Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe
-
Size
454KB
-
MD5
ea897fdd73a39369fbc0f600dcb60300
-
SHA1
0c3030b4f2035c340c6c75581ca2a01b95fe4b1d
-
SHA256
95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1
-
SHA512
13279385c906a7e1d6bbb61aec9110226ff2b2780e9346c1290a1c340eee4dea154cec3e4eed4536c55cd1f57eceb74bda07e06e804aae19023af2fa9ba4e21d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-27-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-200-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/584-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-335-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2104-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-333-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2748-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-421-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/592-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-462-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2928-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-706-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/108-747-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 jjddp.exe 2408 lfxfllx.exe 2348 9nhntn.exe 2564 rlflffr.exe 2808 hbtttt.exe 2732 5llxlrl.exe 2976 thnbbt.exe 2008 vvvdp.exe 2608 rrlxflf.exe 2728 nnbhnb.exe 1732 pppjv.exe 1568 1ttbtn.exe 2592 jvjjd.exe 1144 rllxflx.exe 896 9dpvj.exe 1364 5lxrxxx.exe 1452 hhnbnn.exe 2928 9dvpj.exe 2072 lxrxlrf.exe 2392 ddpdv.exe 584 rrlrflr.exe 2464 pjjvj.exe 304 5rlflxl.exe 1968 nnhthh.exe 1800 jjjjj.exe 1612 rrrllrl.exe 2460 pjpvd.exe 2296 nnhtbh.exe 2432 bbtbtt.exe 2272 xrfrfff.exe 1032 hhhnbh.exe 3012 9vjpd.exe 2524 5rxflrr.exe 2688 bhbthn.exe 2104 jjppv.exe 2140 rxrfrff.exe 2748 1hhhtt.exe 2736 ppdjp.exe 2760 llrfffx.exe 2740 lrlrlfx.exe 2832 tbhtbt.exe 2644 vjdjv.exe 2604 5xlrflx.exe 2720 rffflfr.exe 3060 tthnhn.exe 1208 jdjpv.exe 592 flxrflx.exe 1956 btnbht.exe 1468 ttthht.exe 1188 pdjvp.exe 2444 xrlrrlr.exe 1072 3nhhtt.exe 1888 jdjvd.exe 2676 pdpvp.exe 1452 xfrrflr.exe 2928 tnhnbh.exe 2496 3vppd.exe 2960 3vpdp.exe 1492 fxxflrl.exe 824 tnnbth.exe 408 btbnth.exe 2108 jjvjp.exe 2896 5lfrffr.exe 1844 rffxfxr.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-419-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/592-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-747-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2952-752-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2520 2100 95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe 30 PID 2100 wrote to memory of 2520 2100 95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe 30 PID 2100 wrote to memory of 2520 2100 95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe 30 PID 2100 wrote to memory of 2520 2100 95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe 30 PID 2520 wrote to memory of 2408 2520 jjddp.exe 31 PID 2520 wrote to memory of 2408 2520 jjddp.exe 31 PID 2520 wrote to memory of 2408 2520 jjddp.exe 31 PID 2520 wrote to memory of 2408 2520 jjddp.exe 31 PID 2408 wrote to memory of 2348 2408 lfxfllx.exe 32 PID 2408 wrote to memory of 2348 2408 lfxfllx.exe 32 PID 2408 wrote to memory of 2348 2408 lfxfllx.exe 32 PID 2408 wrote to memory of 2348 2408 lfxfllx.exe 32 PID 2348 wrote to memory of 2564 2348 9nhntn.exe 33 PID 2348 wrote to memory of 2564 2348 9nhntn.exe 33 PID 2348 wrote to memory of 2564 2348 9nhntn.exe 33 PID 2348 wrote to memory of 2564 2348 9nhntn.exe 33 PID 2564 wrote to memory of 2808 2564 rlflffr.exe 34 PID 2564 wrote to memory of 2808 2564 rlflffr.exe 34 PID 2564 wrote to memory of 2808 2564 rlflffr.exe 34 PID 2564 wrote to memory of 2808 2564 rlflffr.exe 34 PID 2808 wrote to memory of 2732 2808 hbtttt.exe 35 PID 2808 wrote to memory of 2732 2808 hbtttt.exe 35 PID 2808 wrote to memory of 2732 2808 hbtttt.exe 35 PID 2808 wrote to memory of 2732 2808 hbtttt.exe 35 PID 2732 wrote to memory of 2976 2732 5llxlrl.exe 36 PID 2732 wrote to memory of 2976 2732 5llxlrl.exe 36 PID 2732 wrote to memory of 2976 2732 5llxlrl.exe 36 PID 2732 wrote to memory of 2976 2732 5llxlrl.exe 36 PID 2976 wrote to memory of 2008 2976 thnbbt.exe 37 PID 2976 wrote to memory of 2008 2976 thnbbt.exe 37 PID 2976 wrote to memory of 2008 2976 thnbbt.exe 37 PID 2976 wrote to memory of 2008 2976 thnbbt.exe 37 PID 2008 wrote to memory of 2608 2008 vvvdp.exe 38 PID 2008 wrote to memory of 2608 2008 vvvdp.exe 38 PID 2008 wrote to memory of 2608 2008 vvvdp.exe 38 PID 2008 wrote to memory of 2608 2008 vvvdp.exe 38 PID 2608 wrote to memory of 2728 2608 rrlxflf.exe 39 PID 2608 wrote to memory of 2728 2608 rrlxflf.exe 39 PID 2608 wrote to memory of 2728 2608 rrlxflf.exe 39 PID 2608 wrote to memory of 2728 2608 rrlxflf.exe 39 PID 2728 wrote to memory of 1732 2728 nnbhnb.exe 40 PID 2728 wrote to memory of 1732 2728 nnbhnb.exe 40 PID 2728 wrote to memory of 1732 2728 nnbhnb.exe 40 PID 2728 wrote to memory of 1732 2728 nnbhnb.exe 40 PID 1732 wrote to memory of 1568 1732 pppjv.exe 41 PID 1732 wrote to memory of 1568 1732 pppjv.exe 41 PID 1732 wrote to memory of 1568 1732 pppjv.exe 41 PID 1732 wrote to memory of 1568 1732 pppjv.exe 41 PID 1568 wrote to memory of 2592 1568 1ttbtn.exe 42 PID 1568 wrote to memory of 2592 1568 1ttbtn.exe 42 PID 1568 wrote to memory of 2592 1568 1ttbtn.exe 42 PID 1568 wrote to memory of 2592 1568 1ttbtn.exe 42 PID 2592 wrote to memory of 1144 2592 jvjjd.exe 43 PID 2592 wrote to memory of 1144 2592 jvjjd.exe 43 PID 2592 wrote to memory of 1144 2592 jvjjd.exe 43 PID 2592 wrote to memory of 1144 2592 jvjjd.exe 43 PID 1144 wrote to memory of 896 1144 rllxflx.exe 44 PID 1144 wrote to memory of 896 1144 rllxflx.exe 44 PID 1144 wrote to memory of 896 1144 rllxflx.exe 44 PID 1144 wrote to memory of 896 1144 rllxflx.exe 44 PID 896 wrote to memory of 1364 896 9dpvj.exe 45 PID 896 wrote to memory of 1364 896 9dpvj.exe 45 PID 896 wrote to memory of 1364 896 9dpvj.exe 45 PID 896 wrote to memory of 1364 896 9dpvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe"C:\Users\Admin\AppData\Local\Temp\95fbc384c795a4174e1a7d0b098f0a363754e02fbf062f7a46e65822e63d61c1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jjddp.exec:\jjddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\lfxfllx.exec:\lfxfllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\9nhntn.exec:\9nhntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rlflffr.exec:\rlflffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\hbtttt.exec:\hbtttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5llxlrl.exec:\5llxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\thnbbt.exec:\thnbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vvvdp.exec:\vvvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rrlxflf.exec:\rrlxflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nnbhnb.exec:\nnbhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pppjv.exec:\pppjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\1ttbtn.exec:\1ttbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\jvjjd.exec:\jvjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rllxflx.exec:\rllxflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\9dpvj.exec:\9dpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\5lxrxxx.exec:\5lxrxxx.exe17⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hhnbnn.exec:\hhnbnn.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9dvpj.exec:\9dvpj.exe19⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lxrxlrf.exec:\lxrxlrf.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ddpdv.exec:\ddpdv.exe21⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rrlrflr.exec:\rrlrflr.exe22⤵
- Executes dropped EXE
PID:584 -
\??\c:\pjjvj.exec:\pjjvj.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5rlflxl.exec:\5rlflxl.exe24⤵
- Executes dropped EXE
PID:304 -
\??\c:\nnhthh.exec:\nnhthh.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jjjjj.exec:\jjjjj.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rrrllrl.exec:\rrrllrl.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pjpvd.exec:\pjpvd.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nnhtbh.exec:\nnhtbh.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bbtbtt.exec:\bbtbtt.exe30⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xrfrfff.exec:\xrfrfff.exe31⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hhhnbh.exec:\hhhnbh.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9vjpd.exec:\9vjpd.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5rxflrr.exec:\5rxflrr.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bhbthn.exec:\bhbthn.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jjppv.exec:\jjppv.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rxrfrff.exec:\rxrfrff.exe37⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1hhhtt.exec:\1hhhtt.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ppdjp.exec:\ppdjp.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\llrfffx.exec:\llrfffx.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lrlrlfx.exec:\lrlrlfx.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tbhtbt.exec:\tbhtbt.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vjdjv.exec:\vjdjv.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\5xlrflx.exec:\5xlrflx.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rffflfr.exec:\rffflfr.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tthnhn.exec:\tthnhn.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jdjpv.exec:\jdjpv.exe47⤵
- Executes dropped EXE
PID:1208 -
\??\c:\flxrflx.exec:\flxrflx.exe48⤵
- Executes dropped EXE
PID:592 -
\??\c:\btnbht.exec:\btnbht.exe49⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ttthht.exec:\ttthht.exe50⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pdjvp.exec:\pdjvp.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xrlrrlr.exec:\xrlrrlr.exe52⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3nhhtt.exec:\3nhhtt.exe53⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jdjvd.exec:\jdjvd.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pdpvp.exec:\pdpvp.exe55⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xfrrflr.exec:\xfrrflr.exe56⤵
- Executes dropped EXE
PID:1452 -
\??\c:\tnhnbh.exec:\tnhnbh.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3vppd.exec:\3vppd.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3vpdp.exec:\3vpdp.exe59⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fxxflrl.exec:\fxxflrl.exe60⤵
- Executes dropped EXE
PID:1492 -
\??\c:\tnnbth.exec:\tnnbth.exe61⤵
- Executes dropped EXE
PID:824 -
\??\c:\btbnth.exec:\btbnth.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\jjvjp.exec:\jjvjp.exe63⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5lfrffr.exec:\5lfrffr.exe64⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rffxfxr.exec:\rffxfxr.exe65⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nnbhtn.exec:\nnbhtn.exe66⤵PID:1720
-
\??\c:\dvpvj.exec:\dvpvj.exe67⤵PID:760
-
\??\c:\ddvdj.exec:\ddvdj.exe68⤵PID:2120
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe69⤵PID:2328
-
\??\c:\bnnhhh.exec:\bnnhhh.exe70⤵PID:872
-
\??\c:\nhhtbh.exec:\nhhtbh.exe71⤵PID:3028
-
\??\c:\pvdvv.exec:\pvdvv.exe72⤵PID:2468
-
\??\c:\xffrrxl.exec:\xffrrxl.exe73⤵PID:1796
-
\??\c:\btbnbb.exec:\btbnbb.exe74⤵PID:2080
-
\??\c:\5ttnbb.exec:\5ttnbb.exe75⤵PID:840
-
\??\c:\vpjjp.exec:\vpjjp.exe76⤵PID:2412
-
\??\c:\1xlrrxl.exec:\1xlrrxl.exe77⤵
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\5bnnbb.exec:\5bnnbb.exe78⤵PID:2228
-
\??\c:\ttthbh.exec:\ttthbh.exe79⤵PID:1940
-
\??\c:\7jjpp.exec:\7jjpp.exe80⤵PID:2316
-
\??\c:\rfrrrlr.exec:\rfrrrlr.exe81⤵PID:2700
-
\??\c:\xxrfllx.exec:\xxrfllx.exe82⤵PID:2848
-
\??\c:\hhtbhb.exec:\hhtbhb.exe83⤵PID:2764
-
\??\c:\jvpjv.exec:\jvpjv.exe84⤵PID:2820
-
\??\c:\rrrrfrf.exec:\rrrrfrf.exe85⤵PID:2980
-
\??\c:\xrlrrxl.exec:\xrlrrxl.exe86⤵PID:2640
-
\??\c:\tthtbh.exec:\tthtbh.exe87⤵PID:2832
-
\??\c:\jjjpd.exec:\jjjpd.exe88⤵PID:2744
-
\??\c:\flxflrf.exec:\flxflrf.exe89⤵PID:2680
-
\??\c:\1xfffff.exec:\1xfffff.exe90⤵PID:2300
-
\??\c:\hhbbtt.exec:\hhbbtt.exe91⤵PID:2664
-
\??\c:\jvddd.exec:\jvddd.exe92⤵PID:1208
-
\??\c:\ppppj.exec:\ppppj.exe93⤵PID:592
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe94⤵PID:320
-
\??\c:\nhbnbn.exec:\nhbnbn.exe95⤵PID:1936
-
\??\c:\jvppv.exec:\jvppv.exe96⤵PID:1680
-
\??\c:\jpdjp.exec:\jpdjp.exe97⤵PID:1424
-
\??\c:\frlrxfr.exec:\frlrxfr.exe98⤵PID:896
-
\??\c:\tnbhtb.exec:\tnbhtb.exe99⤵PID:108
-
\??\c:\htthht.exec:\htthht.exe100⤵PID:2952
-
\??\c:\vppjp.exec:\vppjp.exe101⤵PID:2788
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe102⤵PID:3052
-
\??\c:\3tbnbn.exec:\3tbnbn.exe103⤵PID:1224
-
\??\c:\tnntbb.exec:\tnntbb.exe104⤵PID:1824
-
\??\c:\pppdj.exec:\pppdj.exe105⤵PID:2908
-
\??\c:\3frffrf.exec:\3frffrf.exe106⤵PID:820
-
\??\c:\hnhnhn.exec:\hnhnhn.exe107⤵PID:3004
-
\??\c:\1hhnth.exec:\1hhnth.exe108⤵PID:1716
-
\??\c:\pppdp.exec:\pppdp.exe109⤵PID:2588
-
\??\c:\rxrxrfr.exec:\rxrxrfr.exe110⤵PID:1308
-
\??\c:\nhhnbn.exec:\nhhnbn.exe111⤵PID:580
-
\??\c:\ttbbbh.exec:\ttbbbh.exe112⤵PID:1612
-
\??\c:\vppvp.exec:\vppvp.exe113⤵PID:1052
-
\??\c:\xrrlfff.exec:\xrrlfff.exe114⤵PID:1448
-
\??\c:\7fxxfll.exec:\7fxxfll.exe115⤵PID:2436
-
\??\c:\bttbnt.exec:\bttbnt.exe116⤵PID:1728
-
\??\c:\jppdp.exec:\jppdp.exe117⤵PID:1484
-
\??\c:\llxlxxl.exec:\llxlxxl.exe118⤵PID:876
-
\??\c:\xxxfxxl.exec:\xxxfxxl.exe119⤵PID:1988
-
\??\c:\bnbbhh.exec:\bnbbhh.exe120⤵PID:1136
-
\??\c:\vppvj.exec:\vppvj.exe121⤵PID:2532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-