Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe
-
Size
454KB
-
MD5
f505569a977511e07499723fa2c2d7f0
-
SHA1
9c53ac8fb2e2ff0fd38f31917391c336a24277fc
-
SHA256
1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840
-
SHA512
4edfe5afdec2ccb4de5460175f2e9beb022bb845ba3ad650f4689d22180fca4a3fd193a15a5b10dfdf4766cd90fee7203013ec25e712f2f6a22420b5422879fc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1968-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/628-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-165-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1156-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1540-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-270-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-333-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-395-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/332-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-442-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2140-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-494-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1068-495-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1960-504-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/776-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-637-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2616-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-735-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2460-802-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1496-847-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1260-949-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1852-1045-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-1241-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 vvjpv.exe 1592 lxrxflf.exe 2436 hbbhtb.exe 2744 ffxxfxf.exe 2972 nhbnht.exe 2860 1pdjp.exe 2908 ffxrxrr.exe 2768 9dvvj.exe 2620 xrfflrx.exe 3040 nbnhtt.exe 3056 3jpvv.exe 1572 llxfrlr.exe 764 jvvjd.exe 628 lfrxlrf.exe 1520 hthnnt.exe 1200 jvddj.exe 2000 fxffxrx.exe 1156 bhhnbb.exe 572 llrllll.exe 2320 thtnnn.exe 1736 3vjpj.exe 944 lfxfrlx.exe 1540 nbhbnn.exe 684 9ffllrr.exe 2044 5tbttn.exe 1420 3djdd.exe 1924 3rrrlfl.exe 900 5bntbh.exe 1996 vpjjv.exe 1808 3fxrxfl.exe 1684 bnthnt.exe 2964 ppvvj.exe 1248 fxllxrx.exe 1596 hnbbbb.exe 1048 5dpvd.exe 1928 vpjpv.exe 1912 5xxxfxf.exe 2800 bnbttt.exe 2728 httnnn.exe 2972 vvpdj.exe 2860 9rflffx.exe 2640 tnbhnh.exe 2652 3ttbhn.exe 2656 vdvvv.exe 2864 frxfrrx.exe 1552 tnthnn.exe 2488 7htbnt.exe 1664 pvvvv.exe 1300 3rxrrll.exe 1832 xrfxffl.exe 332 tnhbhh.exe 2576 jdjpp.exe 2504 5ddjd.exe 1796 rlrlxxl.exe 1700 hbnhhh.exe 2176 tnhbbb.exe 1156 vdvpv.exe 348 5rffxff.exe 680 1rllllf.exe 2140 9nbbhb.exe 668 3jdvd.exe 1068 xffxxfx.exe 1424 5xlrrxl.exe 1960 bhtnhh.exe -
resource yara_rule behavioral1/memory/1968-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-416-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/332-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-494-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/776-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-637-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2616-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-968-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-1007-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-1020-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-1132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-1145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-1176-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2548 1968 1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe 30 PID 1968 wrote to memory of 2548 1968 1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe 30 PID 1968 wrote to memory of 2548 1968 1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe 30 PID 1968 wrote to memory of 2548 1968 1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe 30 PID 2548 wrote to memory of 1592 2548 vvjpv.exe 31 PID 2548 wrote to memory of 1592 2548 vvjpv.exe 31 PID 2548 wrote to memory of 1592 2548 vvjpv.exe 31 PID 2548 wrote to memory of 1592 2548 vvjpv.exe 31 PID 1592 wrote to memory of 2436 1592 lxrxflf.exe 32 PID 1592 wrote to memory of 2436 1592 lxrxflf.exe 32 PID 1592 wrote to memory of 2436 1592 lxrxflf.exe 32 PID 1592 wrote to memory of 2436 1592 lxrxflf.exe 32 PID 2436 wrote to memory of 2744 2436 hbbhtb.exe 33 PID 2436 wrote to memory of 2744 2436 hbbhtb.exe 33 PID 2436 wrote to memory of 2744 2436 hbbhtb.exe 33 PID 2436 wrote to memory of 2744 2436 hbbhtb.exe 33 PID 2744 wrote to memory of 2972 2744 ffxxfxf.exe 34 PID 2744 wrote to memory of 2972 2744 ffxxfxf.exe 34 PID 2744 wrote to memory of 2972 2744 ffxxfxf.exe 34 PID 2744 wrote to memory of 2972 2744 ffxxfxf.exe 34 PID 2972 wrote to memory of 2860 2972 nhbnht.exe 35 PID 2972 wrote to memory of 2860 2972 nhbnht.exe 35 PID 2972 wrote to memory of 2860 2972 nhbnht.exe 35 PID 2972 wrote to memory of 2860 2972 nhbnht.exe 35 PID 2860 wrote to memory of 2908 2860 1pdjp.exe 36 PID 2860 wrote to memory of 2908 2860 1pdjp.exe 36 PID 2860 wrote to memory of 2908 2860 1pdjp.exe 36 PID 2860 wrote to memory of 2908 2860 1pdjp.exe 36 PID 2908 wrote to memory of 2768 2908 ffxrxrr.exe 37 PID 2908 wrote to memory of 2768 2908 ffxrxrr.exe 37 PID 2908 wrote to memory of 2768 2908 ffxrxrr.exe 37 PID 2908 wrote to memory of 2768 2908 ffxrxrr.exe 37 PID 2768 wrote to memory of 2620 2768 9dvvj.exe 38 PID 2768 wrote to memory of 2620 2768 9dvvj.exe 38 PID 2768 wrote to memory of 2620 2768 9dvvj.exe 38 PID 2768 wrote to memory of 2620 2768 9dvvj.exe 38 PID 2620 wrote to memory of 3040 2620 xrfflrx.exe 39 PID 2620 wrote to memory of 3040 2620 xrfflrx.exe 39 PID 2620 wrote to memory of 3040 2620 xrfflrx.exe 39 PID 2620 wrote to memory of 3040 2620 xrfflrx.exe 39 PID 3040 wrote to memory of 3056 3040 nbnhtt.exe 40 PID 3040 wrote to memory of 3056 3040 nbnhtt.exe 40 PID 3040 wrote to memory of 3056 3040 nbnhtt.exe 40 PID 3040 wrote to memory of 3056 3040 nbnhtt.exe 40 PID 3056 wrote to memory of 1572 3056 3jpvv.exe 41 PID 3056 wrote to memory of 1572 3056 3jpvv.exe 41 PID 3056 wrote to memory of 1572 3056 3jpvv.exe 41 PID 3056 wrote to memory of 1572 3056 3jpvv.exe 41 PID 1572 wrote to memory of 764 1572 llxfrlr.exe 42 PID 1572 wrote to memory of 764 1572 llxfrlr.exe 42 PID 1572 wrote to memory of 764 1572 llxfrlr.exe 42 PID 1572 wrote to memory of 764 1572 llxfrlr.exe 42 PID 764 wrote to memory of 628 764 jvvjd.exe 43 PID 764 wrote to memory of 628 764 jvvjd.exe 43 PID 764 wrote to memory of 628 764 jvvjd.exe 43 PID 764 wrote to memory of 628 764 jvvjd.exe 43 PID 628 wrote to memory of 1520 628 lfrxlrf.exe 44 PID 628 wrote to memory of 1520 628 lfrxlrf.exe 44 PID 628 wrote to memory of 1520 628 lfrxlrf.exe 44 PID 628 wrote to memory of 1520 628 lfrxlrf.exe 44 PID 1520 wrote to memory of 1200 1520 hthnnt.exe 45 PID 1520 wrote to memory of 1200 1520 hthnnt.exe 45 PID 1520 wrote to memory of 1200 1520 hthnnt.exe 45 PID 1520 wrote to memory of 1200 1520 hthnnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe"C:\Users\Admin\AppData\Local\Temp\1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\vvjpv.exec:\vvjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\lxrxflf.exec:\lxrxflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\hbbhtb.exec:\hbbhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\ffxxfxf.exec:\ffxxfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\nhbnht.exec:\nhbnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\1pdjp.exec:\1pdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ffxrxrr.exec:\ffxrxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\9dvvj.exec:\9dvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xrfflrx.exec:\xrfflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nbnhtt.exec:\nbnhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\3jpvv.exec:\3jpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\llxfrlr.exec:\llxfrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\jvvjd.exec:\jvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\hthnnt.exec:\hthnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\jvddj.exec:\jvddj.exe17⤵
- Executes dropped EXE
PID:1200 -
\??\c:\fxffxrx.exec:\fxffxrx.exe18⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bhhnbb.exec:\bhhnbb.exe19⤵
- Executes dropped EXE
PID:1156 -
\??\c:\llrllll.exec:\llrllll.exe20⤵
- Executes dropped EXE
PID:572 -
\??\c:\thtnnn.exec:\thtnnn.exe21⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3vjpj.exec:\3vjpj.exe22⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe23⤵
- Executes dropped EXE
PID:944 -
\??\c:\nbhbnn.exec:\nbhbnn.exe24⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9ffllrr.exec:\9ffllrr.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\5tbttn.exec:\5tbttn.exe26⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3djdd.exec:\3djdd.exe27⤵
- Executes dropped EXE
PID:1420 -
\??\c:\3rrrlfl.exec:\3rrrlfl.exe28⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5bntbh.exec:\5bntbh.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\vpjjv.exec:\vpjjv.exe30⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3fxrxfl.exec:\3fxrxfl.exe31⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bnthnt.exec:\bnthnt.exe32⤵
- Executes dropped EXE
PID:1684 -
\??\c:\ppvvj.exec:\ppvvj.exe33⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fxllxrx.exec:\fxllxrx.exe34⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hnbbbb.exec:\hnbbbb.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5dpvd.exec:\5dpvd.exe36⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vpjpv.exec:\vpjpv.exe37⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5xxxfxf.exec:\5xxxfxf.exe38⤵
- Executes dropped EXE
PID:1912 -
\??\c:\bnbttt.exec:\bnbttt.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\httnnn.exec:\httnnn.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vvpdj.exec:\vvpdj.exe41⤵
- Executes dropped EXE
PID:2972 -
\??\c:\9rflffx.exec:\9rflffx.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tnbhnh.exec:\tnbhnh.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3ttbhn.exec:\3ttbhn.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vdvvv.exec:\vdvvv.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\frxfrrx.exec:\frxfrrx.exe46⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tnthnn.exec:\tnthnn.exe47⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7htbnt.exec:\7htbnt.exe48⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pvvvv.exec:\pvvvv.exe49⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3rxrrll.exec:\3rxrrll.exe50⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xrfxffl.exec:\xrfxffl.exe51⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tnhbhh.exec:\tnhbhh.exe52⤵
- Executes dropped EXE
PID:332 -
\??\c:\jdjpp.exec:\jdjpp.exe53⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5ddjd.exec:\5ddjd.exe54⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rlrlxxl.exec:\rlrlxxl.exe55⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hbnhhh.exec:\hbnhhh.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tnhbbb.exec:\tnhbbb.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vdvpv.exec:\vdvpv.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\5rffxff.exec:\5rffxff.exe59⤵
- Executes dropped EXE
PID:348 -
\??\c:\1rllllf.exec:\1rllllf.exe60⤵
- Executes dropped EXE
PID:680 -
\??\c:\9nbbhb.exec:\9nbbhb.exe61⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3jdvd.exec:\3jdvd.exe62⤵
- Executes dropped EXE
PID:668 -
\??\c:\xffxxfx.exec:\xffxxfx.exe63⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5xlrrxl.exec:\5xlrrxl.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bhtnhh.exec:\bhtnhh.exe65⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ddppp.exec:\ddppp.exe66⤵PID:2336
-
\??\c:\frxrxrf.exec:\frxrxrf.exe67⤵PID:776
-
\??\c:\flxfllx.exec:\flxfllx.exe68⤵PID:1112
-
\??\c:\ntbnbn.exec:\ntbnbn.exe69⤵PID:1924
-
\??\c:\jpvjj.exec:\jpvjj.exe70⤵PID:2996
-
\??\c:\llxxrll.exec:\llxxrll.exe71⤵PID:2992
-
\??\c:\frflllr.exec:\frflllr.exe72⤵PID:3008
-
\??\c:\3nbtbb.exec:\3nbtbb.exe73⤵
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\1vdvv.exec:\1vdvv.exe74⤵PID:2528
-
\??\c:\vjvpj.exec:\vjvpj.exe75⤵PID:1972
-
\??\c:\frrxfxf.exec:\frrxfxf.exe76⤵PID:2116
-
\??\c:\1thhnn.exec:\1thhnn.exe77⤵PID:2688
-
\??\c:\ddpvj.exec:\ddpvj.exe78⤵PID:1628
-
\??\c:\dpddj.exec:\dpddj.exe79⤵PID:1928
-
\??\c:\rffxxrx.exec:\rffxxrx.exe80⤵PID:2732
-
\??\c:\thhnbh.exec:\thhnbh.exe81⤵PID:2820
-
\??\c:\5nhbtt.exec:\5nhbtt.exe82⤵PID:2804
-
\??\c:\jdjjj.exec:\jdjjj.exe83⤵PID:2612
-
\??\c:\5rlrllr.exec:\5rlrllr.exe84⤵PID:2780
-
\??\c:\nnhtbn.exec:\nnhtbn.exe85⤵PID:2776
-
\??\c:\9hhnbb.exec:\9hhnbb.exe86⤵PID:2616
-
\??\c:\dvjjv.exec:\dvjjv.exe87⤵PID:2716
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe88⤵PID:2444
-
\??\c:\fxrrfff.exec:\fxrrfff.exe89⤵PID:980
-
\??\c:\nnhnnt.exec:\nnhnnt.exe90⤵PID:2932
-
\??\c:\ppdjp.exec:\ppdjp.exe91⤵PID:3028
-
\??\c:\fxxxffr.exec:\fxxxffr.exe92⤵
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\lxlrxrl.exec:\lxlrxrl.exe93⤵PID:2672
-
\??\c:\1bbbtb.exec:\1bbbtb.exe94⤵PID:1412
-
\??\c:\dvjjv.exec:\dvjjv.exe95⤵PID:1444
-
\??\c:\vvvvv.exec:\vvvvv.exe96⤵PID:300
-
\??\c:\9fffllr.exec:\9fffllr.exe97⤵PID:2504
-
\??\c:\9bbhbb.exec:\9bbhbb.exe98⤵PID:1796
-
\??\c:\vpjvd.exec:\vpjvd.exe99⤵PID:1700
-
\??\c:\9vvpv.exec:\9vvpv.exe100⤵PID:2176
-
\??\c:\lxffxrx.exec:\lxffxrx.exe101⤵PID:1156
-
\??\c:\1thnnb.exec:\1thnnb.exe102⤵PID:2208
-
\??\c:\nhntbh.exec:\nhntbh.exe103⤵PID:1656
-
\??\c:\dvjvj.exec:\dvjvj.exe104⤵PID:1728
-
\??\c:\jdddp.exec:\jdddp.exe105⤵PID:928
-
\??\c:\5fxxxxf.exec:\5fxxxxf.exe106⤵PID:1524
-
\??\c:\bbtbbb.exec:\bbtbbb.exe107⤵PID:2376
-
\??\c:\bbnhtt.exec:\bbnhtt.exe108⤵PID:1212
-
\??\c:\1vjjv.exec:\1vjjv.exe109⤵PID:880
-
\??\c:\7lxfffr.exec:\7lxfffr.exe110⤵PID:1920
-
\??\c:\bntbhn.exec:\bntbhn.exe111⤵PID:2460
-
\??\c:\thtntb.exec:\thtntb.exe112⤵PID:1112
-
\??\c:\pjvdp.exec:\pjvdp.exe113⤵PID:560
-
\??\c:\lfrxxrx.exec:\lfrxxrx.exe114⤵PID:2952
-
\??\c:\hbbbnt.exec:\hbbbnt.exe115⤵PID:1676
-
\??\c:\tthbbh.exec:\tthbbh.exe116⤵PID:888
-
\??\c:\vjvjj.exec:\vjvjj.exe117⤵PID:1684
-
\??\c:\lxrrrll.exec:\lxrrrll.exe118⤵
- System Location Discovery: System Language Discovery
PID:1496 -
\??\c:\xxffflr.exec:\xxffflr.exe119⤵PID:1492
-
\??\c:\hthhnn.exec:\hthhnn.exe120⤵PID:2116
-
\??\c:\pjpvv.exec:\pjpvv.exe121⤵PID:1048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-