Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe
-
Size
455KB
-
MD5
daedd621153c201278bd0521a3200a30
-
SHA1
e6302faec0fb431a05944169299009f8deda73ab
-
SHA256
1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ec
-
SHA512
6132bb2bbe9cca884ab17ce538d27bc408edf1ea3da32db894fbd805bbe47e4b3f07f52238eda385122d970da7f5b12cc0d9001bb635defc3d9468c8763995e1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2828-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-291-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1752-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-471-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1564-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-572-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1720-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-639-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1920-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-1023-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/700-1130-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 vpddp.exe 1832 ffrllfl.exe 2928 lfrrxxf.exe 2140 nnbntt.exe 1956 pjppv.exe 2996 nhnntn.exe 2700 ddppv.exe 2648 bntttt.exe 2756 9thbhb.exe 2520 7xrxllx.exe 2540 tnbhnt.exe 2544 1pddd.exe 2000 llxxffl.exe 632 pdppp.exe 2308 xrxxffr.exe 2420 htnnnn.exe 2464 ddvpj.exe 808 tnhhtt.exe 1780 ppjdj.exe 1560 flflxxx.exe 1628 nnhhnt.exe 1892 1ppjj.exe 2104 fxfxxrx.exe 1124 pjjpp.exe 1132 7dpdj.exe 3064 thnbbh.exe 1540 jdvdp.exe 3060 tnbbhh.exe 1092 djddd.exe 2404 5nbbnt.exe 1752 3ttthb.exe 2344 vjvvp.exe 3028 hnbttt.exe 2384 bhtbnt.exe 1720 vvddv.exe 2840 lfxxffl.exe 2876 fxlflll.exe 2948 tnnhtt.exe 2096 pjvjj.exe 2128 5xlfxxx.exe 1980 xlrrflr.exe 2424 3btnnn.exe 2704 vdppv.exe 2736 fxffrrx.exe 2696 5frrlll.exe 1920 9nhntn.exe 2592 pjvpd.exe 2532 xlfflfl.exe 2492 7rllrrl.exe 2564 thtnnh.exe 2544 5vvvv.exe 2904 dpppp.exe 2252 7lxxlll.exe 632 lflxfff.exe 2288 htbbhb.exe 1440 dpvpv.exe 1284 vjvpp.exe 1260 9llfxxr.exe 1992 rlrxxff.exe 1280 tthhnn.exe 2400 pvjdj.exe 1560 lrrffrr.exe 1692 lxfxrll.exe 2892 1httnn.exe -
resource yara_rule behavioral1/memory/2828-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-1169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-1244-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rffrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2212 2828 1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe 28 PID 2828 wrote to memory of 2212 2828 1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe 28 PID 2828 wrote to memory of 2212 2828 1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe 28 PID 2828 wrote to memory of 2212 2828 1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe 28 PID 2212 wrote to memory of 1832 2212 vpddp.exe 29 PID 2212 wrote to memory of 1832 2212 vpddp.exe 29 PID 2212 wrote to memory of 1832 2212 vpddp.exe 29 PID 2212 wrote to memory of 1832 2212 vpddp.exe 29 PID 1832 wrote to memory of 2928 1832 ffrllfl.exe 30 PID 1832 wrote to memory of 2928 1832 ffrllfl.exe 30 PID 1832 wrote to memory of 2928 1832 ffrllfl.exe 30 PID 1832 wrote to memory of 2928 1832 ffrllfl.exe 30 PID 2928 wrote to memory of 2140 2928 lfrrxxf.exe 31 PID 2928 wrote to memory of 2140 2928 lfrrxxf.exe 31 PID 2928 wrote to memory of 2140 2928 lfrrxxf.exe 31 PID 2928 wrote to memory of 2140 2928 lfrrxxf.exe 31 PID 2140 wrote to memory of 1956 2140 nnbntt.exe 32 PID 2140 wrote to memory of 1956 2140 nnbntt.exe 32 PID 2140 wrote to memory of 1956 2140 nnbntt.exe 32 PID 2140 wrote to memory of 1956 2140 nnbntt.exe 32 PID 1956 wrote to memory of 2996 1956 pjppv.exe 33 PID 1956 wrote to memory of 2996 1956 pjppv.exe 33 PID 1956 wrote to memory of 2996 1956 pjppv.exe 33 PID 1956 wrote to memory of 2996 1956 pjppv.exe 33 PID 2996 wrote to memory of 2700 2996 nhnntn.exe 34 PID 2996 wrote to memory of 2700 2996 nhnntn.exe 34 PID 2996 wrote to memory of 2700 2996 nhnntn.exe 34 PID 2996 wrote to memory of 2700 2996 nhnntn.exe 34 PID 2700 wrote to memory of 2648 2700 ddppv.exe 35 PID 2700 wrote to memory of 2648 2700 ddppv.exe 35 PID 2700 wrote to memory of 2648 2700 ddppv.exe 35 PID 2700 wrote to memory of 2648 2700 ddppv.exe 35 PID 2648 wrote to memory of 2756 2648 bntttt.exe 36 PID 2648 wrote to memory of 2756 2648 bntttt.exe 36 PID 2648 wrote to memory of 2756 2648 bntttt.exe 36 PID 2648 wrote to memory of 2756 2648 bntttt.exe 36 PID 2756 wrote to memory of 2520 2756 9thbhb.exe 37 PID 2756 wrote to memory of 2520 2756 9thbhb.exe 37 PID 2756 wrote to memory of 2520 2756 9thbhb.exe 37 PID 2756 wrote to memory of 2520 2756 9thbhb.exe 37 PID 2520 wrote to memory of 2540 2520 7xrxllx.exe 38 PID 2520 wrote to memory of 2540 2520 7xrxllx.exe 38 PID 2520 wrote to memory of 2540 2520 7xrxllx.exe 38 PID 2520 wrote to memory of 2540 2520 7xrxllx.exe 38 PID 2540 wrote to memory of 2544 2540 tnbhnt.exe 39 PID 2540 wrote to memory of 2544 2540 tnbhnt.exe 39 PID 2540 wrote to memory of 2544 2540 tnbhnt.exe 39 PID 2540 wrote to memory of 2544 2540 tnbhnt.exe 39 PID 2544 wrote to memory of 2000 2544 1pddd.exe 40 PID 2544 wrote to memory of 2000 2544 1pddd.exe 40 PID 2544 wrote to memory of 2000 2544 1pddd.exe 40 PID 2544 wrote to memory of 2000 2544 1pddd.exe 40 PID 2000 wrote to memory of 632 2000 llxxffl.exe 41 PID 2000 wrote to memory of 632 2000 llxxffl.exe 41 PID 2000 wrote to memory of 632 2000 llxxffl.exe 41 PID 2000 wrote to memory of 632 2000 llxxffl.exe 41 PID 632 wrote to memory of 2308 632 pdppp.exe 42 PID 632 wrote to memory of 2308 632 pdppp.exe 42 PID 632 wrote to memory of 2308 632 pdppp.exe 42 PID 632 wrote to memory of 2308 632 pdppp.exe 42 PID 2308 wrote to memory of 2420 2308 xrxxffr.exe 43 PID 2308 wrote to memory of 2420 2308 xrxxffr.exe 43 PID 2308 wrote to memory of 2420 2308 xrxxffr.exe 43 PID 2308 wrote to memory of 2420 2308 xrxxffr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe"C:\Users\Admin\AppData\Local\Temp\1ed8adf4db02957c309ed86f2c24057636e2f123c5651b28556165eb7a42e9ecN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vpddp.exec:\vpddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ffrllfl.exec:\ffrllfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\nnbntt.exec:\nnbntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pjppv.exec:\pjppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\nhnntn.exec:\nhnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\ddppv.exec:\ddppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bntttt.exec:\bntttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9thbhb.exec:\9thbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7xrxllx.exec:\7xrxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\tnbhnt.exec:\tnbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\1pddd.exec:\1pddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\llxxffl.exec:\llxxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\pdppp.exec:\pdppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\xrxxffr.exec:\xrxxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\htnnnn.exec:\htnnnn.exe17⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ddvpj.exec:\ddvpj.exe18⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tnhhtt.exec:\tnhhtt.exe19⤵
- Executes dropped EXE
PID:808 -
\??\c:\ppjdj.exec:\ppjdj.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\flflxxx.exec:\flflxxx.exe21⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nnhhnt.exec:\nnhhnt.exe22⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1ppjj.exec:\1ppjj.exe23⤵
- Executes dropped EXE
PID:1892 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe24⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pjjpp.exec:\pjjpp.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\7dpdj.exec:\7dpdj.exe26⤵
- Executes dropped EXE
PID:1132 -
\??\c:\thnbbh.exec:\thnbbh.exe27⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jdvdp.exec:\jdvdp.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tnbbhh.exec:\tnbbhh.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\djddd.exec:\djddd.exe30⤵
- Executes dropped EXE
PID:1092 -
\??\c:\5nbbnt.exec:\5nbbnt.exe31⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3ttthb.exec:\3ttthb.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vjvvp.exec:\vjvvp.exe33⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hnbttt.exec:\hnbttt.exe34⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bhtbnt.exec:\bhtbnt.exe35⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvddv.exec:\vvddv.exe36⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfxxffl.exec:\lfxxffl.exe37⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fxlflll.exec:\fxlflll.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnnhtt.exec:\tnnhtt.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjvjj.exec:\pjvjj.exe40⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5xlfxxx.exec:\5xlfxxx.exe41⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xlrrflr.exec:\xlrrflr.exe42⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3btnnn.exec:\3btnnn.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vdppv.exec:\vdppv.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxffrrx.exec:\fxffrrx.exe45⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5frrlll.exec:\5frrlll.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9nhntn.exec:\9nhntn.exe47⤵
- Executes dropped EXE
PID:1920 -
\??\c:\pjvpd.exec:\pjvpd.exe48⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xlfflfl.exec:\xlfflfl.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7rllrrl.exec:\7rllrrl.exe50⤵
- Executes dropped EXE
PID:2492 -
\??\c:\thtnnh.exec:\thtnnh.exe51⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5vvvv.exec:\5vvvv.exe52⤵
- Executes dropped EXE
PID:2544 -
\??\c:\dpppp.exec:\dpppp.exe53⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7lxxlll.exec:\7lxxlll.exe54⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lflxfff.exec:\lflxfff.exe55⤵
- Executes dropped EXE
PID:632 -
\??\c:\htbbhb.exec:\htbbhb.exe56⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dpvpv.exec:\dpvpv.exe57⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vjvpp.exec:\vjvpp.exe58⤵
- Executes dropped EXE
PID:1284 -
\??\c:\9llfxxr.exec:\9llfxxr.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\rlrxxff.exec:\rlrxxff.exe60⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tthhnn.exec:\tthhnn.exe61⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pvjdj.exec:\pvjdj.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lrrffrr.exec:\lrrffrr.exe63⤵
- Executes dropped EXE
PID:1560 -
\??\c:\lxfxrll.exec:\lxfxrll.exe64⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1httnn.exec:\1httnn.exe65⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dpvjp.exec:\dpvjp.exe66⤵PID:2804
-
\??\c:\vpddv.exec:\vpddv.exe67⤵PID:1900
-
\??\c:\lxffxxx.exec:\lxffxxx.exe68⤵PID:1880
-
\??\c:\7nhhhb.exec:\7nhhhb.exe69⤵PID:804
-
\??\c:\tnttbt.exec:\tnttbt.exe70⤵PID:1144
-
\??\c:\5vvvv.exec:\5vvvv.exe71⤵PID:1788
-
\??\c:\1ffrlfx.exec:\1ffrlfx.exe72⤵PID:1936
-
\??\c:\lxxxffr.exec:\lxxxffr.exe73⤵PID:1564
-
\??\c:\9nnhnn.exec:\9nnhnn.exe74⤵PID:1728
-
\??\c:\pdjdj.exec:\pdjdj.exe75⤵PID:1772
-
\??\c:\vpvpj.exec:\vpvpj.exe76⤵PID:3032
-
\??\c:\xrfrlff.exec:\xrfrlff.exe77⤵PID:3000
-
\??\c:\frflrlr.exec:\frflrlr.exe78⤵PID:1752
-
\??\c:\ntbtbt.exec:\ntbtbt.exe79⤵PID:1912
-
\??\c:\vjppp.exec:\vjppp.exe80⤵PID:1732
-
\??\c:\vjvvv.exec:\vjvvv.exe81⤵PID:1696
-
\??\c:\lfxxrrx.exec:\lfxxrrx.exe82⤵PID:1904
-
\??\c:\bntnnh.exec:\bntnnh.exe83⤵PID:1720
-
\??\c:\bnhbhh.exec:\bnhbhh.exe84⤵PID:2896
-
\??\c:\3djjp.exec:\3djjp.exe85⤵PID:2876
-
\??\c:\frxxxxf.exec:\frxxxxf.exe86⤵PID:2948
-
\??\c:\5lrlfff.exec:\5lrlfff.exe87⤵PID:2936
-
\??\c:\ntnnbt.exec:\ntnnbt.exe88⤵PID:2128
-
\??\c:\dpppj.exec:\dpppj.exe89⤵PID:1980
-
\??\c:\vpvpd.exec:\vpvpd.exe90⤵PID:2996
-
\??\c:\xrrflfx.exec:\xrrflfx.exe91⤵PID:2704
-
\??\c:\hbbhnn.exec:\hbbhnn.exe92⤵PID:2616
-
\??\c:\7hhhbh.exec:\7hhhbh.exe93⤵PID:3004
-
\??\c:\ppdvd.exec:\ppdvd.exe94⤵PID:1920
-
\??\c:\rfrllff.exec:\rfrllff.exe95⤵PID:2580
-
\??\c:\3nnntt.exec:\3nnntt.exe96⤵PID:2532
-
\??\c:\thtnnh.exec:\thtnnh.exe97⤵PID:2524
-
\??\c:\jvjpp.exec:\jvjpp.exe98⤵PID:2548
-
\??\c:\lrlxxrl.exec:\lrlxxrl.exe99⤵PID:2920
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe100⤵PID:1148
-
\??\c:\htbtnh.exec:\htbtnh.exe101⤵PID:856
-
\??\c:\1hnbhh.exec:\1hnbhh.exe102⤵PID:1804
-
\??\c:\jdjdv.exec:\jdjdv.exe103⤵
- System Location Discovery: System Language Discovery
PID:296 -
\??\c:\xlrffff.exec:\xlrffff.exe104⤵PID:540
-
\??\c:\9thhnh.exec:\9thhnh.exe105⤵
- System Location Discovery: System Language Discovery
PID:1056 -
\??\c:\bhnhnh.exec:\bhnhnh.exe106⤵PID:2244
-
\??\c:\vpdvj.exec:\vpdvj.exe107⤵PID:2248
-
\??\c:\dppjj.exec:\dppjj.exe108⤵PID:864
-
\??\c:\rfxrrll.exec:\rfxrrll.exe109⤵PID:1372
-
\??\c:\7hbtbt.exec:\7hbtbt.exe110⤵PID:1676
-
\??\c:\bthnnb.exec:\bthnnb.exe111⤵PID:2256
-
\??\c:\vjddp.exec:\vjddp.exe112⤵PID:2012
-
\??\c:\5xxfxrx.exec:\5xxfxrx.exe113⤵PID:2724
-
\??\c:\5lrlrrl.exec:\5lrlrrl.exe114⤵PID:2196
-
\??\c:\3hthbb.exec:\3hthbb.exe115⤵PID:2552
-
\??\c:\jpvvd.exec:\jpvvd.exe116⤵PID:2008
-
\??\c:\jpvpp.exec:\jpvpp.exe117⤵PID:700
-
\??\c:\frffxxf.exec:\frffxxf.exe118⤵PID:1384
-
\??\c:\1bhhhh.exec:\1bhhhh.exe119⤵PID:1948
-
\??\c:\hnbnbb.exec:\hnbnbb.exe120⤵PID:876
-
\??\c:\jvddv.exec:\jvddv.exe121⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-