Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe
-
Size
455KB
-
MD5
dc1ccc0b7646ff639241be8f902519fe
-
SHA1
9b32f1c391f41af1373a3656bbbf742f0dc2f76a
-
SHA256
9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623
-
SHA512
7712b1d0c4d8a541e6c59125c4b6723c29d7c7b3ad12701f31646c97056fcd036ecdd78e4c284e0273e4355bc76e3f9f19667f9dffb8d7d2c8d127ab2ce6b916
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeow:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/3028-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-64-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2040-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-126-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2044-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-203-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2112-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-350-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-402-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1832-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1044-531-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1036-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-675-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1592-716-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-718-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/948-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-798-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 tnbhnn.exe 3048 tbtthh.exe 2656 jdpvp.exe 2852 5htnhh.exe 2732 pjvvp.exe 2616 frrxllx.exe 2584 dpvvd.exe 2040 3vjvv.exe 1896 ddvjp.exe 2360 ffllrxl.exe 1200 ddvvv.exe 1844 fxxxllf.exe 2820 thnntt.exe 2044 rlffxfl.exe 980 ppdpd.exe 2748 btnnnn.exe 2244 ffrlffr.exe 2316 xrrrxfr.exe 1452 ppdpd.exe 2196 3rxlllr.exe 2112 5vjjv.exe 1092 1frfxxl.exe 1632 jpjpj.exe 2608 3fxxlrx.exe 1560 dvjvd.exe 1724 3rrrrxl.exe 628 jdvpd.exe 2368 fxrxllf.exe 2016 pjvdp.exe 1000 lfxfllr.exe 2680 pjjvj.exe 2772 llxlxfr.exe 2812 ddvpd.exe 2672 5llrrrf.exe 2740 bttbnn.exe 2752 ddpdd.exe 2676 1frrxlf.exe 3004 lfxfrxl.exe 2732 3nnbnh.exe 2964 5pdjv.exe 1780 bhttbb.exe 656 bttbhn.exe 2096 5jvjj.exe 2132 1xxflfl.exe 2168 5ntbtb.exe 808 dddpp.exe 1832 lrxlllf.exe 1820 bbnbnb.exe 1844 vppdd.exe 2860 ffxlrxr.exe 580 hhnthn.exe 356 9vjvp.exe 2892 llxlrfr.exe 2080 hbtbnb.exe 2252 7jjjv.exe 3024 rrrrflr.exe 1628 hbntht.exe 1656 vvjvj.exe 2028 7frxxfr.exe 2112 hnbhnt.exe 860 pdpdp.exe 948 dpjpd.exe 2992 9xrrxfr.exe 2100 nbtttt.exe -
resource yara_rule behavioral1/memory/2780-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-350-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2732-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-402-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1832-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-417-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/580-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-529-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1588-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-716-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/948-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-799-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2780 3028 9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe 31 PID 3028 wrote to memory of 2780 3028 9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe 31 PID 3028 wrote to memory of 2780 3028 9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe 31 PID 3028 wrote to memory of 2780 3028 9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe 31 PID 2780 wrote to memory of 3048 2780 tnbhnn.exe 32 PID 2780 wrote to memory of 3048 2780 tnbhnn.exe 32 PID 2780 wrote to memory of 3048 2780 tnbhnn.exe 32 PID 2780 wrote to memory of 3048 2780 tnbhnn.exe 32 PID 3048 wrote to memory of 2656 3048 tbtthh.exe 33 PID 3048 wrote to memory of 2656 3048 tbtthh.exe 33 PID 3048 wrote to memory of 2656 3048 tbtthh.exe 33 PID 3048 wrote to memory of 2656 3048 tbtthh.exe 33 PID 2656 wrote to memory of 2852 2656 jdpvp.exe 34 PID 2656 wrote to memory of 2852 2656 jdpvp.exe 34 PID 2656 wrote to memory of 2852 2656 jdpvp.exe 34 PID 2656 wrote to memory of 2852 2656 jdpvp.exe 34 PID 2852 wrote to memory of 2732 2852 5htnhh.exe 35 PID 2852 wrote to memory of 2732 2852 5htnhh.exe 35 PID 2852 wrote to memory of 2732 2852 5htnhh.exe 35 PID 2852 wrote to memory of 2732 2852 5htnhh.exe 35 PID 2732 wrote to memory of 2616 2732 pjvvp.exe 36 PID 2732 wrote to memory of 2616 2732 pjvvp.exe 36 PID 2732 wrote to memory of 2616 2732 pjvvp.exe 36 PID 2732 wrote to memory of 2616 2732 pjvvp.exe 36 PID 2616 wrote to memory of 2584 2616 frrxllx.exe 37 PID 2616 wrote to memory of 2584 2616 frrxllx.exe 37 PID 2616 wrote to memory of 2584 2616 frrxllx.exe 37 PID 2616 wrote to memory of 2584 2616 frrxllx.exe 37 PID 2584 wrote to memory of 2040 2584 dpvvd.exe 38 PID 2584 wrote to memory of 2040 2584 dpvvd.exe 38 PID 2584 wrote to memory of 2040 2584 dpvvd.exe 38 PID 2584 wrote to memory of 2040 2584 dpvvd.exe 38 PID 2040 wrote to memory of 1896 2040 3vjvv.exe 39 PID 2040 wrote to memory of 1896 2040 3vjvv.exe 39 PID 2040 wrote to memory of 1896 2040 3vjvv.exe 39 PID 2040 wrote to memory of 1896 2040 3vjvv.exe 39 PID 1896 wrote to memory of 2360 1896 ddvjp.exe 40 PID 1896 wrote to memory of 2360 1896 ddvjp.exe 40 PID 1896 wrote to memory of 2360 1896 ddvjp.exe 40 PID 1896 wrote to memory of 2360 1896 ddvjp.exe 40 PID 2360 wrote to memory of 1200 2360 ffllrxl.exe 41 PID 2360 wrote to memory of 1200 2360 ffllrxl.exe 41 PID 2360 wrote to memory of 1200 2360 ffllrxl.exe 41 PID 2360 wrote to memory of 1200 2360 ffllrxl.exe 41 PID 1200 wrote to memory of 1844 1200 ddvvv.exe 42 PID 1200 wrote to memory of 1844 1200 ddvvv.exe 42 PID 1200 wrote to memory of 1844 1200 ddvvv.exe 42 PID 1200 wrote to memory of 1844 1200 ddvvv.exe 42 PID 1844 wrote to memory of 2820 1844 fxxxllf.exe 43 PID 1844 wrote to memory of 2820 1844 fxxxllf.exe 43 PID 1844 wrote to memory of 2820 1844 fxxxllf.exe 43 PID 1844 wrote to memory of 2820 1844 fxxxllf.exe 43 PID 2820 wrote to memory of 2044 2820 thnntt.exe 44 PID 2820 wrote to memory of 2044 2820 thnntt.exe 44 PID 2820 wrote to memory of 2044 2820 thnntt.exe 44 PID 2820 wrote to memory of 2044 2820 thnntt.exe 44 PID 2044 wrote to memory of 980 2044 rlffxfl.exe 45 PID 2044 wrote to memory of 980 2044 rlffxfl.exe 45 PID 2044 wrote to memory of 980 2044 rlffxfl.exe 45 PID 2044 wrote to memory of 980 2044 rlffxfl.exe 45 PID 980 wrote to memory of 2748 980 ppdpd.exe 46 PID 980 wrote to memory of 2748 980 ppdpd.exe 46 PID 980 wrote to memory of 2748 980 ppdpd.exe 46 PID 980 wrote to memory of 2748 980 ppdpd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe"C:\Users\Admin\AppData\Local\Temp\9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\tnbhnn.exec:\tnbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\tbtthh.exec:\tbtthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jdpvp.exec:\jdpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5htnhh.exec:\5htnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\pjvvp.exec:\pjvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\frrxllx.exec:\frrxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dpvvd.exec:\dpvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\3vjvv.exec:\3vjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\ddvjp.exec:\ddvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\ffllrxl.exec:\ffllrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\ddvvv.exec:\ddvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\fxxxllf.exec:\fxxxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\thnntt.exec:\thnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rlffxfl.exec:\rlffxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\ppdpd.exec:\ppdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\btnnnn.exec:\btnnnn.exe17⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ffrlffr.exec:\ffrlffr.exe18⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xrrrxfr.exec:\xrrrxfr.exe19⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ppdpd.exec:\ppdpd.exe20⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3rxlllr.exec:\3rxlllr.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5vjjv.exec:\5vjjv.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1frfxxl.exec:\1frfxxl.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jpjpj.exec:\jpjpj.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3fxxlrx.exec:\3fxxlrx.exe25⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvjvd.exec:\dvjvd.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3rrrrxl.exec:\3rrrrxl.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jdvpd.exec:\jdvpd.exe28⤵
- Executes dropped EXE
PID:628 -
\??\c:\fxrxllf.exec:\fxrxllf.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjvdp.exec:\pjvdp.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lfxfllr.exec:\lfxfllr.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pjjvj.exec:\pjjvj.exe32⤵
- Executes dropped EXE
PID:2680 -
\??\c:\llxlxfr.exec:\llxlxfr.exe33⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ddvpd.exec:\ddvpd.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5llrrrf.exec:\5llrrrf.exe35⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bttbnn.exec:\bttbnn.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ddpdd.exec:\ddpdd.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1frrxlf.exec:\1frrxlf.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe39⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3nnbnh.exec:\3nnbnh.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5pdjv.exec:\5pdjv.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bhttbb.exec:\bhttbb.exe42⤵
- Executes dropped EXE
PID:1780 -
\??\c:\bttbhn.exec:\bttbhn.exe43⤵
- Executes dropped EXE
PID:656 -
\??\c:\5jvjj.exec:\5jvjj.exe44⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1xxflfl.exec:\1xxflfl.exe45⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5ntbtb.exec:\5ntbtb.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dddpp.exec:\dddpp.exe47⤵
- Executes dropped EXE
PID:808 -
\??\c:\lrxlllf.exec:\lrxlllf.exe48⤵
- Executes dropped EXE
PID:1832 -
\??\c:\bbnbnb.exec:\bbnbnb.exe49⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vppdd.exec:\vppdd.exe50⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hhnthn.exec:\hhnthn.exe52⤵
- Executes dropped EXE
PID:580 -
\??\c:\9vjvp.exec:\9vjvp.exe53⤵
- Executes dropped EXE
PID:356 -
\??\c:\llxlrfr.exec:\llxlrfr.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hbtbnb.exec:\hbtbnb.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7jjjv.exec:\7jjjv.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rrrrflr.exec:\rrrrflr.exe57⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hbntht.exec:\hbntht.exe58⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvjvj.exec:\vvjvj.exe59⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7frxxfr.exec:\7frxxfr.exe60⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hnbhnt.exec:\hnbhnt.exe61⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pdpdp.exec:\pdpdp.exe62⤵
- Executes dropped EXE
PID:860 -
\??\c:\dpjpd.exec:\dpjpd.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\9xrrxfr.exec:\9xrrxfr.exe64⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nbtttt.exec:\nbtttt.exe65⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjvjv.exec:\pjvjv.exe66⤵PID:1648
-
\??\c:\rrlfxff.exec:\rrlfxff.exe67⤵
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\7hhhnt.exec:\7hhhnt.exe68⤵PID:2212
-
\??\c:\nhbhbb.exec:\nhbhbb.exe69⤵PID:2412
-
\??\c:\dvpvj.exec:\dvpvj.exe70⤵PID:1692
-
\??\c:\3xflflx.exec:\3xflflx.exe71⤵PID:1036
-
\??\c:\nhntbh.exec:\nhntbh.exe72⤵PID:1588
-
\??\c:\bbnnbh.exec:\bbnnbh.exe73⤵PID:1580
-
\??\c:\djvpp.exec:\djvpp.exe74⤵PID:1576
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe75⤵PID:1548
-
\??\c:\nhhnhn.exec:\nhhnhn.exe76⤵PID:2780
-
\??\c:\vvpvp.exec:\vvpvp.exe77⤵
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\jdpdj.exec:\jdpdj.exe78⤵PID:2568
-
\??\c:\rlflxfr.exec:\rlflxfr.exe79⤵PID:2708
-
\??\c:\hhbhbn.exec:\hhbhbn.exe80⤵PID:2532
-
\??\c:\7dpdj.exec:\7dpdj.exe81⤵PID:2716
-
\??\c:\7rxfrxl.exec:\7rxfrxl.exe82⤵
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\5bbtht.exec:\5bbtht.exe83⤵PID:2240
-
\??\c:\ntnhnh.exec:\ntnhnh.exe84⤵PID:1480
-
\??\c:\jvvdp.exec:\jvvdp.exe85⤵PID:2944
-
\??\c:\3rflrxf.exec:\3rflrxf.exe86⤵PID:2380
-
\??\c:\nhtbhh.exec:\nhtbhh.exe87⤵PID:1896
-
\??\c:\jjvdj.exec:\jjvdj.exe88⤵PID:2372
-
\??\c:\jppvj.exec:\jppvj.exe89⤵
- System Location Discovery: System Language Discovery
PID:2264 -
\??\c:\lfxllrl.exec:\lfxllrl.exe90⤵PID:1332
-
\??\c:\ffxrflx.exec:\ffxrflx.exe91⤵PID:1396
-
\??\c:\hntnbh.exec:\hntnbh.exe92⤵PID:1104
-
\??\c:\1vjvp.exec:\1vjvp.exe93⤵PID:2768
-
\??\c:\rfxxrff.exec:\rfxxrff.exe94⤵PID:536
-
\??\c:\ffrxrrl.exec:\ffrxrrl.exe95⤵PID:1592
-
\??\c:\nhbhbb.exec:\nhbhbb.exe96⤵PID:1992
-
\??\c:\5dvdp.exec:\5dvdp.exe97⤵PID:2148
-
\??\c:\xflffll.exec:\xflffll.exe98⤵PID:3060
-
\??\c:\hbnnbb.exec:\hbnnbb.exe99⤵PID:1028
-
\??\c:\tnhtnt.exec:\tnhtnt.exe100⤵PID:1504
-
\??\c:\pjdjp.exec:\pjdjp.exe101⤵PID:952
-
\??\c:\9ffxxxl.exec:\9ffxxxl.exe102⤵PID:2376
-
\??\c:\tnhtth.exec:\tnhtth.exe103⤵PID:2600
-
\??\c:\vvvdp.exec:\vvvdp.exe104⤵PID:832
-
\??\c:\1xlxlrf.exec:\1xlxlrf.exe105⤵PID:2912
-
\??\c:\thtttn.exec:\thtttn.exe106⤵PID:948
-
\??\c:\dvdpd.exec:\dvdpd.exe107⤵PID:1944
-
\??\c:\nhbnht.exec:\nhbnht.exe108⤵PID:1604
-
\??\c:\jdjjv.exec:\jdjjv.exe109⤵PID:1044
-
\??\c:\1xxxrrl.exec:\1xxxrrl.exe110⤵PID:2288
-
\??\c:\xlfrflf.exec:\xlfrflf.exe111⤵PID:2508
-
\??\c:\ttnthn.exec:\ttnthn.exe112⤵PID:2292
-
\??\c:\jjdvj.exec:\jjdvj.exe113⤵PID:2632
-
\??\c:\dvvvd.exec:\dvvvd.exe114⤵PID:2180
-
\??\c:\fllxrrl.exec:\fllxrrl.exe115⤵PID:1996
-
\??\c:\bbtbnn.exec:\bbtbnn.exe116⤵PID:2692
-
\??\c:\hhnttt.exec:\hhnttt.exe117⤵PID:2888
-
\??\c:\1jddj.exec:\1jddj.exe118⤵PID:2756
-
\??\c:\rxfrxrr.exec:\rxfrxrr.exe119⤵PID:2840
-
\??\c:\rrrlxfr.exec:\rrrlxfr.exe120⤵PID:2740
-
\??\c:\7hbnth.exec:\7hbnth.exe121⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-