Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:09
Behavioral task
behavioral1
Sample
b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe
-
Size
334KB
-
MD5
a1a7e98274c192ac1581f83ff6967310
-
SHA1
04e1c0c89b9fc6b06039a515ee83117c38b7a10f
-
SHA256
b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4d
-
SHA512
e794773bb23071ea7e808faa6573a4d63b0a20343e6257d4537cd35e7c1e0195328c65e18fe73588ae1f243eb514ff4102da4c3f85b0e37c7b40ca36932ab518
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2396-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-50-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2296-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-114-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2376-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-189-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/584-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-207-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1744-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/968-240-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2456-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-283-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/2288-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/280-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-387-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-406-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3024-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-593-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2344-626-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-637-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2764-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-691-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1868-744-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-745-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/912-757-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2116-790-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2288-807-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/2964-851-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2964-850-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1848-958-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-11489-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/2288-14775-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/2288-18069-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1632 086684.exe 2576 nhtbhn.exe 2372 thttbb.exe 2060 7bhnbh.exe 2296 xrrlxfx.exe 2960 lllxlxl.exe 3052 pjpvd.exe 2348 fxllrfl.exe 2896 vjpdp.exe 2980 80628.exe 2708 jdvvv.exe 1036 e20684.exe 1968 00446.exe 1884 jjjpp.exe 3024 lxxxfll.exe 2000 jvpvp.exe 2376 268000.exe 2764 hthntt.exe 1940 20280.exe 2164 66060.exe 2216 tnbnhb.exe 2104 rlrfffr.exe 584 hbhhth.exe 1924 824400.exe 2008 lfxfrrx.exe 1868 2022886.exe 1744 jdjjp.exe 896 642846.exe 968 3djpp.exe 1212 jdjjj.exe 2424 46888.exe 2456 480060.exe 2504 424404.exe 1412 vjvpv.exe 1436 vdddv.exe 2188 08606.exe 2288 202626.exe 532 dvpjd.exe 1644 9bnttb.exe 2032 thtbbb.exe 2428 028842.exe 2420 9hnhnn.exe 2836 3jvpv.exe 2964 pddjj.exe 2988 2004844.exe 2828 frfxxxx.exe 3052 bbttnt.exe 2888 42444.exe 1348 64622.exe 2944 vpdpv.exe 2832 6020222.exe 2700 vjjvd.exe 2588 02068.exe 1032 2044006.exe 2284 0862060.exe 3016 lrfxxxl.exe 2028 w80022.exe 3024 1lxllrl.exe 1636 frxrfll.exe 1320 5vdjj.exe 3020 24224.exe 2336 26400.exe 2436 6088840.exe 1552 246626.exe -
resource yara_rule behavioral1/memory/2396-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001202c-5.dat upx behavioral1/memory/2396-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1632-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186f1-16.dat upx behavioral1/memory/2576-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f4-25.dat upx behavioral1/files/0x0006000000018704-36.dat upx behavioral1/memory/2372-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018739-43.dat upx behavioral1/memory/2060-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018744-53.dat upx behavioral1/memory/3052-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001878e-60.dat upx behavioral1/files/0x00070000000187a8-67.dat upx behavioral1/files/0x0007000000019451-74.dat upx behavioral1/memory/2896-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019458-81.dat upx behavioral1/memory/2980-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a9-90.dat upx behavioral1/files/0x00050000000194b9-98.dat upx behavioral1/memory/2708-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c9-108.dat upx behavioral1/memory/1036-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ee-115.dat upx behavioral1/files/0x00050000000194f1-122.dat upx behavioral1/files/0x000900000001755b-129.dat upx behavioral1/files/0x0005000000019502-136.dat upx behavioral1/files/0x0005000000019509-145.dat upx behavioral1/memory/2376-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950e-152.dat upx behavioral1/files/0x0005000000019512-159.dat upx behavioral1/memory/2164-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957e-167.dat upx behavioral1/memory/2216-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001958e-175.dat upx behavioral1/files/0x00050000000195ab-182.dat upx behavioral1/files/0x00050000000195f0-193.dat upx behavioral1/memory/1924-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/584-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019621-200.dat upx behavioral1/memory/1924-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-209.dat upx behavioral1/files/0x0005000000019624-215.dat upx behavioral1/memory/1744-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1744-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-226.dat upx behavioral1/memory/896-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019627-234.dat upx behavioral1/memory/896-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019629-242.dat upx behavioral1/files/0x000500000001962b-248.dat upx behavioral1/files/0x000500000001962d-255.dat upx behavioral1/memory/2456-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/280-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-403-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-410-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4282808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w82466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6082820.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 1632 2396 b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe 30 PID 2396 wrote to memory of 1632 2396 b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe 30 PID 2396 wrote to memory of 1632 2396 b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe 30 PID 2396 wrote to memory of 1632 2396 b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe 30 PID 1632 wrote to memory of 2576 1632 086684.exe 31 PID 1632 wrote to memory of 2576 1632 086684.exe 31 PID 1632 wrote to memory of 2576 1632 086684.exe 31 PID 1632 wrote to memory of 2576 1632 086684.exe 31 PID 2576 wrote to memory of 2372 2576 nhtbhn.exe 32 PID 2576 wrote to memory of 2372 2576 nhtbhn.exe 32 PID 2576 wrote to memory of 2372 2576 nhtbhn.exe 32 PID 2576 wrote to memory of 2372 2576 nhtbhn.exe 32 PID 2372 wrote to memory of 2060 2372 thttbb.exe 33 PID 2372 wrote to memory of 2060 2372 thttbb.exe 33 PID 2372 wrote to memory of 2060 2372 thttbb.exe 33 PID 2372 wrote to memory of 2060 2372 thttbb.exe 33 PID 2060 wrote to memory of 2296 2060 7bhnbh.exe 34 PID 2060 wrote to memory of 2296 2060 7bhnbh.exe 34 PID 2060 wrote to memory of 2296 2060 7bhnbh.exe 34 PID 2060 wrote to memory of 2296 2060 7bhnbh.exe 34 PID 2296 wrote to memory of 2960 2296 xrrlxfx.exe 35 PID 2296 wrote to memory of 2960 2296 xrrlxfx.exe 35 PID 2296 wrote to memory of 2960 2296 xrrlxfx.exe 35 PID 2296 wrote to memory of 2960 2296 xrrlxfx.exe 35 PID 2960 wrote to memory of 3052 2960 lllxlxl.exe 36 PID 2960 wrote to memory of 3052 2960 lllxlxl.exe 36 PID 2960 wrote to memory of 3052 2960 lllxlxl.exe 36 PID 2960 wrote to memory of 3052 2960 lllxlxl.exe 36 PID 3052 wrote to memory of 2348 3052 pjpvd.exe 37 PID 3052 wrote to memory of 2348 3052 pjpvd.exe 37 PID 3052 wrote to memory of 2348 3052 pjpvd.exe 37 PID 3052 wrote to memory of 2348 3052 pjpvd.exe 37 PID 2348 wrote to memory of 2896 2348 fxllrfl.exe 38 PID 2348 wrote to memory of 2896 2348 fxllrfl.exe 38 PID 2348 wrote to memory of 2896 2348 fxllrfl.exe 38 PID 2348 wrote to memory of 2896 2348 fxllrfl.exe 38 PID 2896 wrote to memory of 2980 2896 vjpdp.exe 39 PID 2896 wrote to memory of 2980 2896 vjpdp.exe 39 PID 2896 wrote to memory of 2980 2896 vjpdp.exe 39 PID 2896 wrote to memory of 2980 2896 vjpdp.exe 39 PID 2980 wrote to memory of 2708 2980 80628.exe 40 PID 2980 wrote to memory of 2708 2980 80628.exe 40 PID 2980 wrote to memory of 2708 2980 80628.exe 40 PID 2980 wrote to memory of 2708 2980 80628.exe 40 PID 2708 wrote to memory of 1036 2708 jdvvv.exe 41 PID 2708 wrote to memory of 1036 2708 jdvvv.exe 41 PID 2708 wrote to memory of 1036 2708 jdvvv.exe 41 PID 2708 wrote to memory of 1036 2708 jdvvv.exe 41 PID 1036 wrote to memory of 1968 1036 e20684.exe 42 PID 1036 wrote to memory of 1968 1036 e20684.exe 42 PID 1036 wrote to memory of 1968 1036 e20684.exe 42 PID 1036 wrote to memory of 1968 1036 e20684.exe 42 PID 1968 wrote to memory of 1884 1968 00446.exe 43 PID 1968 wrote to memory of 1884 1968 00446.exe 43 PID 1968 wrote to memory of 1884 1968 00446.exe 43 PID 1968 wrote to memory of 1884 1968 00446.exe 43 PID 1884 wrote to memory of 3024 1884 jjjpp.exe 44 PID 1884 wrote to memory of 3024 1884 jjjpp.exe 44 PID 1884 wrote to memory of 3024 1884 jjjpp.exe 44 PID 1884 wrote to memory of 3024 1884 jjjpp.exe 44 PID 3024 wrote to memory of 2000 3024 lxxxfll.exe 45 PID 3024 wrote to memory of 2000 3024 lxxxfll.exe 45 PID 3024 wrote to memory of 2000 3024 lxxxfll.exe 45 PID 3024 wrote to memory of 2000 3024 lxxxfll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe"C:\Users\Admin\AppData\Local\Temp\b8ebfcb5da2e0ffda3415962afeb29bc82aacfe7540f9a2200d2f94b16c30b4dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\086684.exec:\086684.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\nhtbhn.exec:\nhtbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\thttbb.exec:\thttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\7bhnbh.exec:\7bhnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\xrrlxfx.exec:\xrrlxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\lllxlxl.exec:\lllxlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\pjpvd.exec:\pjpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\fxllrfl.exec:\fxllrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vjpdp.exec:\vjpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\80628.exec:\80628.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\jdvvv.exec:\jdvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\e20684.exec:\e20684.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\00446.exec:\00446.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jjjpp.exec:\jjjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\lxxxfll.exec:\lxxxfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jvpvp.exec:\jvpvp.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\268000.exec:\268000.exe18⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hthntt.exec:\hthntt.exe19⤵
- Executes dropped EXE
PID:2764 -
\??\c:\20280.exec:\20280.exe20⤵
- Executes dropped EXE
PID:1940 -
\??\c:\66060.exec:\66060.exe21⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tnbnhb.exec:\tnbnhb.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlrfffr.exec:\rlrfffr.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbhhth.exec:\hbhhth.exe24⤵
- Executes dropped EXE
PID:584 -
\??\c:\824400.exec:\824400.exe25⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\2022886.exec:\2022886.exe27⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jdjjp.exec:\jdjjp.exe28⤵
- Executes dropped EXE
PID:1744 -
\??\c:\642846.exec:\642846.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\3djpp.exec:\3djpp.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\jdjjj.exec:\jdjjj.exe31⤵
- Executes dropped EXE
PID:1212 -
\??\c:\46888.exec:\46888.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\480060.exec:\480060.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\424404.exec:\424404.exe34⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vjvpv.exec:\vjvpv.exe35⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vdddv.exec:\vdddv.exe36⤵
- Executes dropped EXE
PID:1436 -
\??\c:\08606.exec:\08606.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\202626.exec:\202626.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hnnbtt.exec:\hnnbtt.exe39⤵PID:280
-
\??\c:\dvpjd.exec:\dvpjd.exe40⤵
- Executes dropped EXE
PID:532 -
\??\c:\9bnttb.exec:\9bnttb.exe41⤵
- Executes dropped EXE
PID:1644 -
\??\c:\thtbbb.exec:\thtbbb.exe42⤵
- Executes dropped EXE
PID:2032 -
\??\c:\028842.exec:\028842.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9hnhnn.exec:\9hnhnn.exe44⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3jvpv.exec:\3jvpv.exe45⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pddjj.exec:\pddjj.exe46⤵
- Executes dropped EXE
PID:2964 -
\??\c:\2004844.exec:\2004844.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\frfxxxx.exec:\frfxxxx.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bbttnt.exec:\bbttnt.exe49⤵
- Executes dropped EXE
PID:3052 -
\??\c:\42444.exec:\42444.exe50⤵
- Executes dropped EXE
PID:2888 -
\??\c:\64622.exec:\64622.exe51⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vpdpv.exec:\vpdpv.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\6020222.exec:\6020222.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vjjvd.exec:\vjjvd.exe54⤵
- Executes dropped EXE
PID:2700 -
\??\c:\02068.exec:\02068.exe55⤵
- Executes dropped EXE
PID:2588 -
\??\c:\2044006.exec:\2044006.exe56⤵
- Executes dropped EXE
PID:1032 -
\??\c:\0862060.exec:\0862060.exe57⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lrfxxxl.exec:\lrfxxxl.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\w80022.exec:\w80022.exe59⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1lxllrl.exec:\1lxllrl.exe60⤵
- Executes dropped EXE
PID:3024 -
\??\c:\frxrfll.exec:\frxrfll.exe61⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5vdjj.exec:\5vdjj.exe62⤵
- Executes dropped EXE
PID:1320 -
\??\c:\24224.exec:\24224.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\26400.exec:\26400.exe64⤵
- Executes dropped EXE
PID:2336 -
\??\c:\6088840.exec:\6088840.exe65⤵
- Executes dropped EXE
PID:2436 -
\??\c:\246626.exec:\246626.exe66⤵
- Executes dropped EXE
PID:1552 -
\??\c:\20644.exec:\20644.exe67⤵PID:2792
-
\??\c:\9ntnnh.exec:\9ntnnh.exe68⤵PID:940
-
\??\c:\1htbbb.exec:\1htbbb.exe69⤵PID:1756
-
\??\c:\lffxlrf.exec:\lffxlrf.exe70⤵PID:584
-
\??\c:\5xlrrxf.exec:\5xlrrxf.exe71⤵PID:276
-
\??\c:\9xrrxff.exec:\9xrrxff.exe72⤵PID:1272
-
\??\c:\hnhhtt.exec:\hnhhtt.exe73⤵PID:1556
-
\??\c:\tnhnnh.exec:\tnhnnh.exe74⤵PID:1784
-
\??\c:\9vdpj.exec:\9vdpj.exe75⤵PID:588
-
\??\c:\lxxflrl.exec:\lxxflrl.exe76⤵PID:1464
-
\??\c:\1dvvv.exec:\1dvvv.exe77⤵PID:804
-
\??\c:\4840224.exec:\4840224.exe78⤵PID:700
-
\??\c:\i668662.exec:\i668662.exe79⤵PID:2292
-
\??\c:\22020.exec:\22020.exe80⤵PID:600
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe81⤵PID:2116
-
\??\c:\1xxffrx.exec:\1xxffrx.exe82⤵PID:2456
-
\??\c:\0866284.exec:\0866284.exe83⤵PID:2280
-
\??\c:\jvdjv.exec:\jvdjv.exe84⤵PID:1412
-
\??\c:\w84004.exec:\w84004.exe85⤵PID:1436
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe86⤵PID:2408
-
\??\c:\5hbbbt.exec:\5hbbbt.exe87⤵PID:2072
-
\??\c:\3vdjp.exec:\3vdjp.exe88⤵PID:1532
-
\??\c:\3ppjp.exec:\3ppjp.exe89⤵PID:1632
-
\??\c:\3htthn.exec:\3htthn.exe90⤵PID:2660
-
\??\c:\24062.exec:\24062.exe91⤵PID:2232
-
\??\c:\e24448.exec:\e24448.exe92⤵PID:2884
-
\??\c:\lxlxrll.exec:\lxlxrll.exe93⤵PID:2200
-
\??\c:\424460.exec:\424460.exe94⤵PID:2972
-
\??\c:\42244.exec:\42244.exe95⤵PID:2968
-
\??\c:\pdppp.exec:\pdppp.exe96⤵PID:2448
-
\??\c:\s0262.exec:\s0262.exe97⤵PID:2952
-
\??\c:\2000662.exec:\2000662.exe98⤵PID:2736
-
\??\c:\644026.exec:\644026.exe99⤵PID:1348
-
\??\c:\hbnbtn.exec:\hbnbtn.exe100⤵PID:2344
-
\??\c:\2080628.exec:\2080628.exe101⤵PID:2772
-
\??\c:\a6068.exec:\a6068.exe102⤵PID:2584
-
\??\c:\084066.exec:\084066.exe103⤵PID:1036
-
\??\c:\u608024.exec:\u608024.exe104⤵PID:480
-
\??\c:\vjdvv.exec:\vjdvv.exe105⤵PID:2936
-
\??\c:\bbtbnn.exec:\bbtbnn.exe106⤵PID:2940
-
\??\c:\6206228.exec:\6206228.exe107⤵PID:1672
-
\??\c:\dpvvj.exec:\dpvvj.exe108⤵PID:2908
-
\??\c:\7vdpp.exec:\7vdpp.exe109⤵PID:2916
-
\??\c:\a4646.exec:\a4646.exe110⤵PID:2928
-
\??\c:\420006.exec:\420006.exe111⤵PID:2764
-
\??\c:\hbnhnn.exec:\hbnhnn.exe112⤵PID:2912
-
\??\c:\jvjjp.exec:\jvjjp.exe113⤵PID:2272
-
\??\c:\jjdjd.exec:\jjdjd.exe114⤵PID:3068
-
\??\c:\ttbtbb.exec:\ttbtbb.exe115⤵PID:1552
-
\??\c:\6406828.exec:\6406828.exe116⤵PID:2104
-
\??\c:\rfxxllr.exec:\rfxxllr.exe117⤵PID:1432
-
\??\c:\lflrrrx.exec:\lflrrrx.exe118⤵PID:1756
-
\??\c:\0866228.exec:\0866228.exe119⤵PID:1612
-
\??\c:\4244440.exec:\4244440.exe120⤵PID:844
-
\??\c:\pjppp.exec:\pjppp.exe121⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-