1ttbhb.exec:\1ttbhb.exe120⤵PID:2552
-
\??\c:\jvpdp.exec:\jvpdp.exe121⤵PID:2892
-
\??\c:\vpdpp.exec:\vpdpp.exe122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-