Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe
-
Size
456KB
-
MD5
176eced5095c86332092a002acc2418e
-
SHA1
8b9b9d78a68c148f802f833ef3458b658e973773
-
SHA256
9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044
-
SHA512
115c0ae096f7bb97e643f7bc51f467880c9b271cf2f0a2019e142cae3c4c69657210f1bfebba7b69da4f940cfe720503684c274890d5823827ecdbd9af9d5113
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2460-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-26-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/924-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/652-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-149-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1980-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1980-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-168-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2168-173-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2392-178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2268-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-295-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-646-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-720-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1152-856-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-948-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-952-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2080-956-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-1067-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-1130-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2788-1261-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/780-1368-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 540 3rrxrxr.exe 2324 tntbhh.exe 924 jdpdj.exe 2680 5bthnb.exe 2984 pjvdp.exe 2764 tnnthn.exe 2144 thnbbn.exe 2720 rrlxxff.exe 2568 jpjdj.exe 652 pvppd.exe 628 djdvp.exe 2732 7flrlxr.exe 2020 dvpvd.exe 2880 1fxlrxr.exe 2100 3hhbbt.exe 1612 9dpvp.exe 1980 rlflrrx.exe 2168 ntnnbt.exe 2392 ppdpj.exe 2268 5tnbnn.exe 548 5flrfll.exe 1692 hbnnhb.exe 1636 xfxxlrr.exe 2296 lxrxlrf.exe 660 9tbnth.exe 1788 rxxlxxr.exe 1320 nttbtb.exe 2500 7lxxflf.exe 2444 bbtbtb.exe 1944 5jvvp.exe 996 hbthtb.exe 2516 ffrllrr.exe 2260 lrfxflx.exe 864 bnbntt.exe 484 3dvdp.exe 828 xrffffr.exe 1148 bhbnbh.exe 2696 nhbhbh.exe 2840 vvppd.exe 2972 3rllflx.exe 2008 fxxflrl.exe 2712 7ttbnn.exe 2588 7jpvj.exe 2820 rlflfrx.exe 2720 fxllrlx.exe 2220 3hthhn.exe 2248 vvdpp.exe 788 ddpvj.exe 628 rxrrlrl.exe 1252 thhntt.exe 2796 9vvjv.exe 2452 5vjdj.exe 2800 rxrrrxf.exe 2900 nhthbh.exe 564 jjdjv.exe 3040 7jdpj.exe 2936 xxxfrxf.exe 2916 hhtbnn.exe 2064 btbnbh.exe 1240 5pdjv.exe 1936 rrlxllr.exe 1020 bttbhn.exe 1084 nntnbb.exe 1608 pjdvj.exe -
resource yara_rule behavioral1/memory/2460-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-295-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1148-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-646-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3040-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-989-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-1118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-1261-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/3040-1313-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 540 2460 9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe 31 PID 2460 wrote to memory of 540 2460 9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe 31 PID 2460 wrote to memory of 540 2460 9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe 31 PID 2460 wrote to memory of 540 2460 9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe 31 PID 540 wrote to memory of 2324 540 3rrxrxr.exe 32 PID 540 wrote to memory of 2324 540 3rrxrxr.exe 32 PID 540 wrote to memory of 2324 540 3rrxrxr.exe 32 PID 540 wrote to memory of 2324 540 3rrxrxr.exe 32 PID 2324 wrote to memory of 924 2324 tntbhh.exe 33 PID 2324 wrote to memory of 924 2324 tntbhh.exe 33 PID 2324 wrote to memory of 924 2324 tntbhh.exe 33 PID 2324 wrote to memory of 924 2324 tntbhh.exe 33 PID 924 wrote to memory of 2680 924 jdpdj.exe 34 PID 924 wrote to memory of 2680 924 jdpdj.exe 34 PID 924 wrote to memory of 2680 924 jdpdj.exe 34 PID 924 wrote to memory of 2680 924 jdpdj.exe 34 PID 2680 wrote to memory of 2984 2680 5bthnb.exe 35 PID 2680 wrote to memory of 2984 2680 5bthnb.exe 35 PID 2680 wrote to memory of 2984 2680 5bthnb.exe 35 PID 2680 wrote to memory of 2984 2680 5bthnb.exe 35 PID 2984 wrote to memory of 2764 2984 pjvdp.exe 36 PID 2984 wrote to memory of 2764 2984 pjvdp.exe 36 PID 2984 wrote to memory of 2764 2984 pjvdp.exe 36 PID 2984 wrote to memory of 2764 2984 pjvdp.exe 36 PID 2764 wrote to memory of 2144 2764 tnnthn.exe 37 PID 2764 wrote to memory of 2144 2764 tnnthn.exe 37 PID 2764 wrote to memory of 2144 2764 tnnthn.exe 37 PID 2764 wrote to memory of 2144 2764 tnnthn.exe 37 PID 2144 wrote to memory of 2720 2144 thnbbn.exe 38 PID 2144 wrote to memory of 2720 2144 thnbbn.exe 38 PID 2144 wrote to memory of 2720 2144 thnbbn.exe 38 PID 2144 wrote to memory of 2720 2144 thnbbn.exe 38 PID 2720 wrote to memory of 2568 2720 rrlxxff.exe 39 PID 2720 wrote to memory of 2568 2720 rrlxxff.exe 39 PID 2720 wrote to memory of 2568 2720 rrlxxff.exe 39 PID 2720 wrote to memory of 2568 2720 rrlxxff.exe 39 PID 2568 wrote to memory of 652 2568 jpjdj.exe 40 PID 2568 wrote to memory of 652 2568 jpjdj.exe 40 PID 2568 wrote to memory of 652 2568 jpjdj.exe 40 PID 2568 wrote to memory of 652 2568 jpjdj.exe 40 PID 652 wrote to memory of 628 652 pvppd.exe 41 PID 652 wrote to memory of 628 652 pvppd.exe 41 PID 652 wrote to memory of 628 652 pvppd.exe 41 PID 652 wrote to memory of 628 652 pvppd.exe 41 PID 628 wrote to memory of 2732 628 djdvp.exe 42 PID 628 wrote to memory of 2732 628 djdvp.exe 42 PID 628 wrote to memory of 2732 628 djdvp.exe 42 PID 628 wrote to memory of 2732 628 djdvp.exe 42 PID 2732 wrote to memory of 2020 2732 7flrlxr.exe 43 PID 2732 wrote to memory of 2020 2732 7flrlxr.exe 43 PID 2732 wrote to memory of 2020 2732 7flrlxr.exe 43 PID 2732 wrote to memory of 2020 2732 7flrlxr.exe 43 PID 2020 wrote to memory of 2880 2020 dvpvd.exe 44 PID 2020 wrote to memory of 2880 2020 dvpvd.exe 44 PID 2020 wrote to memory of 2880 2020 dvpvd.exe 44 PID 2020 wrote to memory of 2880 2020 dvpvd.exe 44 PID 2880 wrote to memory of 2100 2880 1fxlrxr.exe 45 PID 2880 wrote to memory of 2100 2880 1fxlrxr.exe 45 PID 2880 wrote to memory of 2100 2880 1fxlrxr.exe 45 PID 2880 wrote to memory of 2100 2880 1fxlrxr.exe 45 PID 2100 wrote to memory of 1612 2100 3hhbbt.exe 46 PID 2100 wrote to memory of 1612 2100 3hhbbt.exe 46 PID 2100 wrote to memory of 1612 2100 3hhbbt.exe 46 PID 2100 wrote to memory of 1612 2100 3hhbbt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe"C:\Users\Admin\AppData\Local\Temp\9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\3rrxrxr.exec:\3rrxrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\tntbhh.exec:\tntbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jdpdj.exec:\jdpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\5bthnb.exec:\5bthnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pjvdp.exec:\pjvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tnnthn.exec:\tnnthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\thnbbn.exec:\thnbbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\rrlxxff.exec:\rrlxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jpjdj.exec:\jpjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\pvppd.exec:\pvppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\djdvp.exec:\djdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\7flrlxr.exec:\7flrlxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dvpvd.exec:\dvpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1fxlrxr.exec:\1fxlrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\3hhbbt.exec:\3hhbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\9dpvp.exec:\9dpvp.exe17⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rlflrrx.exec:\rlflrrx.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ntnnbt.exec:\ntnnbt.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ppdpj.exec:\ppdpj.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5tnbnn.exec:\5tnbnn.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5flrfll.exec:\5flrfll.exe22⤵
- Executes dropped EXE
PID:548 -
\??\c:\hbnnhb.exec:\hbnnhb.exe23⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xfxxlrr.exec:\xfxxlrr.exe24⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lxrxlrf.exec:\lxrxlrf.exe25⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9tbnth.exec:\9tbnth.exe26⤵
- Executes dropped EXE
PID:660 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nttbtb.exec:\nttbtb.exe28⤵
- Executes dropped EXE
PID:1320 -
\??\c:\7lxxflf.exec:\7lxxflf.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bbtbtb.exec:\bbtbtb.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5jvvp.exec:\5jvvp.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hbthtb.exec:\hbthtb.exe32⤵
- Executes dropped EXE
PID:996 -
\??\c:\ffrllrr.exec:\ffrllrr.exe33⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lrfxflx.exec:\lrfxflx.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bnbntt.exec:\bnbntt.exe35⤵
- Executes dropped EXE
PID:864 -
\??\c:\3dvdp.exec:\3dvdp.exe36⤵
- Executes dropped EXE
PID:484 -
\??\c:\xrffffr.exec:\xrffffr.exe37⤵
- Executes dropped EXE
PID:828 -
\??\c:\bhbnbh.exec:\bhbnbh.exe38⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nhbhbh.exec:\nhbhbh.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vvppd.exec:\vvppd.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3rllflx.exec:\3rllflx.exe41⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fxxflrl.exec:\fxxflrl.exe42⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7ttbnn.exec:\7ttbnn.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7jpvj.exec:\7jpvj.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlflfrx.exec:\rlflfrx.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxllrlx.exec:\fxllrlx.exe46⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3hthhn.exec:\3hthhn.exe47⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vvdpp.exec:\vvdpp.exe48⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ddpvj.exec:\ddpvj.exe49⤵
- Executes dropped EXE
PID:788 -
\??\c:\rxrrlrl.exec:\rxrrlrl.exe50⤵
- Executes dropped EXE
PID:628 -
\??\c:\thhntt.exec:\thhntt.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\9vvjv.exec:\9vvjv.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5vjdj.exec:\5vjdj.exe53⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rxrrrxf.exec:\rxrrrxf.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhthbh.exec:\nhthbh.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jjdjv.exec:\jjdjv.exe56⤵
- Executes dropped EXE
PID:564 -
\??\c:\7jdpj.exec:\7jdpj.exe57⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xxxfrxf.exec:\xxxfrxf.exe58⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhtbnn.exec:\hhtbnn.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btbnbh.exec:\btbnbh.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5pdjv.exec:\5pdjv.exe61⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rrlxllr.exec:\rrlxllr.exe62⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bttbhn.exec:\bttbhn.exe63⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nntnbb.exec:\nntnbb.exe64⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pjdvj.exec:\pjdvj.exe65⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxrflrf.exec:\fxrflrf.exe66⤵PID:1060
-
\??\c:\llflxfr.exec:\llflxfr.exe67⤵PID:1092
-
\??\c:\ntnnbh.exec:\ntnnbh.exe68⤵PID:296
-
\??\c:\dvvdd.exec:\dvvdd.exe69⤵PID:560
-
\??\c:\vvjpp.exec:\vvjpp.exe70⤵PID:2740
-
\??\c:\ffxlrxx.exec:\ffxlrxx.exe71⤵PID:1224
-
\??\c:\3nhhnh.exec:\3nhhnh.exe72⤵PID:2964
-
\??\c:\vvpdj.exec:\vvpdj.exe73⤵PID:2076
-
\??\c:\7lrrlrr.exec:\7lrrlrr.exe74⤵PID:2404
-
\??\c:\lfxrxff.exec:\lfxrxff.exe75⤵PID:884
-
\??\c:\tnhhnt.exec:\tnhhnt.exe76⤵PID:1756
-
\??\c:\9vppp.exec:\9vppp.exe77⤵PID:1164
-
\??\c:\fxrfxxf.exec:\fxrfxxf.exe78⤵PID:1368
-
\??\c:\1rlrflx.exec:\1rlrflx.exe79⤵PID:2356
-
\??\c:\7ttthn.exec:\7ttthn.exe80⤵PID:2644
-
\??\c:\vvvvj.exec:\vvvvj.exe81⤵PID:2736
-
\??\c:\fxllxxx.exec:\fxllxxx.exe82⤵PID:2856
-
\??\c:\3lfxflf.exec:\3lfxflf.exe83⤵PID:2660
-
\??\c:\tbtbtt.exec:\tbtbtt.exe84⤵PID:2708
-
\??\c:\pjppj.exec:\pjppj.exe85⤵PID:2812
-
\??\c:\pdppp.exec:\pdppp.exe86⤵PID:2656
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe87⤵PID:2872
-
\??\c:\5tbhbh.exec:\5tbhbh.exe88⤵PID:1660
-
\??\c:\tthbhb.exec:\tthbhb.exe89⤵PID:2560
-
\??\c:\vpjpv.exec:\vpjpv.exe90⤵PID:2820
-
\??\c:\3rlxflx.exec:\3rlxflx.exe91⤵PID:2376
-
\??\c:\xfllrrx.exec:\xfllrrx.exe92⤵PID:652
-
\??\c:\9htbnn.exec:\9htbnn.exe93⤵PID:1408
-
\??\c:\5pdpv.exec:\5pdpv.exe94⤵PID:1708
-
\??\c:\jdvvv.exec:\jdvvv.exe95⤵PID:628
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe96⤵PID:2788
-
\??\c:\nnhhnt.exec:\nnhhnt.exe97⤵PID:2804
-
\??\c:\htnbhn.exec:\htnbhn.exe98⤵PID:2452
-
\??\c:\jppdv.exec:\jppdv.exe99⤵PID:2860
-
\??\c:\lllfflr.exec:\lllfflr.exe100⤵PID:1984
-
\??\c:\9xlxlxr.exec:\9xlxlxr.exe101⤵PID:2948
-
\??\c:\hnhnbb.exec:\hnhnbb.exe102⤵PID:3040
-
\??\c:\9jvdj.exec:\9jvdj.exe103⤵PID:2168
-
\??\c:\1jddd.exec:\1jddd.exe104⤵PID:2916
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe105⤵PID:2064
-
\??\c:\1tthnb.exec:\1tthnb.exe106⤵PID:1444
-
\??\c:\hbhhbb.exec:\hbhhbb.exe107⤵PID:1936
-
\??\c:\vdpdd.exec:\vdpdd.exe108⤵PID:1616
-
\??\c:\xrflxrf.exec:\xrflxrf.exe109⤵PID:948
-
\??\c:\lfflxfx.exec:\lfflxfx.exe110⤵PID:1608
-
\??\c:\btnthn.exec:\btnthn.exe111⤵PID:2296
-
\??\c:\djdjv.exec:\djdjv.exe112⤵PID:1664
-
\??\c:\vvpdd.exec:\vvpdd.exe113⤵PID:1672
-
\??\c:\rlffrrl.exec:\rlffrrl.exe114⤵PID:236
-
\??\c:\nnhhnb.exec:\nnhhnb.exe115⤵PID:2176
-
\??\c:\1nntbh.exec:\1nntbh.exe116⤵PID:2380
-
\??\c:\dvpjv.exec:\dvpjv.exe117⤵PID:2468
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe118⤵PID:2868
-
\??\c:\9rffffl.exec:\9rffffl.exe119⤵PID:1656
-
\??\c:\3bhttb.exec:\3bhttb.exe120⤵PID:1964
-
\??\c:\5dvpv.exec:\5dvpv.exe121⤵PID:1152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-