Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe
-
Size
455KB
-
MD5
4bdabaaa9b099cd15d095346268dc0ad
-
SHA1
5c1e447f9b957ab514b08064e8f037165ac85cfc
-
SHA256
b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3
-
SHA512
805f4c995ed3c203ba27788745ddba0aeecd2e2bd58c8ea53fdb679404222b36ad9a27970e3a8a37714207d2db5e8b910308b25cdcadee29f1f4cb662c8d189f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2744-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3032-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-516-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1052-613-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2360-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-877-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1876-888-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2812 5rflllr.exe 2068 9jddj.exe 2728 1xllrff.exe 2504 vvjjv.exe 2544 lfxffrl.exe 592 5bbbht.exe 2260 vvpvp.exe 1256 nbnttt.exe 3004 pjvvv.exe 2376 rrfflfl.exe 2052 bbthth.exe 484 lfxfflr.exe 2008 bthhhn.exe 2144 jvjjj.exe 1960 9thhhh.exe 1972 pjpjp.exe 2844 xflfxfl.exe 2168 vpddj.exe 2396 djvpp.exe 1604 tbbhnn.exe 2276 vdvdp.exe 892 xfxlfrf.exe 1596 tnbnnn.exe 268 frlrxxf.exe 2960 7tnthh.exe 3068 7vjdd.exe 2968 xlrxflr.exe 1132 ddvdd.exe 2664 ffrxfxl.exe 2012 tthntt.exe 1628 5dvvd.exe 2820 1hbhhh.exe 2560 tntbtt.exe 2572 3vjpd.exe 2588 llxlxxr.exe 2596 hbthnh.exe 3020 ppdjd.exe 2656 jdjvd.exe 3024 llfrfrf.exe 2760 1btntn.exe 3032 ddvjp.exe 1896 pjvvd.exe 2776 1rlllrx.exe 2348 nnbhnn.exe 1064 vpdvv.exe 1708 3vjjp.exe 1976 1rxrllr.exe 2792 ttnbhh.exe 2800 dpjpd.exe 1968 pdvjp.exe 988 5lrllrr.exe 2932 nnttbt.exe 2172 9jvvv.exe 1940 9jddj.exe 844 1lxfllx.exe 2092 nbnntt.exe 2456 btnnnt.exe 2276 dvppv.exe 892 pppdp.exe 1208 lffrflx.exe 1260 nhnnbb.exe 1740 dvddp.exe 984 dvdpd.exe 2336 xrflflr.exe -
resource yara_rule behavioral1/memory/2744-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-877-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1876-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-943-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2812 2744 b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe 31 PID 2744 wrote to memory of 2812 2744 b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe 31 PID 2744 wrote to memory of 2812 2744 b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe 31 PID 2744 wrote to memory of 2812 2744 b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe 31 PID 2812 wrote to memory of 2068 2812 5rflllr.exe 32 PID 2812 wrote to memory of 2068 2812 5rflllr.exe 32 PID 2812 wrote to memory of 2068 2812 5rflllr.exe 32 PID 2812 wrote to memory of 2068 2812 5rflllr.exe 32 PID 2068 wrote to memory of 2728 2068 9jddj.exe 33 PID 2068 wrote to memory of 2728 2068 9jddj.exe 33 PID 2068 wrote to memory of 2728 2068 9jddj.exe 33 PID 2068 wrote to memory of 2728 2068 9jddj.exe 33 PID 2728 wrote to memory of 2504 2728 1xllrff.exe 34 PID 2728 wrote to memory of 2504 2728 1xllrff.exe 34 PID 2728 wrote to memory of 2504 2728 1xllrff.exe 34 PID 2728 wrote to memory of 2504 2728 1xllrff.exe 34 PID 2504 wrote to memory of 2544 2504 vvjjv.exe 35 PID 2504 wrote to memory of 2544 2504 vvjjv.exe 35 PID 2504 wrote to memory of 2544 2504 vvjjv.exe 35 PID 2504 wrote to memory of 2544 2504 vvjjv.exe 35 PID 2544 wrote to memory of 592 2544 lfxffrl.exe 36 PID 2544 wrote to memory of 592 2544 lfxffrl.exe 36 PID 2544 wrote to memory of 592 2544 lfxffrl.exe 36 PID 2544 wrote to memory of 592 2544 lfxffrl.exe 36 PID 592 wrote to memory of 2260 592 5bbbht.exe 37 PID 592 wrote to memory of 2260 592 5bbbht.exe 37 PID 592 wrote to memory of 2260 592 5bbbht.exe 37 PID 592 wrote to memory of 2260 592 5bbbht.exe 37 PID 2260 wrote to memory of 1256 2260 vvpvp.exe 38 PID 2260 wrote to memory of 1256 2260 vvpvp.exe 38 PID 2260 wrote to memory of 1256 2260 vvpvp.exe 38 PID 2260 wrote to memory of 1256 2260 vvpvp.exe 38 PID 1256 wrote to memory of 3004 1256 nbnttt.exe 39 PID 1256 wrote to memory of 3004 1256 nbnttt.exe 39 PID 1256 wrote to memory of 3004 1256 nbnttt.exe 39 PID 1256 wrote to memory of 3004 1256 nbnttt.exe 39 PID 3004 wrote to memory of 2376 3004 pjvvv.exe 40 PID 3004 wrote to memory of 2376 3004 pjvvv.exe 40 PID 3004 wrote to memory of 2376 3004 pjvvv.exe 40 PID 3004 wrote to memory of 2376 3004 pjvvv.exe 40 PID 2376 wrote to memory of 2052 2376 rrfflfl.exe 41 PID 2376 wrote to memory of 2052 2376 rrfflfl.exe 41 PID 2376 wrote to memory of 2052 2376 rrfflfl.exe 41 PID 2376 wrote to memory of 2052 2376 rrfflfl.exe 41 PID 2052 wrote to memory of 484 2052 bbthth.exe 42 PID 2052 wrote to memory of 484 2052 bbthth.exe 42 PID 2052 wrote to memory of 484 2052 bbthth.exe 42 PID 2052 wrote to memory of 484 2052 bbthth.exe 42 PID 484 wrote to memory of 2008 484 lfxfflr.exe 43 PID 484 wrote to memory of 2008 484 lfxfflr.exe 43 PID 484 wrote to memory of 2008 484 lfxfflr.exe 43 PID 484 wrote to memory of 2008 484 lfxfflr.exe 43 PID 2008 wrote to memory of 2144 2008 bthhhn.exe 44 PID 2008 wrote to memory of 2144 2008 bthhhn.exe 44 PID 2008 wrote to memory of 2144 2008 bthhhn.exe 44 PID 2008 wrote to memory of 2144 2008 bthhhn.exe 44 PID 2144 wrote to memory of 1960 2144 jvjjj.exe 45 PID 2144 wrote to memory of 1960 2144 jvjjj.exe 45 PID 2144 wrote to memory of 1960 2144 jvjjj.exe 45 PID 2144 wrote to memory of 1960 2144 jvjjj.exe 45 PID 1960 wrote to memory of 1972 1960 9thhhh.exe 46 PID 1960 wrote to memory of 1972 1960 9thhhh.exe 46 PID 1960 wrote to memory of 1972 1960 9thhhh.exe 46 PID 1960 wrote to memory of 1972 1960 9thhhh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe"C:\Users\Admin\AppData\Local\Temp\b8afa43b30707a9922c1467cbb6d1550a67bc2a8d68502fa94f3da699962c6d3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\5rflllr.exec:\5rflllr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9jddj.exec:\9jddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\1xllrff.exec:\1xllrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vvjjv.exec:\vvjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lfxffrl.exec:\lfxffrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\5bbbht.exec:\5bbbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\vvpvp.exec:\vvpvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\nbnttt.exec:\nbnttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pjvvv.exec:\pjvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rrfflfl.exec:\rrfflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bbthth.exec:\bbthth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\lfxfflr.exec:\lfxfflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\bthhhn.exec:\bthhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\jvjjj.exec:\jvjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\9thhhh.exec:\9thhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\pjpjp.exec:\pjpjp.exe17⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xflfxfl.exec:\xflfxfl.exe18⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpddj.exec:\vpddj.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\djvpp.exec:\djvpp.exe20⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tbbhnn.exec:\tbbhnn.exe21⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vdvdp.exec:\vdvdp.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xfxlfrf.exec:\xfxlfrf.exe23⤵
- Executes dropped EXE
PID:892 -
\??\c:\tnbnnn.exec:\tnbnnn.exe24⤵
- Executes dropped EXE
PID:1596 -
\??\c:\frlrxxf.exec:\frlrxxf.exe25⤵
- Executes dropped EXE
PID:268 -
\??\c:\7tnthh.exec:\7tnthh.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\7vjdd.exec:\7vjdd.exe27⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xlrxflr.exec:\xlrxflr.exe28⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddvdd.exec:\ddvdd.exe29⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ffrxfxl.exec:\ffrxfxl.exe30⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tthntt.exec:\tthntt.exe31⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5dvvd.exec:\5dvvd.exe32⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1hbhhh.exec:\1hbhhh.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tntbtt.exec:\tntbtt.exe34⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3vjpd.exec:\3vjpd.exe35⤵
- Executes dropped EXE
PID:2572 -
\??\c:\llxlxxr.exec:\llxlxxr.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hbthnh.exec:\hbthnh.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ppdjd.exec:\ppdjd.exe38⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jdjvd.exec:\jdjvd.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\llfrfrf.exec:\llfrfrf.exe40⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1btntn.exec:\1btntn.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ddvjp.exec:\ddvjp.exe42⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjvvd.exec:\pjvvd.exe43⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1rlllrx.exec:\1rlllrx.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nnbhnn.exec:\nnbhnn.exe45⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vpdvv.exec:\vpdvv.exe46⤵
- Executes dropped EXE
PID:1064 -
\??\c:\3vjjp.exec:\3vjjp.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708 -
\??\c:\1rxrllr.exec:\1rxrllr.exe48⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ttnbhh.exec:\ttnbhh.exe49⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dpjpd.exec:\dpjpd.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pdvjp.exec:\pdvjp.exe51⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5lrllrr.exec:\5lrllrr.exe52⤵
- Executes dropped EXE
PID:988 -
\??\c:\nnttbt.exec:\nnttbt.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9jvvv.exec:\9jvvv.exe54⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9jddj.exec:\9jddj.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\1lxfllx.exec:\1lxfllx.exe56⤵
- Executes dropped EXE
PID:844 -
\??\c:\nbnntt.exec:\nbnntt.exe57⤵
- Executes dropped EXE
PID:2092 -
\??\c:\btnnnt.exec:\btnnnt.exe58⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dvppv.exec:\dvppv.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pppdp.exec:\pppdp.exe60⤵
- Executes dropped EXE
PID:892 -
\??\c:\lffrflx.exec:\lffrflx.exe61⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nhnnbb.exec:\nhnnbb.exe62⤵
- Executes dropped EXE
PID:1260 -
\??\c:\dvddp.exec:\dvddp.exe63⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dvdpd.exec:\dvdpd.exe64⤵
- Executes dropped EXE
PID:984 -
\??\c:\xrflflr.exec:\xrflflr.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3bnhhn.exec:\3bnhhn.exe66⤵PID:1556
-
\??\c:\3hnhhb.exec:\3hnhhb.exe67⤵PID:2952
-
\??\c:\vpdjj.exec:\vpdjj.exe68⤵PID:900
-
\??\c:\9xlflll.exec:\9xlflll.exe69⤵PID:904
-
\??\c:\9bnnhh.exec:\9bnnhh.exe70⤵PID:2744
-
\??\c:\nhttbn.exec:\nhttbn.exe71⤵PID:2748
-
\??\c:\vvjpp.exec:\vvjpp.exe72⤵PID:2696
-
\??\c:\rrffrrr.exec:\rrffrrr.exe73⤵PID:2840
-
\??\c:\llrxffl.exec:\llrxffl.exe74⤵PID:2068
-
\??\c:\bbhnbh.exec:\bbhnbh.exe75⤵PID:2676
-
\??\c:\dvjjv.exec:\dvjjv.exe76⤵PID:2564
-
\??\c:\llflxxf.exec:\llflxxf.exe77⤵PID:2712
-
\??\c:\5rxrlrr.exec:\5rxrlrr.exe78⤵PID:3016
-
\??\c:\tnhntb.exec:\tnhntb.exe79⤵PID:1592
-
\??\c:\ppdpp.exec:\ppdpp.exe80⤵PID:1052
-
\??\c:\dpjjj.exec:\dpjjj.exe81⤵PID:1932
-
\??\c:\7xlrrrr.exec:\7xlrrrr.exe82⤵PID:2900
-
\??\c:\nbnbnn.exec:\nbnbnn.exe83⤵PID:1924
-
\??\c:\jpvvj.exec:\jpvvj.exe84⤵PID:604
-
\??\c:\7pjjp.exec:\7pjjp.exe85⤵PID:2400
-
\??\c:\lfrxllx.exec:\lfrxllx.exe86⤵PID:2252
-
\??\c:\hbnnhh.exec:\hbnnhh.exe87⤵PID:1064
-
\??\c:\nthbhh.exec:\nthbhh.exe88⤵PID:1928
-
\??\c:\vpddd.exec:\vpddd.exe89⤵PID:1624
-
\??\c:\dpdpv.exec:\dpdpv.exe90⤵PID:1784
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe91⤵PID:1420
-
\??\c:\lxxrxrf.exec:\lxxrxrf.exe92⤵PID:1968
-
\??\c:\1bnntt.exec:\1bnntt.exe93⤵PID:2160
-
\??\c:\jvddj.exec:\jvddj.exe94⤵PID:2844
-
\??\c:\jjvjp.exec:\jjvjp.exe95⤵PID:2168
-
\??\c:\5frlrrx.exec:\5frlrrx.exe96⤵PID:2360
-
\??\c:\3htbhh.exec:\3htbhh.exe97⤵PID:924
-
\??\c:\9hbthb.exec:\9hbthb.exe98⤵PID:444
-
\??\c:\jvjjv.exec:\jvjjv.exe99⤵PID:408
-
\??\c:\xlrxxxf.exec:\xlrxxxf.exe100⤵PID:2340
-
\??\c:\3thnnh.exec:\3thnnh.exe101⤵PID:1788
-
\??\c:\9nbbnn.exec:\9nbbnn.exe102⤵PID:920
-
\??\c:\vdvjp.exec:\vdvjp.exe103⤵PID:2424
-
\??\c:\7xlllrx.exec:\7xlllrx.exe104⤵PID:1740
-
\??\c:\1tnntb.exec:\1tnntb.exe105⤵PID:2960
-
\??\c:\bttbnt.exec:\bttbnt.exe106⤵PID:2336
-
\??\c:\vvjjp.exec:\vvjjp.exe107⤵PID:1576
-
\??\c:\lxfflff.exec:\lxfflff.exe108⤵PID:1092
-
\??\c:\5xrllff.exec:\5xrllff.exe109⤵PID:2248
-
\??\c:\tnttbb.exec:\tnttbb.exe110⤵PID:2740
-
\??\c:\jvjjp.exec:\jvjjp.exe111⤵PID:2664
-
\??\c:\jdppp.exec:\jdppp.exe112⤵PID:1520
-
\??\c:\3rrxxxr.exec:\3rrxxxr.exe113⤵PID:1516
-
\??\c:\5bnntb.exec:\5bnntb.exe114⤵PID:2556
-
\??\c:\1hnhtt.exec:\1hnhtt.exe115⤵PID:2992
-
\??\c:\pdppv.exec:\pdppv.exe116⤵PID:2816
-
\??\c:\fxlrllx.exec:\fxlrllx.exe117⤵PID:2856
-
\??\c:\fxxxffr.exec:\fxxxffr.exe118⤵PID:2196
-
\??\c:\bnbhnn.exec:\bnbhnn.exe119⤵PID:1504
-
\??\c:\9jvdv.exec:\9jvdv.exe120⤵PID:2656
-
\??\c:\ddjjp.exec:\ddjjp.exe121⤵PID:2632
-
\??\c:\rlxflll.exec:\rlxflll.exe122⤵PID:640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-