Analysis
- max time kernel
120s - max time network
120s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 13:40
Behavioral task
behavioral1
Sample
9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
- Target 9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe
- Size 334KB
- Sample250108-qyzsvasjax
- SHA256 9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e
- MD5 14397bea22e89ca01fed23e92911e368
- SHA1 2bbe443a7dc8c6054bd5b06561b357522d9ae147
- SHA512 35e8c44bad4886f2058e42d0cc3daeb7f05055c63bd4a7e370418b5eb9dbbb4fbf57828371a78070d3c0afae24c73f4c24cedecb940cc465bd2fa50b4a024e92
- SSDEEP 6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTG:R4wFHoSHYHUrAwfMp3CDK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2116-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1248-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-44-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2816-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-62-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-73-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2476-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-97-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2740-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-111-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/452-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-181-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1744-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-264-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/288-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/580-403-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1760-436-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1972-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-510-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2876-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-603-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/592-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-684-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-718-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2524-761-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2260-857-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2260-858-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2220-869-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/828-981-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2124-1101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-1135-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2656-1136-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-1149-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2488-8773-0x0000000076AD0000-0x0000000076BEF000-memory.dmp family_blackmoon behavioral1/memory/2488-11395-0x0000000076AD0000-0x0000000076BEF000-memory.dmp family_blackmoon behavioral1/memory/2488-16923-0x0000000076AD0000-0x0000000076BEF000-memory.dmp family_blackmoon behavioral1/memory/2488-17750-0x0000000076AD0000-0x0000000076BEF000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1248 7ththt.exe 2028 008462.exe 2492 a0402.exe 2484 pdpdp.exe 2816 tthbth.exe 3000 9rlxlff.exe 1144 64862.exe 2972 9jjvp.exe 2476 ffxfrrx.exe 2860 rlxfllx.exe 2760 042468.exe 2740 vpdjp.exe 2748 9pjdp.exe 1164 048426.exe 452 c868624.exe 3020 flflxxl.exe 2900 8262408.exe 3016 6084246.exe 2112 3flxxxl.exe 2004 26408.exe 544 ttthtn.exe 1980 w60246.exe 884 ttnntn.exe 1656 6028042.exe 2364 0486664.exe 1300 642088.exe 976 826244.exe 1744 1hbntb.exe 1748 jpvvvj.exe 1008 26408.exe 1812 82046.exe 2532 08066.exe 288 482466.exe 1936 2680846.exe 1916 5dvjp.exe 1804 8662006.exe 2116 2064446.exe 1580 824400.exe 1564 rfrrrll.exe 2640 xlxfrrr.exe 2416 ppdpp.exe 2316 7hnhbb.exe 2276 684444.exe 2328 rlffllr.exe 2988 frfflfl.exe 2944 vvvdp.exe 2984 820288.exe 1144 2688040.exe 2824 lxfrrxf.exe 2936 9vjpd.exe 2476 jdppj.exe 2860 9vddp.exe 2720 dvvjv.exe 2232 9xrfflr.exe 1500 dvjpv.exe 1304 0206268.exe 824 q42884.exe 580 9nthbb.exe 1652 nbnttt.exe 928 c084628.exe 1664 1nnnnn.exe 1644 86888.exe 2880 hthbbt.exe 1760 u828620.exe -
resource yara_rule behavioral1/memory/2116-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001202c-6.dat upx behavioral1/memory/1248-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1248-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cfd-16.dat upx behavioral1/files/0x0008000000016d0e-22.dat upx behavioral1/files/0x0007000000016d1f-30.dat upx behavioral1/memory/2484-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2484-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d27-40.dat upx behavioral1/memory/2816-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d3b-51.dat upx behavioral1/memory/3000-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d42-57.dat upx behavioral1/memory/1144-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d46-66.dat upx behavioral1/files/0x000500000001949d-74.dat upx behavioral1/memory/2476-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c6-81.dat upx behavioral1/files/0x00050000000194d0-90.dat upx behavioral1/memory/2860-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194da-98.dat upx behavioral1/files/0x00050000000194e4-107.dat upx behavioral1/memory/2740-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e6-116.dat upx behavioral1/memory/1164-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/452-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019551-125.dat upx behavioral1/files/0x0009000000016c5c-132.dat upx behavioral1/files/0x000500000001955c-140.dat upx behavioral1/memory/3020-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019581-148.dat upx behavioral1/memory/3016-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c0-159.dat upx behavioral1/memory/2112-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195f7-167.dat upx behavioral1/memory/2112-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195f9-174.dat upx behavioral1/memory/544-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/544-181-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000195fb-183.dat upx behavioral1/files/0x00050000000195fd-189.dat upx behavioral1/files/0x00050000000195fe-197.dat upx behavioral1/files/0x00050000000195ff-203.dat upx behavioral1/files/0x0005000000019601-212.dat upx behavioral1/files/0x0005000000019603-219.dat upx behavioral1/files/0x0005000000019605-226.dat upx behavioral1/files/0x0005000000019615-234.dat upx behavioral1/memory/1744-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195f7-241.dat upx behavioral1/memory/1008-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1812-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019659-250.dat upx behavioral1/files/0x000500000001969b-257.dat upx behavioral1/memory/1936-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/288-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-331-0x00000000001B0000-0x00000000001D7000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882646.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o202828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 482466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k42466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1248 2116 9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe 30 PID 2116 wrote to memory of 1248 2116 9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe 30 PID 2116 wrote to memory of 1248 2116 9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe 30 PID 2116 wrote to memory of 1248 2116 9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe 30 PID 1248 wrote to memory of 2028 1248 7ththt.exe 31 PID 1248 wrote to memory of 2028 1248 7ththt.exe 31 PID 1248 wrote to memory of 2028 1248 7ththt.exe 31 PID 1248 wrote to memory of 2028 1248 7ththt.exe 31 PID 2028 wrote to memory of 2492 2028 008462.exe 32 PID 2028 wrote to memory of 2492 2028 008462.exe 32 PID 2028 wrote to memory of 2492 2028 008462.exe 32 PID 2028 wrote to memory of 2492 2028 008462.exe 32 PID 2492 wrote to memory of 2484 2492 a0402.exe 33 PID 2492 wrote to memory of 2484 2492 a0402.exe 33 PID 2492 wrote to memory of 2484 2492 a0402.exe 33 PID 2492 wrote to memory of 2484 2492 a0402.exe 33 PID 2484 wrote to memory of 2816 2484 pdpdp.exe 34 PID 2484 wrote to memory of 2816 2484 pdpdp.exe 34 PID 2484 wrote to memory of 2816 2484 pdpdp.exe 34 PID 2484 wrote to memory of 2816 2484 pdpdp.exe 34 PID 2816 wrote to memory of 3000 2816 tthbth.exe 35 PID 2816 wrote to memory of 3000 2816 tthbth.exe 35 PID 2816 wrote to memory of 3000 2816 tthbth.exe 35 PID 2816 wrote to memory of 3000 2816 tthbth.exe 35 PID 3000 wrote to memory of 1144 3000 9rlxlff.exe 36 PID 3000 wrote to memory of 1144 3000 9rlxlff.exe 36 PID 3000 wrote to memory of 1144 3000 9rlxlff.exe 36 PID 3000 wrote to memory of 1144 3000 9rlxlff.exe 36 PID 1144 wrote to memory of 2972 1144 64862.exe 37 PID 1144 wrote to memory of 2972 1144 64862.exe 37 PID 1144 wrote to memory of 2972 1144 64862.exe 37 PID 1144 wrote to memory of 2972 1144 64862.exe 37 PID 2972 wrote to memory of 2476 2972 9jjvp.exe 38 PID 2972 wrote to memory of 2476 2972 9jjvp.exe 38 PID 2972 wrote to memory of 2476 2972 9jjvp.exe 38 PID 2972 wrote to memory of 2476 2972 9jjvp.exe 38 PID 2476 wrote to memory of 2860 2476 ffxfrrx.exe 39 PID 2476 wrote to memory of 2860 2476 ffxfrrx.exe 39 PID 2476 wrote to memory of 2860 2476 ffxfrrx.exe 39 PID 2476 wrote to memory of 2860 2476 ffxfrrx.exe 39 PID 2860 wrote to memory of 2760 2860 rlxfllx.exe 40 PID 2860 wrote to memory of 2760 2860 rlxfllx.exe 40 PID 2860 wrote to memory of 2760 2860 rlxfllx.exe 40 PID 2860 wrote to memory of 2760 2860 rlxfllx.exe 40 PID 2760 wrote to memory of 2740 2760 042468.exe 41 PID 2760 wrote to memory of 2740 2760 042468.exe 41 PID 2760 wrote to memory of 2740 2760 042468.exe 41 PID 2760 wrote to memory of 2740 2760 042468.exe 41 PID 2740 wrote to memory of 2748 2740 vpdjp.exe 42 PID 2740 wrote to memory of 2748 2740 vpdjp.exe 42 PID 2740 wrote to memory of 2748 2740 vpdjp.exe 42 PID 2740 wrote to memory of 2748 2740 vpdjp.exe 42 PID 2748 wrote to memory of 1164 2748 9pjdp.exe 43 PID 2748 wrote to memory of 1164 2748 9pjdp.exe 43 PID 2748 wrote to memory of 1164 2748 9pjdp.exe 43 PID 2748 wrote to memory of 1164 2748 9pjdp.exe 43 PID 1164 wrote to memory of 452 1164 048426.exe 44 PID 1164 wrote to memory of 452 1164 048426.exe 44 PID 1164 wrote to memory of 452 1164 048426.exe 44 PID 1164 wrote to memory of 452 1164 048426.exe 44 PID 452 wrote to memory of 3020 452 c868624.exe 45 PID 452 wrote to memory of 3020 452 c868624.exe 45 PID 452 wrote to memory of 3020 452 c868624.exe 45 PID 452 wrote to memory of 3020 452 c868624.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe"C:\Users\Admin\AppData\Local\Temp\9d6f2c3e45bb0c5a0cc82507dba847435519628e8c5dfdf6f243a88240371c0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7ththt.exec:\7ththt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\008462.exec:\008462.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\a0402.exec:\a0402.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\pdpdp.exec:\pdpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\tthbth.exec:\tthbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\9rlxlff.exec:\9rlxlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\64862.exec:\64862.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\9jjvp.exec:\9jjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\ffxfrrx.exec:\ffxfrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rlxfllx.exec:\rlxfllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\042468.exec:\042468.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vpdjp.exec:\vpdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\9pjdp.exec:\9pjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\048426.exec:\048426.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\c868624.exec:\c868624.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\flflxxl.exec:\flflxxl.exe17⤵
- Executes dropped EXE
PID:3020 -
\??\c:\8262408.exec:\8262408.exe18⤵
- Executes dropped EXE
PID:2900 -
\??\c:\6084246.exec:\6084246.exe19⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3flxxxl.exec:\3flxxxl.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\26408.exec:\26408.exe21⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ttthtn.exec:\ttthtn.exe22⤵
- Executes dropped EXE
PID:544 -
\??\c:\w60246.exec:\w60246.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ttnntn.exec:\ttnntn.exe24⤵
- Executes dropped EXE
PID:884 -
\??\c:\6028042.exec:\6028042.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\0486664.exec:\0486664.exe26⤵
- Executes dropped EXE
PID:2364 -
\??\c:\642088.exec:\642088.exe27⤵
- Executes dropped EXE
PID:1300 -
\??\c:\826244.exec:\826244.exe28⤵
- Executes dropped EXE
PID:976 -
\??\c:\1hbntb.exec:\1hbntb.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jpvvvj.exec:\jpvvvj.exe30⤵
- Executes dropped EXE
PID:1748 -
\??\c:\26408.exec:\26408.exe31⤵
- Executes dropped EXE
PID:1008 -
\??\c:\82046.exec:\82046.exe32⤵
- Executes dropped EXE
PID:1812 -
\??\c:\08066.exec:\08066.exe33⤵
- Executes dropped EXE
PID:2532 -
\??\c:\482466.exec:\482466.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:288 -
\??\c:\2680846.exec:\2680846.exe35⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5dvjp.exec:\5dvjp.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\8662006.exec:\8662006.exe37⤵
- Executes dropped EXE
PID:1804 -
\??\c:\2064446.exec:\2064446.exe38⤵
- Executes dropped EXE
PID:2116 -
\??\c:\824400.exec:\824400.exe39⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rfrrrll.exec:\rfrrrll.exe40⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xlxfrrr.exec:\xlxfrrr.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ppdpp.exec:\ppdpp.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7hnhbb.exec:\7hnhbb.exe43⤵
- Executes dropped EXE
PID:2316 -
\??\c:\684444.exec:\684444.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rlffllr.exec:\rlffllr.exe45⤵
- Executes dropped EXE
PID:2328 -
\??\c:\frfflfl.exec:\frfflfl.exe46⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vvvdp.exec:\vvvdp.exe47⤵
- Executes dropped EXE
PID:2944 -
\??\c:\820288.exec:\820288.exe48⤵
- Executes dropped EXE
PID:2984 -
\??\c:\2688040.exec:\2688040.exe49⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lxfrrxf.exec:\lxfrrxf.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9vjpd.exec:\9vjpd.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jdppj.exec:\jdppj.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9vddp.exec:\9vddp.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\dvvjv.exec:\dvvjv.exe54⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9xrfflr.exec:\9xrfflr.exe55⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dvjpv.exec:\dvjpv.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\0206268.exec:\0206268.exe57⤵
- Executes dropped EXE
PID:1304 -
\??\c:\q42884.exec:\q42884.exe58⤵
- Executes dropped EXE
PID:824 -
\??\c:\9nthbb.exec:\9nthbb.exe59⤵
- Executes dropped EXE
PID:580 -
\??\c:\nbnttt.exec:\nbnttt.exe60⤵
- Executes dropped EXE
PID:1652 -
\??\c:\c084628.exec:\c084628.exe61⤵
- Executes dropped EXE
PID:928 -
\??\c:\1nnnnn.exec:\1nnnnn.exe62⤵
- Executes dropped EXE
PID:1664 -
\??\c:\86888.exec:\86888.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hthbbt.exec:\hthbbt.exe64⤵
- Executes dropped EXE
PID:2880 -
\??\c:\u828620.exec:\u828620.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\k42222.exec:\k42222.exe66⤵PID:3040
-
\??\c:\i824224.exec:\i824224.exe67⤵PID:2004
-
\??\c:\86488.exec:\86488.exe68⤵PID:2644
-
\??\c:\c800668.exec:\c800668.exe69⤵PID:1972
-
\??\c:\rflrrlx.exec:\rflrrlx.exe70⤵PID:1980
-
\??\c:\ppvvj.exec:\ppvvj.exe71⤵PID:2584
-
\??\c:\a2888.exec:\a2888.exe72⤵PID:884
-
\??\c:\824622.exec:\824622.exe73⤵PID:2356
-
\??\c:\tntthh.exec:\tntthh.exe74⤵PID:1624
-
\??\c:\48068.exec:\48068.exe75⤵PID:2364
-
\??\c:\64062.exec:\64062.exe76⤵PID:2524
-
\??\c:\jvdpd.exec:\jvdpd.exe77⤵PID:2548
-
\??\c:\9hnnhn.exec:\9hnnhn.exe78⤵PID:2268
-
\??\c:\468226.exec:\468226.exe79⤵PID:1680
-
\??\c:\420066.exec:\420066.exe80⤵PID:2072
-
\??\c:\c404884.exec:\c404884.exe81⤵PID:2236
-
\??\c:\826844.exec:\826844.exe82⤵PID:1812
-
\??\c:\60268.exec:\60268.exe83⤵PID:2536
-
\??\c:\btntbh.exec:\btntbh.exe84⤵PID:2280
-
\??\c:\frlrrxr.exec:\frlrrxr.exe85⤵PID:1524
-
\??\c:\m0886.exec:\m0886.exe86⤵PID:1800
-
\??\c:\86024.exec:\86024.exe87⤵PID:1316
-
\??\c:\btntht.exec:\btntht.exe88⤵PID:1036
-
\??\c:\7jpvd.exec:\7jpvd.exe89⤵PID:1604
-
\??\c:\bntnbb.exec:\bntnbb.exe90⤵PID:632
-
\??\c:\886806.exec:\886806.exe91⤵PID:2124
-
\??\c:\260062.exec:\260062.exe92⤵PID:1720
-
\??\c:\0268880.exec:\0268880.exe93⤵PID:2876
-
\??\c:\0484680.exec:\0484680.exe94⤵PID:2260
-
\??\c:\2022266.exec:\2022266.exe95⤵PID:2992
-
\??\c:\nhtntt.exec:\nhtntt.exe96⤵PID:2836
-
\??\c:\xrllrrx.exec:\xrllrrx.exe97⤵PID:3004
-
\??\c:\q00688.exec:\q00688.exe98⤵PID:2956
-
\??\c:\9nnnbh.exec:\9nnnbh.exe99⤵PID:2696
-
\??\c:\ppdjp.exec:\ppdjp.exe100⤵PID:2972
-
\??\c:\btttbh.exec:\btttbh.exe101⤵PID:2800
-
\??\c:\g2400.exec:\g2400.exe102⤵PID:2936
-
\??\c:\6440622.exec:\6440622.exe103⤵PID:2684
-
\??\c:\082288.exec:\082288.exe104⤵PID:2528
-
\??\c:\1thntt.exec:\1thntt.exe105⤵PID:2472
-
\??\c:\3thhnh.exec:\3thhnh.exe106⤵PID:592
-
\??\c:\080628.exec:\080628.exe107⤵PID:1692
-
\??\c:\thntbt.exec:\thntbt.exe108⤵PID:2920
-
\??\c:\1bnnbh.exec:\1bnnbh.exe109⤵PID:488
-
\??\c:\424844.exec:\424844.exe110⤵PID:1512
-
\??\c:\dpvpd.exec:\dpvpd.exe111⤵PID:2788
-
\??\c:\s2022.exec:\s2022.exe112⤵PID:2932
-
\??\c:\m4666.exec:\m4666.exe113⤵PID:2900
-
\??\c:\602244.exec:\602244.exe114⤵PID:3016
-
\??\c:\5pvjj.exec:\5pvjj.exe115⤵PID:2880
-
\??\c:\80224.exec:\80224.exe116⤵PID:2168
-
\??\c:\jdvvv.exec:\jdvvv.exe117⤵PID:1272
-
\??\c:\httthn.exec:\httthn.exe118⤵PID:2100
-
\??\c:\vjddd.exec:\vjddd.exe119⤵PID:2340
-
\??\c:\0880040.exec:\0880040.exe120⤵PID:2080
-
\??\c:\0240028.exec:\0240028.exe121⤵PID:448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-